?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: abstract the main locking logic from the LockingAndX parsing
[Samba/fernandojvsilva.git] / source3 / smbd / reply.c
blob4a915d6f9050f072bd0e0ae4af774cbb73c23167
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!posix_path && !stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 break;
132 }
133 /* Go back one level... */
134 /* We know this is safe as '/' cannot be part of a mb sequence. */
135 /* NOTE - if this assumption is invalid we are not in good shape... */
136 /* Decrement d first as d points to the *next* char to write into. */
137 for (d--; d > path; d--) {
138 if (*d == '/')
139 break;
140 }
141 s += 2; /* Else go past the .. */
142 /* We're still at the start of a name component, just the previous one. */
143 continue;
144
145 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
146 if (posix_path) {
147 /* Eat the '.' */
148 s++;
149 continue;
150 }
151 }
152
153 }
154
155 if (!(*s & 0x80)) {
156 if (!posix_path) {
157 if (*s <= 0x1f || *s == '|') {
158 return NT_STATUS_OBJECT_NAME_INVALID;
159 }
160 switch (*s) {
161 case '*':
162 case '?':
163 case '<':
164 case '>':
165 case '"':
166 *p_last_component_contains_wcard = True;
167 break;
168 default:
169 break;
170 }
171 }
172 *d++ = *s++;
173 } else {
174 size_t siz;
175 /* Get the size of the next MB character. */
176 next_codepoint(s,&siz);
177 switch(siz) {
178 case 5:
179 *d++ = *s++;
180 /*fall through*/
181 case 4:
182 *d++ = *s++;
183 /*fall through*/
184 case 3:
185 *d++ = *s++;
186 /*fall through*/
187 case 2:
188 *d++ = *s++;
189 /*fall through*/
190 case 1:
191 *d++ = *s++;
192 break;
193 default:
194 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
195 *d = '\0';
196 return NT_STATUS_INVALID_PARAMETER;
197 }
198 }
199 start_of_name_component = False;
200 }
201
202 *d = '\0';
203
204 return ret;
205 }
206
207 /****************************************************************************
208 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
209 No wildcards allowed.
210 ****************************************************************************/
211
212 NTSTATUS check_path_syntax(char *path)
213 {
214 bool ignore;
215 return check_path_syntax_internal(path, False, &ignore);
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 Wildcards allowed - p_contains_wcard returns true if the last component contained
221 a wildcard.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
225 {
226 return check_path_syntax_internal(path, False, p_contains_wcard);
227 }
228
229 /****************************************************************************
230 Check the path for a POSIX client.
231 We're assuming here that '/' is not the second byte in any multibyte char
232 set (a safe assumption).
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_posix(char *path)
236 {
237 bool ignore;
238 return check_path_syntax_internal(path, True, &ignore);
239 }
240
241 /****************************************************************************
242 Pull a string and check the path allowing a wilcard - provide for error return.
243 ****************************************************************************/
244
245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
246 const char *base_ptr,
247 uint16 smb_flags2,
248 char **pp_dest,
249 const char *src,
250 size_t src_len,
251 int flags,
252 NTSTATUS *err,
253 bool *contains_wcard)
254 {
255 size_t ret;
256
257 *pp_dest = NULL;
258
259 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
260 src_len, flags);
261
262 if (!*pp_dest) {
263 *err = NT_STATUS_INVALID_PARAMETER;
264 return ret;
265 }
266
267 *contains_wcard = False;
268
269 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
270 /*
271 * For a DFS path the function parse_dfs_path()
272 * will do the path processing, just make a copy.
273 */
274 *err = NT_STATUS_OK;
275 return ret;
276 }
277
278 if (lp_posix_pathnames()) {
279 *err = check_path_syntax_posix(*pp_dest);
280 } else {
281 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
282 }
283
284 return ret;
285 }
286
287 /****************************************************************************
288 Pull a string and check the path - provide for error return.
289 ****************************************************************************/
290
291 size_t srvstr_get_path(TALLOC_CTX *ctx,
292 const char *base_ptr,
293 uint16 smb_flags2,
294 char **pp_dest,
295 const char *src,
296 size_t src_len,
297 int flags,
298 NTSTATUS *err)
299 {
300 bool ignore;
301 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
302 src_len, flags, err, &ignore);
303 }
304
305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
306 char **pp_dest, const char *src, int flags,
307 NTSTATUS *err, bool *contains_wcard)
308 {
309 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
310 pp_dest, src, smbreq_bufrem(req, src),
311 flags, err, contains_wcard);
312 }
313
314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err)
317 {
318 bool ignore;
319 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
320 flags, err, &ignore);
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if (!(fsp) || !(conn)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if ((fsp)->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if ((fsp)->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 (fsp)->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 /****************************************************************************
395 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
396 ****************************************************************************/
397
398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
399 files_struct *fsp)
400 {
401 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
402 && (req->vuid == (fsp)->vuid)) {
403 return True;
404 }
405
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return False;
408 }
409
410 static bool netbios_session_retarget(const char *name, int name_type)
411 {
412 char *trim_name;
413 char *trim_name_type;
414 const char *retarget_parm;
415 char *retarget;
416 char *p;
417 int retarget_type = 0x20;
418 int retarget_port = 139;
419 struct sockaddr_storage retarget_addr;
420 struct sockaddr_in *in_addr;
421 bool ret = false;
422 uint8_t outbuf[10];
423
424 if (get_socket_port(smbd_server_fd()) != 139) {
425 return false;
426 }
427
428 trim_name = talloc_strdup(talloc_tos(), name);
429 if (trim_name == NULL) {
430 goto fail;
431 }
432 trim_char(trim_name, ' ', ' ');
433
434 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
435 name_type);
436 if (trim_name_type == NULL) {
437 goto fail;
438 }
439
440 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
441 trim_name_type, NULL);
442 if (retarget_parm == NULL) {
443 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
444 trim_name, NULL);
445 }
446 if (retarget_parm == NULL) {
447 goto fail;
448 }
449
450 retarget = talloc_strdup(trim_name, retarget_parm);
451 if (retarget == NULL) {
452 goto fail;
453 }
454
455 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
456
457 p = strchr(retarget, ':');
458 if (p != NULL) {
459 *p++ = '\0';
460 retarget_port = atoi(p);
461 }
462
463 p = strchr_m(retarget, '#');
464 if (p != NULL) {
465 *p++ = '\0';
466 sscanf(p, "%x", &retarget_type);
467 }
468
469 ret = resolve_name(retarget, &retarget_addr, retarget_type);
470 if (!ret) {
471 DEBUG(10, ("could not resolve %s\n", retarget));
472 goto fail;
473 }
474
475 if (retarget_addr.ss_family != AF_INET) {
476 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
477 goto fail;
478 }
479
480 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
481
482 _smb_setlen(outbuf, 6);
483 SCVAL(outbuf, 0, 0x84);
484 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
485 *(uint16_t *)(outbuf+8) = htons(retarget_port);
486
487 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
488 NULL)) {
489 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
490 "failed.");
491 }
492
493 ret = true;
494 fail:
495 TALLOC_FREE(trim_name);
496 return ret;
497 }
498
499 /****************************************************************************
500 Reply to a (netbios-level) special message.
501 ****************************************************************************/
502
503 void reply_special(char *inbuf)
504 {
505 int msg_type = CVAL(inbuf,0);
506 int msg_flags = CVAL(inbuf,1);
507 fstring name1,name2;
508 char name_type1, name_type2;
509 struct smbd_server_connection *sconn = smbd_server_conn;
510
511 /*
512 * We only really use 4 bytes of the outbuf, but for the smb_setlen
513 * calculation & friends (srv_send_smb uses that) we need the full smb
514 * header.
515 */
516 char outbuf[smb_size];
517
518 *name1 = *name2 = 0;
519
520 memset(outbuf, '\0', sizeof(outbuf));
521
522 smb_setlen(outbuf,0);
523
524 switch (msg_type) {
525 case 0x81: /* session request */
526
527 if (sconn->nbt.got_session) {
528 exit_server_cleanly("multiple session request not permitted");
529 }
530
531 SCVAL(outbuf,0,0x82);
532 SCVAL(outbuf,3,0);
533 if (name_len(inbuf+4) > 50 ||
534 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
535 DEBUG(0,("Invalid name length in session request\n"));
536 return;
537 }
538 name_type1 = name_extract(inbuf,4,name1);
539 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
540 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
541 name1, name_type1, name2, name_type2));
542
543 if (netbios_session_retarget(name1, name_type1)) {
544 exit_server_cleanly("retargeted client");
545 }
546
547 set_local_machine_name(name1, True);
548 set_remote_machine_name(name2, True);
549
550 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
551 get_local_machine_name(), get_remote_machine_name(),
552 name_type2));
553
554 if (name_type2 == 'R') {
555 /* We are being asked for a pathworks session ---
556 no thanks! */
557 SCVAL(outbuf, 0,0x83);
558 break;
559 }
560
561 /* only add the client's machine name to the list
562 of possibly valid usernames if we are operating
563 in share mode security */
564 if (lp_security() == SEC_SHARE) {
565 add_session_user(sconn, get_remote_machine_name());
566 }
567
568 reload_services(True);
569 reopen_logs();
570
571 sconn->nbt.got_session = true;
572 break;
573
574 case 0x89: /* session keepalive request
575 (some old clients produce this?) */
576 SCVAL(outbuf,0,SMBkeepalive);
577 SCVAL(outbuf,3,0);
578 break;
579
580 case 0x82: /* positive session response */
581 case 0x83: /* negative session response */
582 case 0x84: /* retarget session response */
583 DEBUG(0,("Unexpected session response\n"));
584 break;
585
586 case SMBkeepalive: /* session keepalive */
587 default:
588 return;
589 }
590
591 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
592 msg_type, msg_flags));
593
594 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
595 return;
596 }
597
598 /****************************************************************************
599 Reply to a tcon.
600 conn POINTER CAN BE NULL HERE !
601 ****************************************************************************/
602
603 void reply_tcon(struct smb_request *req)
604 {
605 connection_struct *conn = req->conn;
606 const char *service;
607 char *service_buf = NULL;
608 char *password = NULL;
609 char *dev = NULL;
610 int pwlen=0;
611 NTSTATUS nt_status;
612 const char *p;
613 DATA_BLOB password_blob;
614 TALLOC_CTX *ctx = talloc_tos();
615 struct smbd_server_connection *sconn = smbd_server_conn;
616
617 START_PROFILE(SMBtcon);
618
619 if (req->buflen < 4) {
620 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
621 END_PROFILE(SMBtcon);
622 return;
623 }
624
625 p = (const char *)req->buf + 1;
626 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
627 p += 1;
628 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
629 p += pwlen+1;
630 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
631 p += 1;
632
633 if (service_buf == NULL || password == NULL || dev == NULL) {
634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
635 END_PROFILE(SMBtcon);
636 return;
637 }
638 p = strrchr_m(service_buf,'\\');
639 if (p) {
640 service = p+1;
641 } else {
642 service = service_buf;
643 }
644
645 password_blob = data_blob(password, pwlen+1);
646
647 conn = make_connection(sconn,service,password_blob,dev,
648 req->vuid,&nt_status);
649 req->conn = conn;
650
651 data_blob_clear_free(&password_blob);
652
653 if (!conn) {
654 reply_nterror(req, nt_status);
655 END_PROFILE(SMBtcon);
656 return;
657 }
658
659 reply_outbuf(req, 2, 0);
660 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
661 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
662 SSVAL(req->outbuf,smb_tid,conn->cnum);
663
664 DEBUG(3,("tcon service=%s cnum=%d\n",
665 service, conn->cnum));
666
667 END_PROFILE(SMBtcon);
668 return;
669 }
670
671 /****************************************************************************
672 Reply to a tcon and X.
673 conn POINTER CAN BE NULL HERE !
674 ****************************************************************************/
675
676 void reply_tcon_and_X(struct smb_request *req)
677 {
678 connection_struct *conn = req->conn;
679 const char *service = NULL;
680 DATA_BLOB password;
681 TALLOC_CTX *ctx = talloc_tos();
682 /* what the cleint thinks the device is */
683 char *client_devicetype = NULL;
684 /* what the server tells the client the share represents */
685 const char *server_devicetype;
686 NTSTATUS nt_status;
687 int passlen;
688 char *path = NULL;
689 const char *p, *q;
690 uint16 tcon_flags;
691 struct smbd_server_connection *sconn = smbd_server_conn;
692
693 START_PROFILE(SMBtconX);
694
695 if (req->wct < 4) {
696 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
697 END_PROFILE(SMBtconX);
698 return;
699 }
700
701 passlen = SVAL(req->vwv+3, 0);
702 tcon_flags = SVAL(req->vwv+2, 0);
703
704 /* we might have to close an old one */
705 if ((tcon_flags & 0x1) && conn) {
706 close_cnum(sconn, conn,req->vuid);
707 req->conn = NULL;
708 conn = NULL;
709 }
710
711 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
712 reply_doserror(req, ERRDOS, ERRbuftoosmall);
713 END_PROFILE(SMBtconX);
714 return;
715 }
716
717 if (sconn->smb1.negprot.encrypted_passwords) {
718 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
719 if (lp_security() == SEC_SHARE) {
720 /*
721 * Security = share always has a pad byte
722 * after the password.
723 */
724 p = (const char *)req->buf + passlen + 1;
725 } else {
726 p = (const char *)req->buf + passlen;
727 }
728 } else {
729 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
730 /* Ensure correct termination */
731 password.data[passlen]=0;
732 p = (const char *)req->buf + passlen + 1;
733 }
734
735 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
736
737 if (path == NULL) {
738 data_blob_clear_free(&password);
739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
740 END_PROFILE(SMBtconX);
741 return;
742 }
743
744 /*
745 * the service name can be either: \\server\share
746 * or share directly like on the DELL PowerVault 705
747 */
748 if (*path=='\\') {
749 q = strchr_m(path+2,'\\');
750 if (!q) {
751 data_blob_clear_free(&password);
752 reply_doserror(req, ERRDOS, ERRnosuchshare);
753 END_PROFILE(SMBtconX);
754 return;
755 }
756 service = q+1;
757 } else {
758 service = path;
759 }
760
761 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
762 &client_devicetype, p,
763 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
764
765 if (client_devicetype == NULL) {
766 data_blob_clear_free(&password);
767 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
768 END_PROFILE(SMBtconX);
769 return;
770 }
771
772 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
773
774 conn = make_connection(sconn, service, password, client_devicetype,
775 req->vuid, &nt_status);
776 req->conn =conn;
777
778 data_blob_clear_free(&password);
779
780 if (!conn) {
781 reply_nterror(req, nt_status);
782 END_PROFILE(SMBtconX);
783 return;
784 }
785
786 if ( IS_IPC(conn) )
787 server_devicetype = "IPC";
788 else if ( IS_PRINT(conn) )
789 server_devicetype = "LPT1:";
790 else
791 server_devicetype = "A:";
792
793 if (Protocol < PROTOCOL_NT1) {
794 reply_outbuf(req, 2, 0);
795 if (message_push_string(&req->outbuf, server_devicetype,
796 STR_TERMINATE|STR_ASCII) == -1) {
797 reply_nterror(req, NT_STATUS_NO_MEMORY);
798 END_PROFILE(SMBtconX);
799 return;
800 }
801 } else {
802 /* NT sets the fstype of IPC$ to the null string */
803 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
804
805 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
806 /* Return permissions. */
807 uint32 perm1 = 0;
808 uint32 perm2 = 0;
809
810 reply_outbuf(req, 7, 0);
811
812 if (IS_IPC(conn)) {
813 perm1 = FILE_ALL_ACCESS;
814 perm2 = FILE_ALL_ACCESS;
815 } else {
816 perm1 = CAN_WRITE(conn) ?
817 SHARE_ALL_ACCESS :
818 SHARE_READ_ONLY;
819 }
820
821 SIVAL(req->outbuf, smb_vwv3, perm1);
822 SIVAL(req->outbuf, smb_vwv5, perm2);
823 } else {
824 reply_outbuf(req, 3, 0);
825 }
826
827 if ((message_push_string(&req->outbuf, server_devicetype,
828 STR_TERMINATE|STR_ASCII) == -1)
829 || (message_push_string(&req->outbuf, fstype,
830 STR_TERMINATE) == -1)) {
831 reply_nterror(req, NT_STATUS_NO_MEMORY);
832 END_PROFILE(SMBtconX);
833 return;
834 }
835
836 /* what does setting this bit do? It is set by NT4 and
837 may affect the ability to autorun mounted cdroms */
838 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
839 (lp_csc_policy(SNUM(conn)) << 2));
840
841 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
842 DEBUG(2,("Serving %s as a Dfs root\n",
843 lp_servicename(SNUM(conn)) ));
844 SSVAL(req->outbuf, smb_vwv2,
845 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
846 }
847 }
848
849
850 DEBUG(3,("tconX service=%s \n",
851 service));
852
853 /* set the incoming and outgoing tid to the just created one */
854 SSVAL(req->inbuf,smb_tid,conn->cnum);
855 SSVAL(req->outbuf,smb_tid,conn->cnum);
856
857 END_PROFILE(SMBtconX);
858
859 chain_reply(req);
860 return;
861 }
862
863 /****************************************************************************
864 Reply to an unknown type.
865 ****************************************************************************/
866
867 void reply_unknown_new(struct smb_request *req, uint8 type)
868 {
869 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
870 smb_fn_name(type), type, type));
871 reply_doserror(req, ERRSRV, ERRunknownsmb);
872 return;
873 }
874
875 /****************************************************************************
876 Reply to an ioctl.
877 conn POINTER CAN BE NULL HERE !
878 ****************************************************************************/
879
880 void reply_ioctl(struct smb_request *req)
881 {
882 connection_struct *conn = req->conn;
883 uint16 device;
884 uint16 function;
885 uint32 ioctl_code;
886 int replysize;
887 char *p;
888
889 START_PROFILE(SMBioctl);
890
891 if (req->wct < 3) {
892 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
893 END_PROFILE(SMBioctl);
894 return;
895 }
896
897 device = SVAL(req->vwv+1, 0);
898 function = SVAL(req->vwv+2, 0);
899 ioctl_code = (device << 16) + function;
900
901 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
902
903 switch (ioctl_code) {
904 case IOCTL_QUERY_JOB_INFO:
905 replysize = 32;
906 break;
907 default:
908 reply_doserror(req, ERRSRV, ERRnosupport);
909 END_PROFILE(SMBioctl);
910 return;
911 }
912
913 reply_outbuf(req, 8, replysize+1);
914 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
915 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
916 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
917 p = smb_buf(req->outbuf);
918 memset(p, '\0', replysize+1); /* valgrind-safe. */
919 p += 1; /* Allow for alignment */
920
921 switch (ioctl_code) {
922 case IOCTL_QUERY_JOB_INFO:
923 {
924 files_struct *fsp = file_fsp(
925 req, SVAL(req->vwv+0, 0));
926 if (!fsp) {
927 reply_doserror(req, ERRDOS, ERRbadfid);
928 END_PROFILE(SMBioctl);
929 return;
930 }
931 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
932 srvstr_push((char *)req->outbuf, req->flags2, p+2,
933 global_myname(), 15,
934 STR_TERMINATE|STR_ASCII);
935 if (conn) {
936 srvstr_push((char *)req->outbuf, req->flags2,
937 p+18, lp_servicename(SNUM(conn)),
938 13, STR_TERMINATE|STR_ASCII);
939 } else {
940 memset(p+18, 0, 13);
941 }
942 break;
943 }
944 }
945
946 END_PROFILE(SMBioctl);
947 return;
948 }
949
950 /****************************************************************************
951 Strange checkpath NTSTATUS mapping.
952 ****************************************************************************/
953
954 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
955 {
956 /* Strange DOS error code semantics only for checkpath... */
957 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
958 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
959 /* We need to map to ERRbadpath */
960 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
961 }
962 }
963 return status;
964 }
965
966 /****************************************************************************
967 Reply to a checkpath.
968 ****************************************************************************/
969
970 void reply_checkpath(struct smb_request *req)
971 {
972 connection_struct *conn = req->conn;
973 struct smb_filename *smb_fname = NULL;
974 char *name = NULL;
975 NTSTATUS status;
976 TALLOC_CTX *ctx = talloc_tos();
977
978 START_PROFILE(SMBcheckpath);
979
980 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
981 STR_TERMINATE, &status);
982
983 if (!NT_STATUS_IS_OK(status)) {
984 status = map_checkpath_error(req->flags2, status);
985 reply_nterror(req, status);
986 END_PROFILE(SMBcheckpath);
987 return;
988 }
989
990 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
991
992 status = filename_convert(ctx,
993 conn,
994 req->flags2 & FLAGS2_DFS_PATHNAMES,
995 name,
996 &smb_fname,
997 NULL);
998
999 if (!NT_STATUS_IS_OK(status)) {
1000 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1001 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1002 ERRSRV, ERRbadpath);
1003 END_PROFILE(SMBcheckpath);
1004 return;
1005 }
1006 goto path_err;
1007 }
1008
1009 if (!VALID_STAT(smb_fname->st) &&
1010 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1011 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1012 smb_fname_str_dbg(smb_fname), strerror(errno)));
1013 status = map_nt_error_from_unix(errno);
1014 goto path_err;
1015 }
1016
1017 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1018 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1019 ERRDOS, ERRbadpath);
1020 goto out;
1021 }
1022
1023 reply_outbuf(req, 0, 0);
1024
1025 path_err:
1026 /* We special case this - as when a Windows machine
1027 is parsing a path is steps through the components
1028 one at a time - if a component fails it expects
1029 ERRbadpath, not ERRbadfile.
1030 */
1031 status = map_checkpath_error(req->flags2, status);
1032 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1033 /*
1034 * Windows returns different error codes if
1035 * the parent directory is valid but not the
1036 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1037 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1038 * if the path is invalid.
1039 */
1040 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1041 ERRDOS, ERRbadpath);
1042 goto out;
1043 }
1044
1045 reply_nterror(req, status);
1046
1047 out:
1048 TALLOC_FREE(smb_fname);
1049 END_PROFILE(SMBcheckpath);
1050 return;
1051 }
1052
1053 /****************************************************************************
1054 Reply to a getatr.
1055 ****************************************************************************/
1056
1057 void reply_getatr(struct smb_request *req)
1058 {
1059 connection_struct *conn = req->conn;
1060 struct smb_filename *smb_fname = NULL;
1061 char *fname = NULL;
1062 int mode=0;
1063 SMB_OFF_T size=0;
1064 time_t mtime=0;
1065 const char *p;
1066 NTSTATUS status;
1067 TALLOC_CTX *ctx = talloc_tos();
1068 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1069
1070 START_PROFILE(SMBgetatr);
1071
1072 p = (const char *)req->buf + 1;
1073 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1074 if (!NT_STATUS_IS_OK(status)) {
1075 reply_nterror(req, status);
1076 goto out;
1077 }
1078
1079 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1080 under WfWg - weird! */
1081 if (*fname == '\0') {
1082 mode = aHIDDEN | aDIR;
1083 if (!CAN_WRITE(conn)) {
1084 mode |= aRONLY;
1085 }
1086 size = 0;
1087 mtime = 0;
1088 } else {
1089 status = filename_convert(ctx,
1090 conn,
1091 req->flags2 & FLAGS2_DFS_PATHNAMES,
1092 fname,
1093 &smb_fname,
1094 NULL);
1095 if (!NT_STATUS_IS_OK(status)) {
1096 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1097 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1098 ERRSRV, ERRbadpath);
1099 goto out;
1100 }
1101 reply_nterror(req, status);
1102 goto out;
1103 }
1104 if (!VALID_STAT(smb_fname->st) &&
1105 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1106 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1107 smb_fname_str_dbg(smb_fname),
1108 strerror(errno)));
1109 reply_unixerror(req, ERRDOS,ERRbadfile);
1110 goto out;
1111 }
1112
1113 mode = dos_mode(conn, smb_fname);
1114 size = smb_fname->st.st_ex_size;
1115
1116 if (ask_sharemode) {
1117 struct timespec write_time_ts;
1118 struct file_id fileid;
1119
1120 ZERO_STRUCT(write_time_ts);
1121 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1122 get_file_infos(fileid, NULL, &write_time_ts);
1123 if (!null_timespec(write_time_ts)) {
1124 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1125 }
1126 }
1127
1128 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1129 if (mode & aDIR) {
1130 size = 0;
1131 }
1132 }
1133
1134 reply_outbuf(req, 10, 0);
1135
1136 SSVAL(req->outbuf,smb_vwv0,mode);
1137 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1138 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1139 } else {
1140 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1141 }
1142 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1143
1144 if (Protocol >= PROTOCOL_NT1) {
1145 SSVAL(req->outbuf, smb_flg2,
1146 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1147 }
1148
1149 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1150 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1151
1152 out:
1153 TALLOC_FREE(smb_fname);
1154 TALLOC_FREE(fname);
1155 END_PROFILE(SMBgetatr);
1156 return;
1157 }
1158
1159 /****************************************************************************
1160 Reply to a setatr.
1161 ****************************************************************************/
1162
1163 void reply_setatr(struct smb_request *req)
1164 {
1165 struct smb_file_time ft;
1166 connection_struct *conn = req->conn;
1167 struct smb_filename *smb_fname = NULL;
1168 char *fname = NULL;
1169 int mode;
1170 time_t mtime;
1171 const char *p;
1172 NTSTATUS status;
1173 TALLOC_CTX *ctx = talloc_tos();
1174
1175 START_PROFILE(SMBsetatr);
1176
1177 ZERO_STRUCT(ft);
1178
1179 if (req->wct < 2) {
1180 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1181 goto out;
1182 }
1183
1184 p = (const char *)req->buf + 1;
1185 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1186 if (!NT_STATUS_IS_OK(status)) {
1187 reply_nterror(req, status);
1188 goto out;
1189 }
1190
1191 status = filename_convert(ctx,
1192 conn,
1193 req->flags2 & FLAGS2_DFS_PATHNAMES,
1194 fname,
1195 &smb_fname,
1196 NULL);
1197 if (!NT_STATUS_IS_OK(status)) {
1198 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1199 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1200 ERRSRV, ERRbadpath);
1201 goto out;
1202 }
1203 reply_nterror(req, status);
1204 goto out;
1205 }
1206
1207 if (smb_fname->base_name[0] == '.' &&
1208 smb_fname->base_name[1] == '\0') {
1209 /*
1210 * Not sure here is the right place to catch this
1211 * condition. Might be moved to somewhere else later -- vl
1212 */
1213 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1214 goto out;
1215 }
1216
1217 mode = SVAL(req->vwv+0, 0);
1218 mtime = srv_make_unix_date3(req->vwv+1);
1219
1220 ft.mtime = convert_time_t_to_timespec(mtime);
1221 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1222 if (!NT_STATUS_IS_OK(status)) {
1223 reply_unixerror(req, ERRDOS, ERRnoaccess);
1224 goto out;
1225 }
1226
1227 if (mode != FILE_ATTRIBUTE_NORMAL) {
1228 if (VALID_STAT_OF_DIR(smb_fname->st))
1229 mode |= aDIR;
1230 else
1231 mode &= ~aDIR;
1232
1233 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1234 false) != 0) {
1235 reply_unixerror(req, ERRDOS, ERRnoaccess);
1236 goto out;
1237 }
1238 }
1239
1240 reply_outbuf(req, 0, 0);
1241
1242 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1243 mode));
1244 out:
1245 TALLOC_FREE(smb_fname);
1246 END_PROFILE(SMBsetatr);
1247 return;
1248 }
1249
1250 /****************************************************************************
1251 Reply to a dskattr.
1252 ****************************************************************************/
1253
1254 void reply_dskattr(struct smb_request *req)
1255 {
1256 connection_struct *conn = req->conn;
1257 uint64_t dfree,dsize,bsize;
1258 START_PROFILE(SMBdskattr);
1259
1260 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1261 reply_unixerror(req, ERRHRD, ERRgeneral);
1262 END_PROFILE(SMBdskattr);
1263 return;
1264 }
1265
1266 reply_outbuf(req, 5, 0);
1267
1268 if (Protocol <= PROTOCOL_LANMAN2) {
1269 double total_space, free_space;
1270 /* we need to scale this to a number that DOS6 can handle. We
1271 use floating point so we can handle large drives on systems
1272 that don't have 64 bit integers
1273
1274 we end up displaying a maximum of 2G to DOS systems
1275 */
1276 total_space = dsize * (double)bsize;
1277 free_space = dfree * (double)bsize;
1278
1279 dsize = (uint64_t)((total_space+63*512) / (64*512));
1280 dfree = (uint64_t)((free_space+63*512) / (64*512));
1281
1282 if (dsize > 0xFFFF) dsize = 0xFFFF;
1283 if (dfree > 0xFFFF) dfree = 0xFFFF;
1284
1285 SSVAL(req->outbuf,smb_vwv0,dsize);
1286 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1287 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1288 SSVAL(req->outbuf,smb_vwv3,dfree);
1289 } else {
1290 SSVAL(req->outbuf,smb_vwv0,dsize);
1291 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1292 SSVAL(req->outbuf,smb_vwv2,512);
1293 SSVAL(req->outbuf,smb_vwv3,dfree);
1294 }
1295
1296 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1297
1298 END_PROFILE(SMBdskattr);
1299 return;
1300 }
1301
1302 /*
1303 * Utility function to split the filename from the directory.
