?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
pyldb: Raise proper exception when attempting to assign a string to a dn
[Samba/fernandojvsilva.git] / source3 / smbd / reply.c
blob77e122a90c95c86f8b084b29370d01091b937264
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!posix_path && !stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 break;
132 }
133 /* Go back one level... */
134 /* We know this is safe as '/' cannot be part of a mb sequence. */
135 /* NOTE - if this assumption is invalid we are not in good shape... */
136 /* Decrement d first as d points to the *next* char to write into. */
137 for (d--; d > path; d--) {
138 if (*d == '/')
139 break;
140 }
141 s += 2; /* Else go past the .. */
142 /* We're still at the start of a name component, just the previous one. */
143 continue;
144
145 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
146 if (posix_path) {
147 /* Eat the '.' */
148 s++;
149 continue;
150 }
151 }
152
153 }
154
155 if (!(*s & 0x80)) {
156 if (!posix_path) {
157 if (*s <= 0x1f || *s == '|') {
158 return NT_STATUS_OBJECT_NAME_INVALID;
159 }
160 switch (*s) {
161 case '*':
162 case '?':
163 case '<':
164 case '>':
165 case '"':
166 *p_last_component_contains_wcard = True;
167 break;
168 default:
169 break;
170 }
171 }
172 *d++ = *s++;
173 } else {
174 size_t siz;
175 /* Get the size of the next MB character. */
176 next_codepoint(s,&siz);
177 switch(siz) {
178 case 5:
179 *d++ = *s++;
180 /*fall through*/
181 case 4:
182 *d++ = *s++;
183 /*fall through*/
184 case 3:
185 *d++ = *s++;
186 /*fall through*/
187 case 2:
188 *d++ = *s++;
189 /*fall through*/
190 case 1:
191 *d++ = *s++;
192 break;
193 default:
194 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
195 *d = '\0';
196 return NT_STATUS_INVALID_PARAMETER;
197 }
198 }
199 start_of_name_component = False;
200 }
201
202 *d = '\0';
203
204 return ret;
205 }
206
207 /****************************************************************************
208 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
209 No wildcards allowed.
210 ****************************************************************************/
211
212 NTSTATUS check_path_syntax(char *path)
213 {
214 bool ignore;
215 return check_path_syntax_internal(path, False, &ignore);
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 Wildcards allowed - p_contains_wcard returns true if the last component contained
221 a wildcard.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
225 {
226 return check_path_syntax_internal(path, False, p_contains_wcard);
227 }
228
229 /****************************************************************************
230 Check the path for a POSIX client.
231 We're assuming here that '/' is not the second byte in any multibyte char
232 set (a safe assumption).
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_posix(char *path)
236 {
237 bool ignore;
238 return check_path_syntax_internal(path, True, &ignore);
239 }
240
241 /****************************************************************************
242 Pull a string and check the path allowing a wilcard - provide for error return.
243 ****************************************************************************/
244
245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
246 const char *base_ptr,
247 uint16 smb_flags2,
248 char **pp_dest,
249 const char *src,
250 size_t src_len,
251 int flags,
252 NTSTATUS *err,
253 bool *contains_wcard)
254 {
255 size_t ret;
256
257 *pp_dest = NULL;
258
259 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
260 src_len, flags);
261
262 if (!*pp_dest) {
263 *err = NT_STATUS_INVALID_PARAMETER;
264 return ret;
265 }
266
267 *contains_wcard = False;
268
269 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
270 /*
271 * For a DFS path the function parse_dfs_path()
272 * will do the path processing, just make a copy.
273 */
274 *err = NT_STATUS_OK;
275 return ret;
276 }
277
278 if (lp_posix_pathnames()) {
279 *err = check_path_syntax_posix(*pp_dest);
280 } else {
281 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
282 }
283
284 return ret;
285 }
286
287 /****************************************************************************