1304 */
1305 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1306 char **fname_dir_out,
1307 char **fname_mask_out)
1308 {
1309 const char *p = NULL;
1310 char *fname_dir = NULL;
1311 char *fname_mask = NULL;
1312
1313 p = strrchr_m(fname_in, '/');
1314 if (!p) {
1315 fname_dir = talloc_strdup(ctx, ".");
1316 fname_mask = talloc_strdup(ctx, fname_in);
1317 } else {
1318 fname_dir = talloc_strndup(ctx, fname_in,
1319 PTR_DIFF(p, fname_in));
1320 fname_mask = talloc_strdup(ctx, p+1);
1321 }
1322
1323 if (!fname_dir || !fname_mask) {
1324 TALLOC_FREE(fname_dir);
1325 TALLOC_FREE(fname_mask);
1326 return NT_STATUS_NO_MEMORY;
1327 }
1328
1329 *fname_dir_out = fname_dir;
1330 *fname_mask_out = fname_mask;
1331 return NT_STATUS_OK;
1332 }
1333
1334 /****************************************************************************
1335 Reply to a search.
1336 Can be called from SMBsearch, SMBffirst or SMBfunique.
1337 ****************************************************************************/
1338
1339 void reply_search(struct smb_request *req)
1340 {
1341 connection_struct *conn = req->conn;
1342 char *path = NULL;
1343 const char *mask = NULL;
1344 char *directory = NULL;
1345 char *fname = NULL;
1346 SMB_OFF_T size;
1347 uint32 mode;
1348 struct timespec date;
1349 uint32 dirtype;
1350 unsigned int numentries = 0;
1351 unsigned int maxentries = 0;
1352 bool finished = False;
1353 const char *p;
1354 int status_len;
1355 char status[21];
1356 int dptr_num= -1;
1357 bool check_descend = False;
1358 bool expect_close = False;
1359 NTSTATUS nt_status;
1360 bool mask_contains_wcard = False;
1361 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1362 TALLOC_CTX *ctx = talloc_tos();
1363 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1364
1365 START_PROFILE(SMBsearch);
1366
1367 if (req->wct < 2) {
1368 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1369 END_PROFILE(SMBsearch);
1370 return;
1371 }
1372
1373 if (lp_posix_pathnames()) {
1374 reply_unknown_new(req, req->cmd);
1375 END_PROFILE(SMBsearch);
1376 return;
1377 }
1378
1379 /* If we were called as SMBffirst then we must expect close. */
1380 if(req->cmd == SMBffirst) {
1381 expect_close = True;
1382 }
1383
1384 reply_outbuf(req, 1, 3);
1385 maxentries = SVAL(req->vwv+0, 0);
1386 dirtype = SVAL(req->vwv+1, 0);
1387 p = (const char *)req->buf + 1;
1388 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1389 &nt_status, &mask_contains_wcard);
1390 if (!NT_STATUS_IS_OK(nt_status)) {
1391 reply_nterror(req, nt_status);
1392 END_PROFILE(SMBsearch);
1393 return;
1394 }
1395
1396 p++;
1397 status_len = SVAL(p, 0);
1398 p += 2;
1399
1400 /* dirtype &= ~aDIR; */
1401
1402 if (status_len == 0) {
1403 struct smb_filename *smb_fname = NULL;
1404
1405 nt_status = resolve_dfspath_wcard(ctx, conn,
1406 req->flags2 & FLAGS2_DFS_PATHNAMES,
1407 path,
1408 &path,
1409 &mask_contains_wcard);
1410 if (!NT_STATUS_IS_OK(nt_status)) {
1411 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1412 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1413 ERRSRV, ERRbadpath);
1414 END_PROFILE(SMBsearch);
1415 return;
1416 }
1417 reply_nterror(req, nt_status);
1418 END_PROFILE(SMBsearch);
1419 return;
1420 }
1421
1422 nt_status = unix_convert(ctx, conn, path, &smb_fname,
1423 UCF_ALLOW_WCARD_LCOMP);
1424 if (!NT_STATUS_IS_OK(nt_status)) {
1425 reply_nterror(req, nt_status);
1426 END_PROFILE(SMBsearch);
1427 return;
1428 }
1429
1430 nt_status = get_full_smb_filename(ctx, smb_fname, &directory);
1431 TALLOC_FREE(smb_fname);
1432 if (!NT_STATUS_IS_OK(nt_status)) {
1433 reply_nterror(req, nt_status);
1434 END_PROFILE(SMBsearch);
1435 return;
1436 }
1437
1438 nt_status = check_name(conn, directory);
1439 if (!NT_STATUS_IS_OK(nt_status)) {
1440 reply_nterror(req, nt_status);
1441 END_PROFILE(SMBsearch);
1442 return;
1443 }
1444
1445 p = strrchr_m(directory,'/');
1446 if ((p != NULL) && (*directory != '/')) {
1447 mask = p + 1;
1448 directory = talloc_strndup(ctx, directory,
1449 PTR_DIFF(p, directory));
1450 } else {
1451 mask = directory;
1452 directory = talloc_strdup(ctx,".");
1453 }
1454
1455 if (!directory) {
1456 reply_nterror(req, NT_STATUS_NO_MEMORY);
1457 END_PROFILE(SMBsearch);
1458 return;
1459 }
1460
1461 memset((char *)status,'\0',21);
1462 SCVAL(status,0,(dirtype & 0x1F));
1463
1464 nt_status = dptr_create(conn,
1465 directory,
1466 True,
1467 expect_close,
1468 req->smbpid,
1469 mask,
1470 mask_contains_wcard,
1471 dirtype,
1472 &conn->dirptr);
1473 if (!NT_STATUS_IS_OK(nt_status)) {
1474 reply_nterror(req, nt_status);
1475 END_PROFILE(SMBsearch);
1476 return;
1477 }
1478 dptr_num = dptr_dnum(conn->dirptr);
1479 } else {
1480 int status_dirtype;
1481
1482 memcpy(status,p,21);
1483 status_dirtype = CVAL(status,0) & 0x1F;
1484 if (status_dirtype != (dirtype & 0x1F)) {
1485 dirtype = status_dirtype;
1486 }
1487
1488 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1489 if (!conn->dirptr) {
1490 goto SearchEmpty;
1491 }
1492 string_set(&conn->dirpath,dptr_path(dptr_num));
1493 mask = dptr_wcard(dptr_num);
1494 if (!mask) {
1495 goto SearchEmpty;
1496 }
1497 /*
1498 * For a 'continue' search we have no string. So
1499 * check from the initial saved string.
1500 */
1501 mask_contains_wcard = ms_has_wild(mask);
1502 dirtype = dptr_attr(dptr_num);
1503 }
1504
1505 DEBUG(4,("dptr_num is %d\n",dptr_num));
1506
1507 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1508 dptr_init_search_op(conn->dirptr);
1509
1510 if ((dirtype&0x1F) == aVOLID) {
1511 char buf[DIR_STRUCT_SIZE];
1512 memcpy(buf,status,21);
1513 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1514 0,aVOLID,0,!allow_long_path_components)) {
1515 reply_nterror(req, NT_STATUS_NO_MEMORY);
1516 END_PROFILE(SMBsearch);
1517 return;
1518 }
1519 dptr_fill(buf+12,dptr_num);
1520 if (dptr_zero(buf+12) && (status_len==0)) {
1521 numentries = 1;
1522 } else {
1523 numentries = 0;
1524 }
1525 if (message_push_blob(&req->outbuf,
1526 data_blob_const(buf, sizeof(buf)))
1527 == -1) {
1528 reply_nterror(req, NT_STATUS_NO_MEMORY);
1529 END_PROFILE(SMBsearch);
1530 return;
1531 }
1532 } else {
1533 unsigned int i;
1534 maxentries = MIN(
1535 maxentries,
1536 ((BUFFER_SIZE -
1537 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1538 /DIR_STRUCT_SIZE));
1539
1540 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1541 conn->dirpath,lp_dontdescend(SNUM(conn))));
1542 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1543 check_descend = True;
1544 }
1545
1546 for (i=numentries;(i<maxentries) && !finished;i++) {
1547 finished = !get_dir_entry(ctx,
1548 conn,
1549 mask,
1550 dirtype,
1551 &fname,
1552 &size,
1553 &mode,
1554 &date,
1555 check_descend,
1556 ask_sharemode);
1557 if (!finished) {
1558 char buf[DIR_STRUCT_SIZE];
1559 memcpy(buf,status,21);
1560 if (!make_dir_struct(ctx,
1561 buf,
1562 mask,
1563 fname,
1564 size,
1565 mode,
1566 convert_timespec_to_time_t(date),
1567 !allow_long_path_components)) {
1568 reply_nterror(req, NT_STATUS_NO_MEMORY);
1569 END_PROFILE(SMBsearch);
1570 return;
1571 }
1572 if (!dptr_fill(buf+12,dptr_num)) {
1573 break;
1574 }
1575 if (message_push_blob(&req->outbuf,
1576 data_blob_const(buf, sizeof(buf)))
1577 == -1) {
1578 reply_nterror(req, NT_STATUS_NO_MEMORY);
1579 END_PROFILE(SMBsearch);
1580 return;
1581 }
1582 numentries++;
1583 }
1584 }
1585 }
1586
1587 SearchEmpty:
1588
1589 /* If we were called as SMBffirst with smb_search_id == NULL
1590 and no entries were found then return error and close dirptr
1591 (X/Open spec) */
1592
1593 if (numentries == 0) {
1594 dptr_close(&dptr_num);
1595 } else if(expect_close && status_len == 0) {
1596 /* Close the dptr - we know it's gone */
1597 dptr_close(&dptr_num);
1598 }
1599
1600 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1601 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1602 dptr_close(&dptr_num);
1603 }
1604
1605 if ((numentries == 0) && !mask_contains_wcard) {
1606 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1607 END_PROFILE(SMBsearch);
1608 return;
1609 }
1610
1611 SSVAL(req->outbuf,smb_vwv0,numentries);
1612 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1613 SCVAL(smb_buf(req->outbuf),0,5);
1614 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1615
1616 /* The replies here are never long name. */
1617 SSVAL(req->outbuf, smb_flg2,
1618 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1619 if (!allow_long_path_components) {
1620 SSVAL(req->outbuf, smb_flg2,
1621 SVAL(req->outbuf, smb_flg2)
1622 & (~FLAGS2_LONG_PATH_COMPONENTS));
1623 }
1624
1625 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1626 SSVAL(req->outbuf, smb_flg2,
1627 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1628
1629 if (!directory) {
1630 directory = dptr_path(dptr_num);
1631 }
1632
1633 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1634 smb_fn_name(req->cmd),
1635 mask,
1636 directory ? directory : "./",
1637 dirtype,
1638 numentries,
1639 maxentries ));
1640
1641 END_PROFILE(SMBsearch);
1642 return;
1643 }
1644
1645 /****************************************************************************
1646 Reply to a fclose (stop directory search).
1647 ****************************************************************************/
1648
1649 void reply_fclose(struct smb_request *req)
1650 {
1651 int status_len;
1652 char status[21];
1653 int dptr_num= -2;
1654 const char *p;
1655 char *path = NULL;
1656 NTSTATUS err;
1657 bool path_contains_wcard = False;
1658 TALLOC_CTX *ctx = talloc_tos();
1659
1660 START_PROFILE(SMBfclose);
1661
1662 if (lp_posix_pathnames()) {
1663 reply_unknown_new(req, req->cmd);
1664 END_PROFILE(SMBfclose);
1665 return;
1666 }
1667
1668 p = (const char *)req->buf + 1;
1669 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1670 &err, &path_contains_wcard);
1671 if (!NT_STATUS_IS_OK(err)) {
1672 reply_nterror(req, err);
1673 END_PROFILE(SMBfclose);
1674 return;
1675 }
1676 p++;
1677 status_len = SVAL(p,0);
1678 p += 2;
1679
1680 if (status_len == 0) {
1681 reply_doserror(req, ERRSRV, ERRsrverror);
1682 END_PROFILE(SMBfclose);
1683 return;
1684 }
1685
1686 memcpy(status,p,21);
1687
1688 if(dptr_fetch(status+12,&dptr_num)) {
1689 /* Close the dptr - we know it's gone */
1690 dptr_close(&dptr_num);
1691 }
1692
1693 reply_outbuf(req, 1, 0);
1694 SSVAL(req->outbuf,smb_vwv0,0);
1695
1696 DEBUG(3,("search close\n"));
1697
1698 END_PROFILE(SMBfclose);
1699 return;
1700 }
1701
1702 /****************************************************************************
1703 Reply to an open.
1704 ****************************************************************************/
1705
1706 void reply_open(struct smb_request *req)
1707 {
1708 connection_struct *conn = req->conn;
1709 struct smb_filename *smb_fname = NULL;
1710 char *fname = NULL;
1711 uint32 fattr=0;
1712 SMB_OFF_T size = 0;
1713 time_t mtime=0;
1714 int info;
1715 files_struct *fsp;
1716 int oplock_request;
1717 int deny_mode;
1718 uint32 dos_attr;
1719 uint32 access_mask;
1720 uint32 share_mode;
1721 uint32 create_disposition;
1722 uint32 create_options = 0;
1723 NTSTATUS status;
1724 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1725 TALLOC_CTX *ctx = talloc_tos();
1726
1727 START_PROFILE(SMBopen);
1728
1729 if (req->wct < 2) {
1730 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1731 goto out;
1732 }
1733
1734 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1735 deny_mode = SVAL(req->vwv+0, 0);
1736 dos_attr = SVAL(req->vwv+1, 0);
1737
1738 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1739 STR_TERMINATE, &status);
1740 if (!NT_STATUS_IS_OK(status)) {
1741 reply_nterror(req, status);
1742 goto out;
1743 }
1744
1745 status = filename_convert(ctx,
1746 conn,
1747 req->flags2 & FLAGS2_DFS_PATHNAMES,
1748 fname,
1749 &smb_fname,
1750 NULL);
1751 if (!NT_STATUS_IS_OK(status)) {
1752 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1753 reply_botherror(req,
1754 NT_STATUS_PATH_NOT_COVERED,
1755 ERRSRV, ERRbadpath);
1756 goto out;
1757 }
1758 reply_nterror(req, status);
1759 goto out;
1760 }
1761
1762 if (!map_open_params_to_ntcreate(
1763 smb_fname->base_name, deny_mode, OPENX_FILE_EXISTS_OPEN,
1764 &access_mask, &share_mode, &create_disposition,
1765 &create_options)) {
1766 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1767 goto out;
1768 }
1769
1770 status = SMB_VFS_CREATE_FILE(
1771 conn, /* conn */
1772 req, /* req */
1773 0, /* root_dir_fid */
1774 smb_fname, /* fname */
1775 access_mask, /* access_mask */
1776 share_mode, /* share_access */
1777 create_disposition, /* create_disposition*/
1778 create_options, /* create_options */
1779 dos_attr, /* file_attributes */
1780 oplock_request, /* oplock_request */
1781 0, /* allocation_size */
1782 NULL, /* sd */
1783 NULL, /* ea_list */
1784 &fsp, /* result */
1785 &info); /* pinfo */
1786
1787 if (!NT_STATUS_IS_OK(status)) {
1788 if (open_was_deferred(req->mid)) {
1789 /* We have re-scheduled this call. */
1790 goto out;
1791 }
1792 reply_openerror(req, status);
1793 goto out;
1794 }
1795
1796 size = smb_fname->st.st_ex_size;
1797 fattr = dos_mode(conn, smb_fname);
1798
1799 /* Deal with other possible opens having a modified
1800 write time. JRA. */
1801 if (ask_sharemode) {
1802 struct timespec write_time_ts;
1803
1804 ZERO_STRUCT(write_time_ts);
1805 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1806 if (!null_timespec(write_time_ts)) {
1807 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1808 }
1809 }
1810
1811 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1812
1813 if (fattr & aDIR) {
1814 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1815 close_file(req, fsp, ERROR_CLOSE);
1816 reply_doserror(req, ERRDOS,ERRnoaccess);
1817 goto out;
1818 }
1819
1820 reply_outbuf(req, 7, 0);
1821 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1822 SSVAL(req->outbuf,smb_vwv1,fattr);
1823 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1824 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1825 } else {
1826 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1827 }
1828 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1829 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1830
1831 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1832 SCVAL(req->outbuf,smb_flg,
1833 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1834 }
1835
1836 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1837 SCVAL(req->outbuf,smb_flg,
1838 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1839 }
1840 out:
1841 TALLOC_FREE(smb_fname);
1842 END_PROFILE(SMBopen);
1843 return;
1844 }
1845
1846 /****************************************************************************
1847 Reply to an open and X.
1848 ****************************************************************************/
1849
1850 void reply_open_and_X(struct smb_request *req)
1851 {
1852 connection_struct *conn = req->conn;
1853 struct smb_filename *smb_fname = NULL;
1854 char *fname = NULL;
1855 uint16 open_flags;
1856 int deny_mode;
1857 uint32 smb_attr;
1858 /* Breakout the oplock request bits so we can set the
1859 reply bits separately. */
1860 int ex_oplock_request;
1861 int core_oplock_request;
1862 int oplock_request;
1863 #if 0
1864 int smb_sattr = SVAL(req->vwv+4, 0);
1865 uint32 smb_time = make_unix_date3(req->vwv+6);
1866 #endif
1867 int smb_ofun;
1868 uint32 fattr=0;
1869 int mtime=0;
1870 int smb_action = 0;
1871 files_struct *fsp;
1872 NTSTATUS status;
1873 uint64_t allocation_size;
1874 ssize_t retval = -1;
1875 uint32 access_mask;
1876 uint32 share_mode;
1877 uint32 create_disposition;
1878 uint32 create_options = 0;
1879 TALLOC_CTX *ctx = talloc_tos();
1880
1881 START_PROFILE(SMBopenX);
1882
1883 if (req->wct < 15) {
1884 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1885 goto out;
1886 }
1887
1888 open_flags = SVAL(req->vwv+2, 0);
1889 deny_mode = SVAL(req->vwv+3, 0);
1890 smb_attr = SVAL(req->vwv+5, 0);
1891 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1892 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1893 oplock_request = ex_oplock_request | core_oplock_request;
1894 smb_ofun = SVAL(req->vwv+8, 0);
1895 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1896
1897 /* If it's an IPC, pass off the pipe handler. */
1898 if (IS_IPC(conn)) {
1899 if (lp_nt_pipe_support()) {
1900 reply_open_pipe_and_X(conn, req);
1901 } else {
1902 reply_doserror(req, ERRSRV, ERRaccess);
1903 }
1904 goto out;
1905 }
1906
1907 /* XXXX we need to handle passed times, sattr and flags */
1908 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1909 STR_TERMINATE, &status);
1910 if (!NT_STATUS_IS_OK(status)) {
1911 reply_nterror(req, status);
1912 goto out;
1913 }
1914
1915 status = filename_convert(ctx,
1916 conn,
1917 req->flags2 & FLAGS2_DFS_PATHNAMES,
1918 fname,
1919 &smb_fname,
1920 NULL);
1921 if (!NT_STATUS_IS_OK(status)) {
1922 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1923 reply_botherror(req,
1924 NT_STATUS_PATH_NOT_COVERED,
1925 ERRSRV, ERRbadpath);
1926 goto out;
1927 }
1928 reply_nterror(req, status);
1929 goto out;
1930 }
1931
1932 if (!map_open_params_to_ntcreate(
1933 smb_fname->base_name, deny_mode, smb_ofun, &access_mask,
1934 &share_mode, &create_disposition, &create_options)) {
1935 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1936 goto out;
1937 }
1938
1939 status = SMB_VFS_CREATE_FILE(
1940 conn, /* conn */
1941 req, /* req */
1942 0, /* root_dir_fid */
1943 smb_fname, /* fname */
1944 access_mask, /* access_mask */
1945 share_mode, /* share_access */
1946 create_disposition, /* create_disposition*/
1947 create_options, /* create_options */
1948 smb_attr, /* file_attributes */
1949 oplock_request, /* oplock_request */
1950 0, /* allocation_size */
1951 NULL, /* sd */
1952 NULL, /* ea_list */
1953 &fsp, /* result */
1954 &smb_action); /* pinfo */
1955
1956 if (!NT_STATUS_IS_OK(status)) {
1957 if (open_was_deferred(req->mid)) {
1958 /* We have re-scheduled this call. */
1959 goto out;
1960 }
1961 reply_openerror(req, status);
1962 goto out;
1963 }
1964
1965 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1966 if the file is truncated or created. */
1967 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1968 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1969 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1970 close_file(req, fsp, ERROR_CLOSE);
1971 reply_nterror(req, NT_STATUS_DISK_FULL);
1972 goto out;
1973 }
1974 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1975 if (retval < 0) {
1976 close_file(req, fsp, ERROR_CLOSE);
1977 reply_nterror(req, NT_STATUS_DISK_FULL);
1978 goto out;
1979 }
1980 smb_fname->st.st_ex_size =
1981 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1982 }
1983
1984 fattr = dos_mode(conn, smb_fname);
1985 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1986 if (fattr & aDIR) {
1987 close_file(req, fsp, ERROR_CLOSE);
1988 reply_doserror(req, ERRDOS, ERRnoaccess);
1989 goto out;
1990 }
1991
1992 /* If the caller set the extended oplock request bit
1993 and we granted one (by whatever means) - set the
1994 correct bit for extended oplock reply.
1995 */
1996
1997 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1998 smb_action |= EXTENDED_OPLOCK_GRANTED;
1999 }
2000
2001 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2002 smb_action |= EXTENDED_OPLOCK_GRANTED;
2003 }
2004
2005 /* If the caller set the core oplock request bit
2006 and we granted one (by whatever means) - set the
2007 correct bit for core oplock reply.
2008 */
2009
2010 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2011 reply_outbuf(req, 19, 0);
2012 } else {
2013 reply_outbuf(req, 15, 0);
2014 }
2015
2016 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2017 SCVAL(req->outbuf, smb_flg,
2018 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2019 }
2020
2021 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2022 SCVAL(req->outbuf, smb_flg,
2023 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2024 }
2025
2026 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2027 SSVAL(req->outbuf,smb_vwv3,fattr);
2028 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2029 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2030 } else {
2031 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2032 }
2033 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2034 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2035 SSVAL(req->outbuf,smb_vwv11,smb_action);
2036
2037 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2038 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2039 }
2040
2041 chain_reply(req);
2042 out:
2043 TALLOC_FREE(smb_fname);
2044 END_PROFILE(SMBopenX);
2045 return;
2046 }
2047
2048 /****************************************************************************
2049 Reply to a SMBulogoffX.
2050 ****************************************************************************/
2051
2052 void reply_ulogoffX(struct smb_request *req)
2053 {
2054 struct smbd_server_connection *sconn = smbd_server_conn;
2055 user_struct *vuser;
2056
2057 START_PROFILE(SMBulogoffX);
2058
2059 vuser = get_valid_user_struct(sconn, req->vuid);
2060
2061 if(vuser == NULL) {
2062 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2063 req->vuid));
2064 }
2065
2066 /* in user level security we are supposed to close any files
2067 open by this user */
2068 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2069 file_close_user(req->vuid);
2070 }
2071
2072 invalidate_vuid(sconn, req->vuid);
2073
2074 reply_outbuf(req, 2, 0);
2075
2076 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2077
2078 END_PROFILE(SMBulogoffX);
2079 chain_reply(req);
2080 }
2081
2082 /****************************************************************************
2083 Reply to a mknew or a create.
2084 ****************************************************************************/
2085
2086 void reply_mknew(struct smb_request *req)
2087 {
2088 connection_struct *conn = req->conn;
2089 struct smb_filename *smb_fname = NULL;
2090 char *fname = NULL;
2091 uint32 fattr = 0;
2092 struct smb_file_time ft;
2093 files_struct *fsp;
2094 int oplock_request = 0;
2095 NTSTATUS status;
2096 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2097 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2098 uint32 create_disposition;
2099 uint32 create_options = 0;
2100 TALLOC_CTX *ctx = talloc_tos();
2101
2102 START_PROFILE(SMBcreate);
2103 ZERO_STRUCT(ft);
2104
2105 if (req->wct < 3) {
2106 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2107 goto out;
2108 }
2109
2110 fattr = SVAL(req->vwv+0, 0);
2111 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2112
2113 /* mtime. */
2114 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2115
2116 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2117 STR_TERMINATE, &status);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 reply_nterror(req, status);
2120 goto out;
2121 }
2122
2123 status = filename_convert(ctx,
2124 conn,
2125 req->flags2 & FLAGS2_DFS_PATHNAMES,
2126 fname,
2127 &smb_fname,
2128 NULL);
2129 if (!NT_STATUS_IS_OK(status)) {
2130 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2131 reply_botherror(req,
2132 NT_STATUS_PATH_NOT_COVERED,
2133 ERRSRV, ERRbadpath);
2134 goto out;
2135 }
2136 reply_nterror(req, status);
2137 goto out;
2138 }
2139
2140 if (fattr & aVOLID) {
2141 DEBUG(0,("Attempt to create file (%s) with volid set - "
2142 "please report this\n",
2143 smb_fname_str_dbg(smb_fname)));
2144 }
2145
2146 if(req->cmd == SMBmknew) {
2147 /* We should fail if file exists. */
2148 create_disposition = FILE_CREATE;
2149 } else {
2150 /* Create if file doesn't exist, truncate if it does. */
2151 create_disposition = FILE_OVERWRITE_IF;
2152 }
2153
2154 status = SMB_VFS_CREATE_FILE(
2155 conn, /* conn */
2156 req, /* req */
2157 0, /* root_dir_fid */
2158 smb_fname, /* fname */
2159 access_mask, /* access_mask */
2160 share_mode, /* share_access */
2161 create_disposition, /* create_disposition*/
2162 create_options, /* create_options */
2163 fattr, /* file_attributes */
2164 oplock_request, /* oplock_request */
2165 0, /* allocation_size */
2166 NULL, /* sd */
2167 NULL, /* ea_list */
2168 &fsp, /* result */
2169 NULL); /* pinfo */
2170
2171 if (!NT_STATUS_IS_OK(status)) {
2172 if (open_was_deferred(req->mid)) {
2173 /* We have re-scheduled this call. */
2174 goto out;
2175 }
2176 reply_openerror(req, status);
2177 goto out;
2178 }
2179
2180 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2181 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2182 if (!NT_STATUS_IS_OK(status)) {
2183 END_PROFILE(SMBcreate);
2184 goto out;
2185 }
2186
2187 reply_outbuf(req, 1, 0);
2188 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2189
2190 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2191 SCVAL(req->outbuf,smb_flg,
2192 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2193 }
2194
2195 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2196 SCVAL(req->outbuf,smb_flg,
2197 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2198 }
2199
2200 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2201 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2202 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2203 (unsigned int)fattr));
2204
2205 out:
2206 TALLOC_FREE(smb_fname);
2207 END_PROFILE(SMBcreate);
2208 return;
2209 }
2210
2211 /****************************************************************************