288 Pull a string and check the path - provide for error return.
289 ****************************************************************************/
290
291 size_t srvstr_get_path(TALLOC_CTX *ctx,
292 const char *base_ptr,
293 uint16 smb_flags2,
294 char **pp_dest,
295 const char *src,
296 size_t src_len,
297 int flags,
298 NTSTATUS *err)
299 {
300 bool ignore;
301 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
302 src_len, flags, err, &ignore);
303 }
304
305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
306 char **pp_dest, const char *src, int flags,
307 NTSTATUS *err, bool *contains_wcard)
308 {
309 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
310 pp_dest, src, smbreq_bufrem(req, src),
311 flags, err, contains_wcard);
312 }
313
314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err)
317 {
318 bool ignore;
319 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
320 flags, err, &ignore);
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if (!(fsp) || !(conn)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if ((fsp)->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if ((fsp)->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 (fsp)->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 /****************************************************************************
395 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
396 ****************************************************************************/
397
398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
399 files_struct *fsp)
400 {
401 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
402 && (req->vuid == (fsp)->vuid)) {
403 return True;
404 }
405
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return False;
408 }
409
410 static bool netbios_session_retarget(const char *name, int name_type)
411 {
412 char *trim_name;
413 char *trim_name_type;
414 const char *retarget_parm;
415 char *retarget;
416 char *p;
417 int retarget_type = 0x20;
418 int retarget_port = 139;
419 struct sockaddr_storage retarget_addr;
420 struct sockaddr_in *in_addr;
421 bool ret = false;
422 uint8_t outbuf[10];
423
424 if (get_socket_port(smbd_server_fd()) != 139) {
425 return false;
426 }
427
428 trim_name = talloc_strdup(talloc_tos(), name);
429 if (trim_name == NULL) {
430 goto fail;
431 }
432 trim_char(trim_name, ' ', ' ');
433
434 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
435 name_type);
436 if (trim_name_type == NULL) {
437 goto fail;
438 }
439
440 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
441 trim_name_type, NULL);
442 if (retarget_parm == NULL) {
443 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
444 trim_name, NULL);
445 }
446 if (retarget_parm == NULL) {
447 goto fail;
448 }
449
450 retarget = talloc_strdup(trim_name, retarget_parm);
451 if (retarget == NULL) {
452 goto fail;
453 }
454
455 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
456
457 p = strchr(retarget, ':');
458 if (p != NULL) {
459 *p++ = '\0';
460 retarget_port = atoi(p);
461 }
462
463 p = strchr_m(retarget, '#');
464 if (p != NULL) {
465 *p++ = '\0';
466 sscanf(p, "%x", &retarget_type);
467 }
468
469 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
470 if (!ret) {
471 DEBUG(10, ("could not resolve %s\n", retarget));
472 goto fail;
473 }
474
475 if (retarget_addr.ss_family != AF_INET) {
476 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
477 goto fail;
478 }
479
480 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
481
482 _smb_setlen(outbuf, 6);
483 SCVAL(outbuf, 0, 0x84);
484 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
485 *(uint16_t *)(outbuf+8) = htons(retarget_port);
486
487 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
488 NULL)) {
489 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
490 "failed.");
491 }
492
493 ret = true;
494 fail:
495 TALLOC_FREE(trim_name);
496 return ret;
497 }
498
499 /****************************************************************************
500 Reply to a (netbios-level) special message.
501 ****************************************************************************/
502
503 void reply_special(char *inbuf)
504 {
505 int msg_type = CVAL(inbuf,0);
506 int msg_flags = CVAL(inbuf,1);
507 fstring name1,name2;
508 char name_type1, name_type2;
509 struct smbd_server_connection *sconn = smbd_server_conn;
510
511 /*
512 * We only really use 4 bytes of the outbuf, but for the smb_setlen
513 * calculation & friends (srv_send_smb uses that) we need the full smb
514 * header.
515 */
516 char outbuf[smb_size];
517
518 *name1 = *name2 = 0;
519
520 memset(outbuf, '\0', sizeof(outbuf));
521
522 smb_setlen(outbuf,0);
523
524 switch (msg_type) {
525 case 0x81: /* session request */
526
527 if (sconn->nbt.got_session) {
528 exit_server_cleanly("multiple session request not permitted");
529 }
530
531 SCVAL(outbuf,0,0x82);
532 SCVAL(outbuf,3,0);
533 if (name_len(inbuf+4) > 50 ||
534 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
535 DEBUG(0,("Invalid name length in session request\n"));
536 return;
537 }
538 name_type1 = name_extract(inbuf,4,name1);
539 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
540 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
541 name1, name_type1, name2, name_type2));
542
543 if (netbios_session_retarget(name1, name_type1)) {
544 exit_server_cleanly("retargeted client");
545 }
546
547 set_local_machine_name(name1, True);
548 set_remote_machine_name(name2, True);
549
550 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
551 get_local_machine_name(), get_remote_machine_name(),
552 name_type2));
553
554 if (name_type2 == 'R') {
555 /* We are being asked for a pathworks session ---
556 no thanks! */
557 SCVAL(outbuf, 0,0x83);
558 break;
559 }
560
561 /* only add the client's machine name to the list
562 of possibly valid usernames if we are operating
563 in share mode security */
564 if (lp_security() == SEC_SHARE) {
565 add_session_user(sconn, get_remote_machine_name());
566 }
567
568 reload_services(True);
569 reopen_logs();
570
571 sconn->nbt.got_session = true;
572 break;
573
574 case 0x89: /* session keepalive request
575 (some old clients produce this?) */
576 SCVAL(outbuf,0,SMBkeepalive);
577 SCVAL(outbuf,3,0);
578 break;
579
580 case 0x82: /* positive session response */
581 case 0x83: /* negative session response */
582 case 0x84: /* retarget session response */
583 DEBUG(0,("Unexpected session response\n"));
584 break;
585
586 case SMBkeepalive: /* session keepalive */
587 default:
588 return;
589 }
590
591 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
592 msg_type, msg_flags));
593
594 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
595 return;
596 }
597
598 /****************************************************************************
599 Reply to a tcon.
600 conn POINTER CAN BE NULL HERE !