2212 Reply to a create temporary file.
2213 ****************************************************************************/
2214
2215 void reply_ctemp(struct smb_request *req)
2216 {
2217 connection_struct *conn = req->conn;
2218 struct smb_filename *smb_fname = NULL;
2219 char *fname = NULL;
2220 uint32 fattr;
2221 files_struct *fsp;
2222 int oplock_request;
2223 int tmpfd;
2224 char *s;
2225 NTSTATUS status;
2226 TALLOC_CTX *ctx = talloc_tos();
2227
2228 START_PROFILE(SMBctemp);
2229
2230 if (req->wct < 3) {
2231 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2232 goto out;
2233 }
2234
2235 fattr = SVAL(req->vwv+0, 0);
2236 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2237
2238 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2239 STR_TERMINATE, &status);
2240 if (!NT_STATUS_IS_OK(status)) {
2241 reply_nterror(req, status);
2242 goto out;
2243 }
2244 if (*fname) {
2245 fname = talloc_asprintf(ctx,
2246 "%s/TMXXXXXX",
2247 fname);
2248 } else {
2249 fname = talloc_strdup(ctx, "TMXXXXXX");
2250 }
2251
2252 if (!fname) {
2253 reply_nterror(req, NT_STATUS_NO_MEMORY);
2254 goto out;
2255 }
2256
2257 status = filename_convert(ctx, conn,
2258 req->flags2 & FLAGS2_DFS_PATHNAMES,
2259 fname,
2260 &smb_fname,
2261 NULL);
2262 if (!NT_STATUS_IS_OK(status)) {
2263 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2264 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2265 ERRSRV, ERRbadpath);
2266 goto out;
2267 }
2268 reply_nterror(req, status);
2269 goto out;
2270 }
2271
2272 tmpfd = mkstemp(smb_fname->base_name);
2273 if (tmpfd == -1) {
2274 reply_unixerror(req, ERRDOS, ERRnoaccess);
2275 goto out;
2276 }
2277
2278 SMB_VFS_STAT(conn, smb_fname);
2279
2280 /* We should fail if file does not exist. */
2281 status = SMB_VFS_CREATE_FILE(
2282 conn, /* conn */
2283 req, /* req */
2284 0, /* root_dir_fid */
2285 smb_fname, /* fname */
2286 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2287 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2288 FILE_OPEN, /* create_disposition*/
2289 0, /* create_options */
2290 fattr, /* file_attributes */
2291 oplock_request, /* oplock_request */
2292 0, /* allocation_size */
2293 NULL, /* sd */
2294 NULL, /* ea_list */
2295 &fsp, /* result */
2296 NULL); /* pinfo */
2297
2298 /* close fd from mkstemp() */
2299 close(tmpfd);
2300
2301 if (!NT_STATUS_IS_OK(status)) {
2302 if (open_was_deferred(req->mid)) {
2303 /* We have re-scheduled this call. */
2304 goto out;
2305 }
2306 reply_openerror(req, status);
2307 goto out;
2308 }
2309
2310 reply_outbuf(req, 1, 0);
2311 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2312
2313 /* the returned filename is relative to the directory */
2314 s = strrchr_m(fsp->fsp_name, '/');
2315 if (!s) {
2316 s = fsp->fsp_name;
2317 } else {
2318 s++;
2319 }
2320
2321 #if 0
2322 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2323 thing in the byte section. JRA */
2324 SSVALS(p, 0, -1); /* what is this? not in spec */
2325 #endif
2326 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2327 == -1) {
2328 reply_nterror(req, NT_STATUS_NO_MEMORY);
2329 goto out;
2330 }
2331
2332 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2333 SCVAL(req->outbuf, smb_flg,
2334 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2335 }
2336
2337 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2338 SCVAL(req->outbuf, smb_flg,
2339 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2340 }
2341
2342 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2343 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2344 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2345 out:
2346 TALLOC_FREE(smb_fname);
2347 END_PROFILE(SMBctemp);
2348 return;
2349 }
2350
2351 /*******************************************************************
2352 Check if a user is allowed to rename a file.
2353 ********************************************************************/
2354
2355 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2356 uint16 dirtype, SMB_STRUCT_STAT *pst)
2357 {
2358 struct smb_filename *smb_fname = NULL;
2359 NTSTATUS status;
2360 uint32 fmode;
2361
2362 if (!CAN_WRITE(conn)) {
2363 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2364 }
2365
2366 status = create_synthetic_smb_fname_split(talloc_tos(), fsp->fsp_name,
2367 pst, &smb_fname);
2368 if (!NT_STATUS_IS_OK(status)) {
2369 return status;
2370 }
2371
2372 fmode = dos_mode(conn, smb_fname);
2373 TALLOC_FREE(smb_fname);
2374 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2375 return NT_STATUS_NO_SUCH_FILE;
2376 }
2377
2378 if (S_ISDIR(pst->st_ex_mode)) {
2379 if (fsp->posix_open) {
2380 return NT_STATUS_OK;
2381 }
2382
2383 /* If no pathnames are open below this
2384 directory, allow the rename. */
2385
2386 if (file_find_subpath(fsp)) {
2387 return NT_STATUS_ACCESS_DENIED;
2388 }
2389 return NT_STATUS_OK;
2390 }
2391
2392 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2393 return NT_STATUS_OK;
2394 }
2395
2396 return NT_STATUS_ACCESS_DENIED;
2397 }
2398
2399 /*******************************************************************
2400 * unlink a file with all relevant access checks
2401 *******************************************************************/
2402
2403 static NTSTATUS do_unlink(connection_struct *conn,
2404 struct smb_request *req,
2405 struct smb_filename *smb_fname,
2406 uint32 dirtype)
2407 {
2408 uint32 fattr;
2409 files_struct *fsp;
2410 uint32 dirtype_orig = dirtype;
2411 NTSTATUS status;
2412
2413 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2414 smb_fname_str_dbg(smb_fname),
2415 dirtype));
2416
2417 if (!CAN_WRITE(conn)) {
2418 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2419 }
2420
2421 if (SMB_VFS_LSTAT(conn, smb_fname) != 0) {
2422 return map_nt_error_from_unix(errno);
2423 }
2424
2425 fattr = dos_mode(conn, smb_fname);
2426
2427 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2428 dirtype = aDIR|aARCH|aRONLY;
2429 }
2430
2431 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2432 if (!dirtype) {
2433 return NT_STATUS_NO_SUCH_FILE;
2434 }
2435
2436 if (!dir_check_ftype(conn, fattr, dirtype)) {
2437 if (fattr & aDIR) {
2438 return NT_STATUS_FILE_IS_A_DIRECTORY;
2439 }
2440 return NT_STATUS_NO_SUCH_FILE;
2441 }
2442
2443 if (dirtype_orig & 0x8000) {
2444 /* These will never be set for POSIX. */
2445 return NT_STATUS_NO_SUCH_FILE;
2446 }
2447
2448 #if 0
2449 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2450 return NT_STATUS_FILE_IS_A_DIRECTORY;
2451 }
2452
2453 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2454 return NT_STATUS_NO_SUCH_FILE;
2455 }
2456
2457 if (dirtype & 0xFF00) {
2458 /* These will never be set for POSIX. */
2459 return NT_STATUS_NO_SUCH_FILE;
2460 }
2461
2462 dirtype &= 0xFF;
2463 if (!dirtype) {
2464 return NT_STATUS_NO_SUCH_FILE;
2465 }
2466
2467 /* Can't delete a directory. */
2468 if (fattr & aDIR) {
2469 return NT_STATUS_FILE_IS_A_DIRECTORY;
2470 }
2471 #endif
2472
2473 #if 0 /* JRATEST */
2474 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2475 return NT_STATUS_OBJECT_NAME_INVALID;
2476 #endif /* JRATEST */
2477
2478 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2479
2480 On a Windows share, a file with read-only dosmode can be opened with
2481 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2482 fails with NT_STATUS_CANNOT_DELETE error.
2483
2484 This semantic causes a problem that a user can not
2485 rename a file with read-only dosmode on a Samba share
2486 from a Windows command prompt (i.e. cmd.exe, but can rename
2487 from Windows Explorer).
2488 */
2489
2490 if (!lp_delete_readonly(SNUM(conn))) {
2491 if (fattr & aRONLY) {
2492 return NT_STATUS_CANNOT_DELETE;
2493 }
2494 }
2495
2496 /* On open checks the open itself will check the share mode, so
2497 don't do it here as we'll get it wrong. */
2498
2499 status = SMB_VFS_CREATE_FILE
2500 (conn, /* conn */
2501 req, /* req */
2502 0, /* root_dir_fid */
2503 smb_fname, /* fname */
2504 DELETE_ACCESS, /* access_mask */
2505 FILE_SHARE_NONE, /* share_access */
2506 FILE_OPEN, /* create_disposition*/
2507 FILE_NON_DIRECTORY_FILE, /* create_options */
2508 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2509 0, /* oplock_request */
2510 0, /* allocation_size */
2511 NULL, /* sd */
2512 NULL, /* ea_list */
2513 &fsp, /* result */
2514 NULL); /* pinfo */
2515
2516 if (!NT_STATUS_IS_OK(status)) {
2517 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2518 nt_errstr(status)));
2519 return status;
2520 }
2521
2522 /* The set is across all open files on this dev/inode pair. */
2523 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2524 close_file(req, fsp, NORMAL_CLOSE);
2525 return NT_STATUS_ACCESS_DENIED;
2526 }
2527
2528 return close_file(req, fsp, NORMAL_CLOSE);
2529 }
2530
2531 /****************************************************************************
2532 The guts of the unlink command, split out so it may be called by the NT SMB
2533 code.
2534 ****************************************************************************/
2535
2536 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2537 uint32 dirtype, const char *name_in, bool has_wild)
2538 {
2539 struct smb_filename *smb_fname = NULL;
2540 char *fname_dir = NULL;
2541 char *fname_mask = NULL;
2542 int count=0;
2543 NTSTATUS status = NT_STATUS_OK;
2544 TALLOC_CTX *ctx = talloc_tos();
2545
2546 status = unix_convert(ctx, conn, name_in, &smb_fname,
2547 has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
2548 if (!NT_STATUS_IS_OK(status)) {
2549 goto out;
2550 }
2551
2552 /* Split up the directory from the filename/mask. */
2553 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2554 &fname_dir, &fname_mask);
2555 if (!NT_STATUS_IS_OK(status)) {
2556 goto out;
2557 }
2558
2559 /*
2560 * We should only check the mangled cache
2561 * here if unix_convert failed. This means
2562 * that the path in 'mask' doesn't exist
2563 * on the file system and so we need to look
2564 * for a possible mangle. This patch from
2565 * Tine Smukavec <valentin.smukavec@hermes.si>.
2566 */
2567
2568 if (!VALID_STAT(smb_fname->st) &&
2569 mangle_is_mangled(fname_mask, conn->params)) {
2570 char *new_mask = NULL;
2571 mangle_lookup_name_from_8_3(ctx, fname_mask,
2572 &new_mask, conn->params);
2573 if (new_mask) {
2574 TALLOC_FREE(fname_mask);
2575 fname_mask = new_mask;
2576 }
2577 }
2578
2579 if (!has_wild) {
2580
2581 /*
2582 * Only one file needs to be unlinked. Append the mask back
2583 * onto the directory.
2584 */
2585 TALLOC_FREE(smb_fname->base_name);
2586 smb_fname->base_name = talloc_asprintf(smb_fname,
2587 "%s/%s",
2588 fname_dir,
2589 fname_mask);
2590 if (!smb_fname->base_name) {
2591 status = NT_STATUS_NO_MEMORY;
2592 goto out;
2593 }
2594 if (dirtype == 0) {
2595 dirtype = FILE_ATTRIBUTE_NORMAL;
2596 }
2597
2598 status = check_name(conn, smb_fname->base_name);
2599 if (!NT_STATUS_IS_OK(status)) {
2600 goto out;
2601 }
2602
2603 status = do_unlink(conn, req, smb_fname, dirtype);
2604 if (!NT_STATUS_IS_OK(status)) {
2605 goto out;
2606 }
2607
2608 count++;
2609 } else {
2610 struct smb_Dir *dir_hnd = NULL;
2611 long offset = 0;
2612 const char *dname;
2613
2614 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2615 status = NT_STATUS_OBJECT_NAME_INVALID;
2616 goto out;
2617 }
2618
2619 if (strequal(fname_mask,"????????.???")) {
2620 TALLOC_FREE(fname_mask);
2621 fname_mask = talloc_strdup(ctx, "*");
2622 if (!fname_mask) {
2623 status = NT_STATUS_NO_MEMORY;
2624 goto out;
2625 }
2626 }
2627
2628 status = check_name(conn, fname_dir);
2629 if (!NT_STATUS_IS_OK(status)) {
2630 goto out;
2631 }
2632
2633 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2634 dirtype);
2635 if (dir_hnd == NULL) {
2636 status = map_nt_error_from_unix(errno);
2637 goto out;
2638 }
2639
2640 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2641 the pattern matches against the long name, otherwise the short name
2642 We don't implement this yet XXXX
2643 */
2644
2645 status = NT_STATUS_NO_SUCH_FILE;
2646
2647 while ((dname = ReadDirName(dir_hnd, &offset,
2648 &smb_fname->st))) {
2649 if (!is_visible_file(conn, fname_dir, dname,
2650 &smb_fname->st, true)) {
2651 continue;
2652 }
2653
2654 /* Quick check for "." and ".." */
2655 if (ISDOT(dname) || ISDOTDOT(dname)) {
2656 continue;
2657 }
2658
2659 if(!mask_match(dname, fname_mask,
2660 conn->case_sensitive)) {
2661 continue;
2662 }
2663
2664 TALLOC_FREE(smb_fname->base_name);
2665 smb_fname->base_name =
2666 talloc_asprintf(smb_fname, "%s/%s",
2667 fname_dir, dname);
2668
2669 if (!smb_fname->base_name) {
2670 TALLOC_FREE(dir_hnd);
2671 status = NT_STATUS_NO_MEMORY;
2672 goto out;
2673 }
2674
2675 status = check_name(conn, smb_fname->base_name);
2676 if (!NT_STATUS_IS_OK(status)) {
2677 TALLOC_FREE(dir_hnd);
2678 goto out;
2679 }
2680
2681 status = do_unlink(conn, req, smb_fname, dirtype);
2682 if (!NT_STATUS_IS_OK(status)) {
2683 continue;
2684 }
2685
2686 count++;
2687 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2688 smb_fname->base_name));
2689 }
2690 TALLOC_FREE(dir_hnd);
2691 }
2692
2693 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2694 status = map_nt_error_from_unix(errno);
2695 }
2696
2697 out:
2698 TALLOC_FREE(smb_fname);
2699 TALLOC_FREE(fname_dir);
2700 TALLOC_FREE(fname_mask);
2701 return status;
2702 }
2703
2704 /****************************************************************************
2705 Reply to a unlink
2706 ****************************************************************************/
2707
2708 void reply_unlink(struct smb_request *req)
2709 {
2710 connection_struct *conn = req->conn;
2711 char *name = NULL;
2712 uint32 dirtype;
2713 NTSTATUS status;
2714 bool path_contains_wcard = False;
2715 TALLOC_CTX *ctx = talloc_tos();
2716
2717 START_PROFILE(SMBunlink);
2718
2719 if (req->wct < 1) {
2720 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2721 END_PROFILE(SMBunlink);
2722 return;
2723 }
2724
2725 dirtype = SVAL(req->vwv+0, 0);
2726
2727 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2728 STR_TERMINATE, &status,
2729 &path_contains_wcard);
2730 if (!NT_STATUS_IS_OK(status)) {
2731 reply_nterror(req, status);
2732 END_PROFILE(SMBunlink);
2733 return;
2734 }
2735
2736 status = resolve_dfspath_wcard(ctx, conn,
2737 req->flags2 & FLAGS2_DFS_PATHNAMES,
2738 name,
2739 &name,
2740 &path_contains_wcard);
2741 if (!NT_STATUS_IS_OK(status)) {
2742 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2743 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2744 ERRSRV, ERRbadpath);
2745 END_PROFILE(SMBunlink);
2746 return;
2747 }
2748 reply_nterror(req, status);
2749 END_PROFILE(SMBunlink);
2750 return;
2751 }
2752
2753 DEBUG(3,("reply_unlink : %s\n",name));
2754
2755 status = unlink_internals(conn, req, dirtype, name,
2756 path_contains_wcard);
2757 if (!NT_STATUS_IS_OK(status)) {
2758 if (open_was_deferred(req->mid)) {
2759 /* We have re-scheduled this call. */
2760 END_PROFILE(SMBunlink);
2761 return;
2762 }
2763 reply_nterror(req, status);
2764 END_PROFILE(SMBunlink);
2765 return;
2766 }
2767
2768 reply_outbuf(req, 0, 0);
2769 END_PROFILE(SMBunlink);
2770
2771 return;
2772 }
2773
2774 /****************************************************************************
2775 Fail for readbraw.
2776 ****************************************************************************/
2777
2778 static void fail_readraw(void)
2779 {
2780 const char *errstr = talloc_asprintf(talloc_tos(),
2781 "FAIL ! reply_readbraw: socket write fail (%s)",
2782 strerror(errno));
2783 if (!errstr) {
2784 errstr = "";
2785 }
2786 exit_server_cleanly(errstr);
2787 }
2788
2789 /****************************************************************************
2790 Fake (read/write) sendfile. Returns -1 on read or write fail.
2791 ****************************************************************************/
2792
2793 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2794 size_t nread)
2795 {
2796 size_t bufsize;
2797 size_t tosend = nread;
2798 char *buf;
2799
2800 if (nread == 0) {
2801 return 0;
2802 }
2803
2804 bufsize = MIN(nread, 65536);
2805
2806 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2807 return -1;
2808 }
2809
2810 while (tosend > 0) {
2811 ssize_t ret;
2812 size_t cur_read;
2813
2814 if (tosend > bufsize) {
2815 cur_read = bufsize;
2816 } else {
2817 cur_read = tosend;
2818 }
2819 ret = read_file(fsp,buf,startpos,cur_read);
2820 if (ret == -1) {
2821 SAFE_FREE(buf);
2822 return -1;
2823 }
2824
2825 /* If we had a short read, fill with zeros. */
2826 if (ret < cur_read) {
2827 memset(buf + ret, '\0', cur_read - ret);
2828 }
2829
2830 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2831 SAFE_FREE(buf);
2832 return -1;
2833 }
2834 tosend -= cur_read;
2835 startpos += cur_read;
2836 }
2837
2838 SAFE_FREE(buf);
2839 return (ssize_t)nread;
2840 }
2841
2842 #if defined(WITH_SENDFILE)
2843 /****************************************************************************
2844 Deal with the case of sendfile reading less bytes from the file than
2845 requested. Fill with zeros (all we can do).
2846 ****************************************************************************/
2847
2848 static void sendfile_short_send(files_struct *fsp,
2849 ssize_t nread,
2850 size_t headersize,
2851 size_t smb_maxcnt)
2852 {
2853 #define SHORT_SEND_BUFSIZE 1024
2854 if (nread < headersize) {
2855 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2856 "header for file %s (%s). Terminating\n",
2857 fsp->fsp_name, strerror(errno) ));
2858 exit_server_cleanly("sendfile_short_send failed");
2859 }
2860
2861 nread -= headersize;
2862
2863 if (nread < smb_maxcnt) {
2864 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2865 if (!buf) {
2866 exit_server_cleanly("sendfile_short_send: "
2867 "malloc failed");
2868 }
2869
2870 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2871 "with zeros !\n", fsp->fsp_name));
2872
2873 while (nread < smb_maxcnt) {
2874 /*
2875 * We asked for the real file size and told sendfile
2876 * to not go beyond the end of the file. But it can
2877 * happen that in between our fstat call and the
2878 * sendfile call the file was truncated. This is very
2879 * bad because we have already announced the larger
2880 * number of bytes to the client.
2881 *
2882 * The best we can do now is to send 0-bytes, just as
2883 * a read from a hole in a sparse file would do.
2884 *
2885 * This should happen rarely enough that I don't care
2886 * about efficiency here :-)
2887 */
2888 size_t to_write;
2889
2890 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2891 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2892 exit_server_cleanly("sendfile_short_send: "
2893 "write_data failed");
2894 }
2895 nread += to_write;
2896 }
2897 SAFE_FREE(buf);
2898 }
2899 }
2900 #endif /* defined WITH_SENDFILE */
2901
2902 /****************************************************************************
2903 Return a readbraw error (4 bytes of zero).
2904 ****************************************************************************/
2905
2906 static void reply_readbraw_error(void)
2907 {
2908 char header[4];
2909 SIVAL(header,0,0);
2910 if (write_data(smbd_server_fd(),header,4) != 4) {
2911 fail_readraw();
2912 }
2913 }
2914
2915 /****************************************************************************
2916 Use sendfile in readbraw.
2917 ****************************************************************************/
2918
2919 static void send_file_readbraw(connection_struct *conn,
2920 struct smb_request *req,
2921 files_struct *fsp,
2922 SMB_OFF_T startpos,
2923 size_t nread,
2924 ssize_t mincount)
2925 {
2926 char *outbuf = NULL;
2927 ssize_t ret=0;
2928
2929 #if defined(WITH_SENDFILE)
2930 /*
2931 * We can only use sendfile on a non-chained packet
2932 * but we can use on a non-oplocked file. tridge proved this
2933 * on a train in Germany :-). JRA.
2934 * reply_readbraw has already checked the length.
2935 */
2936
2937 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2938 (fsp->wcp == NULL) &&
2939 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2940 ssize_t sendfile_read = -1;
2941 char header[4];
2942 DATA_BLOB header_blob;
2943
2944 _smb_setlen(header,nread);
2945 header_blob = data_blob_const(header, 4);
2946
2947 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2948 &header_blob, startpos, nread)) == -1) {
2949 /* Returning ENOSYS means no data at all was sent.
2950 * Do this as a normal read. */
2951 if (errno == ENOSYS) {
2952 goto normal_readbraw;
2953 }
2954
2955 /*
2956 * Special hack for broken Linux with no working sendfile. If we
2957 * return EINTR we sent the header but not the rest of the data.
2958 * Fake this up by doing read/write calls.
2959 */
2960 if (errno == EINTR) {
2961 /* Ensure we don't do this again. */
2962 set_use_sendfile(SNUM(conn), False);
2963 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2964
2965 if (fake_sendfile(fsp, startpos, nread) == -1) {
2966 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2967 fsp->fsp_name, strerror(errno) ));
2968 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2969 }
2970 return;
2971 }
2972
2973 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2974 fsp->fsp_name, strerror(errno) ));
2975 exit_server_cleanly("send_file_readbraw sendfile failed");
2976 } else if (sendfile_read == 0) {
2977 /*
2978 * Some sendfile implementations return 0 to indicate
2979 * that there was a short read, but nothing was
2980 * actually written to the socket. In this case,
2981 * fallback to the normal read path so the header gets
2982 * the correct byte count.
2983 */
2984 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2985 "bytes falling back to the normal read: "
2986 "%s\n", fsp->fsp_name));
2987 goto normal_readbraw;
2988 }
2989
2990 /* Deal with possible short send. */
2991 if (sendfile_read != 4+nread) {
2992 sendfile_short_send(fsp, sendfile_read, 4, nread);
2993 }
2994 return;
2995 }
2996
2997 normal_readbraw:
2998 #endif
2999
3000 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3001 if (!outbuf) {
3002 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3003 (unsigned)(nread+4)));
3004 reply_readbraw_error();
3005 return;
3006 }
3007
3008 if (nread > 0) {
3009 ret = read_file(fsp,outbuf+4,startpos,nread);
3010 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3011 if (ret < mincount)
3012 ret = 0;
3013 #else
3014 if (ret < nread)
3015 ret = 0;
3016 #endif
3017 }
3018
3019 _smb_setlen(outbuf,ret);
3020 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3021 fail_readraw();
3022
3023 TALLOC_FREE(outbuf);
3024 }
3025
3026 /****************************************************************************
3027 Reply to a readbraw (core+ protocol).
3028 ****************************************************************************/
3029
3030 void reply_readbraw(struct smb_request *req)
3031 {
3032 connection_struct *conn = req->conn;
3033 ssize_t maxcount,mincount;
3034 size_t nread = 0;
3035 SMB_OFF_T startpos;
3036 files_struct *fsp;
3037 struct lock_struct lock;
3038 SMB_STRUCT_STAT st;
3039 SMB_OFF_T size = 0;
3040
3041 START_PROFILE(SMBreadbraw);
3042
3043 if (srv_is_signing_active(smbd_server_conn) ||
3044 is_encrypted_packet(req->inbuf)) {
3045 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3046 "raw reads/writes are disallowed.");
3047 }
3048
3049 if (req->wct < 8) {
3050 reply_readbraw_error();
3051 END_PROFILE(SMBreadbraw);
3052 return;
3053 }
3054
3055 /*
3056 * Special check if an oplock break has been issued
3057 * and the readraw request croses on the wire, we must
3058 * return a zero length response here.
3059 */
3060
3061 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3062
3063 /*
3064 * We have to do a check_fsp by hand here, as
3065 * we must always return 4 zero bytes on error,
3066 * not a NTSTATUS.
3067 */
3068
3069 if (!fsp || !conn || conn != fsp->conn ||
3070 req->vuid != fsp->vuid ||
3071 fsp->is_directory || fsp->fh->fd == -1) {
3072 /*
3073 * fsp could be NULL here so use the value from the packet. JRA.
3074 */
3075 DEBUG(3,("reply_readbraw: fnum %d not valid "
3076 "- cache prime?\n",
3077 (int)SVAL(req->vwv+0, 0)));
3078 reply_readbraw_error();
3079 END_PROFILE(SMBreadbraw);
3080 return;
3081 }
3082
3083 /* Do a "by hand" version of CHECK_READ. */
3084 if (!(fsp->can_read ||
3085 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3086 (fsp->access_mask & FILE_EXECUTE)))) {
3087 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3088 (int)SVAL(req->vwv+0, 0)));
3089 reply_readbraw_error();
3090 END_PROFILE(SMBreadbraw);
3091 return;
3092 }
3093
3094 flush_write_cache(fsp, READRAW_FLUSH);
3095
3096 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3097 if(req->wct == 10) {
3098 /*
3099 * This is a large offset (64 bit) read.
3100 */
3101 #ifdef LARGE_SMB_OFF_T
3102
3103 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3104
3105 #else /* !LARGE_SMB_OFF_T */
3106
3107 /*
3108 * Ensure we haven't been sent a >32 bit offset.
3109 */
3110
3111 if(IVAL(req->vwv+8, 0) != 0) {
3112 DEBUG(0,("reply_readbraw: large offset "
3113 "(%x << 32) used and we don't support "
3114 "64 bit offsets.\n",
3115 (unsigned int)IVAL(req->vwv+8, 0) ));
3116 reply_readbraw_error();
3117 END_PROFILE(SMBreadbraw);
3118 return;
3119 }
3120
3121 #endif /* LARGE_SMB_OFF_T */
3122
3123 if(startpos < 0) {
3124 DEBUG(0,("reply_readbraw: negative 64 bit "
3125 "readraw offset (%.0f) !\n",
3126 (double)startpos ));
3127 reply_readbraw_error();
3128 END_PROFILE(SMBreadbraw);
3129 return;
3130 }
3131 }
3132
3133 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3134 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3135
3136 /* ensure we don't overrun the packet size */
3137 maxcount = MIN(65535,maxcount);
3138
3139 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3140 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3141 &lock);
3142
3143 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3144 reply_readbraw_error();
3145 END_PROFILE(SMBreadbraw);
3146 return;
3147 }
3148
3149 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
3150 size = st.st_ex_size;
3151 }
3152
3153 if (startpos >= size) {
3154 nread = 0;
3155 } else {
3156 nread = MIN(maxcount,(size - startpos));
3157 }
3158
3159 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3160 if (nread < mincount)
3161 nread = 0;
3162 #endif
3163
3164 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3165 "min=%lu nread=%lu\n",
3166 fsp->fnum, (double)startpos,
3167 (unsigned long)maxcount,
3168 (unsigned long)mincount,
3169 (unsigned long)nread ) );
3170
3171 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3172
3173 DEBUG(5,("reply_readbraw finished\n"));
3174
3175 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3176
3177 END_PROFILE(SMBreadbraw);
3178 return;
3179 }
3180
3181 #undef DBGC_CLASS
3182 #define DBGC_CLASS DBGC_LOCKING
3183
3184 /****************************************************************************
3185 Reply to a lockread (core+ protocol).
3186 ****************************************************************************/
3187
3188 void reply_lockread(struct smb_request *req)
3189 {
3190 connection_struct *conn = req->conn;
3191 ssize_t nread = -1;
3192 char *data;
3193 SMB_OFF_T startpos;
3194 size_t numtoread;
3195 NTSTATUS status;
3196 files_struct *fsp;
3197 struct byte_range_lock *br_lck = NULL;
3198 char *p = NULL;
3199 struct smbd_server_connection *sconn = smbd_server_conn;
3200
3201 START_PROFILE(SMBlockread);
3202
3203 if (req->wct < 5) {
3204 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3205 END_PROFILE(SMBlockread);
3206 return;
3207 }
3208
3209 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3210
3211 if (!check_fsp(conn, req, fsp)) {
3212 END_PROFILE(SMBlockread);
3213 return;
3214 }
3215
3216 if (!CHECK_READ(fsp,req)) {
3217 reply_doserror(req, ERRDOS, ERRbadaccess);
3218 END_PROFILE(SMBlockread);
3219 return;
3220 }
3221
3222 numtoread = SVAL(req->vwv+1, 0);
3223 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3224
3225 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3226
3227 reply_outbuf(req, 5, numtoread + 3);
3228
3229 data = smb_buf(req->outbuf) + 3;
3230
3231 /*
3232 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3233 * protocol request that predates the read/write lock concept.
3234 * Thus instead of asking for a read lock here we need to ask
3235 * for a write lock. JRA.
3236 * Note that the requested lock size is unaffected by max_recv.
3237 */
3238
3239 br_lck = do_lock(smbd_messaging_context(),
3240 fsp,
3241 req->smbpid,
3242 (uint64_t)numtoread,
3243 (uint64_t)startpos,
3244 WRITE_LOCK,
3245 WINDOWS_LOCK,
3246 False, /* Non-blocking lock. */
3247 &status,
3248 NULL,
3249 NULL);
3250 TALLOC_FREE(br_lck);
3251
3252 if (NT_STATUS_V(status)) {
3253 reply_nterror(req, status);
3254 END_PROFILE(SMBlockread);
3255 return;
3256 }
3257
3258 /*
3259 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3260 */
3261
3262 if (numtoread > sconn->smb1.negprot.max_recv) {
3263 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3264 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3265 (unsigned int)numtoread,
3266 (unsigned int)sconn->smb1.negprot.max_recv));
3267 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3268 }
3269 nread = read_file(fsp,data,startpos,numtoread);
3270
3271 if (nread < 0) {
3272 reply_unixerror(req, ERRDOS, ERRnoaccess);
3273 END_PROFILE(SMBlockread);
3274 return;
3275 }
3276
3277 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3278
3279 SSVAL(req->outbuf,smb_vwv0,nread);
3280 SSVAL(req->outbuf,smb_vwv5,nread+3);
3281 p = smb_buf(req->outbuf);
3282 SCVAL(p,0,0); /* pad byte. */
3283 SSVAL(p,1,nread);
3284
3285 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3286 fsp->fnum, (int)numtoread, (int)nread));
3287
3288 END_PROFILE(SMBlockread);
3289 return;
3290 }
3291
3292 #undef DBGC_CLASS
3293 #define DBGC_CLASS DBGC_ALL
3294
3295 /****************************************************************************
3296 Reply to a read.
3297 ****************************************************************************/
3298
3299 void reply_read(struct smb_request *req)
3300 {
3301 connection_struct *conn = req->conn;
3302 size_t numtoread;
3303 ssize_t nread = 0;
3304 char *data;
3305 SMB_OFF_T startpos;
3306 int outsize = 0;
3307 files_struct *fsp;
3308 struct lock_struct lock;
3309 struct smbd_server_connection *sconn = smbd_server_conn;
3310
3311 START_PROFILE(SMBread);
3312
3313 if (req->wct < 3) {
3314 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3315 END_PROFILE(SMBread);
3316 return;
3317 }
3318
3319 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3320
3321 if (!check_fsp(conn, req, fsp)) {
3322 END_PROFILE(SMBread);
3323 return;
3324 }
3325
3326 if (!CHECK_READ(fsp,req)) {
3327 reply_doserror(req, ERRDOS, ERRbadaccess);
3328 END_PROFILE(SMBread);
3329 return;
3330 }
3331
3332 numtoread = SVAL(req->vwv+1, 0);
3333 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3334
3335 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3336
3337 /*
3338 * The requested read size cannot be greater than max_recv. JRA.
3339 */
3340 if (numtoread > sconn->smb1.negprot.max_recv) {
3341 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3342 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3343 (unsigned int)numtoread,
3344 (unsigned int)sconn->smb1.negprot.max_recv));
3345 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3346 }
3347
3348 reply_outbuf(req, 5, numtoread+3);
3349
3350 data = smb_buf(req->outbuf) + 3;
3351
3352 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3353 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3354 &lock);
3355
3356 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3357 reply_doserror(req, ERRDOS,ERRlock);
3358 END_PROFILE(SMBread);
3359 return;
3360 }
3361
3362 if (numtoread > 0)
3363 nread = read_file(fsp,data,startpos,numtoread);
3364
3365 if (nread < 0) {
3366 reply_unixerror(req, ERRDOS,ERRnoaccess);
3367 goto strict_unlock;
3368 }
3369
3370 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3371
3372 SSVAL(req->outbuf,smb_vwv0,nread);
3373 SSVAL(req->outbuf,smb_vwv5,nread+3);
3374 SCVAL(smb_buf(req->outbuf),0,1);
3375 SSVAL(smb_buf(req->outbuf),1,nread);
3376
3377 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3378 fsp->fnum, (int)numtoread, (int)nread ) );
3379
3380 strict_unlock:
3381 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3382
3383 END_PROFILE(SMBread);
3384 return;
3385 }
3386
3387 /****************************************************************************
3388 Setup readX header.
3389 ****************************************************************************/
3390
3391 static int setup_readX_header(struct smb_request *req, char *outbuf,
3392 size_t smb_maxcnt)
3393 {
3394 int outsize;
3395 char *data;
3396
3397 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3398 data = smb_buf(outbuf);
3399
3400 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3401
3402 SCVAL(outbuf,smb_vwv0,0xFF);
3403 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3404 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3405 SSVAL(outbuf,smb_vwv6,
3406 req_wct_ofs(req)
3407 + 1 /* the wct field */
3408 + 12 * sizeof(uint16_t) /* vwv */
3409 + 2); /* the buflen field */
3410 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3411 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3412 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3413 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3414 return outsize;
3415 }
3416
3417 /****************************************************************************
3418 Reply to a read and X - possibly using sendfile.
3419 ****************************************************************************/
3420
3421 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3422 files_struct *fsp, SMB_OFF_T startpos,
3423 size_t smb_maxcnt)
3424 {
3425 SMB_STRUCT_STAT sbuf;
3426 ssize_t nread = -1;
3427 struct lock_struct lock;
3428
3429 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3430 reply_unixerror(req, ERRDOS, ERRnoaccess);
3431 return;
3432 }
3433
3434 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3435 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3436 &lock);
3437
3438 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3439 reply_doserror(req, ERRDOS, ERRlock);
3440 return;
3441 }
3442
3443 if (!S_ISREG(sbuf.st_ex_mode) || (startpos > sbuf.st_ex_size)
3444 || (smb_maxcnt > (sbuf.st_ex_size - startpos))) {
3445 /*
3446 * We already know that we would do a short read, so don't
3447 * try the sendfile() path.
3448 */
3449 goto nosendfile_read;
3450 }
3451
3452 #if defined(WITH_SENDFILE)
3453 /*
3454 * We can only use sendfile on a non-chained packet
3455 * but we can use on a non-oplocked file. tridge proved this
3456 * on a train in Germany :-). JRA.
3457 */
3458
3459 if (!req_is_in_chain(req) &&
3460 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3461 (fsp->wcp == NULL) &&
3462 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3463 uint8 headerbuf[smb_size + 12 * 2];
3464 DATA_BLOB header;
3465
3466 /*
3467 * Set up the packet header before send. We
3468 * assume here the sendfile will work (get the
3469 * correct amount of data).
3470 */
3471
3472 header = data_blob_const(headerbuf, sizeof(headerbuf));
3473
3474 construct_reply_common_req(req, (char *)headerbuf);
3475 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3476
3477 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3478 /* Returning ENOSYS means no data at all was sent.
3479 Do this as a normal read. */
3480 if (errno == ENOSYS) {
3481 goto normal_read;
3482 }
3483
3484 /*
3485 * Special hack for broken Linux with no working sendfile. If we
3486 * return EINTR we sent the header but not the rest of the data.
3487 * Fake this up by doing read/write calls.
3488 */
3489
3490 if (errno == EINTR) {
3491 /* Ensure we don't do this again. */
3492 set_use_sendfile(SNUM(conn), False);
3493 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3494 nread = fake_sendfile(fsp, startpos,
3495 smb_maxcnt);
3496 if (nread == -1) {
3497 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3498 fsp->fsp_name, strerror(errno) ));
3499 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3500 }
3501 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3502 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3503 /* No outbuf here means successful sendfile. */
3504 goto strict_unlock;
3505 }
3506
3507 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3508 fsp->fsp_name, strerror(errno) ));
3509 exit_server_cleanly("send_file_readX sendfile failed");
3510 } else if (nread == 0) {
3511 /*
3512 * Some sendfile implementations return 0 to indicate
3513 * that there was a short read, but nothing was
3514 * actually written to the socket. In this case,
3515 * fallback to the normal read path so the header gets
3516 * the correct byte count.
3517 */
3518 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3519 "falling back to the normal read: %s\n",
3520 fsp->fsp_name));
3521 goto normal_read;
3522 }
3523
3524 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3525 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3526
3527 /* Deal with possible short send. */
3528 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3529 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3530 }
3531 /* No outbuf here means successful sendfile. */
3532 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3533 SMB_PERFCOUNT_END(&req->pcd);
3534 goto strict_unlock;
3535 }
3536
3537 normal_read:
3538
3539 #endif
3540
3541 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3542 uint8 headerbuf[smb_size + 2*12];
3543
3544 construct_reply_common_req(req, (char *)headerbuf);
3545 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3546
3547 /* Send out the header. */
3548 if (write_data(smbd_server_fd(), (char *)headerbuf,
3549 sizeof(headerbuf)) != sizeof(headerbuf)) {
3550 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3551 fsp->fsp_name, strerror(errno) ));
3552 exit_server_cleanly("send_file_readX sendfile failed");
3553 }
3554 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3555 if (nread == -1) {
3556 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3557 fsp->fsp_name, strerror(errno) ));
3558 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3559 }
3560 goto strict_unlock;
3561 }
3562
3563 nosendfile_read:
3564
3565 reply_outbuf(req, 12, smb_maxcnt);
3566
3567 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3568
3569 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3570
3571 if (nread < 0) {
3572 reply_unixerror(req, ERRDOS, ERRnoaccess);
3573 return;
3574 }
3575
3576 setup_readX_header(req, (char *)req->outbuf, nread);
3577
3578 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3579 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3580
3581 chain_reply(req);
3582 return;
3583
3584 strict_unlock:
3585 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3586 TALLOC_FREE(req->outbuf);
3587 return;
3588 }
3589
3590 /****************************************************************************
3591 Reply to a read and X.
3592 ****************************************************************************/
3593
3594 void reply_read_and_X(struct smb_request *req)
3595 {
3596 connection_struct *conn = req->conn;
3597 files_struct *fsp;
3598 SMB_OFF_T startpos;
3599 size_t smb_maxcnt;
3600 bool big_readX = False;
3601 #if 0
3602 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3603 #endif
3604
3605 START_PROFILE(SMBreadX);
3606
3607 if ((req->wct != 10) && (req->wct != 12)) {
3608 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3609 return;
3610 }
3611
3612 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3613 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3614 smb_maxcnt = SVAL(req->vwv+5, 0);
3615
3616 /* If it's an IPC, pass off the pipe handler. */
3617 if (IS_IPC(conn)) {
3618 reply_pipe_read_and_X(req);
3619 END_PROFILE(SMBreadX);
3620 return;
3621 }
3622
3623 if (!check_fsp(conn, req, fsp)) {
3624 END_PROFILE(SMBreadX);
3625 return;
3626 }
3627
3628 if (!CHECK_READ(fsp,req)) {
3629 reply_doserror(req, ERRDOS,ERRbadaccess);
3630 END_PROFILE(SMBreadX);
3631 return;
3632 }
3633
3634 if (global_client_caps & CAP_LARGE_READX) {
3635 size_t upper_size = SVAL(req->vwv+7, 0);
3636 smb_maxcnt |= (upper_size<<16);
3637 if (upper_size > 1) {
3638 /* Can't do this on a chained packet. */
3639 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3640 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3641 END_PROFILE(SMBreadX);
3642 return;
3643 }
3644 /* We currently don't do this on signed or sealed data. */
3645 if (srv_is_signing_active(smbd_server_conn) ||
3646 is_encrypted_packet(req->inbuf)) {
3647 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3648 END_PROFILE(SMBreadX);
3649 return;
3650 }
3651 /* Is there room in the reply for this data ? */
3652 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3653 reply_nterror(req,
3654 NT_STATUS_INVALID_PARAMETER);
3655 END_PROFILE(SMBreadX);
3656 return;
3657 }
3658 big_readX = True;
3659 }
3660 }
3661
3662 if (req->wct == 12) {
3663 #ifdef LARGE_SMB_OFF_T
3664 /*
3665 * This is a large offset (64 bit) read.
3666 */
3667 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3668
3669 #else /* !LARGE_SMB_OFF_T */
3670
3671 /*
3672 * Ensure we haven't been sent a >32 bit offset.
3673 */
3674
3675 if(IVAL(req->vwv+10, 0) != 0) {
3676 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3677 "used and we don't support 64 bit offsets.\n",
3678 (unsigned int)IVAL(req->vwv+10, 0) ));
3679 END_PROFILE(SMBreadX);
3680 reply_doserror(req, ERRDOS, ERRbadaccess);
3681 return;
3682 }
3683
3684 #endif /* LARGE_SMB_OFF_T */
3685
3686 }
3687
3688 if (!big_readX &&
3689 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3690 goto out;
3691 }
3692
3693 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3694
3695 out:
3696 END_PROFILE(SMBreadX);
3697 return;
3698 }
3699
3700 /****************************************************************************
3701 Error replies to writebraw must have smb_wct == 1. Fix this up.
3702 ****************************************************************************/
3703
3704 void error_to_writebrawerr(struct smb_request *req)
3705 {
3706 uint8 *old_outbuf = req->outbuf;
3707
3708 reply_outbuf(req, 1, 0);
3709
3710 memcpy(req->outbuf, old_outbuf, smb_size);
3711 TALLOC_FREE(old_outbuf);
3712 }
3713
3714 /****************************************************************************
3715 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3716 ****************************************************************************/
3717
3718 void reply_writebraw(struct smb_request *req)
3719 {
3720 connection_struct *conn = req->conn;
3721 char *buf = NULL;
3722 ssize_t nwritten=0;
3723 ssize_t total_written=0;
3724 size_t numtowrite=0;
3725 size_t tcount;
3726 SMB_OFF_T startpos;
3727 char *data=NULL;
3728 bool write_through;
3729 files_struct *fsp;
3730 struct lock_struct lock;
3731 NTSTATUS status;
3732
3733 START_PROFILE(SMBwritebraw);
3734
3735 /*
3736 * If we ever reply with an error, it must have the SMB command
3737 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3738 * we're finished.
3739 */
3740 SCVAL(req->inbuf,smb_com,SMBwritec);
3741
3742 if (srv_is_signing_active(smbd_server_conn)) {
3743 END_PROFILE(SMBwritebraw);
3744 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3745 "raw reads/writes are disallowed.");
3746 }
3747
3748 if (req->wct < 12) {
3749 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3750 error_to_writebrawerr(req);
3751 END_PROFILE(SMBwritebraw);
3752 return;
3753 }
3754
3755 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3756 if (!check_fsp(conn, req, fsp)) {
3757 error_to_writebrawerr(req);
3758 END_PROFILE(SMBwritebraw);
3759 return;
3760 }
3761
3762 if (!CHECK_WRITE(fsp)) {
3763 reply_doserror(req, ERRDOS, ERRbadaccess);
3764 error_to_writebrawerr(req);
3765 END_PROFILE(SMBwritebraw);
3766 return;
3767 }
3768
3769 tcount = IVAL(req->vwv+1, 0);
3770 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3771 write_through = BITSETW(req->vwv+7,0);
3772
3773 /* We have to deal with slightly different formats depending
3774 on whether we are using the core+ or lanman1.0 protocol */
3775
3776 if(Protocol <= PROTOCOL_COREPLUS) {
3777 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3778 data = smb_buf(req->inbuf);
3779 } else {
3780 numtowrite = SVAL(req->vwv+10, 0);
3781 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3782 }
3783
3784 /* Ensure we don't write bytes past the end of this packet. */
3785 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3786 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3787 error_to_writebrawerr(req);
3788 END_PROFILE(SMBwritebraw);
3789 return;
3790 }
3791
3792 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3793 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3794 &lock);
3795
3796 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3797 reply_doserror(req, ERRDOS, ERRlock);
3798 error_to_writebrawerr(req);
3799 END_PROFILE(SMBwritebraw);
3800 return;
3801 }
3802
3803 if (numtowrite>0) {
3804 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3805 }
3806
3807 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3808 "wrote=%d sync=%d\n",
3809 fsp->fnum, (double)startpos, (int)numtowrite,
3810 (int)nwritten, (int)write_through));
3811
3812 if (nwritten < (ssize_t)numtowrite) {
3813 reply_unixerror(req, ERRHRD, ERRdiskfull);
3814 error_to_writebrawerr(req);
3815 goto strict_unlock;
3816 }
3817
3818 total_written = nwritten;
3819
3820 /* Allocate a buffer of 64k + length. */
3821 buf = TALLOC_ARRAY(NULL, char, 65540);
3822 if (!buf) {
3823 reply_doserror(req, ERRDOS, ERRnomem);
3824 error_to_writebrawerr(req);
3825 goto strict_unlock;
3826 }
3827
3828 /* Return a SMBwritebraw message to the redirector to tell
3829 * it to send more bytes */
3830
3831 memcpy(buf, req->inbuf, smb_size);
3832 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3833 SCVAL(buf,smb_com,SMBwritebraw);
3834 SSVALS(buf,smb_vwv0,0xFFFF);
3835 show_msg(buf);
3836 if (!srv_send_smb(smbd_server_fd(),
3837 buf,
3838 false, 0, /* no signing */
3839 IS_CONN_ENCRYPTED(conn),
3840 &req->pcd)) {
3841 exit_server_cleanly("reply_writebraw: srv_send_smb "
3842 "failed.");
3843 }
3844
3845 /* Now read the raw data into the buffer and write it */
3846 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3847 &numtowrite);
3848 if (!NT_STATUS_IS_OK(status)) {
3849 exit_server_cleanly("secondary writebraw failed");
3850 }
3851
3852 /* Set up outbuf to return the correct size */
3853 reply_outbuf(req, 1, 0);
3854
3855 if (numtowrite != 0) {
3856
3857 if (numtowrite > 0xFFFF) {
3858 DEBUG(0,("reply_writebraw: Oversize secondary write "
3859 "raw requested (%u). Terminating\n",
3860 (unsigned int)numtowrite ));
3861 exit_server_cleanly("secondary writebraw failed");
3862 }
3863
3864 if (tcount > nwritten+numtowrite) {
3865 DEBUG(3,("reply_writebraw: Client overestimated the "
3866 "write %d %d %d\n",
3867 (int)tcount,(int)nwritten,(int)numtowrite));
3868 }
3869
3870 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3871
3872 if (!NT_STATUS_IS_OK(status)) {
3873 DEBUG(0,("reply_writebraw: Oversize secondary write "
3874 "raw read failed (%s). Terminating\n",
3875 nt_errstr(status)));
3876 exit_server_cleanly("secondary writebraw failed");
3877 }
3878
3879 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3880 if (nwritten == -1) {
3881 TALLOC_FREE(buf);
3882 reply_unixerror(req, ERRHRD, ERRdiskfull);
3883 error_to_writebrawerr(req);
3884 goto strict_unlock;
3885 }
3886
3887 if (nwritten < (ssize_t)numtowrite) {
3888 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3889 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3890 }
3891
3892 if (nwritten > 0) {
3893 total_written += nwritten;
3894 }
3895 }
3896
3897 TALLOC_FREE(buf);
3898 SSVAL(req->outbuf,smb_vwv0,total_written);
3899
3900 status = sync_file(conn, fsp, write_through);
3901 if (!NT_STATUS_IS_OK(status)) {
3902 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3903 fsp->fsp_name, nt_errstr(status) ));
3904 reply_nterror(req, status);
3905 error_to_writebrawerr(req);
3906 goto strict_unlock;
3907 }
3908
3909 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3910 "wrote=%d\n",
3911 fsp->fnum, (double)startpos, (int)numtowrite,
3912 (int)total_written));
3913
3914 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3915
3916 /* We won't return a status if write through is not selected - this
3917 * follows what WfWg does */
3918 END_PROFILE(SMBwritebraw);
3919
3920 if (!write_through && total_written==tcount) {
3921
3922 #if RABBIT_PELLET_FIX
3923 /*
3924 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3925 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3926 * JRA.
3927 */
3928 if (!send_keepalive(smbd_server_fd())) {
3929 exit_server_cleanly("reply_writebraw: send of "
3930 "keepalive failed");
3931 }
3932 #endif
3933 TALLOC_FREE(req->outbuf);
3934 }
3935 return;
3936
3937 strict_unlock:
3938 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3939
3940 END_PROFILE(SMBwritebraw);
3941 return;
3942 }
3943
3944 #undef DBGC_CLASS
3945 #define DBGC_CLASS DBGC_LOCKING
3946
3947 /****************************************************************************
3948 Reply to a writeunlock (core+).
3949 ****************************************************************************/
3950
3951 void reply_writeunlock(struct smb_request *req)
3952 {
3953 connection_struct *conn = req->conn;
3954 ssize_t nwritten = -1;
3955 size_t numtowrite;
3956 SMB_OFF_T startpos;
3957 const char *data;
3958 NTSTATUS status = NT_STATUS_OK;
3959 files_struct *fsp;
3960 struct lock_struct lock;
3961
3962 START_PROFILE(SMBwriteunlock);
3963
3964 if (req->wct < 5) {
3965 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3966 END_PROFILE(SMBwriteunlock);
3967 return;
3968 }
3969
3970 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3971
3972 if (!check_fsp(conn, req, fsp)) {
3973 END_PROFILE(SMBwriteunlock);
3974 return;
3975 }
3976
3977 if (!CHECK_WRITE(fsp)) {
3978 reply_doserror(req, ERRDOS,ERRbadaccess);
3979 END_PROFILE(SMBwriteunlock);
3980 return;
3981 }
3982
3983 numtowrite = SVAL(req->vwv+1, 0);
3984 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3985 data = (const char *)req->buf + 3;
3986
3987 if (numtowrite) {
3988 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3989 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3990 &lock);
3991
3992 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3993 reply_doserror(req, ERRDOS, ERRlock);
3994 END_PROFILE(SMBwriteunlock);
3995 return;
3996 }
3997 }
3998
3999 /* The special X/Open SMB protocol handling of
4000 zero length writes is *NOT* done for
4001 this call */
4002 if(numtowrite == 0) {
4003 nwritten = 0;
4004 } else {
4005 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4006 }
4007
4008 status = sync_file(conn, fsp, False /* write through */);
4009 if (!NT_STATUS_IS_OK(status)) {
4010 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4011 fsp->fsp_name, nt_errstr(status) ));
4012 reply_nterror(req, status);
4013 goto strict_unlock;
4014 }
4015
4016 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
4017 reply_unixerror(req, ERRHRD, ERRdiskfull);
4018 goto strict_unlock;
4019 }
4020
4021 if (numtowrite) {
4022 status = do_unlock(smbd_messaging_context(),
4023 fsp,
4024 req->smbpid,
4025 (uint64_t)numtowrite,
4026 (uint64_t)startpos,
4027 WINDOWS_LOCK);
4028
4029 if (NT_STATUS_V(status)) {
4030 reply_nterror(req, status);
4031 goto strict_unlock;
4032 }
4033 }
4034
4035 reply_outbuf(req, 1, 0);
4036
4037 SSVAL(req->outbuf,smb_vwv0,nwritten);
4038
4039 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4040 fsp->fnum, (int)numtowrite, (int)nwritten));
4041
4042 strict_unlock:
4043 if (numtowrite) {
4044 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4045 }
4046
4047 END_PROFILE(SMBwriteunlock);
4048 return;
4049 }
4050
4051 #undef DBGC_CLASS
4052 #define DBGC_CLASS DBGC_ALL
4053
4054 /****************************************************************************
4055 Reply to a write.
4056 ****************************************************************************/
4057
4058 void reply_write(struct smb_request *req)
4059 {
4060 connection_struct *conn = req->conn;
4061 size_t numtowrite;
4062 ssize_t nwritten = -1;
4063 SMB_OFF_T startpos;
4064 const char *data;
4065 files_struct *fsp;
4066 struct lock_struct lock;
4067 NTSTATUS status;
4068
4069 START_PROFILE(SMBwrite);
4070
4071 if (req->wct < 5) {
4072 END_PROFILE(SMBwrite);
4073 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4074 return;
4075 }
4076
4077 /* If it's an IPC, pass off the pipe handler. */
4078 if (IS_IPC(conn)) {
4079 reply_pipe_write(req);
4080 END_PROFILE(SMBwrite);
4081 return;
4082 }
4083
4084 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4085
4086 if (!check_fsp(conn, req, fsp)) {
4087 END_PROFILE(SMBwrite);
4088 return;
4089 }
4090
4091 if (!CHECK_WRITE(fsp)) {
4092 reply_doserror(req, ERRDOS, ERRbadaccess);
4093 END_PROFILE(SMBwrite);
4094 return;
4095 }
4096
4097 numtowrite = SVAL(req->vwv+1, 0);
4098 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4099 data = (const char *)req->buf + 3;
4100
4101 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4102 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4103 &lock);
4104
4105 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4106 reply_doserror(req, ERRDOS, ERRlock);
4107 END_PROFILE(SMBwrite);
4108 return;
4109 }
4110
4111 /*
4112 * X/Open SMB protocol says that if smb_vwv1 is
4113 * zero then the file size should be extended or
4114 * truncated to the size given in smb_vwv[2-3].
4115 */
4116
4117 if(numtowrite == 0) {
4118 /*
4119 * This is actually an allocate call, and set EOF. JRA.