601 ****************************************************************************/
602
603 void reply_tcon(struct smb_request *req)
604 {
605 connection_struct *conn = req->conn;
606 const char *service;
607 char *service_buf = NULL;
608 char *password = NULL;
609 char *dev = NULL;
610 int pwlen=0;
611 NTSTATUS nt_status;
612 const char *p;
613 DATA_BLOB password_blob;
614 TALLOC_CTX *ctx = talloc_tos();
615 struct smbd_server_connection *sconn = smbd_server_conn;
616
617 START_PROFILE(SMBtcon);
618
619 if (req->buflen < 4) {
620 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
621 END_PROFILE(SMBtcon);
622 return;
623 }
624
625 p = (const char *)req->buf + 1;
626 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
627 p += 1;
628 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
629 p += pwlen+1;
630 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
631 p += 1;
632
633 if (service_buf == NULL || password == NULL || dev == NULL) {
634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
635 END_PROFILE(SMBtcon);
636 return;
637 }
638 p = strrchr_m(service_buf,'\\');
639 if (p) {
640 service = p+1;
641 } else {
642 service = service_buf;
643 }
644
645 password_blob = data_blob(password, pwlen+1);
646
647 conn = make_connection(sconn,service,password_blob,dev,
648 req->vuid,&nt_status);
649 req->conn = conn;
650
651 data_blob_clear_free(&password_blob);
652
653 if (!conn) {
654 reply_nterror(req, nt_status);
655 END_PROFILE(SMBtcon);
656 return;
657 }
658
659 reply_outbuf(req, 2, 0);
660 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
661 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
662 SSVAL(req->outbuf,smb_tid,conn->cnum);
663
664 DEBUG(3,("tcon service=%s cnum=%d\n",
665 service, conn->cnum));
666
667 END_PROFILE(SMBtcon);
668 return;
669 }
670
671 /****************************************************************************
672 Reply to a tcon and X.
673 conn POINTER CAN BE NULL HERE !
674 ****************************************************************************/
675
676 void reply_tcon_and_X(struct smb_request *req)
677 {
678 connection_struct *conn = req->conn;
679 const char *service = NULL;
680 DATA_BLOB password;
681 TALLOC_CTX *ctx = talloc_tos();
682 /* what the cleint thinks the device is */
683 char *client_devicetype = NULL;
684 /* what the server tells the client the share represents */
685 const char *server_devicetype;
686 NTSTATUS nt_status;
687 int passlen;
688 char *path = NULL;
689 const char *p, *q;
690 uint16 tcon_flags;
691 struct smbd_server_connection *sconn = smbd_server_conn;
692
693 START_PROFILE(SMBtconX);
694
695 if (req->wct < 4) {
696 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
697 END_PROFILE(SMBtconX);
698 return;
699 }
700
701 passlen = SVAL(req->vwv+3, 0);
702 tcon_flags = SVAL(req->vwv+2, 0);
703
704 /* we might have to close an old one */
705 if ((tcon_flags & 0x1) && conn) {
706 close_cnum(sconn, conn,req->vuid);
707 req->conn = NULL;
708 conn = NULL;
709 }
710
711 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
712 reply_doserror(req, ERRDOS, ERRbuftoosmall);
713 END_PROFILE(SMBtconX);
714 return;
715 }
716
717 if (sconn->smb1.negprot.encrypted_passwords) {
718 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
719 if (lp_security() == SEC_SHARE) {
720 /*
721 * Security = share always has a pad byte
722 * after the password.
723 */
724 p = (const char *)req->buf + passlen + 1;
725 } else {
726 p = (const char *)req->buf + passlen;
727 }
728 } else {
729 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
730 /* Ensure correct termination */
731 password.data[passlen]=0;
732 p = (const char *)req->buf + passlen + 1;
733 }
734
735 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
736
737 if (path == NULL) {
738 data_blob_clear_free(&password);
739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
740 END_PROFILE(SMBtconX);
741 return;
742 }
743
744 /*
745 * the service name can be either: \\server\share
746 * or share directly like on the DELL PowerVault 705
747 */
748 if (*path=='\\') {
749 q = strchr_m(path+2,'\\');
750 if (!q) {
751 data_blob_clear_free(&password);
752 reply_doserror(req, ERRDOS, ERRnosuchshare);
753 END_PROFILE(SMBtconX);
754 return;
755 }
756 service = q+1;
757 } else {
758 service = path;
759 }
760
761 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
762 &client_devicetype, p,
763 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
764
765 if (client_devicetype == NULL) {
766 data_blob_clear_free(&password);
767 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
768 END_PROFILE(SMBtconX);
769 return;
770 }
771
772 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
773
774 conn = make_connection(sconn, service, password, client_devicetype,
775 req->vuid, &nt_status);
776 req->conn =conn;
777
778 data_blob_clear_free(&password);
779
780 if (!conn) {
781 reply_nterror(req, nt_status);
782 END_PROFILE(SMBtconX);
783 return;
784 }
785
786 if ( IS_IPC(conn) )
787 server_devicetype = "IPC";
788 else if ( IS_PRINT(conn) )
789 server_devicetype = "LPT1:";
790 else
791 server_devicetype = "A:";
792
793 if (Protocol < PROTOCOL_NT1) {
794 reply_outbuf(req, 2, 0);
795 if (message_push_string(&req->outbuf, server_devicetype,
796 STR_TERMINATE|STR_ASCII) == -1) {
797 reply_nterror(req, NT_STATUS_NO_MEMORY);
798 END_PROFILE(SMBtconX);
799 return;
800 }
801 } else {
802 /* NT sets the fstype of IPC$ to the null string */
803 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
804
805 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
806 /* Return permissions. */
807 uint32 perm1 = 0;
808 uint32 perm2 = 0;
809
810 reply_outbuf(req, 7, 0);
811
812 if (IS_IPC(conn)) {
813 perm1 = FILE_ALL_ACCESS;
814 perm2 = FILE_ALL_ACCESS;
815 } else {
816 perm1 = CAN_WRITE(conn) ?
817 SHARE_ALL_ACCESS :
818 SHARE_READ_ONLY;
819 }
820
821 SIVAL(req->outbuf, smb_vwv3, perm1);
822 SIVAL(req->outbuf, smb_vwv5, perm2);
823 } else {
824 reply_outbuf(req, 3, 0);
825 }
826
827 if ((message_push_string(&req->outbuf, server_devicetype,
828 STR_TERMINATE|STR_ASCII) == -1)
829 || (message_push_string(&req->outbuf, fstype,
830 STR_TERMINATE) == -1)) {
831 reply_nterror(req, NT_STATUS_NO_MEMORY);
832 END_PROFILE(SMBtconX);
833 return;
834 }
835
836 /* what does setting this bit do? It is set by NT4 and
837 may affect the ability to autorun mounted cdroms */
838 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
839 (lp_csc_policy(SNUM(conn)) << 2));
840
841 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
842 DEBUG(2,("Serving %s as a Dfs root\n",
843 lp_servicename(SNUM(conn)) ));
844 SSVAL(req->outbuf, smb_vwv2,
845 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
846 }
847 }
848
849
850 DEBUG(3,("tconX service=%s \n",
851 service));
852
853 /* set the incoming and outgoing tid to the just created one */
854 SSVAL(req->inbuf,smb_tid,conn->cnum);
855 SSVAL(req->outbuf,smb_tid,conn->cnum);
856
857 END_PROFILE(SMBtconX);
858
859 req->tid = conn->cnum;
860 chain_reply(req);
861 return;
862 }
863
864 /****************************************************************************
865 Reply to an unknown type.
866 ****************************************************************************/
867
868 void reply_unknown_new(struct smb_request *req, uint8 type)
869 {
870 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
871 smb_fn_name(type), type, type));
872 reply_doserror(req, ERRSRV, ERRunknownsmb);
873 return;
874 }
875
876 /****************************************************************************
877 Reply to an ioctl.
878 conn POINTER CAN BE NULL HERE !