4120 */
4121 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4122 if (nwritten < 0) {
4123 reply_nterror(req, NT_STATUS_DISK_FULL);
4124 goto strict_unlock;
4125 }
4126 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4127 if (nwritten < 0) {
4128 reply_nterror(req, NT_STATUS_DISK_FULL);
4129 goto strict_unlock;
4130 }
4131 trigger_write_time_update_immediate(fsp);
4132 } else {
4133 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4134 }
4135
4136 status = sync_file(conn, fsp, False);
4137 if (!NT_STATUS_IS_OK(status)) {
4138 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4139 fsp->fsp_name, nt_errstr(status) ));
4140 reply_nterror(req, status);
4141 goto strict_unlock;
4142 }
4143
4144 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4145 reply_unixerror(req, ERRHRD, ERRdiskfull);
4146 goto strict_unlock;
4147 }
4148
4149 reply_outbuf(req, 1, 0);
4150
4151 SSVAL(req->outbuf,smb_vwv0,nwritten);
4152
4153 if (nwritten < (ssize_t)numtowrite) {
4154 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4155 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4156 }
4157
4158 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4159
4160 strict_unlock:
4161 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4162
4163 END_PROFILE(SMBwrite);
4164 return;
4165 }
4166
4167 /****************************************************************************
4168 Ensure a buffer is a valid writeX for recvfile purposes.
4169 ****************************************************************************/
4170
4171 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4172 (2*14) + /* word count (including bcc) */ \
4173 1 /* pad byte */)
4174
4175 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4176 {
4177 size_t numtowrite;
4178 connection_struct *conn = NULL;
4179 unsigned int doff = 0;
4180 size_t len = smb_len_large(inbuf);
4181 struct smbd_server_connection *sconn = smbd_server_conn;
4182
4183 if (is_encrypted_packet(inbuf)) {
4184 /* Can't do this on encrypted
4185 * connections. */
4186 return false;
4187 }
4188
4189 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4190 return false;
4191 }
4192
4193 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4194 CVAL(inbuf,smb_wct) != 14) {
4195 DEBUG(10,("is_valid_writeX_buffer: chained or "
4196 "invalid word length.\n"));
4197 return false;
4198 }
4199
4200 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4201 if (conn == NULL) {
4202 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4203 return false;
4204 }
4205 if (IS_IPC(conn)) {
4206 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4207 return false;
4208 }
4209 if (IS_PRINT(conn)) {
4210 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4211 return false;
4212 }
4213 doff = SVAL(inbuf,smb_vwv11);
4214
4215 numtowrite = SVAL(inbuf,smb_vwv10);
4216
4217 if (len > doff && len - doff > 0xFFFF) {
4218 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4219 }
4220
4221 if (numtowrite == 0) {
4222 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4223 return false;
4224 }
4225
4226 /* Ensure the sizes match up. */
4227 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4228 /* no pad byte...old smbclient :-( */
4229 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4230 (unsigned int)doff,
4231 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4232 return false;
4233 }
4234
4235 if (len - doff != numtowrite) {
4236 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4237 "len = %u, doff = %u, numtowrite = %u\n",
4238 (unsigned int)len,
4239 (unsigned int)doff,
4240 (unsigned int)numtowrite ));
4241 return false;
4242 }
4243
4244 DEBUG(10,("is_valid_writeX_buffer: true "
4245 "len = %u, doff = %u, numtowrite = %u\n",
4246 (unsigned int)len,
4247 (unsigned int)doff,
4248 (unsigned int)numtowrite ));
4249
4250 return true;
4251 }
4252
4253 /****************************************************************************
4254 Reply to a write and X.
4255 ****************************************************************************/
4256
4257 void reply_write_and_X(struct smb_request *req)
4258 {
4259 connection_struct *conn = req->conn;
4260 files_struct *fsp;
4261 struct lock_struct lock;
4262 SMB_OFF_T startpos;
4263 size_t numtowrite;
4264 bool write_through;
4265 ssize_t nwritten;
4266 unsigned int smb_doff;
4267 unsigned int smblen;
4268 char *data;
4269 NTSTATUS status;
4270
4271 START_PROFILE(SMBwriteX);
4272
4273 if ((req->wct != 12) && (req->wct != 14)) {
4274 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4275 END_PROFILE(SMBwriteX);
4276 return;
4277 }
4278
4279 numtowrite = SVAL(req->vwv+10, 0);
4280 smb_doff = SVAL(req->vwv+11, 0);
4281 smblen = smb_len(req->inbuf);
4282
4283 if (req->unread_bytes > 0xFFFF ||
4284 (smblen > smb_doff &&
4285 smblen - smb_doff > 0xFFFF)) {
4286 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4287 }
4288
4289 if (req->unread_bytes) {
4290 /* Can't do a recvfile write on IPC$ */
4291 if (IS_IPC(conn)) {
4292 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4293 END_PROFILE(SMBwriteX);
4294 return;
4295 }
4296 if (numtowrite != req->unread_bytes) {
4297 reply_doserror(req, ERRDOS, ERRbadmem);
4298 END_PROFILE(SMBwriteX);
4299 return;
4300 }
4301 } else {
4302 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4303 smb_doff + numtowrite > smblen) {
4304 reply_doserror(req, ERRDOS, ERRbadmem);
4305 END_PROFILE(SMBwriteX);
4306 return;
4307 }
4308 }
4309
4310 /* If it's an IPC, pass off the pipe handler. */
4311 if (IS_IPC(conn)) {
4312 if (req->unread_bytes) {
4313 reply_doserror(req, ERRDOS, ERRbadmem);
4314 END_PROFILE(SMBwriteX);
4315 return;
4316 }
4317 reply_pipe_write_and_X(req);
4318 END_PROFILE(SMBwriteX);
4319 return;
4320 }
4321
4322 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4323 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4324 write_through = BITSETW(req->vwv+7,0);
4325
4326 if (!check_fsp(conn, req, fsp)) {
4327 END_PROFILE(SMBwriteX);
4328 return;
4329 }
4330
4331 if (!CHECK_WRITE(fsp)) {
4332 reply_doserror(req, ERRDOS, ERRbadaccess);
4333 END_PROFILE(SMBwriteX);
4334 return;
4335 }
4336
4337 data = smb_base(req->inbuf) + smb_doff;
4338
4339 if(req->wct == 14) {
4340 #ifdef LARGE_SMB_OFF_T
4341 /*
4342 * This is a large offset (64 bit) write.
4343 */
4344 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4345
4346 #else /* !LARGE_SMB_OFF_T */
4347
4348 /*
4349 * Ensure we haven't been sent a >32 bit offset.
4350 */
4351
4352 if(IVAL(req->vwv+12, 0) != 0) {
4353 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4354 "used and we don't support 64 bit offsets.\n",
4355 (unsigned int)IVAL(req->vwv+12, 0) ));
4356 reply_doserror(req, ERRDOS, ERRbadaccess);
4357 END_PROFILE(SMBwriteX);
4358 return;
4359 }
4360
4361 #endif /* LARGE_SMB_OFF_T */
4362 }
4363
4364 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4365 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4366 &lock);
4367
4368 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4369 reply_doserror(req, ERRDOS, ERRlock);
4370 END_PROFILE(SMBwriteX);
4371 return;
4372 }
4373
4374 /* X/Open SMB protocol says that, unlike SMBwrite
4375 if the length is zero then NO truncation is
4376 done, just a write of zero. To truncate a file,
4377 use SMBwrite. */
4378
4379 if(numtowrite == 0) {
4380 nwritten = 0;
4381 } else {
4382
4383 if ((req->unread_bytes == 0) &&
4384 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4385 numtowrite)) {
4386 goto strict_unlock;
4387 }
4388
4389 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4390 }
4391
4392 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4393 reply_unixerror(req, ERRHRD, ERRdiskfull);
4394 goto strict_unlock;
4395 }
4396
4397 reply_outbuf(req, 6, 0);
4398 SSVAL(req->outbuf,smb_vwv2,nwritten);
4399 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4400
4401 if (nwritten < (ssize_t)numtowrite) {
4402 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4403 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4404 }
4405
4406 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4407 fsp->fnum, (int)numtowrite, (int)nwritten));
4408
4409 status = sync_file(conn, fsp, write_through);
4410 if (!NT_STATUS_IS_OK(status)) {
4411 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4412 fsp->fsp_name, nt_errstr(status) ));
4413 reply_nterror(req, status);
4414 goto strict_unlock;
4415 }
4416
4417 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4418
4419 END_PROFILE(SMBwriteX);
4420 chain_reply(req);
4421 return;
4422
4423 strict_unlock:
4424 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4425
4426 END_PROFILE(SMBwriteX);
4427 return;
4428 }
4429
4430 /****************************************************************************
4431 Reply to a lseek.
4432 ****************************************************************************/
4433
4434 void reply_lseek(struct smb_request *req)
4435 {
4436 connection_struct *conn = req->conn;
4437 SMB_OFF_T startpos;
4438 SMB_OFF_T res= -1;
4439 int mode,umode;
4440 files_struct *fsp;
4441
4442 START_PROFILE(SMBlseek);
4443
4444 if (req->wct < 4) {
4445 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4446 END_PROFILE(SMBlseek);
4447 return;
4448 }
4449
4450 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4451
4452 if (!check_fsp(conn, req, fsp)) {
4453 return;
4454 }
4455
4456 flush_write_cache(fsp, SEEK_FLUSH);
4457
4458 mode = SVAL(req->vwv+1, 0) & 3;
4459 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4460 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4461
4462 switch (mode) {
4463 case 0:
4464 umode = SEEK_SET;
4465 res = startpos;
4466 break;
4467 case 1:
4468 umode = SEEK_CUR;
4469 res = fsp->fh->pos + startpos;
4470 break;
4471 case 2:
4472 umode = SEEK_END;
4473 break;
4474 default:
4475 umode = SEEK_SET;
4476 res = startpos;
4477 break;
4478 }
4479
4480 if (umode == SEEK_END) {
4481 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4482 if(errno == EINVAL) {
4483 SMB_OFF_T current_pos = startpos;
4484 SMB_STRUCT_STAT sbuf;
4485
4486 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4487 reply_unixerror(req, ERRDOS,
4488 ERRnoaccess);
4489 END_PROFILE(SMBlseek);
4490 return;
4491 }
4492
4493 current_pos += sbuf.st_ex_size;
4494 if(current_pos < 0)
4495 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4496 }
4497 }
4498
4499 if(res == -1) {
4500 reply_unixerror(req, ERRDOS, ERRnoaccess);
4501 END_PROFILE(SMBlseek);
4502 return;
4503 }
4504 }
4505
4506 fsp->fh->pos = res;
4507
4508 reply_outbuf(req, 2, 0);
4509 SIVAL(req->outbuf,smb_vwv0,res);
4510
4511 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4512 fsp->fnum, (double)startpos, (double)res, mode));
4513
4514 END_PROFILE(SMBlseek);
4515 return;
4516 }
4517
4518 /****************************************************************************
4519 Reply to a flush.
4520 ****************************************************************************/
4521
4522 void reply_flush(struct smb_request *req)
4523 {
4524 connection_struct *conn = req->conn;
4525 uint16 fnum;
4526 files_struct *fsp;
4527
4528 START_PROFILE(SMBflush);
4529
4530 if (req->wct < 1) {
4531 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4532 return;
4533 }
4534
4535 fnum = SVAL(req->vwv+0, 0);
4536 fsp = file_fsp(req, fnum);
4537
4538 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4539 return;
4540 }
4541
4542 if (!fsp) {
4543 file_sync_all(conn);
4544 } else {
4545 NTSTATUS status = sync_file(conn, fsp, True);
4546 if (!NT_STATUS_IS_OK(status)) {
4547 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4548 fsp->fsp_name, nt_errstr(status) ));
4549 reply_nterror(req, status);
4550 END_PROFILE(SMBflush);
4551 return;
4552 }
4553 }
4554
4555 reply_outbuf(req, 0, 0);
4556
4557 DEBUG(3,("flush\n"));
4558 END_PROFILE(SMBflush);
4559 return;
4560 }
4561
4562 /****************************************************************************
4563 Reply to a exit.
4564 conn POINTER CAN BE NULL HERE !
4565 ****************************************************************************/
4566
4567 void reply_exit(struct smb_request *req)
4568 {
4569 START_PROFILE(SMBexit);
4570
4571 file_close_pid(req->smbpid, req->vuid);
4572
4573 reply_outbuf(req, 0, 0);
4574
4575 DEBUG(3,("exit\n"));
4576
4577 END_PROFILE(SMBexit);
4578 return;
4579 }
4580
4581 /****************************************************************************
4582 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4583 ****************************************************************************/
4584
4585 void reply_close(struct smb_request *req)
4586 {
4587 connection_struct *conn = req->conn;
4588 NTSTATUS status = NT_STATUS_OK;
4589 files_struct *fsp = NULL;
4590 START_PROFILE(SMBclose);
4591
4592 if (req->wct < 3) {
4593 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4594 END_PROFILE(SMBclose);
4595 return;
4596 }
4597
4598 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4599
4600 /*
4601 * We can only use check_fsp if we know it's not a directory.
4602 */
4603
4604 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4605 reply_doserror(req, ERRDOS, ERRbadfid);
4606 END_PROFILE(SMBclose);
4607 return;
4608 }
4609
4610 if(fsp->is_directory) {
4611 /*
4612 * Special case - close NT SMB directory handle.
4613 */
4614 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4615 status = close_file(req, fsp, NORMAL_CLOSE);
4616 } else {
4617 time_t t;
4618 /*
4619 * Close ordinary file.
4620 */
4621
4622 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4623 fsp->fh->fd, fsp->fnum,
4624 conn->num_files_open));
4625
4626 /*
4627 * Take care of any time sent in the close.
4628 */
4629
4630 t = srv_make_unix_date3(req->vwv+1);
4631 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4632
4633 /*
4634 * close_file() returns the unix errno if an error
4635 * was detected on close - normally this is due to
4636 * a disk full error. If not then it was probably an I/O error.
4637 */
4638
4639 status = close_file(req, fsp, NORMAL_CLOSE);
4640 }
4641
4642 if (!NT_STATUS_IS_OK(status)) {
4643 reply_nterror(req, status);
4644 END_PROFILE(SMBclose);
4645 return;
4646 }
4647
4648 reply_outbuf(req, 0, 0);
4649 END_PROFILE(SMBclose);
4650 return;
4651 }
4652
4653 /****************************************************************************
4654 Reply to a writeclose (Core+ protocol).
4655 ****************************************************************************/
4656
4657 void reply_writeclose(struct smb_request *req)
4658 {
4659 connection_struct *conn = req->conn;
4660 size_t numtowrite;
4661 ssize_t nwritten = -1;
4662 NTSTATUS close_status = NT_STATUS_OK;
4663 SMB_OFF_T startpos;
4664 const char *data;
4665 struct timespec mtime;
4666 files_struct *fsp;
4667 struct lock_struct lock;
4668
4669 START_PROFILE(SMBwriteclose);
4670
4671 if (req->wct < 6) {
4672 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4673 END_PROFILE(SMBwriteclose);
4674 return;
4675 }
4676
4677 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4678
4679 if (!check_fsp(conn, req, fsp)) {
4680 END_PROFILE(SMBwriteclose);
4681 return;
4682 }
4683 if (!CHECK_WRITE(fsp)) {
4684 reply_doserror(req, ERRDOS,ERRbadaccess);
4685 END_PROFILE(SMBwriteclose);
4686 return;
4687 }
4688
4689 numtowrite = SVAL(req->vwv+1, 0);
4690 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4691 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4692 data = (const char *)req->buf + 1;
4693
4694 if (numtowrite) {
4695 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4696 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4697 &lock);
4698
4699 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4700 reply_doserror(req, ERRDOS,ERRlock);
4701 END_PROFILE(SMBwriteclose);
4702 return;
4703 }
4704 }
4705
4706 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4707
4708 set_close_write_time(fsp, mtime);
4709
4710 /*
4711 * More insanity. W2K only closes the file if writelen > 0.
4712 * JRA.
4713 */
4714
4715 if (numtowrite) {
4716 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4717 fsp->fsp_name ));
4718 close_status = close_file(req, fsp, NORMAL_CLOSE);
4719 }
4720
4721 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4722 fsp->fnum, (int)numtowrite, (int)nwritten,
4723 conn->num_files_open));
4724
4725 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4726 reply_doserror(req, ERRHRD, ERRdiskfull);
4727 goto strict_unlock;
4728 }
4729
4730 if(!NT_STATUS_IS_OK(close_status)) {
4731 reply_nterror(req, close_status);
4732 goto strict_unlock;
4733 }
4734
4735 reply_outbuf(req, 1, 0);
4736
4737 SSVAL(req->outbuf,smb_vwv0,nwritten);
4738
4739 strict_unlock:
4740 if (numtowrite) {
4741 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4742 }
4743
4744 END_PROFILE(SMBwriteclose);
4745 return;
4746 }
4747
4748 #undef DBGC_CLASS
4749 #define DBGC_CLASS DBGC_LOCKING
4750
4751 /****************************************************************************
4752 Reply to a lock.
4753 ****************************************************************************/
4754
4755 void reply_lock(struct smb_request *req)
4756 {
4757 connection_struct *conn = req->conn;
4758 uint64_t count,offset;
4759 NTSTATUS status;
4760 files_struct *fsp;
4761 struct byte_range_lock *br_lck = NULL;
4762
4763 START_PROFILE(SMBlock);
4764
4765 if (req->wct < 5) {
4766 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4767 END_PROFILE(SMBlock);
4768 return;
4769 }
4770
4771 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4772
4773 if (!check_fsp(conn, req, fsp)) {
4774 END_PROFILE(SMBlock);
4775 return;
4776 }
4777
4778 count = (uint64_t)IVAL(req->vwv+1, 0);
4779 offset = (uint64_t)IVAL(req->vwv+3, 0);
4780
4781 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4782 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4783
4784 br_lck = do_lock(smbd_messaging_context(),
4785 fsp,
4786 req->smbpid,
4787 count,
4788 offset,
4789 WRITE_LOCK,
4790 WINDOWS_LOCK,
4791 False, /* Non-blocking lock. */
4792 &status,
4793 NULL,
4794 NULL);
4795
4796 TALLOC_FREE(br_lck);
4797
4798 if (NT_STATUS_V(status)) {
4799 reply_nterror(req, status);
4800 END_PROFILE(SMBlock);
4801 return;
4802 }
4803
4804 reply_outbuf(req, 0, 0);
4805
4806 END_PROFILE(SMBlock);
4807 return;
4808 }
4809
4810 /****************************************************************************
4811 Reply to a unlock.
4812 ****************************************************************************/
4813
4814 void reply_unlock(struct smb_request *req)
4815 {
4816 connection_struct *conn = req->conn;
4817 uint64_t count,offset;
4818 NTSTATUS status;
4819 files_struct *fsp;
4820
4821 START_PROFILE(SMBunlock);
4822
4823 if (req->wct < 5) {
4824 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4825 END_PROFILE(SMBunlock);
4826 return;
4827 }
4828
4829 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4830
4831 if (!check_fsp(conn, req, fsp)) {
4832 END_PROFILE(SMBunlock);
4833 return;
4834 }
4835
4836 count = (uint64_t)IVAL(req->vwv+1, 0);
4837 offset = (uint64_t)IVAL(req->vwv+3, 0);
4838
4839 status = do_unlock(smbd_messaging_context(),
4840 fsp,
4841 req->smbpid,
4842 count,
4843 offset,
4844 WINDOWS_LOCK);
4845
4846 if (NT_STATUS_V(status)) {
4847 reply_nterror(req, status);
4848 END_PROFILE(SMBunlock);
4849 return;
4850 }
4851
4852 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4853 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4854
4855 reply_outbuf(req, 0, 0);
4856
4857 END_PROFILE(SMBunlock);
4858 return;
4859 }
4860
4861 #undef DBGC_CLASS
4862 #define DBGC_CLASS DBGC_ALL
4863
4864 /****************************************************************************
4865 Reply to a tdis.
4866 conn POINTER CAN BE NULL HERE !
4867 ****************************************************************************/
4868
4869 void reply_tdis(struct smb_request *req)
4870 {
4871 struct smbd_server_connection *sconn = smbd_server_conn;
4872 connection_struct *conn = req->conn;
4873 START_PROFILE(SMBtdis);
4874
4875 if (!conn) {
4876 DEBUG(4,("Invalid connection in tdis\n"));
4877 reply_doserror(req, ERRSRV, ERRinvnid);
4878 END_PROFILE(SMBtdis);
4879 return;
4880 }
4881
4882 conn->used = False;
4883
4884 close_cnum(sconn, conn,req->vuid);
4885 req->conn = NULL;
4886
4887 reply_outbuf(req, 0, 0);
4888 END_PROFILE(SMBtdis);
4889 return;
4890 }
4891
4892 /****************************************************************************
4893 Reply to a echo.
4894 conn POINTER CAN BE NULL HERE !
4895 ****************************************************************************/
4896
4897 void reply_echo(struct smb_request *req)
4898 {
4899 connection_struct *conn = req->conn;
4900 struct smb_perfcount_data local_pcd;
4901 struct smb_perfcount_data *cur_pcd;
4902 int smb_reverb;
4903 int seq_num;
4904
4905 START_PROFILE(SMBecho);
4906
4907 smb_init_perfcount_data(&local_pcd);
4908
4909 if (req->wct < 1) {
4910 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4911 END_PROFILE(SMBecho);
4912 return;
4913 }
4914
4915 smb_reverb = SVAL(req->vwv+0, 0);
4916
4917 reply_outbuf(req, 1, req->buflen);
4918
4919 /* copy any incoming data back out */
4920 if (req->buflen > 0) {
4921 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4922 }
4923
4924 if (smb_reverb > 100) {
4925 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4926 smb_reverb = 100;
4927 }
4928
4929 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4930
4931 /* this makes sure we catch the request pcd */
4932 if (seq_num == smb_reverb) {
4933 cur_pcd = &req->pcd;
4934 } else {
4935 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4936 cur_pcd = &local_pcd;
4937 }
4938
4939 SSVAL(req->outbuf,smb_vwv0,seq_num);
4940
4941 show_msg((char *)req->outbuf);
4942 if (!srv_send_smb(smbd_server_fd(),
4943 (char *)req->outbuf,
4944 true, req->seqnum+1,
4945 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4946 cur_pcd))
4947 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4948 }
4949
4950 DEBUG(3,("echo %d times\n", smb_reverb));
4951
4952 TALLOC_FREE(req->outbuf);
4953
4954 END_PROFILE(SMBecho);
4955 return;
4956 }
4957
4958 /****************************************************************************
4959 Reply to a printopen.
4960 ****************************************************************************/
4961
4962 void reply_printopen(struct smb_request *req)
4963 {
4964 connection_struct *conn = req->conn;
4965 files_struct *fsp;
4966 SMB_STRUCT_STAT sbuf;
4967 NTSTATUS status;
4968
4969 START_PROFILE(SMBsplopen);
4970
4971 if (req->wct < 2) {
4972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4973 END_PROFILE(SMBsplopen);
4974 return;
4975 }
4976
4977 if (!CAN_PRINT(conn)) {
4978 reply_doserror(req, ERRDOS, ERRnoaccess);
4979 END_PROFILE(SMBsplopen);
4980 return;
4981 }
4982
4983 status = file_new(req, conn, &fsp);
4984 if(!NT_STATUS_IS_OK(status)) {
4985 reply_nterror(req, status);
4986 END_PROFILE(SMBsplopen);
4987 return;
4988 }
4989
4990 /* Open for exclusive use, write only. */
4991 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4992
4993 if (!NT_STATUS_IS_OK(status)) {
4994 file_free(req, fsp);
4995 reply_nterror(req, status);
4996 END_PROFILE(SMBsplopen);
4997 return;
4998 }
4999
5000 reply_outbuf(req, 1, 0);
5001 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5002
5003 DEBUG(3,("openprint fd=%d fnum=%d\n",
5004 fsp->fh->fd, fsp->fnum));
5005
5006 END_PROFILE(SMBsplopen);
5007 return;
5008 }
5009
5010 /****************************************************************************
5011 Reply to a printclose.
5012 ****************************************************************************/
5013
5014 void reply_printclose(struct smb_request *req)
5015 {
5016 connection_struct *conn = req->conn;
5017 files_struct *fsp;
5018 NTSTATUS status;
5019
5020 START_PROFILE(SMBsplclose);
5021
5022 if (req->wct < 1) {
5023 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5024 END_PROFILE(SMBsplclose);
5025 return;
5026 }
5027
5028 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5029
5030 if (!check_fsp(conn, req, fsp)) {
5031 END_PROFILE(SMBsplclose);
5032 return;
5033 }
5034
5035 if (!CAN_PRINT(conn)) {
5036 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
5037 END_PROFILE(SMBsplclose);
5038 return;
5039 }
5040
5041 DEBUG(3,("printclose fd=%d fnum=%d\n",
5042 fsp->fh->fd,fsp->fnum));
5043
5044 status = close_file(req, fsp, NORMAL_CLOSE);
5045
5046 if(!NT_STATUS_IS_OK(status)) {
5047 reply_nterror(req, status);
5048 END_PROFILE(SMBsplclose);
5049 return;
5050 }
5051
5052 reply_outbuf(req, 0, 0);
5053
5054 END_PROFILE(SMBsplclose);
5055 return;
5056 }
5057
5058 /****************************************************************************
5059 Reply to a printqueue.
5060 ****************************************************************************/
5061
5062 void reply_printqueue(struct smb_request *req)
5063 {
5064 connection_struct *conn = req->conn;
5065 int max_count;
5066 int start_index;
5067
5068 START_PROFILE(SMBsplretq);
5069
5070 if (req->wct < 2) {
5071 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5072 END_PROFILE(SMBsplretq);
5073 return;
5074 }
5075
5076 max_count = SVAL(req->vwv+0, 0);
5077 start_index = SVAL(req->vwv+1, 0);
5078
5079 /* we used to allow the client to get the cnum wrong, but that
5080 is really quite gross and only worked when there was only
5081 one printer - I think we should now only accept it if they
5082 get it right (tridge) */
5083 if (!CAN_PRINT(conn)) {
5084 reply_doserror(req, ERRDOS, ERRnoaccess);
5085 END_PROFILE(SMBsplretq);
5086 return;
5087 }
5088
5089 reply_outbuf(req, 2, 3);
5090 SSVAL(req->outbuf,smb_vwv0,0);
5091 SSVAL(req->outbuf,smb_vwv1,0);
5092 SCVAL(smb_buf(req->outbuf),0,1);
5093 SSVAL(smb_buf(req->outbuf),1,0);
5094
5095 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5096 start_index, max_count));
5097
5098 {
5099 print_queue_struct *queue = NULL;
5100 print_status_struct status;
5101 int count = print_queue_status(SNUM(conn), &queue, &status);
5102 int num_to_get = ABS(max_count);
5103 int first = (max_count>0?start_index:start_index+max_count+1);
5104 int i;
5105
5106 if (first >= count)
5107 num_to_get = 0;
5108 else
5109 num_to_get = MIN(num_to_get,count-first);
5110
5111
5112 for (i=first;i<first+num_to_get;i++) {
5113 char blob[28];
5114 char *p = blob;
5115
5116 srv_put_dos_date2(p,0,queue[i].time);
5117 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5118 SSVAL(p,5, queue[i].job);
5119 SIVAL(p,7,queue[i].size);
5120 SCVAL(p,11,0);
5121 srvstr_push(blob, req->flags2, p+12,
5122 queue[i].fs_user, 16, STR_ASCII);
5123
5124 if (message_push_blob(
5125 &req->outbuf,
5126 data_blob_const(
5127 blob, sizeof(blob))) == -1) {
5128 reply_nterror(req, NT_STATUS_NO_MEMORY);
5129 END_PROFILE(SMBsplretq);
5130 return;
5131 }
5132 }
5133
5134 if (count > 0) {
5135 SSVAL(req->outbuf,smb_vwv0,count);
5136 SSVAL(req->outbuf,smb_vwv1,
5137 (max_count>0?first+count:first-1));
5138 SCVAL(smb_buf(req->outbuf),0,1);
5139 SSVAL(smb_buf(req->outbuf),1,28*count);
5140 }
5141
5142 SAFE_FREE(queue);
5143
5144 DEBUG(3,("%d entries returned in queue\n",count));
5145 }
5146
5147 END_PROFILE(SMBsplretq);
5148 return;
5149 }
5150
5151 /****************************************************************************
5152 Reply to a printwrite.
5153 ****************************************************************************/
5154
5155 void reply_printwrite(struct smb_request *req)
5156 {
5157 connection_struct *conn = req->conn;
5158 int numtowrite;
5159 const char *data;
5160 files_struct *fsp;
5161
5162 START_PROFILE(SMBsplwr);
5163
5164 if (req->wct < 1) {
5165 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5166 END_PROFILE(SMBsplwr);
5167 return;
5168 }
5169
5170 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5171
5172 if (!check_fsp(conn, req, fsp)) {
5173 END_PROFILE(SMBsplwr);
5174 return;
5175 }
5176
5177 if (!CAN_PRINT(conn)) {
5178 reply_doserror(req, ERRDOS, ERRnoaccess);
5179 END_PROFILE(SMBsplwr);
5180 return;
5181 }
5182
5183 if (!CHECK_WRITE(fsp)) {
5184 reply_doserror(req, ERRDOS, ERRbadaccess);
5185 END_PROFILE(SMBsplwr);
5186 return;
5187 }
5188
5189 numtowrite = SVAL(req->buf, 1);
5190
5191 if (req->buflen < numtowrite + 3) {
5192 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5193 END_PROFILE(SMBsplwr);
5194 return;
5195 }
5196
5197 data = (const char *)req->buf + 3;
5198
5199 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5200 reply_unixerror(req, ERRHRD, ERRdiskfull);
5201 END_PROFILE(SMBsplwr);
5202 return;
5203 }
5204
5205 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5206
5207 END_PROFILE(SMBsplwr);
5208 return;
5209 }
5210
5211 /****************************************************************************
5212 Reply to a mkdir.
5213 ****************************************************************************/
5214
5215 void reply_mkdir(struct smb_request *req)
5216 {
5217 connection_struct *conn = req->conn;
5218 struct smb_filename *smb_dname = NULL;
5219 char *directory = NULL;
5220 NTSTATUS status;
5221 TALLOC_CTX *ctx = talloc_tos();
5222
5223 START_PROFILE(SMBmkdir);
5224
5225 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5226 STR_TERMINATE, &status);
5227 if (!NT_STATUS_IS_OK(status)) {
5228 reply_nterror(req, status);
5229 goto out;
5230 }
5231
5232 status = filename_convert(ctx, conn,
5233 req->flags2 & FLAGS2_DFS_PATHNAMES,
5234 directory,
5235 &smb_dname,
5236 NULL);
5237 if (!NT_STATUS_IS_OK(status)) {
5238 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5239 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5240 ERRSRV, ERRbadpath);
5241 goto out;
5242 }
5243 reply_nterror(req, status);
5244 goto out;
5245 }
5246
5247 status = create_directory(conn, req, smb_dname);
5248
5249 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5250
5251 if (!NT_STATUS_IS_OK(status)) {
5252
5253 if (!use_nt_status()
5254 && NT_STATUS_EQUAL(status,
5255 NT_STATUS_OBJECT_NAME_COLLISION)) {
5256 /*
5257 * Yes, in the DOS error code case we get a
5258 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5259 * samba4 torture test.