879 ****************************************************************************/
880
881 void reply_ioctl(struct smb_request *req)
882 {
883 connection_struct *conn = req->conn;
884 uint16 device;
885 uint16 function;
886 uint32 ioctl_code;
887 int replysize;
888 char *p;
889
890 START_PROFILE(SMBioctl);
891
892 if (req->wct < 3) {
893 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
894 END_PROFILE(SMBioctl);
895 return;
896 }
897
898 device = SVAL(req->vwv+1, 0);
899 function = SVAL(req->vwv+2, 0);
900 ioctl_code = (device << 16) + function;
901
902 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
903
904 switch (ioctl_code) {
905 case IOCTL_QUERY_JOB_INFO:
906 replysize = 32;
907 break;
908 default:
909 reply_doserror(req, ERRSRV, ERRnosupport);
910 END_PROFILE(SMBioctl);
911 return;
912 }
913
914 reply_outbuf(req, 8, replysize+1);
915 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
916 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
917 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
918 p = smb_buf(req->outbuf);
919 memset(p, '\0', replysize+1); /* valgrind-safe. */
920 p += 1; /* Allow for alignment */
921
922 switch (ioctl_code) {
923 case IOCTL_QUERY_JOB_INFO:
924 {
925 files_struct *fsp = file_fsp(
926 req, SVAL(req->vwv+0, 0));
927 if (!fsp) {
928 reply_doserror(req, ERRDOS, ERRbadfid);
929 END_PROFILE(SMBioctl);
930 return;
931 }
932 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
933 srvstr_push((char *)req->outbuf, req->flags2, p+2,
934 global_myname(), 15,
935 STR_TERMINATE|STR_ASCII);
936 if (conn) {
937 srvstr_push((char *)req->outbuf, req->flags2,
938 p+18, lp_servicename(SNUM(conn)),
939 13, STR_TERMINATE|STR_ASCII);
940 } else {
941 memset(p+18, 0, 13);
942 }
943 break;
944 }
945 }
946
947 END_PROFILE(SMBioctl);
948 return;
949 }
950
951 /****************************************************************************
952 Strange checkpath NTSTATUS mapping.
953 ****************************************************************************/
954
955 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
956 {
957 /* Strange DOS error code semantics only for checkpath... */
958 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
959 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
960 /* We need to map to ERRbadpath */
961 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
962 }
963 }
964 return status;
965 }
966
967 /****************************************************************************
968 Reply to a checkpath.
969 ****************************************************************************/
970
971 void reply_checkpath(struct smb_request *req)
972 {
973 connection_struct *conn = req->conn;
974 struct smb_filename *smb_fname = NULL;
975 char *name = NULL;
976 NTSTATUS status;
977 TALLOC_CTX *ctx = talloc_tos();
978
979 START_PROFILE(SMBcheckpath);
980
981 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
982 STR_TERMINATE, &status);
983
984 if (!NT_STATUS_IS_OK(status)) {
985 status = map_checkpath_error(req->flags2, status);
986 reply_nterror(req, status);
987 END_PROFILE(SMBcheckpath);
988 return;
989 }
990
991 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
992
993 status = filename_convert(ctx,
994 conn,
995 req->flags2 & FLAGS2_DFS_PATHNAMES,
996 name,
997 0,
998 NULL,
999 &smb_fname);
1000
1001 if (!NT_STATUS_IS_OK(status)) {
1002 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1003 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1004 ERRSRV, ERRbadpath);
1005 END_PROFILE(SMBcheckpath);
1006 return;
1007 }
1008 goto path_err;
1009 }
1010
1011 if (!VALID_STAT(smb_fname->st) &&
1012 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1013 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1014 smb_fname_str_dbg(smb_fname), strerror(errno)));
1015 status = map_nt_error_from_unix(errno);
1016 goto path_err;
1017 }
1018
1019 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1020 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1021 ERRDOS, ERRbadpath);
1022 goto out;
1023 }
1024
1025 reply_outbuf(req, 0, 0);
1026
1027 path_err:
1028 /* We special case this - as when a Windows machine
1029 is parsing a path is steps through the components
1030 one at a time - if a component fails it expects
1031 ERRbadpath, not ERRbadfile.
1032 */
1033 status = map_checkpath_error(req->flags2, status);
1034 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1035 /*
1036 * Windows returns different error codes if
1037 * the parent directory is valid but not the
1038 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1039 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1040 * if the path is invalid.
1041 */
1042 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1043 ERRDOS, ERRbadpath);
1044 goto out;
1045 }
1046
1047 reply_nterror(req, status);
1048
1049 out:
1050 TALLOC_FREE(smb_fname);
1051 END_PROFILE(SMBcheckpath);
1052 return;
1053 }
1054
1055 /****************************************************************************
1056 Reply to a getatr.
1057 ****************************************************************************/
1058
1059 void reply_getatr(struct smb_request *req)
1060 {
1061 connection_struct *conn = req->conn;
1062 struct smb_filename *smb_fname = NULL;
1063 char *fname = NULL;
1064 int mode=0;
1065 SMB_OFF_T size=0;
1066 time_t mtime=0;
1067 const char *p;
1068 NTSTATUS status;
1069 TALLOC_CTX *ctx = talloc_tos();
1070 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1071
1072 START_PROFILE(SMBgetatr);
1073
1074 p = (const char *)req->buf + 1;
1075 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1076 if (!NT_STATUS_IS_OK(status)) {
1077 reply_nterror(req, status);
1078 goto out;
1079 }
1080
1081 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1082 under WfWg - weird! */
1083 if (*fname == '\0') {
1084 mode = aHIDDEN | aDIR;
1085 if (!CAN_WRITE(conn)) {
1086 mode |= aRONLY;
1087 }
1088 size = 0;
1089 mtime = 0;
1090 } else {
1091 status = filename_convert(ctx,
1092 conn,
1093 req->flags2 & FLAGS2_DFS_PATHNAMES,
1094 fname,
1095 0,
1096 NULL,
1097 &smb_fname);
1098 if (!NT_STATUS_IS_OK(status)) {
1099 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1100 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1101 ERRSRV, ERRbadpath);
1102 goto out;
1103 }
1104 reply_nterror(req, status);
1105 goto out;
1106 }
1107 if (!VALID_STAT(smb_fname->st) &&
1108 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1109 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1110 smb_fname_str_dbg(smb_fname),
1111 strerror(errno)));
1112 reply_nterror(req, map_nt_error_from_unix(errno));
1113 goto out;
1114 }
1115
1116 mode = dos_mode(conn, smb_fname);
1117 size = smb_fname->st.st_ex_size;
1118
1119 if (ask_sharemode) {
1120 struct timespec write_time_ts;
1121 struct file_id fileid;
1122
1123 ZERO_STRUCT(write_time_ts);
1124 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1125 get_file_infos(fileid, NULL, &write_time_ts);
1126 if (!null_timespec(write_time_ts)) {
1127 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1128 }
1129 }
1130
1131 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1132 if (mode & aDIR) {
1133 size = 0;
1134 }
1135 }
1136
1137 reply_outbuf(req, 10, 0);
1138
1139 SSVAL(req->outbuf,smb_vwv0,mode);
1140 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1141 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1142 } else {
1143 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1144 }
1145 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1146
1147 if (Protocol >= PROTOCOL_NT1) {
1148 SSVAL(req->outbuf, smb_flg2,
1149 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1150 }
1151
1152 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1153 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1154
1155 out:
1156 TALLOC_FREE(smb_fname);
1157 TALLOC_FREE(fname);
1158 END_PROFILE(SMBgetatr);
1159 return;
1160 }
1161
1162 /****************************************************************************
1163 Reply to a setatr.
1164 ****************************************************************************/
1165
1166 void reply_setatr(struct smb_request *req)
1167 {
1168 struct smb_file_time ft;
1169 connection_struct *conn = req->conn;
1170 struct smb_filename *smb_fname = NULL;
1171 char *fname = NULL;
1172 int mode;
1173 time_t mtime;
1174 const char *p;
1175 NTSTATUS status;
1176 TALLOC_CTX *ctx = talloc_tos();
1177
1178 START_PROFILE(SMBsetatr);
1179
1180 ZERO_STRUCT(ft);
1181
1182 if (req->wct < 2) {
1183 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1184 goto out;
1185 }
1186
1187 p = (const char *)req->buf + 1;
1188 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1189 if (!NT_STATUS_IS_OK(status)) {
1190 reply_nterror(req, status);
1191 goto out;
1192 }
1193
1194 status = filename_convert(ctx,
1195 conn,
1196 req->flags2 & FLAGS2_DFS_PATHNAMES,
1197 fname,
1198 0,
1199 NULL,
1200 &smb_fname);
1201 if (!NT_STATUS_IS_OK(status)) {
1202 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1203 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1204 ERRSRV, ERRbadpath);
1205 goto out;
1206 }
1207 reply_nterror(req, status);
1208 goto out;
1209 }
1210
1211 if (smb_fname->base_name[0] == '.' &&
1212 smb_fname->base_name[1] == '\0') {
1213 /*
1214 * Not sure here is the right place to catch this
1215 * condition. Might be moved to somewhere else later -- vl
1216 */
1217 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1218 goto out;
1219 }
1220
1221 mode = SVAL(req->vwv+0, 0);
1222 mtime = srv_make_unix_date3(req->vwv+1);
1223
1224 ft.mtime = convert_time_t_to_timespec(mtime);
1225 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1226 if (!NT_STATUS_IS_OK(status)) {
1227 reply_nterror(req, status);
1228 goto out;
1229 }
1230
1231 if (mode != FILE_ATTRIBUTE_NORMAL) {
1232 if (VALID_STAT_OF_DIR(smb_fname->st))
1233 mode |= aDIR;
1234 else
1235 mode &= ~aDIR;
1236
1237 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1238 false) != 0) {
1239 reply_nterror(req, map_nt_error_from_unix(errno));
1240 goto out;
1241 }
1242 }
1243
1244 reply_outbuf(req, 0, 0);
1245
1246 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1247 mode));
1248 out:
1249 TALLOC_FREE(smb_fname);
1250 END_PROFILE(SMBsetatr);
1251 return;
1252 }
1253
1254 /****************************************************************************