5260 */
5261 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5262 }
5263
5264 reply_nterror(req, status);
5265 goto out;
5266 }
5267
5268 reply_outbuf(req, 0, 0);
5269
5270 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5271 out:
5272 TALLOC_FREE(smb_dname);
5273 END_PROFILE(SMBmkdir);
5274 return;
5275 }
5276
5277 /****************************************************************************
5278 Static function used by reply_rmdir to delete an entire directory
5279 tree recursively. Return True on ok, False on fail.
5280 ****************************************************************************/
5281
5282 static bool recursive_rmdir(TALLOC_CTX *ctx,
5283 connection_struct *conn,
5284 struct smb_filename *smb_dname)
5285 {
5286 const char *dname = NULL;
5287 bool ret = True;
5288 long offset = 0;
5289 SMB_STRUCT_STAT st;
5290 struct smb_Dir *dir_hnd;
5291
5292 SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5293
5294 dir_hnd = OpenDir(talloc_tos(), conn, smb_dname->base_name, NULL, 0);
5295 if(dir_hnd == NULL)
5296 return False;
5297
5298 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5299 struct smb_filename *smb_dname_full = NULL;
5300 char *fullname = NULL;
5301 bool do_break = true;
5302 NTSTATUS status;
5303
5304 if (ISDOT(dname) || ISDOTDOT(dname)) {
5305 continue;
5306 }
5307
5308 if (!is_visible_file(conn, smb_dname->base_name, dname, &st,
5309 false)) {
5310 continue;
5311 }
5312
5313 /* Construct the full name. */
5314 fullname = talloc_asprintf(ctx,
5315 "%s/%s",
5316 smb_dname->base_name,
5317 dname);
5318 if (!fullname) {
5319 errno = ENOMEM;
5320 goto err_break;
5321 }
5322
5323 status = create_synthetic_smb_fname(talloc_tos(), fullname,
5324 NULL, NULL,
5325 &smb_dname_full);
5326 if (!NT_STATUS_IS_OK(status)) {
5327 goto err_break;
5328 }
5329
5330 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5331 goto err_break;
5332 }
5333
5334 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5335 if(!recursive_rmdir(ctx, conn, smb_dname_full)) {
5336 goto err_break;
5337 }
5338 if(SMB_VFS_RMDIR(conn,
5339 smb_dname_full->base_name) != 0) {
5340 goto err_break;
5341 }
5342 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5343 goto err_break;
5344 }
5345
5346 /* Successful iteration. */
5347 do_break = false;
5348
5349 err_break:
5350 TALLOC_FREE(smb_dname_full);
5351 TALLOC_FREE(fullname);
5352 if (do_break) {
5353 ret = false;
5354 break;
5355 }
5356 }
5357 TALLOC_FREE(dir_hnd);
5358 return ret;
5359 }
5360
5361 /****************************************************************************
5362 The internals of the rmdir code - called elsewhere.
5363 ****************************************************************************/
5364
5365 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5366 connection_struct *conn,
5367 struct smb_filename *smb_dname)
5368 {
5369 int ret;
5370 SMB_STRUCT_STAT st;
5371
5372 SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5373
5374 /* Might be a symlink. */
5375 if(SMB_VFS_LSTAT(conn, smb_dname) != 0) {
5376 return map_nt_error_from_unix(errno);
5377 }
5378
5379 if (S_ISLNK(smb_dname->st.st_ex_mode)) {
5380 /* Is what it points to a directory ? */
5381 if(SMB_VFS_STAT(conn, smb_dname) != 0) {
5382 return map_nt_error_from_unix(errno);
5383 }
5384 if (!(S_ISDIR(smb_dname->st.st_ex_mode))) {
5385 return NT_STATUS_NOT_A_DIRECTORY;
5386 }
5387 ret = SMB_VFS_UNLINK(conn, smb_dname);
5388 } else {
5389 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5390 }
5391 if (ret == 0) {
5392 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5393 FILE_NOTIFY_CHANGE_DIR_NAME,
5394 smb_dname->base_name);
5395 return NT_STATUS_OK;
5396 }
5397
5398 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5399 /*
5400 * Check to see if the only thing in this directory are
5401 * vetoed files/directories. If so then delete them and
5402 * retry. If we fail to delete any of them (and we *don't*
5403 * do a recursive delete) then fail the rmdir.
5404 */
5405 const char *dname;
5406 long dirpos = 0;
5407 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5408 smb_dname->base_name, NULL,
5409 0);
5410
5411 if(dir_hnd == NULL) {
5412 errno = ENOTEMPTY;
5413 goto err;
5414 }
5415
5416 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5417 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5418 continue;
5419 if (!is_visible_file(conn, smb_dname->base_name, dname,
5420 &st, false))
5421 continue;
5422 if(!IS_VETO_PATH(conn, dname)) {
5423 TALLOC_FREE(dir_hnd);
5424 errno = ENOTEMPTY;
5425 goto err;
5426 }
5427 }
5428
5429 /* We only have veto files/directories.
5430 * Are we allowed to delete them ? */
5431
5432 if(!lp_recursive_veto_delete(SNUM(conn))) {
5433 TALLOC_FREE(dir_hnd);
5434 errno = ENOTEMPTY;
5435 goto err;
5436 }
5437
5438 /* Do a recursive delete. */
5439 RewindDir(dir_hnd,&dirpos);
5440 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5441 struct smb_filename *smb_dname_full = NULL;
5442 char *fullname = NULL;
5443 bool do_break = true;
5444 NTSTATUS status;
5445
5446 if (ISDOT(dname) || ISDOTDOT(dname)) {
5447 continue;
5448 }
5449 if (!is_visible_file(conn, smb_dname->base_name, dname,
5450 &st, false)) {
5451 continue;
5452 }
5453
5454 fullname = talloc_asprintf(ctx,
5455 "%s/%s",
5456 smb_dname->base_name,
5457 dname);
5458
5459 if(!fullname) {
5460 errno = ENOMEM;
5461 goto err_break;
5462 }
5463
5464 status = create_synthetic_smb_fname(talloc_tos(),
5465 fullname, NULL,
5466 NULL,
5467 &smb_dname_full);
5468 if (!NT_STATUS_IS_OK(status)) {
5469 errno = map_errno_from_nt_status(status);
5470 goto err_break;
5471 }
5472
5473 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5474 goto err_break;
5475 }
5476 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5477 if(!recursive_rmdir(ctx, conn,
5478 smb_dname_full)) {
5479 goto err_break;
5480 }
5481 if(SMB_VFS_RMDIR(conn,
5482 smb_dname_full->base_name) != 0) {
5483 goto err_break;
5484 }
5485 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5486 goto err_break;
5487 }
5488
5489 /* Successful iteration. */
5490 do_break = false;
5491
5492 err_break:
5493 TALLOC_FREE(fullname);
5494 TALLOC_FREE(smb_dname_full);
5495 if (do_break)
5496 break;
5497 }
5498 TALLOC_FREE(dir_hnd);
5499 /* Retry the rmdir */
5500 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5501 }
5502
5503 err:
5504
5505 if (ret != 0) {
5506 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5507 "%s\n", smb_fname_str_dbg(smb_dname),
5508 strerror(errno)));
5509 return map_nt_error_from_unix(errno);
5510 }
5511
5512 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5513 FILE_NOTIFY_CHANGE_DIR_NAME,
5514 smb_dname->base_name);
5515
5516 return NT_STATUS_OK;
5517 }
5518
5519 /****************************************************************************
5520 Reply to a rmdir.
5521 ****************************************************************************/
5522
5523 void reply_rmdir(struct smb_request *req)
5524 {
5525 connection_struct *conn = req->conn;
5526 struct smb_filename *smb_dname = NULL;
5527 char *directory = NULL;
5528 NTSTATUS status;
5529 TALLOC_CTX *ctx = talloc_tos();
5530
5531 START_PROFILE(SMBrmdir);
5532
5533 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5534 STR_TERMINATE, &status);
5535 if (!NT_STATUS_IS_OK(status)) {
5536 reply_nterror(req, status);
5537 goto out;
5538 }
5539
5540 status = filename_convert(ctx, conn,
5541 req->flags2 & FLAGS2_DFS_PATHNAMES,
5542 directory,
5543 &smb_dname,
5544 NULL);
5545 if (!NT_STATUS_IS_OK(status)) {
5546 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5547 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5548 ERRSRV, ERRbadpath);
5549 goto out;
5550 }
5551 reply_nterror(req, status);
5552 goto out;
5553 }
5554
5555 if (is_ntfs_stream_smb_fname(smb_dname)) {
5556 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5557 goto out;
5558 }
5559
5560 dptr_closepath(smb_dname->base_name, req->smbpid);
5561 status = rmdir_internals(ctx, conn, smb_dname);
5562 if (!NT_STATUS_IS_OK(status)) {
5563 reply_nterror(req, status);
5564 goto out;
5565 }
5566
5567 reply_outbuf(req, 0, 0);
5568
5569 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5570 out:
5571 TALLOC_FREE(smb_dname);
5572 END_PROFILE(SMBrmdir);
5573 return;
5574 }
5575
5576 /*******************************************************************
5577 Resolve wildcards in a filename rename.
5578 ********************************************************************/
5579
5580 static bool resolve_wildcards(TALLOC_CTX *ctx,
5581 const char *name1,
5582 const char *name2,
5583 char **pp_newname)
5584 {
5585 char *name2_copy = NULL;
5586 char *root1 = NULL;
5587 char *root2 = NULL;
5588 char *ext1 = NULL;
5589 char *ext2 = NULL;
5590 char *p,*p2, *pname1, *pname2;
5591
5592 name2_copy = talloc_strdup(ctx, name2);
5593 if (!name2_copy) {
5594 return False;
5595 }
5596
5597 pname1 = strrchr_m(name1,'/');
5598 pname2 = strrchr_m(name2_copy,'/');
5599
5600 if (!pname1 || !pname2) {
5601 return False;
5602 }
5603
5604 /* Truncate the copy of name2 at the last '/' */
5605 *pname2 = '\0';
5606
5607 /* Now go past the '/' */
5608 pname1++;
5609 pname2++;
5610
5611 root1 = talloc_strdup(ctx, pname1);
5612 root2 = talloc_strdup(ctx, pname2);
5613
5614 if (!root1 || !root2) {
5615 return False;
5616 }
5617
5618 p = strrchr_m(root1,'.');
5619 if (p) {
5620 *p = 0;
5621 ext1 = talloc_strdup(ctx, p+1);
5622 } else {
5623 ext1 = talloc_strdup(ctx, "");
5624 }
5625 p = strrchr_m(root2,'.');
5626 if (p) {
5627 *p = 0;
5628 ext2 = talloc_strdup(ctx, p+1);
5629 } else {
5630 ext2 = talloc_strdup(ctx, "");
5631 }
5632
5633 if (!ext1 || !ext2) {
5634 return False;
5635 }
5636
5637 p = root1;
5638 p2 = root2;
5639 while (*p2) {
5640 if (*p2 == '?') {
5641 /* Hmmm. Should this be mb-aware ? */
5642 *p2 = *p;
5643 p2++;
5644 } else if (*p2 == '*') {
5645 *p2 = '\0';
5646 root2 = talloc_asprintf(ctx, "%s%s",
5647 root2,
5648 p);
5649 if (!root2) {
5650 return False;
5651 }
5652 break;
5653 } else {
5654 p2++;
5655 }
5656 if (*p) {
5657 p++;
5658 }
5659 }
5660
5661 p = ext1;
5662 p2 = ext2;
5663 while (*p2) {
5664 if (*p2 == '?') {
5665 /* Hmmm. Should this be mb-aware ? */
5666 *p2 = *p;
5667 p2++;
5668 } else if (*p2 == '*') {
5669 *p2 = '\0';
5670 ext2 = talloc_asprintf(ctx, "%s%s",
5671 ext2,
5672 p);
5673 if (!ext2) {
5674 return False;
5675 }
5676 break;
5677 } else {
5678 p2++;
5679 }
5680 if (*p) {
5681 p++;
5682 }
5683 }
5684
5685 if (*ext2) {
5686 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5687 name2_copy,
5688 root2,
5689 ext2);
5690 } else {
5691 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5692 name2_copy,
5693 root2);
5694 }
5695
5696 if (!*pp_newname) {
5697 return False;
5698 }
5699
5700 return True;
5701 }
5702
5703 /****************************************************************************
5704 Ensure open files have their names updated. Updated to notify other smbd's
5705 asynchronously.
5706 ****************************************************************************/
5707
5708 static void rename_open_files(connection_struct *conn,
5709 struct share_mode_lock *lck,
5710 const struct smb_filename *smb_fname_dst)
5711 {
5712 files_struct *fsp;
5713 bool did_rename = False;
5714 char *fname_dst = NULL;
5715 NTSTATUS status;
5716
5717 for(fsp = file_find_di_first(lck->id); fsp;
5718 fsp = file_find_di_next(fsp)) {
5719 /* fsp_name is a relative path under the fsp. To change this for other
5720 sharepaths we need to manipulate relative paths. */
5721 /* TODO - create the absolute path and manipulate the newname
5722 relative to the sharepath. */
5723 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5724 continue;
5725 }
5726 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5727 "(file_id %s) from %s -> %s\n", fsp->fnum,
5728 file_id_string_tos(&fsp->file_id), fsp->fsp_name,
5729 smb_fname_str_dbg(smb_fname_dst)));
5730
5731 status = get_full_smb_filename(talloc_tos(), smb_fname_dst,
5732 &fname_dst);
5733 if (!NT_STATUS_IS_OK(status)) {
5734 return;
5735 }
5736 string_set(&fsp->fsp_name, fname_dst);
5737 did_rename = True;
5738 TALLOC_FREE(fname_dst);
5739 }
5740
5741 if (!did_rename) {
5742 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5743 "for %s\n", file_id_string_tos(&lck->id),
5744 smb_fname_str_dbg(smb_fname_dst)));
5745 }
5746
5747 /* Send messages to all smbd's (not ourself) that the name has changed. */
5748 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5749 smb_fname_dst);
5750
5751 }
5752
5753 /****************************************************************************
5754 We need to check if the source path is a parent directory of the destination
5755 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5756 refuse the rename with a sharing violation. Under UNIX the above call can
5757 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5758 probably need to check that the client is a Windows one before disallowing
5759 this as a UNIX client (one with UNIX extensions) can know the source is a
5760 symlink and make this decision intelligently. Found by an excellent bug
5761 report from <AndyLiebman@aol.com>.
5762 ****************************************************************************/
5763
5764 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5765 const struct smb_filename *smb_fname_dst)
5766 {
5767 const char *psrc = smb_fname_src->base_name;
5768 const char *pdst = smb_fname_dst->base_name;
5769 size_t slen;
5770
5771 if (psrc[0] == '.' && psrc[1] == '/') {
5772 psrc += 2;
5773 }
5774 if (pdst[0] == '.' && pdst[1] == '/') {
5775 pdst += 2;
5776 }
5777 if ((slen = strlen(psrc)) > strlen(pdst)) {
5778 return False;
5779 }
5780 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5781 }
5782
5783 /*
5784 * Do the notify calls from a rename
5785 */
5786
5787 static void notify_rename(connection_struct *conn, bool is_dir,
5788 const struct smb_filename *smb_fname_src,
5789 const struct smb_filename *smb_fname_dst)
5790 {
5791 char *parent_dir_src = NULL;
5792 char *parent_dir_dst = NULL;
5793 char *fname_src = NULL;
5794 char *fname_dst = NULL;
5795 NTSTATUS status;
5796 uint32 mask;
5797
5798 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5799 : FILE_NOTIFY_CHANGE_FILE_NAME;
5800
5801 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5802 &parent_dir_src, NULL) ||
5803 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5804 &parent_dir_dst, NULL)) {
5805 goto out;
5806 }
5807
5808 status = get_full_smb_filename(talloc_tos(), smb_fname_src,
5809 &fname_src);
5810 if (!NT_STATUS_IS_OK(status)) {
5811 goto out;
5812 }
5813 status = get_full_smb_filename(talloc_tos(), smb_fname_dst,
5814 &fname_dst);
5815 if (!NT_STATUS_IS_OK(status)) {
5816 goto out;
5817 }
5818
5819 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5820 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, fname_src);
5821 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, fname_dst);
5822 }
5823 else {
5824 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, fname_src);
5825 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, fname_dst);
5826 }
5827
5828 /* this is a strange one. w2k3 gives an additional event for
5829 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5830 files, but not directories */
5831 if (!is_dir) {
5832 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5833 FILE_NOTIFY_CHANGE_ATTRIBUTES
5834 |FILE_NOTIFY_CHANGE_CREATION,
5835 fname_dst);
5836 }
5837 out:
5838 TALLOC_FREE(parent_dir_src);
5839 TALLOC_FREE(parent_dir_dst);
5840 TALLOC_FREE(fname_src);
5841 TALLOC_FREE(fname_dst);
5842 }
5843
5844 /****************************************************************************
5845 Rename an open file - given an fsp.
5846 ****************************************************************************/
5847
5848 NTSTATUS rename_internals_fsp(connection_struct *conn,
5849 files_struct *fsp,
5850 const struct smb_filename *smb_fname_dst_in,
5851 uint32 attrs,
5852 bool replace_if_exists)
5853 {
5854 TALLOC_CTX *ctx = talloc_tos();
5855 struct smb_filename *smb_fname_src = NULL;
5856 struct smb_filename *smb_fname_dst = NULL;
5857 SMB_STRUCT_STAT sbuf;
5858 NTSTATUS status = NT_STATUS_OK;
5859 struct share_mode_lock *lck = NULL;
5860 bool dst_exists, old_is_stream, new_is_stream;
5861
5862 ZERO_STRUCT(sbuf);
5863
5864 status = check_name(conn, smb_fname_dst_in->base_name);
5865 if (!NT_STATUS_IS_OK(status)) {
5866 return status;
5867 }
5868
5869 /* Make a copy of the src and dst smb_fname structs */
5870 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5871 if (!NT_STATUS_IS_OK(status)) {
5872 goto out;
5873 }
5874
5875 /*
5876 * This will be replaced with copy_smb_filename() when fsp->fsp_name
5877 * is converted to store an smb_filename struct.
5878 */
5879 status = create_synthetic_smb_fname_split(ctx, fsp->fsp_name, NULL,
5880 &smb_fname_src);
5881 if (!NT_STATUS_IS_OK(status)) {
5882 goto out;
5883 }
5884
5885 /* Ensure the dst smb_fname contains a '/' */
5886 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5887 char * tmp;
5888 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5889 smb_fname_dst->base_name);
5890 if (!tmp) {
5891 status = NT_STATUS_NO_MEMORY;
5892 goto out;
5893 }
5894 TALLOC_FREE(smb_fname_dst->base_name);
5895 smb_fname_dst->base_name = tmp;
5896 }
5897
5898 /*
5899 * Check for special case with case preserving and not
5900 * case sensitive. If the old last component differs from the original
5901 * last component only by case, then we should allow
5902 * the rename (user is trying to change the case of the
5903 * filename).
5904 */
5905 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5906 strequal(smb_fname_src->base_name, smb_fname_dst->base_name) &&
5907 strequal(smb_fname_src->stream_name, smb_fname_dst->stream_name)) {
5908 char *last_slash;
5909 char *fname_dst_lcomp_base_mod = NULL;
5910 struct smb_filename *smb_fname_orig_lcomp = NULL;
5911
5912 /*
5913 * Get the last component of the destination name. Note that
5914 * we guarantee that destination name contains a '/' character
5915 * above.
5916 */
5917 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5918 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5919 if (!fname_dst_lcomp_base_mod) {
5920 status = NT_STATUS_NO_MEMORY;
5921 goto out;
5922 }
5923
5924 /*
5925 * Create an smb_filename struct using the original last
5926 * component of the destination.
5927 */
5928 status = create_synthetic_smb_fname_split(ctx,
5929 smb_fname_dst->original_lcomp, NULL,
5930 &smb_fname_orig_lcomp);
5931 if (!NT_STATUS_IS_OK(status)) {
5932 TALLOC_FREE(fname_dst_lcomp_base_mod);
5933 goto out;
5934 }
5935
5936 /* If the base names only differ by case, use original. */
5937 if(!strcsequal(fname_dst_lcomp_base_mod,
5938 smb_fname_orig_lcomp->base_name)) {
5939 char *tmp;
5940 /*
5941 * Replace the modified last component with the
5942 * original.
5943 */
5944 *last_slash = '\0'; /* Truncate at the '/' */
5945 tmp = talloc_asprintf(smb_fname_dst,
5946 "%s/%s",
5947 smb_fname_dst->base_name,
5948 smb_fname_orig_lcomp->base_name);
5949 if (tmp == NULL) {
5950 status = NT_STATUS_NO_MEMORY;
5951 TALLOC_FREE(fname_dst_lcomp_base_mod);
5952 TALLOC_FREE(smb_fname_orig_lcomp);
5953 goto out;
5954 }
5955 TALLOC_FREE(smb_fname_dst->base_name);
5956 smb_fname_dst->base_name = tmp;
5957 }
5958
5959 /* If the stream_names only differ by case, use original. */
5960 if(!strcsequal(smb_fname_dst->stream_name,
5961 smb_fname_orig_lcomp->stream_name)) {
5962 char *tmp = NULL;
5963 /* Use the original stream. */
5964 tmp = talloc_strdup(smb_fname_dst,
5965 smb_fname_orig_lcomp->stream_name);
5966 if (tmp == NULL) {
5967 status = NT_STATUS_NO_MEMORY;
5968 TALLOC_FREE(fname_dst_lcomp_base_mod);
5969 TALLOC_FREE(smb_fname_orig_lcomp);
5970 goto out;
5971 }
5972 TALLOC_FREE(smb_fname_dst->stream_name);
5973 smb_fname_dst->stream_name = tmp;
5974 }
5975 TALLOC_FREE(fname_dst_lcomp_base_mod);
5976 TALLOC_FREE(smb_fname_orig_lcomp);
5977 }
5978
5979 /*
5980 * If the src and dest names are identical - including case,
5981 * don't do the rename, just return success.
5982 */
5983
5984 if (strcsequal(smb_fname_src->base_name, smb_fname_dst->base_name) &&
5985 strcsequal(smb_fname_src->stream_name,
5986 smb_fname_dst->stream_name)) {
5987 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5988 "- returning success\n",
5989 smb_fname_str_dbg(smb_fname_dst)));
5990 status = NT_STATUS_OK;
5991 goto out;
5992 }
5993
5994 old_is_stream = is_ntfs_stream_smb_fname(smb_fname_src);
5995 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5996
5997 /* Return the correct error code if both names aren't streams. */
5998 if (!old_is_stream && new_is_stream) {
5999 status = NT_STATUS_OBJECT_NAME_INVALID;
6000 goto out;
6001 }
6002
6003 if (old_is_stream && !new_is_stream) {
6004 status = NT_STATUS_INVALID_PARAMETER;
6005 goto out;
6006 }
6007
6008 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6009
6010 if(!replace_if_exists && dst_exists) {
6011 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6012 "%s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6013 smb_fname_str_dbg(smb_fname_dst)));
6014 status = NT_STATUS_OBJECT_NAME_COLLISION;
6015 goto out;
6016 }
6017
6018 if (dst_exists) {
6019 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6020 &smb_fname_dst->st);
6021 files_struct *dst_fsp = file_find_di_first(fileid);
6022 /* The file can be open when renaming a stream */
6023 if (dst_fsp && !new_is_stream) {
6024 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6025 status = NT_STATUS_ACCESS_DENIED;
6026 goto out;
6027 }
6028 }
6029
6030 /* Ensure we have a valid stat struct for the source. */
6031 if (fsp->fh->fd != -1) {
6032 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
6033 status = map_nt_error_from_unix(errno);
6034 goto out;
6035 }
6036 } else {
6037 int ret = -1;
6038 if (fsp->posix_open) {
6039 ret = SMB_VFS_LSTAT(conn, smb_fname_src);
6040 } else {
6041
6042 ret = SMB_VFS_STAT(conn, smb_fname_src);
6043 }
6044 if (ret == -1) {
6045 status = map_nt_error_from_unix(errno);
6046 goto out;
6047 }
6048 sbuf = smb_fname_src->st;
6049 }
6050
6051 status = can_rename(conn, fsp, attrs, &sbuf);
6052
6053 if (!NT_STATUS_IS_OK(status)) {
6054 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6055 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6056 smb_fname_str_dbg(smb_fname_dst)));
6057 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6058 status = NT_STATUS_ACCESS_DENIED;
6059 goto out;
6060 }
6061
6062 if (rename_path_prefix_equal(smb_fname_src, smb_fname_dst)) {
6063 status = NT_STATUS_ACCESS_DENIED;
6064 }
6065
6066 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6067 NULL);
6068
6069 /*
6070 * We have the file open ourselves, so not being able to get the
6071 * corresponding share mode lock is a fatal error.