1255 Reply to a dskattr.
1256 ****************************************************************************/
1257
1258 void reply_dskattr(struct smb_request *req)
1259 {
1260 connection_struct *conn = req->conn;
1261 uint64_t dfree,dsize,bsize;
1262 START_PROFILE(SMBdskattr);
1263
1264 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1265 reply_nterror(req, map_nt_error_from_unix(errno));
1266 END_PROFILE(SMBdskattr);
1267 return;
1268 }
1269
1270 reply_outbuf(req, 5, 0);
1271
1272 if (Protocol <= PROTOCOL_LANMAN2) {
1273 double total_space, free_space;
1274 /* we need to scale this to a number that DOS6 can handle. We
1275 use floating point so we can handle large drives on systems
1276 that don't have 64 bit integers
1277
1278 we end up displaying a maximum of 2G to DOS systems
1279 */
1280 total_space = dsize * (double)bsize;
1281 free_space = dfree * (double)bsize;
1282
1283 dsize = (uint64_t)((total_space+63*512) / (64*512));
1284 dfree = (uint64_t)((free_space+63*512) / (64*512));
1285
1286 if (dsize > 0xFFFF) dsize = 0xFFFF;
1287 if (dfree > 0xFFFF) dfree = 0xFFFF;
1288
1289 SSVAL(req->outbuf,smb_vwv0,dsize);
1290 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1291 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1292 SSVAL(req->outbuf,smb_vwv3,dfree);
1293 } else {
1294 SSVAL(req->outbuf,smb_vwv0,dsize);
1295 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1296 SSVAL(req->outbuf,smb_vwv2,512);
1297 SSVAL(req->outbuf,smb_vwv3,dfree);
1298 }
1299
1300 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1301
1302 END_PROFILE(SMBdskattr);
1303 return;
1304 }
1305
1306 /*
1307 * Utility function to split the filename from the directory.
1308 */
1309 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1310 char **fname_dir_out,
1311 char **fname_mask_out)
1312 {
1313 const char *p = NULL;
1314 char *fname_dir = NULL;
1315 char *fname_mask = NULL;
1316
1317 p = strrchr_m(fname_in, '/');
1318 if (!p) {
1319 fname_dir = talloc_strdup(ctx, ".");
1320 fname_mask = talloc_strdup(ctx, fname_in);
1321 } else {
1322 fname_dir = talloc_strndup(ctx, fname_in,
1323 PTR_DIFF(p, fname_in));
1324 fname_mask = talloc_strdup(ctx, p+1);
1325 }
1326
1327 if (!fname_dir || !fname_mask) {
1328 TALLOC_FREE(fname_dir);
1329 TALLOC_FREE(fname_mask);
1330 return NT_STATUS_NO_MEMORY;
1331 }
1332
1333 *fname_dir_out = fname_dir;
1334 *fname_mask_out = fname_mask;
1335 return NT_STATUS_OK;
1336 }
1337
1338 /****************************************************************************
1339 Reply to a search.
1340 Can be called from SMBsearch, SMBffirst or SMBfunique.
1341 ****************************************************************************/
1342
1343 void reply_search(struct smb_request *req)
1344 {
1345 connection_struct *conn = req->conn;
1346 char *path = NULL;
1347 const char *mask = NULL;
1348 char *directory = NULL;
1349 struct smb_filename *smb_fname = NULL;
1350 char *fname = NULL;
1351 SMB_OFF_T size;
1352 uint32 mode;
1353 struct timespec date;
1354 uint32 dirtype;
1355 unsigned int numentries = 0;
1356 unsigned int maxentries = 0;
1357 bool finished = False;
1358 const char *p;
1359 int status_len;
1360 char status[21];
1361 int dptr_num= -1;
1362 bool check_descend = False;
1363 bool expect_close = False;
1364 NTSTATUS nt_status;
1365 bool mask_contains_wcard = False;
1366 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1367 TALLOC_CTX *ctx = talloc_tos();
1368 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1369
1370 START_PROFILE(SMBsearch);
1371
1372 if (req->wct < 2) {
1373 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1374 goto out;
1375 }
1376
1377 if (lp_posix_pathnames()) {
1378 reply_unknown_new(req, req->cmd);
1379 goto out;
1380 }
1381
1382 /* If we were called as SMBffirst then we must expect close. */
1383 if(req->cmd == SMBffirst) {
1384 expect_close = True;
1385 }
1386