6072 */
6073
6074 SMB_ASSERT(lck != NULL);
6075
6076 if(SMB_VFS_RENAME(conn, smb_fname_src, smb_fname_dst) == 0) {
6077 uint32 create_options = fsp->fh->private_options;
6078
6079 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6080 "%s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6081 smb_fname_str_dbg(smb_fname_dst)));
6082
6083 notify_rename(conn, fsp->is_directory, smb_fname_src,
6084 smb_fname_dst);
6085
6086 rename_open_files(conn, lck, smb_fname_dst);
6087
6088 /*
6089 * A rename acts as a new file create w.r.t. allowing an initial delete
6090 * on close, probably because in Windows there is a new handle to the
6091 * new file. If initial delete on close was requested but not
6092 * originally set, we need to set it here. This is probably not 100% correct,
6093 * but will work for the CIFSFS client which in non-posix mode
6094 * depends on these semantics. JRA.
6095 */
6096
6097 if (create_options & FILE_DELETE_ON_CLOSE) {
6098 status = can_set_delete_on_close(fsp, True, 0);
6099
6100 if (NT_STATUS_IS_OK(status)) {
6101 /* Note that here we set the *inital* delete on close flag,
6102 * not the regular one. The magic gets handled in close. */
6103 fsp->initial_delete_on_close = True;
6104 }
6105 }
6106 TALLOC_FREE(lck);
6107 status = NT_STATUS_OK;
6108 goto out;
6109 }
6110
6111 TALLOC_FREE(lck);
6112
6113 if (errno == ENOTDIR || errno == EISDIR) {
6114 status = NT_STATUS_OBJECT_NAME_COLLISION;
6115 } else {
6116 status = map_nt_error_from_unix(errno);
6117 }
6118
6119 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6120 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6121 smb_fname_str_dbg(smb_fname_dst)));
6122
6123 out:
6124 TALLOC_FREE(smb_fname_src);
6125 TALLOC_FREE(smb_fname_dst);
6126
6127 return status;
6128 }
6129
6130 /****************************************************************************
6131 The guts of the rename command, split out so it may be called by the NT SMB
6132 code.
6133 ****************************************************************************/
6134
6135 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6136 connection_struct *conn,
6137 struct smb_request *req,
6138 const char *name_in,
6139 const char *newname_in,
6140 uint32 attrs,
6141 bool replace_if_exists,
6142 bool src_has_wild,
6143 bool dest_has_wild,
6144 uint32_t access_mask)
6145 {
6146 struct smb_filename *smb_fname_src = NULL;
6147 struct smb_filename *smb_fname_dst = NULL;
6148 char *fname_src_dir = NULL;
6149 char *fname_src_mask = NULL;
6150 int count=0;
6151 NTSTATUS status = NT_STATUS_OK;
6152 struct smb_Dir *dir_hnd = NULL;
6153 const char *dname;
6154 long offset = 0;
6155 int create_options = 0;
6156 bool posix_pathnames = lp_posix_pathnames();
6157
6158 status = unix_convert(ctx, conn, name_in, &smb_fname_src,
6159 src_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
6160 if (!NT_STATUS_IS_OK(status)) {
6161 goto out;
6162 }
6163
6164 status = unix_convert(ctx, conn, newname_in, &smb_fname_dst,
6165 (UCF_SAVE_LCOMP |
6166 (dest_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0)));
6167 if (!NT_STATUS_IS_OK(status)) {
6168 goto out;
6169 }
6170
6171 /*
6172 * Split the old name into directory and last component
6173 * strings. Note that unix_convert may have stripped off a
6174 * leading ./ from both name and newname if the rename is
6175 * at the root of the share. We need to make sure either both
6176 * name and newname contain a / character or neither of them do
6177 * as this is checked in resolve_wildcards().
6178 */
6179
6180 /* Split up the directory from the filename/mask. */
6181 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6182 &fname_src_dir, &fname_src_mask);
6183 if (!NT_STATUS_IS_OK(status)) {
6184 status = NT_STATUS_NO_MEMORY;
6185 goto out;
6186 }
6187
6188 /*
6189 * We should only check the mangled cache
6190 * here if unix_convert failed. This means
6191 * that the path in 'mask' doesn't exist
6192 * on the file system and so we need to look
6193 * for a possible mangle. This patch from
6194 * Tine Smukavec <valentin.smukavec@hermes.si>.
6195 */
6196
6197 if (!VALID_STAT(smb_fname_src->st) &&
6198 mangle_is_mangled(fname_src_mask, conn->params)) {
6199 char *new_mask = NULL;
6200 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6201 conn->params);
6202 if (new_mask) {
6203 TALLOC_FREE(fname_src_mask);
6204 fname_src_mask = new_mask;
6205 }
6206 }
6207
6208 if (!src_has_wild) {
6209 files_struct *fsp;
6210
6211 /*
6212 * Only one file needs to be renamed. Append the mask back
6213 * onto the directory.
6214 */
6215 TALLOC_FREE(smb_fname_src->base_name);
6216 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6217 "%s/%s",
6218 fname_src_dir,
6219 fname_src_mask);
6220 if (!smb_fname_src->base_name) {
6221 status = NT_STATUS_NO_MEMORY;
6222 goto out;
6223 }
6224
6225 /* Ensure dst fname contains a '/' also */
6226 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6227 char *tmp;
6228 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6229 smb_fname_dst->base_name);
6230 if (!tmp) {
6231 status = NT_STATUS_NO_MEMORY;
6232 goto out;
6233 }
6234 TALLOC_FREE(smb_fname_dst->base_name);
6235 smb_fname_dst->base_name = tmp;
6236 }
6237
6238 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6239 "case_preserve = %d, short case preserve = %d, "
6240 "directory = %s, newname = %s, "
6241 "last_component_dest = %s\n",
6242 conn->case_sensitive, conn->case_preserve,
6243 conn->short_case_preserve,
6244 smb_fname_str_dbg(smb_fname_src),
6245 smb_fname_str_dbg(smb_fname_dst),
6246 smb_fname_dst->original_lcomp));
6247
6248 /* The dest name still may have wildcards. */
6249 if (dest_has_wild) {
6250 char *fname_dst_mod = NULL;
6251 if (!resolve_wildcards(smb_fname_dst,
6252 smb_fname_src->base_name,
6253 smb_fname_dst->base_name,
6254 &fname_dst_mod)) {
6255 DEBUG(6, ("rename_internals: resolve_wildcards "
6256 "%s %s failed\n",
6257 smb_fname_src->base_name,
6258 smb_fname_dst->base_name));
6259 status = NT_STATUS_NO_MEMORY;
6260 goto out;
6261 }
6262 TALLOC_FREE(smb_fname_dst->base_name);
6263 smb_fname_dst->base_name = fname_dst_mod;
6264 }
6265
6266 ZERO_STRUCT(smb_fname_src->st);
6267 if (posix_pathnames) {
6268 SMB_VFS_LSTAT(conn, smb_fname_src);
6269 } else {
6270 SMB_VFS_STAT(conn, smb_fname_src);
6271 }
6272
6273 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6274 create_options |= FILE_DIRECTORY_FILE;
6275 }
6276
6277 status = SMB_VFS_CREATE_FILE(
6278 conn, /* conn */
6279 req, /* req */
6280 0, /* root_dir_fid */
6281 smb_fname_src, /* fname */
6282 access_mask, /* access_mask */
6283 (FILE_SHARE_READ | /* share_access */
6284 FILE_SHARE_WRITE),
6285 FILE_OPEN, /* create_disposition*/
6286 create_options, /* create_options */
6287 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6288 0, /* oplock_request */
6289 0, /* allocation_size */
6290 NULL, /* sd */
6291 NULL, /* ea_list */
6292 &fsp, /* result */
6293 NULL); /* pinfo */
6294
6295 if (!NT_STATUS_IS_OK(status)) {
6296 DEBUG(3, ("Could not open rename source %s: %s\n",
6297 smb_fname_str_dbg(smb_fname_src),
6298 nt_errstr(status)));
6299 goto out;
6300 }
6301
6302 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6303 attrs, replace_if_exists);
6304
6305 close_file(req, fsp, NORMAL_CLOSE);
6306
6307 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6308 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6309 smb_fname_str_dbg(smb_fname_dst)));
6310
6311 goto out;
6312 }
6313
6314 /*
6315 * Wildcards - process each file that matches.
6316 */
6317 if (strequal(fname_src_mask, "????????.???")) {
6318 TALLOC_FREE(fname_src_mask);
6319 fname_src_mask = talloc_strdup(ctx, "*");
6320 if (!fname_src_mask) {
6321 status = NT_STATUS_NO_MEMORY;
6322 goto out;
6323 }
6324 }
6325
6326 status = check_name(conn, fname_src_dir);
6327 if (!NT_STATUS_IS_OK(status)) {
6328 goto out;
6329 }
6330
6331 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6332 attrs);
6333 if (dir_hnd == NULL) {
6334 status = map_nt_error_from_unix(errno);
6335 goto out;
6336 }
6337
6338 status = NT_STATUS_NO_SUCH_FILE;
6339 /*
6340 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6341 * - gentest fix. JRA
6342 */
6343
6344 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st))) {
6345 files_struct *fsp = NULL;
6346 char *destname = NULL;
6347 bool sysdir_entry = False;
6348
6349 /* Quick check for "." and ".." */
6350 if (ISDOT(dname) || ISDOTDOT(dname)) {
6351 if (attrs & aDIR) {
6352 sysdir_entry = True;
6353 } else {
6354 continue;
6355 }
6356 }
6357
6358 if (!is_visible_file(conn, fname_src_dir, dname,
6359 &smb_fname_src->st, false)) {
6360 continue;
6361 }
6362
6363 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6364 continue;
6365 }
6366
6367 if (sysdir_entry) {
6368 status = NT_STATUS_OBJECT_NAME_INVALID;
6369 break;
6370 }
6371
6372 TALLOC_FREE(smb_fname_src->base_name);
6373 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6374 "%s/%s",
6375 fname_src_dir,
6376 dname);
6377 if (!smb_fname_src->base_name) {
6378 status = NT_STATUS_NO_MEMORY;
6379 goto out;
6380 }
6381
6382 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6383 smb_fname_dst->base_name,
6384 &destname)) {
6385 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6386 smb_fname_src->base_name, destname));
6387 continue;
6388 }
6389 if (!destname) {
6390 status = NT_STATUS_NO_MEMORY;
6391 goto out;
6392 }
6393
6394 TALLOC_FREE(smb_fname_dst->base_name);
6395 smb_fname_dst->base_name = destname;
6396
6397 ZERO_STRUCT(smb_fname_src->st);
6398 if (posix_pathnames) {
6399 SMB_VFS_LSTAT(conn, smb_fname_src);
6400 } else {
6401 SMB_VFS_STAT(conn, smb_fname_src);
6402 }
6403
6404 create_options = 0;
6405
6406 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6407 create_options |= FILE_DIRECTORY_FILE;
6408 }
6409
6410 status = SMB_VFS_CREATE_FILE(
6411 conn, /* conn */
6412 req, /* req */
6413 0, /* root_dir_fid */
6414 smb_fname_src, /* fname */
6415 access_mask, /* access_mask */
6416 (FILE_SHARE_READ | /* share_access */
6417 FILE_SHARE_WRITE),
6418 FILE_OPEN, /* create_disposition*/
6419 create_options, /* create_options */
6420 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6421 0, /* oplock_request */
6422 0, /* allocation_size */
6423 NULL, /* sd */
6424 NULL, /* ea_list */
6425 &fsp, /* result */
6426 NULL); /* pinfo */
6427
6428 if (!NT_STATUS_IS_OK(status)) {
6429 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6430 "returned %s rename %s -> %s\n",
6431 nt_errstr(status),
6432 smb_fname_str_dbg(smb_fname_src),
6433 smb_fname_str_dbg(smb_fname_dst)));
6434 break;
6435 }
6436
6437 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6438 dname);
6439 if (!smb_fname_dst->original_lcomp) {
6440 status = NT_STATUS_NO_MEMORY;
6441 goto out;
6442 }
6443
6444 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6445 attrs, replace_if_exists);
6446
6447 close_file(req, fsp, NORMAL_CLOSE);
6448
6449 if (!NT_STATUS_IS_OK(status)) {
6450 DEBUG(3, ("rename_internals_fsp returned %s for "
6451 "rename %s -> %s\n", nt_errstr(status),
6452 smb_fname_str_dbg(smb_fname_src),
6453 smb_fname_str_dbg(smb_fname_dst)));
6454 break;
6455 }
6456
6457 count++;
6458
6459 DEBUG(3,("rename_internals: doing rename on %s -> "
6460 "%s\n", smb_fname_str_dbg(smb_fname_src),
6461 smb_fname_str_dbg(smb_fname_src)));
6462
6463 }
6464 TALLOC_FREE(dir_hnd);
6465
6466 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6467 status = map_nt_error_from_unix(errno);
6468 }
6469
6470 out:
6471 TALLOC_FREE(smb_fname_src);
6472 TALLOC_FREE(smb_fname_dst);
6473 TALLOC_FREE(fname_src_dir);
6474 TALLOC_FREE(fname_src_mask);
6475 return status;
6476 }
6477
6478 /****************************************************************************
6479 Reply to a mv.
6480 ****************************************************************************/
6481
6482 void reply_mv(struct smb_request *req)
6483 {
6484 connection_struct *conn = req->conn;
6485 char *name = NULL;
6486 char *newname = NULL;
6487 const char *p;
6488 uint32 attrs;
6489 NTSTATUS status;
6490 bool src_has_wcard = False;
6491 bool dest_has_wcard = False;
6492 TALLOC_CTX *ctx = talloc_tos();
6493
6494 START_PROFILE(SMBmv);
6495
6496 if (req->wct < 1) {
6497 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6498 END_PROFILE(SMBmv);
6499 return;
6500 }
6501
6502 attrs = SVAL(req->vwv+0, 0);
6503
6504 p = (const char *)req->buf + 1;
6505 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6506 &status, &src_has_wcard);
6507 if (!NT_STATUS_IS_OK(status)) {
6508 reply_nterror(req, status);
6509 END_PROFILE(SMBmv);
6510 return;
6511 }
6512 p++;
6513 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6514 &status, &dest_has_wcard);
6515 if (!NT_STATUS_IS_OK(status)) {
6516 reply_nterror(req, status);
6517 END_PROFILE(SMBmv);
6518 return;
6519 }
6520
6521 status = resolve_dfspath_wcard(ctx, conn,
6522 req->flags2 & FLAGS2_DFS_PATHNAMES,
6523 name,
6524 &name,
6525 &src_has_wcard);
6526 if (!NT_STATUS_IS_OK(status)) {
6527 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6528 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6529 ERRSRV, ERRbadpath);
6530 END_PROFILE(SMBmv);
6531 return;
6532 }
6533 reply_nterror(req, status);
6534 END_PROFILE(SMBmv);
6535 return;
6536 }
6537
6538 status = resolve_dfspath_wcard(ctx, conn,
6539 req->flags2 & FLAGS2_DFS_PATHNAMES,
6540 newname,
6541 &newname,
6542 &dest_has_wcard);
6543 if (!NT_STATUS_IS_OK(status)) {
6544 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6545 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6546 ERRSRV, ERRbadpath);
6547 END_PROFILE(SMBmv);
6548 return;
6549 }
6550 reply_nterror(req, status);
6551 END_PROFILE(SMBmv);
6552 return;
6553 }
6554
6555 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6556
6557 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6558 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6559 if (!NT_STATUS_IS_OK(status)) {
6560 if (open_was_deferred(req->mid)) {
6561 /* We have re-scheduled this call. */
6562 END_PROFILE(SMBmv);
6563 return;
6564 }
6565 reply_nterror(req, status);
6566 END_PROFILE(SMBmv);
6567 return;
6568 }
6569
6570 reply_outbuf(req, 0, 0);
6571
6572 END_PROFILE(SMBmv);
6573 return;
6574 }
6575
6576 /*******************************************************************
6577 Copy a file as part of a reply_copy.
6578 ******************************************************************/
6579
6580 /*
6581 * TODO: check error codes on all callers
6582 */
6583
6584 NTSTATUS copy_file(TALLOC_CTX *ctx,
6585 connection_struct *conn,
6586 struct smb_filename *smb_fname_src,
6587 struct smb_filename *smb_fname_dst,
6588 int ofun,
6589 int count,
6590 bool target_is_directory)
6591 {
6592 struct smb_filename *smb_fname_dst_tmp = NULL;
6593 SMB_OFF_T ret=-1;
6594 files_struct *fsp1,*fsp2;
6595 uint32 dosattrs;
6596 uint32 new_create_disposition;
6597 NTSTATUS status;
6598
6599
6600 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6601 if (!NT_STATUS_IS_OK(status)) {
6602 return status;
6603 }
6604
6605 /*
6606 * If the target is a directory, extract the last component from the
6607 * src filename and append it to the dst filename
6608 */
6609 if (target_is_directory) {
6610 const char *p;
6611
6612 /* dest/target can't be a stream if it's a directory. */
6613 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6614
6615 p = strrchr_m(smb_fname_src->base_name,'/');
6616 if (p) {
6617 p++;
6618 } else {
6619 p = smb_fname_src->base_name;
6620 }
6621 smb_fname_dst_tmp->base_name =
6622 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6623 p);
6624 if (!smb_fname_dst_tmp->base_name) {
6625 status = NT_STATUS_NO_MEMORY;
6626 goto out;
6627 }
6628 }
6629
6630 status = vfs_file_exist(conn, smb_fname_src);
6631 if (!NT_STATUS_IS_OK(status)) {
6632 goto out;
6633 }
6634
6635 if (!target_is_directory && count) {
6636 new_create_disposition = FILE_OPEN;
6637 } else {
6638 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6639 0, ofun, NULL, NULL,
6640 &new_create_disposition,
6641 NULL)) {
6642 status = NT_STATUS_INVALID_PARAMETER;
6643 goto out;
6644 }
6645 }
6646
6647 /* Open the src file for reading. */
6648 status = SMB_VFS_CREATE_FILE(
6649 conn, /* conn */
6650 NULL, /* req */
6651 0, /* root_dir_fid */
6652 smb_fname_src, /* fname */
6653 FILE_GENERIC_READ, /* access_mask */
6654 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6655 FILE_OPEN, /* create_disposition*/
6656 0, /* create_options */
6657 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6658 INTERNAL_OPEN_ONLY, /* oplock_request */
6659 0, /* allocation_size */
6660 NULL, /* sd */
6661 NULL, /* ea_list */
6662 &fsp1, /* result */
6663 NULL); /* psbuf */
6664
6665 if (!NT_STATUS_IS_OK(status)) {
6666 goto out;
6667 }
6668
6669 dosattrs = dos_mode(conn, smb_fname_src);
6670
6671 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6672 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6673 }
6674
6675 /* Open the dst file for writing. */
6676 status = SMB_VFS_CREATE_FILE(
6677 conn, /* conn */
6678 NULL, /* req */
6679 0, /* root_dir_fid */
6680 smb_fname_dst, /* fname */
6681 FILE_GENERIC_WRITE, /* access_mask */
6682 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6683 new_create_disposition, /* create_disposition*/
6684 0, /* create_options */
6685 dosattrs, /* file_attributes */
6686 INTERNAL_OPEN_ONLY, /* oplock_request */
6687 0, /* allocation_size */
6688 NULL, /* sd */
6689 NULL, /* ea_list */
6690 &fsp2, /* result */
6691 NULL); /* psbuf */
6692
6693 if (!NT_STATUS_IS_OK(status)) {
6694 close_file(NULL, fsp1, ERROR_CLOSE);
6695 goto out;
6696 }
6697
6698 if ((ofun&3) == 1) {
6699 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6700 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6701 /*
6702 * Stop the copy from occurring.
6703 */
6704 ret = -1;
6705 smb_fname_src->st.st_ex_size = 0;
6706 }
6707 }
6708
6709 /* Do the actual copy. */
6710 if (smb_fname_src->st.st_ex_size) {
6711 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6712 }
6713
6714 close_file(NULL, fsp1, NORMAL_CLOSE);
6715
6716 /* Ensure the modtime is set correctly on the destination file. */
6717 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6718
6719 /*
6720 * As we are opening fsp1 read-only we only expect
6721 * an error on close on fsp2 if we are out of space.
6722 * Thus we don't look at the error return from the
6723 * close of fsp1.
6724 */
6725 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6726
6727 if (!NT_STATUS_IS_OK(status)) {
6728 goto out;
6729 }
6730
6731 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6732 status = NT_STATUS_DISK_FULL;
6733 goto out;
6734 }
6735
6736 status = NT_STATUS_OK;
6737
6738 out:
6739 TALLOC_FREE(smb_fname_dst_tmp);
6740 return status;
6741 }
6742
6743 /****************************************************************************
6744 Reply to a file copy.
6745 ****************************************************************************/
6746
6747 void reply_copy(struct smb_request *req)
6748 {
6749 connection_struct *conn = req->conn;
6750 struct smb_filename *smb_fname_src = NULL;
6751 struct smb_filename *smb_fname_dst = NULL;
6752 char *fname_src = NULL;
6753 char *fname_dst = NULL;
6754 char *fname_src_mask = NULL;
6755 char *fname_src_dir = NULL;
6756 const char *p;
6757 int count=0;
6758 int error = ERRnoaccess;
6759 int err = 0;
6760 int tid2;
6761 int ofun;
6762 int flags;
6763 bool target_is_directory=False;
6764 bool source_has_wild = False;
6765 bool dest_has_wild = False;
6766 NTSTATUS status;
6767 TALLOC_CTX *ctx = talloc_tos();
6768
6769 START_PROFILE(SMBcopy);
6770
6771 if (req->wct < 3) {
6772 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6773 goto out;
6774 }
6775
6776 tid2 = SVAL(req->vwv+0, 0);
6777 ofun = SVAL(req->vwv+1, 0);
6778 flags = SVAL(req->vwv+2, 0);
6779
6780 p = (const char *)req->buf;
6781 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6782 &status, &source_has_wild);
6783 if (!NT_STATUS_IS_OK(status)) {
6784 reply_nterror(req, status);
6785 goto out;
6786 }
6787 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6788 &status, &dest_has_wild);
6789 if (!NT_STATUS_IS_OK(status)) {
6790 reply_nterror(req, status);
6791 goto out;
6792 }
6793
6794 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6795
6796 if (tid2 != conn->cnum) {
6797 /* can't currently handle inter share copies XXXX */
6798 DEBUG(3,("Rejecting inter-share copy\n"));
6799 reply_doserror(req, ERRSRV, ERRinvdevice);
6800 goto out;
6801 }
6802
6803 status = resolve_dfspath_wcard(ctx, conn,
6804 req->flags2 & FLAGS2_DFS_PATHNAMES,
6805 fname_src,
6806 &fname_src,
6807 &source_has_wild);
6808 if (!NT_STATUS_IS_OK(status)) {
6809 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6810 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6811 ERRSRV, ERRbadpath);
6812 goto out;
6813 }
6814 reply_nterror(req, status);
6815 goto out;
6816 }
6817
6818 status = resolve_dfspath_wcard(ctx, conn,
6819 req->flags2 & FLAGS2_DFS_PATHNAMES,
6820 fname_dst,
6821 &fname_dst,
6822 &dest_has_wild);
6823 if (!NT_STATUS_IS_OK(status)) {
6824 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6825 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6826 ERRSRV, ERRbadpath);
6827 goto out;
6828 }
6829 reply_nterror(req, status);
6830 goto out;
6831 }
6832
6833 status = unix_convert(ctx, conn, fname_src, &smb_fname_src,
6834 source_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
6835 if (!NT_STATUS_IS_OK(status)) {
6836 reply_nterror(req, status);
6837 goto out;
6838 }
6839
6840 status = unix_convert(ctx, conn, fname_dst, &smb_fname_dst,
6841 dest_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
6842 if (!NT_STATUS_IS_OK(status)) {
6843 reply_nterror(req, status);
6844 goto out;
6845 }
6846
6847 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6848
6849 if ((flags&1) && target_is_directory) {
6850 reply_doserror(req, ERRDOS, ERRbadfile);
6851 goto out;
6852 }
6853
6854 if ((flags&2) && !target_is_directory) {
6855 reply_doserror(req, ERRDOS, ERRbadpath);
6856 goto out;
6857 }
6858
6859 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6860 /* wants a tree copy! XXXX */
6861 DEBUG(3,("Rejecting tree copy\n"));
6862 reply_doserror(req, ERRSRV, ERRerror);
6863 goto out;
6864 }
6865
6866 /* Split up the directory from the filename/mask. */
6867 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6868 &fname_src_dir, &fname_src_mask);
6869 if (!NT_STATUS_IS_OK(status)) {
6870 reply_nterror(req, NT_STATUS_NO_MEMORY);
6871 goto out;
6872 }
6873
6874 /*
6875 * We should only check the mangled cache
6876 * here if unix_convert failed. This means
6877 * that the path in 'mask' doesn't exist
6878 * on the file system and so we need to look
6879 * for a possible mangle. This patch from
6880 * Tine Smukavec <valentin.smukavec@hermes.si>.
6881 */
6882 if (!VALID_STAT(smb_fname_src->st) &&
6883 mangle_is_mangled(fname_src_mask, conn->params)) {
6884 char *new_mask = NULL;
6885 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6886 &new_mask, conn->params);
6887
6888 /* Use demangled name if one was successfully found. */
6889 if (new_mask) {
6890 TALLOC_FREE(fname_src_mask);
6891 fname_src_mask = new_mask;
6892 }
6893 }
6894
6895 if (!source_has_wild) {
6896
6897 /*
6898 * Only one file needs to be copied. Append the mask back onto
6899 * the directory.
6900 */
6901 TALLOC_FREE(smb_fname_src->base_name);
6902 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6903 "%s/%s",
6904 fname_src_dir,
6905 fname_src_mask);
6906 if (!smb_fname_src->base_name) {
6907 reply_nterror(req, NT_STATUS_NO_MEMORY);
6908 goto out;
6909 }
6910
6911 if (dest_has_wild) {
6912 char *fname_dst_mod = NULL;
6913 if (!resolve_wildcards(smb_fname_dst,
6914 smb_fname_src->base_name,
6915 smb_fname_dst->base_name,
6916 &fname_dst_mod)) {
6917 reply_nterror(req, NT_STATUS_NO_MEMORY);
6918 goto out;
6919 }
6920 TALLOC_FREE(smb_fname_dst->base_name);
6921 smb_fname_dst->base_name = fname_dst_mod;
6922 }
6923
6924 status = check_name(conn, smb_fname_src->base_name);
6925 if (!NT_STATUS_IS_OK(status)) {
6926 reply_nterror(req, status);
6927 goto out;
6928 }
6929
6930 status = check_name(conn, smb_fname_dst->base_name);
6931 if (!NT_STATUS_IS_OK(status)) {
6932 reply_nterror(req, status);
6933 goto out;
6934 }
6935
6936 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6937 ofun, count, target_is_directory);
6938
6939 if(!NT_STATUS_IS_OK(status)) {
6940 reply_nterror(req, status);
6941 goto out;
6942 } else {
6943 count++;
6944 }
6945 } else {
6946 struct smb_Dir *dir_hnd = NULL;
6947 const char *dname = NULL;
6948 long offset = 0;
6949
6950 /*
6951 * There is a wildcard that requires us to actually read the
6952 * src dir and copy each file matching the mask to the dst.
6953 * Right now streams won't be copied, but this could
6954 * presumably be added with a nested loop for reach dir entry.
6955 */
6956 SMB_ASSERT(!smb_fname_src->stream_name);
6957 SMB_ASSERT(!smb_fname_dst->stream_name);
6958
6959 smb_fname_src->stream_name = NULL;
6960 smb_fname_dst->stream_name = NULL;
6961
6962 if (strequal(fname_src_mask,"????????.???")) {
6963 TALLOC_FREE(fname_src_mask);
6964 fname_src_mask = talloc_strdup(ctx, "*");
6965 if (!fname_src_mask) {
6966 reply_nterror(req, NT_STATUS_NO_MEMORY);
6967 goto out;
6968 }
6969 }
6970
6971 status = check_name(conn, fname_src_dir);
6972 if (!NT_STATUS_IS_OK(status)) {
6973 reply_nterror(req, status);
6974 goto out;
6975 }
6976
6977 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6978 if (dir_hnd == NULL) {
6979 status = map_nt_error_from_unix(errno);
6980 reply_nterror(req, status);
6981 goto out;
6982 }
6983
6984 error = ERRbadfile;
6985
6986 /* Iterate over the src dir copying each entry to the dst. */
6987 while ((dname = ReadDirName(dir_hnd, &offset,
6988 &smb_fname_src->st))) {
6989 char *destname = NULL;
6990
6991 if (ISDOT(dname) || ISDOTDOT(dname)) {
6992 continue;
6993 }
6994
6995 if (!is_visible_file(conn, fname_src_dir, dname,
6996 &smb_fname_src->st, false)) {
6997 continue;
6998 }
6999
7000 if(!mask_match(dname, fname_src_mask,
7001 conn->case_sensitive)) {
7002 continue;
7003 }
7004
7005 error = ERRnoaccess;
7006
7007 /* Get the src smb_fname struct setup. */
7008 TALLOC_FREE(smb_fname_src->base_name);
7009 smb_fname_src->base_name =
7010 talloc_asprintf(smb_fname_src, "%s/%s",
7011 fname_src_dir, dname);
7012
7013 if (!smb_fname_src->base_name) {
7014 TALLOC_FREE(dir_hnd);
7015 reply_nterror(req, NT_STATUS_NO_MEMORY);
7016 goto out;
7017 }
7018
7019 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7020 smb_fname_dst->base_name,
7021 &destname)) {
7022 continue;
7023 }
7024 if (!destname) {
7025 TALLOC_FREE(dir_hnd);
7026 reply_nterror(req, NT_STATUS_NO_MEMORY);
7027 goto out;
7028 }
7029
7030 TALLOC_FREE(smb_fname_dst->base_name);
7031 smb_fname_dst->base_name = destname;
7032
7033 status = check_name(conn, smb_fname_src->base_name);
7034 if (!NT_STATUS_IS_OK(status)) {
7035 TALLOC_FREE(dir_hnd);
7036 reply_nterror(req, status);
7037 goto out;
7038 }
7039
7040 status = check_name(conn, smb_fname_dst->base_name);
7041 if (!NT_STATUS_IS_OK(status)) {
7042 TALLOC_FREE(dir_hnd);
7043 reply_nterror(req, status);
7044 goto out;
7045 }
7046
7047 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7048 smb_fname_src->base_name,
7049 smb_fname_dst->base_name));
7050
7051 status = copy_file(ctx, conn, smb_fname_src,
7052 smb_fname_dst, ofun, count,
7053 target_is_directory);
7054 if (NT_STATUS_IS_OK(status)) {
7055 count++;
7056 }
7057 }
7058 TALLOC_FREE(dir_hnd);
7059 }
7060
7061 if (count == 0) {
7062 if(err) {
7063 /* Error on close... */
7064 errno = err;
7065 reply_unixerror(req, ERRHRD, ERRgeneral);
7066 goto out;
7067 }
7068
7069 reply_doserror(req, ERRDOS, error);
7070 goto out;
7071 }
7072
7073 reply_outbuf(req, 1, 0);
7074 SSVAL(req->outbuf,smb_vwv0,count);
7075 out:
7076 TALLOC_FREE(smb_fname_src);
7077 TALLOC_FREE(smb_fname_dst);
7078 TALLOC_FREE(fname_src);
7079 TALLOC_FREE(fname_dst);
7080 TALLOC_FREE(fname_src_mask);
7081 TALLOC_FREE(fname_src_dir);
7082
7083 END_PROFILE(SMBcopy);
7084 return;
7085 }
7086
7087 #undef DBGC_CLASS
7088 #define DBGC_CLASS DBGC_LOCKING
7089
7090 /****************************************************************************
7091 Get a lock pid, dealing with large count requests.
7092 ****************************************************************************/
7093
7094 uint32 get_lock_pid(const uint8_t *data, int data_offset,
7095 bool large_file_format)
7096 {
7097 if(!large_file_format)
7098 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
7099 else
7100 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7101 }
7102
7103 /****************************************************************************
7104 Get a lock count, dealing with large count requests.
7105 ****************************************************************************/
7106
7107 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7108 bool large_file_format)
7109 {
7110 uint64_t count = 0;
7111
7112 if(!large_file_format) {
7113 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7114 } else {
7115
7116 #if defined(HAVE_LONGLONG)
7117 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7118 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7119 #else /* HAVE_LONGLONG */
7120
7121 /*
7122 * NT4.x seems to be broken in that it sends large file (64 bit)
7123 * lockingX calls even if the CAP_LARGE_FILES was *not*
7124 * negotiated. For boxes without large unsigned ints truncate the
7125 * lock count by dropping the top 32 bits.
7126 */
7127
7128 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7129 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7130 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7131 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7132 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7133 }
7134
7135 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7136 #endif /* HAVE_LONGLONG */
7137 }
7138
7139 return count;
7140 }
7141
7142 #if !defined(HAVE_LONGLONG)
7143 /****************************************************************************
7144 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7145 ****************************************************************************/
7146
7147 static uint32 map_lock_offset(uint32 high, uint32 low)
7148 {
7149 unsigned int i;
7150 uint32 mask = 0;
7151 uint32 highcopy = high;
7152
7153 /*
7154 * Try and find out how many significant bits there are in high.
7155 */
7156
7157 for(i = 0; highcopy; i++)
7158 highcopy >>= 1;
7159
7160 /*
7161 * We use 31 bits not 32 here as POSIX
7162 * lock offsets may not be negative.
7163 */
7164
7165 mask = (~0) << (31 - i);
7166
7167 if(low & mask)
7168 return 0; /* Fail. */
7169
7170 high <<= (31 - i);
7171
7172 return (high|low);
7173 }
7174 #endif /* !defined(HAVE_LONGLONG) */
7175
7176 /****************************************************************************
7177 Get a lock offset, dealing with large offset requests.
7178 ****************************************************************************/
7179
7180 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7181 bool large_file_format, bool *err)
7182 {
7183 uint64_t offset = 0;
7184
7185 *err = False;
7186
7187 if(!large_file_format) {
7188 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7189 } else {
7190
7191 #if defined(HAVE_LONGLONG)
7192 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7193 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7194 #else /* HAVE_LONGLONG */
7195
7196 /*
7197 * NT4.x seems to be broken in that it sends large file (64 bit)
7198 * lockingX calls even if the CAP_LARGE_FILES was *not*
7199 * negotiated. For boxes without large unsigned ints mangle the
7200 * lock offset by mapping the top 32 bits onto the lower 32.
7201 */
7202
7203 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7204 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7205 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7206 uint32 new_low = 0;
7207
7208 if((new_low = map_lock_offset(high, low)) == 0) {
7209 *err = True;
7210 return (uint64_t)-1;
7211 }
7212
7213 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7214 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7215 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7216 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7217 }
7218
7219 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7220 #endif /* HAVE_LONGLONG */
7221 }
7222
7223 return offset;
7224 }
7225
7226 struct smbd_lock_element {
7227 uint32_t smbpid;
7228 enum brl_type brltype;
7229 uint64_t offset;
7230 uint64_t count;
7231 };
7232
7233 static NTSTATUS smbd_do_locking(struct smb_request *req,
7234 files_struct *fsp,
7235 uint8_t type,
7236 int32_t timeout,
7237 uint16_t num_ulocks,
7238 struct smbd_lock_element *ulocks,
7239 uint16_t num_locks,
7240 struct smbd_lock_element *locks,
7241 bool *async)
7242 {
7243 connection_struct *conn = req->conn;
7244 int i;
7245 NTSTATUS status = NT_STATUS_OK;
7246
7247 *async = false;
7248
7249 /* Data now points at the beginning of the list
7250 of smb_unlkrng structs */
7251 for(i = 0; i < (int)num_ulocks; i++) {
7252 struct smbd_lock_element *e = &ulocks[i];
7253
7254 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7255 "pid %u, file %s\n",
7256 (double)e->offset,
7257 (double)e->count,
7258 (unsigned int)e->smbpid,
7259 fsp->fsp_name));
7260
7261 if (e->brltype != UNLOCK_LOCK) {
7262 /* this can only happen with SMB2 */
7263 return NT_STATUS_INVALID_PARAMETER;
7264 }
7265
7266 status = do_unlock(smbd_messaging_context(),
7267 fsp,
7268 e->smbpid,
7269 e->count,
7270 e->offset,
7271 WINDOWS_LOCK);
7272
7273 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7274 nt_errstr(status)));
7275
7276 if (!NT_STATUS_IS_OK(status)) {
7277 return status;
7278 }
7279 }
7280
7281 /* Setup the timeout in seconds. */
7282
7283 if (!lp_blocking_locks(SNUM(conn))) {
7284 timeout = 0;
7285 }
7286
7287 /* Data now points at the beginning of the list
7288 of smb_lkrng structs */
7289
7290 for(i = 0; i < (int)num_locks; i++) {
7291 struct smbd_lock_element *e = &locks[i];
7292
7293 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7294 "%u, file %s timeout = %d\n",
7295 (double)e->offset,
7296 (double)e->count,
7297 (unsigned int)e->smbpid,
7298 fsp->fsp_name,
7299 (int)timeout));
7300
7301 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7302 struct blocking_lock_record *blr = NULL;
7303
7304 if (lp_blocking_locks(SNUM(conn))) {
7305
7306 /* Schedule a message to ourselves to
7307 remove the blocking lock record and
7308 return the right error. */
7309
7310 blr = blocking_lock_cancel(fsp,
7311 e->smbpid,
7312 e->offset,
7313 e->count,
7314 WINDOWS_LOCK,
7315 type,
7316 NT_STATUS_FILE_LOCK_CONFLICT);
7317 if (blr == NULL) {
7318 return NT_STATUS_DOS(
7319 ERRDOS,
7320 ERRcancelviolation);
7321 }
7322 }
7323 /* Remove a matching pending lock. */
7324 status = do_lock_cancel(fsp,
7325 e->smbpid,
7326 e->count,
7327 e->offset,
7328 WINDOWS_LOCK,
7329 blr);
7330 } else {
7331 bool blocking_lock = timeout ? true : false;
7332 bool defer_lock = false;
7333 struct byte_range_lock *br_lck;
7334 uint32_t block_smbpid;
7335
7336 br_lck = do_lock(smbd_messaging_context(),
7337 fsp,
7338 e->smbpid,
7339 e->count,
7340 e->offset,
7341 e->brltype,
7342 WINDOWS_LOCK,
7343 blocking_lock,
7344 &status,
7345 &block_smbpid,
7346 NULL);
7347
7348 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7349 /* Windows internal resolution for blocking locks seems
7350 to be about 200ms... Don't wait for less than that. JRA. */
7351 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7352 timeout = lp_lock_spin_time();
7353 }
7354 defer_lock = true;
7355 }
7356
7357 /* This heuristic seems to match W2K3 very well. If a
7358 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7359 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7360 far as I can tell. Replacement for do_lock_spin(). JRA. */
7361
7362 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7363 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7364 defer_lock = true;
7365 timeout = lp_lock_spin_time();
7366 }
7367
7368 if (br_lck && defer_lock) {
7369 /*
7370 * A blocking lock was requested. Package up
7371 * this smb into a queued request and push it
7372 * onto the blocking lock queue.
7373 */
7374 if(push_blocking_lock_request(br_lck,
7375 req,
7376 fsp,
7377 timeout,
7378 i,
7379 e->smbpid,
7380 e->brltype,
7381 WINDOWS_LOCK,
7382 e->offset,
7383 e->count,
7384 block_smbpid)) {
7385 TALLOC_FREE(br_lck);
7386 *async = true;
7387 return NT_STATUS_OK;
7388 }
7389 }
7390
7391 TALLOC_FREE(br_lck);
7392 }
7393
7394 if (!NT_STATUS_IS_OK(status)) {
7395 break;
7396 }
7397 }
7398
7399 /* If any of the above locks failed, then we must unlock
7400 all of the previous locks (X/Open spec). */
7401
7402 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7403
7404 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7405 i = -1; /* we want to skip the for loop */
7406 }
7407
7408 /*
7409 * Ensure we don't do a remove on the lock that just failed,
7410 * as under POSIX rules, if we have a lock already there, we
7411 * will delete it (and we shouldn't) .....
7412 */
7413 for(i--; i >= 0; i--) {
7414 struct smbd_lock_element *e = &locks[i];
7415
7416 do_unlock(smbd_messaging_context(),
7417 fsp,
7418 e->smbpid,
7419 e->count,
7420 e->offset,
7421 WINDOWS_LOCK);
7422 }
7423 return status;
7424 }
7425
7426 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7427 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7428
7429 return NT_STATUS_OK;
7430 }
7431
7432 /****************************************************************************
7433 Reply to a lockingX request.
7434 ****************************************************************************/
7435
7436 void reply_lockingX(struct smb_request *req)
7437 {
7438 connection_struct *conn = req->conn;
7439 files_struct *fsp;
7440 unsigned char locktype;
7441 unsigned char oplocklevel;
7442 uint16 num_ulocks;
7443 uint16 num_locks;
7444 int32 lock_timeout;
7445 int i;
7446 const uint8_t *data;
7447 bool large_file_format;
7448 bool err;
7449 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7450 struct smbd_lock_element *ulocks;
7451 struct smbd_lock_element *locks;
7452 bool async = false;
7453
7454 START_PROFILE(SMBlockingX);
7455
7456 if (req->wct < 8) {
7457 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7458 END_PROFILE(SMBlockingX);
7459 return;
7460 }
7461
7462 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7463 locktype = CVAL(req->vwv+3, 0);
7464 oplocklevel = CVAL(req->vwv+3, 1);
7465 num_ulocks = SVAL(req->vwv+6, 0);
7466 num_locks = SVAL(req->vwv+7, 0);
7467 lock_timeout = IVAL(req->vwv+4, 0);
7468 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7469
7470 if (!check_fsp(conn, req, fsp)) {
7471 END_PROFILE(SMBlockingX);
7472 return;
7473 }
7474
7475 data = req->buf;
7476
7477 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7478 /* we don't support these - and CANCEL_LOCK makes w2k
7479 and XP reboot so I don't really want to be
7480 compatible! (tridge) */
7481 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
7482 END_PROFILE(SMBlockingX);
7483 return;
7484 }
7485
7486 /* Check if this is an oplock break on a file
7487 we have granted an oplock on.
7488 */
7489 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7490 /* Client can insist on breaking to none. */
7491 bool break_to_none = (oplocklevel == 0);
7492 bool result;
7493
7494 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7495 "for fnum = %d\n", (unsigned int)oplocklevel,
7496 fsp->fnum ));
7497
7498 /*
7499 * Make sure we have granted an exclusive or batch oplock on
7500 * this file.
7501 */
7502
7503 if (fsp->oplock_type == 0) {
7504
7505 /* The Samba4 nbench simulator doesn't understand
7506 the difference between break to level2 and break
7507 to none from level2 - it sends oplock break
7508 replies in both cases. Don't keep logging an error
7509 message here - just ignore it. JRA. */
7510
7511 DEBUG(5,("reply_lockingX: Error : oplock break from "
7512 "client for fnum = %d (oplock=%d) and no "
7513 "oplock granted on this file (%s).\n",
7514 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
7515
7516 /* if this is a pure oplock break request then don't
7517 * send a reply */
7518 if (num_locks == 0 && num_ulocks == 0) {
7519 END_PROFILE(SMBlockingX);
7520 return;
7521 } else {
7522 END_PROFILE(SMBlockingX);
7523 reply_doserror(req, ERRDOS, ERRlock);
7524 return;
7525 }
7526 }
7527
7528 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7529 (break_to_none)) {
7530 result = remove_oplock(fsp);
7531 } else {
7532 result = downgrade_oplock(fsp);
7533 }
7534
7535 if (!result) {
7536 DEBUG(0, ("reply_lockingX: error in removing "
7537 "oplock on file %s\n", fsp->fsp_name));
7538 /* Hmmm. Is this panic justified? */
7539 smb_panic("internal tdb error");
7540 }
7541
7542 reply_to_oplock_break_requests(fsp);
7543
7544 /* if this is a pure oplock break request then don't send a
7545 * reply */
7546 if (num_locks == 0 && num_ulocks == 0) {
7547 /* Sanity check - ensure a pure oplock break is not a
7548 chained request. */
7549 if(CVAL(req->vwv+0, 0) != 0xff)
7550 DEBUG(0,("reply_lockingX: Error : pure oplock "
7551 "break is a chained %d request !\n",
7552 (unsigned int)CVAL(req->vwv+0, 0)));
7553 END_PROFILE(SMBlockingX);
7554 return;
7555 }
7556 }
7557
7558 if (req->buflen <
7559 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7560 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7561 END_PROFILE(SMBlockingX);
7562 return;
7563 }
7564
7565 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7566 if (ulocks == NULL) {
7567 reply_nterror(req, NT_STATUS_NO_MEMORY);
7568 END_PROFILE(SMBlockingX);
7569 return;
7570 }
7571
7572 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7573 if (locks == NULL) {
7574 reply_nterror(req, NT_STATUS_NO_MEMORY);
7575 END_PROFILE(SMBlockingX);
7576 return;
7577 }
7578
7579 /* Data now points at the beginning of the list
7580 of smb_unlkrng structs */
7581 for(i = 0; i < (int)num_ulocks; i++) {
7582 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7583 ulocks[i].count = get_lock_count(data, i, large_file_format);
7584 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7585 ulocks[i].brltype = UNLOCK_LOCK;
7586
7587 /*
7588 * There is no error code marked "stupid client bug".... :-).
7589 */
7590 if(err) {
7591 END_PROFILE(SMBlockingX);
7592 reply_doserror(req, ERRDOS, ERRnoaccess);
7593 return;
7594 }
7595 }
7596
7597 /* Now do any requested locks */
7598 data += ((large_file_format ? 20 : 10)*num_ulocks);
7599
7600 /* Data now points at the beginning of the list
7601 of smb_lkrng structs */
7602
7603 for(i = 0; i < (int)num_locks; i++) {
7604 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7605 locks[i].count = get_lock_count(data, i, large_file_format);
7606 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7607
7608 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7609 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7610 locks[i].brltype = PENDING_READ_LOCK;
7611 } else {
7612 locks[i].brltype = READ_LOCK;
7613 }
7614 } else {
7615 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7616 locks[i].brltype = PENDING_WRITE_LOCK;
7617 } else {
7618 locks[i].brltype = WRITE_LOCK;
7619 }
7620 }
7621
7622 /*
7623 * There is no error code marked "stupid client bug".... :-).
7624 */
7625 if(err) {
7626 END_PROFILE(SMBlockingX);
7627 reply_doserror(req, ERRDOS, ERRnoaccess);
7628 return;
7629 }
7630 }
7631
7632 status = smbd_do_locking(req, fsp,
7633 locktype, lock_timeout,
7634 num_ulocks, ulocks,
7635 num_locks, locks,
7636 &async);
7637 if (!NT_STATUS_IS_OK(status)) {
7638 END_PROFILE(SMBlockingX);
7639 reply_nterror(req, status);
7640 return;
7641 }
7642 if (async) {
7643 END_PROFILE(SMBlockingX);
7644 return;
7645 }
7646
7647 reply_outbuf(req, 2, 0);
7648
7649 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7650 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7651
7652 END_PROFILE(SMBlockingX);
7653 chain_reply(req);
7654 }
7655
7656 #undef DBGC_CLASS
7657 #define DBGC_CLASS DBGC_ALL
7658
7659 /****************************************************************************
7660 Reply to a SMBreadbmpx (read block multiplex) request.
7661 Always reply with an error, if someone has a platform really needs this,
7662 please contact vl@samba.org
7663 ****************************************************************************/
7664
7665 void reply_readbmpx(struct smb_request *req)
7666 {
7667 START_PROFILE(SMBreadBmpx);
7668 reply_doserror(req, ERRSRV, ERRuseSTD);
7669 END_PROFILE(SMBreadBmpx);
7670 return;
7671 }
7672
7673 /****************************************************************************
7674 Reply to a SMBreadbs (read block multiplex secondary) request.
7675 Always reply with an error, if someone has a platform really needs this,
7676 please contact vl@samba.org
7677 ****************************************************************************/
7678
7679 void reply_readbs(struct smb_request *req)
7680 {
7681 START_PROFILE(SMBreadBs);
7682 reply_doserror(req, ERRSRV, ERRuseSTD);
7683 END_PROFILE(SMBreadBs);
7684 return;
7685 }
7686
7687 /****************************************************************************
7688 Reply to a SMBsetattrE.
7689 ****************************************************************************/
7690
7691 void reply_setattrE(struct smb_request *req)
7692 {
7693 connection_struct *conn = req->conn;
7694 struct smb_filename *smb_fname = NULL;
7695 struct smb_file_time ft;
7696 files_struct *fsp;
7697 NTSTATUS status;
7698
7699 START_PROFILE(SMBsetattrE);
7700 ZERO_STRUCT(ft);
7701
7702 if (req->wct < 7) {
7703 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7704 goto out;
7705 }
7706
7707 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7708
7709 if(!fsp || (fsp->conn != conn)) {
7710 reply_doserror(req, ERRDOS, ERRbadfid);
7711 goto out;
7712 }
7713
7714 /* XXX: Remove when fsp->fsp_name is converted to smb_filename. */
7715 status = create_synthetic_smb_fname_split(talloc_tos(), fsp->fsp_name,
7716 NULL, &smb_fname);
7717 if (!NT_STATUS_IS_OK(status)) {
7718 reply_nterror(req, status);
7719 goto out;
7720 }
7721
7722 /*
7723 * Convert the DOS times into unix times.
7724 */
7725
7726 ft.atime = convert_time_t_to_timespec(
7727 srv_make_unix_date2(req->vwv+3));
7728 ft.mtime = convert_time_t_to_timespec(
7729 srv_make_unix_date2(req->vwv+5));
7730 ft.create_time = convert_time_t_to_timespec(
7731 srv_make_unix_date2(req->vwv+1));
7732
7733 reply_outbuf(req, 0, 0);
7734
7735 /*
7736 * Patch from Ray Frush <frush@engr.colostate.edu>
7737 * Sometimes times are sent as zero - ignore them.
7738 */
7739
7740 /* Ensure we have a valid stat struct for the source. */
7741 if (fsp->fh->fd != -1) {
7742 if (SMB_VFS_FSTAT(fsp, &smb_fname->st) == -1) {
7743 status = map_nt_error_from_unix(errno);
7744 reply_nterror(req, status);
7745 goto out;
7746 }
7747 } else {
7748 int ret = -1;
7749
7750 if (fsp->posix_open) {
7751 ret = SMB_VFS_LSTAT(conn, smb_fname);
7752 } else {
7753 ret = SMB_VFS_STAT(conn, smb_fname);
7754 }
7755 if (ret == -1) {
7756 status = map_nt_error_from_unix(errno);
7757 reply_nterror(req, status);
7758 goto out;
7759 }
7760 }
7761
7762 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
7763 if (!NT_STATUS_IS_OK(status)) {
7764 reply_doserror(req, ERRDOS, ERRnoaccess);
7765 goto out;
7766 }
7767
7768 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7769 " createtime=%u\n",
7770 fsp->fnum,
7771 (unsigned int)ft.atime.tv_sec,
7772 (unsigned int)ft.mtime.tv_sec,
7773 (unsigned int)ft.create_time.tv_sec
7774 ));
7775 out:
7776 END_PROFILE(SMBsetattrE);
7777 return;
7778 }
7779
7780
7781 /* Back from the dead for OS/2..... JRA. */
7782
7783 /****************************************************************************
7784 Reply to a SMBwritebmpx (write block multiplex primary) request.
7785 Always reply with an error, if someone has a platform really needs this,
7786 please contact vl@samba.org
7787 ****************************************************************************/
7788
7789 void reply_writebmpx(struct smb_request *req)
7790 {
7791 START_PROFILE(SMBwriteBmpx);
7792 reply_doserror(req, ERRSRV, ERRuseSTD);
7793 END_PROFILE(SMBwriteBmpx);
7794 return;
7795 }
7796
7797 /****************************************************************************
7798 Reply to a SMBwritebs (write block multiplex secondary) request.
7799 Always reply with an error, if someone has a platform really needs this,
7800 please contact vl@samba.org
7801 ****************************************************************************/
7802
7803 void reply_writebs(struct smb_request *req)
7804 {
7805 START_PROFILE(SMBwriteBs);
7806 reply_doserror(req, ERRSRV, ERRuseSTD);
7807 END_PROFILE(SMBwriteBs);
7808 return;
7809 }
7810
7811 /****************************************************************************
7812 Reply to a SMBgetattrE.
7813 ****************************************************************************/
7814
7815 void reply_getattrE(struct smb_request *req)
7816 {
7817 connection_struct *conn = req->conn;
7818 SMB_STRUCT_STAT sbuf;
7819 int mode;
7820 files_struct *fsp;
7821 struct timespec create_ts;
7822 struct smb_filename *smb_fname = NULL;
7823 NTSTATUS status;
7824
7825 START_PROFILE(SMBgetattrE);
7826
7827 if (req->wct < 1) {
7828 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7829 END_PROFILE(SMBgetattrE);
7830 return;
7831 }
7832
7833 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7834
7835 if(!fsp || (fsp->conn != conn)) {
7836 reply_doserror(req, ERRDOS, ERRbadfid);
7837 END_PROFILE(SMBgetattrE);
7838 return;
7839 }
7840
7841 /* Do an fstat on this file */
7842 if(fsp_stat(fsp, &sbuf)) {
7843 reply_unixerror(req, ERRDOS, ERRnoaccess);
7844 END_PROFILE(SMBgetattrE);
7845 return;
7846 }
7847
7848 status = create_synthetic_smb_fname_split(talloc_tos(), fsp->fsp_name,
7849 &sbuf, &smb_fname);
7850 if (!NT_STATUS_IS_OK(status)) {
7851 reply_nterror(req, status);
7852 END_PROFILE(SMBgetattrE);
7853 return;
7854 }
7855
7856 mode = dos_mode(conn, smb_fname);
7857 TALLOC_FREE(smb_fname);
7858
7859 /*
7860 * Convert the times into dos times. Set create
7861 * date to be last modify date as UNIX doesn't save
7862 * this.
7863 */
7864
7865 reply_outbuf(req, 11, 0);
7866
7867 create_ts = sbuf.st_ex_btime;
7868 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7869 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7870 convert_timespec_to_time_t(sbuf.st_ex_atime));
7871 /* Should we check pending modtime here ? JRA */
7872 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7873 convert_timespec_to_time_t(sbuf.st_ex_mtime));
7874
7875 if (mode & aDIR) {
7876 SIVAL(req->outbuf, smb_vwv6, 0);
7877 SIVAL(req->outbuf, smb_vwv8, 0);
7878 } else {
7879 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7880 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_ex_size);
7881 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7882 }
7883 SSVAL(req->outbuf,smb_vwv10, mode);
7884
7885 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7886
7887 END_PROFILE(SMBgetattrE);
7888 return;
7889 }
fernandojvsilva's samba4 branch