1387 reply_outbuf(req, 1, 3);
1388 maxentries = SVAL(req->vwv+0, 0);
1389 dirtype = SVAL(req->vwv+1, 0);
1390 p = (const char *)req->buf + 1;
1391 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1392 &nt_status, &mask_contains_wcard);
1393 if (!NT_STATUS_IS_OK(nt_status)) {
1394 reply_nterror(req, nt_status);
1395 goto out;
1396 }
1397
1398 p++;
1399 status_len = SVAL(p, 0);
1400 p += 2;
1401
1402 /* dirtype &= ~aDIR; */
1403
1404 if (status_len == 0) {
1405 nt_status = filename_convert(ctx, conn,
1406 req->flags2 & FLAGS2_DFS_PATHNAMES,
1407 path,
1408 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1409 &mask_contains_wcard,
1410 &smb_fname);
1411 if (!NT_STATUS_IS_OK(nt_status)) {
1412 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1413 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1414 ERRSRV, ERRbadpath);
1415 goto out;
1416 }
1417 reply_nterror(req, nt_status);
1418 goto out;
1419 }
1420
1421 directory = smb_fname->base_name;
1422
1423 p = strrchr_m(directory,'/');
1424 if ((p != NULL) && (*directory != '/')) {
1425 mask = p + 1;
1426 directory = talloc_strndup(ctx, directory,
1427 PTR_DIFF(p, directory));
1428 } else {
1429 mask = directory;
1430 directory = talloc_strdup(ctx,".");
1431 }
1432
1433 if (!directory) {
1434 reply_nterror(req, NT_STATUS_NO_MEMORY);
1435 goto out;
1436 }
1437
1438 memset((char *)status,'\0',21);
1439 SCVAL(status,0,(dirtype & 0x1F));
1440
1441 nt_status = dptr_create(conn,
1442 directory,
1443 True,
1444 expect_close,
1445 req->smbpid,
1446 mask,
1447 mask_contains_wcard,
1448 dirtype,
1449 &conn->dirptr);
1450 if (!NT_STATUS_IS_OK(nt_status)) {
1451 reply_nterror(req, nt_status);
1452 goto out;
1453 }
1454 dptr_num = dptr_dnum(conn->dirptr);
1455 } else {
1456 int status_dirtype;
1457
1458 memcpy(status,p,21);
1459 status_dirtype = CVAL(status,0) & 0x1F;
1460 if (status_dirtype != (dirtype & 0x1F)) {
1461 dirtype = status_dirtype;
1462 }
1463
1464 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1465 if (!conn->dirptr) {
1466 goto SearchEmpty;
1467 }
1468 string_set(&conn->dirpath,dptr_path(dptr_num));
1469 mask = dptr_wcard(dptr_num);
1470 if (!mask) {
1471 goto SearchEmpty;
1472 }
1473 /*
1474 * For a 'continue' search we have no string. So
1475 * check from the initial saved string.
1476 */
1477 mask_contains_wcard = ms_has_wild(mask);
1478 dirtype = dptr_attr(dptr_num);
1479 }
1480
1481 DEBUG(4,("dptr_num is %d\n",dptr_num));
1482
1483 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1484 dptr_init_search_op(conn->dirptr);
1485
1486 if ((dirtype&0x1F) == aVOLID) {
1487 char buf[DIR_STRUCT_SIZE];
1488 memcpy(buf,status,21);
1489 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1490 0,aVOLID,0,!allow_long_path_components)) {
1491 reply_nterror(req, NT_STATUS_NO_MEMORY);
1492 goto out;
1493 }
1494 dptr_fill(buf+12,dptr_num);
1495 if (dptr_zero(buf+12) && (status_len==0)) {
1496 numentries = 1;
1497 } else {
1498 numentries = 0;
1499 }
1500 if (message_push_blob(&req->outbuf,
1501 data_blob_const(buf, sizeof(buf)))
1502 == -1) {
1503 reply_nterror(req, NT_STATUS_NO_MEMORY);
1504 goto out;
1505 }
1506 } else {
1507 unsigned int i;
1508 maxentries = MIN(
1509 maxentries,
1510 ((BUFFER_SIZE -
1511 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1512 /DIR_STRUCT_SIZE));
1513
1514 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1515 conn->dirpath,lp_dontdescend(SNUM(conn))));
1516 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1517 check_descend = True;
1518 }
1519
1520 for (i=numentries;(i<maxentries) && !finished;i++) {
1521 finished = !get_dir_entry(ctx,
1522 conn,
1523 mask,
1524 dirtype,
1525 &fname,
1526 &size,
1527 &mode,
1528 &date,
1529 check_descend,
1530 ask_sharemode);
1531 if (!finished) {
1532 char buf[DIR_STRUCT_SIZE];
1533 memcpy(buf,status,21);
1534 if (!make_dir_struct(ctx,
1535 buf,
1536 mask,
1537 fname,
1538 size,
1539 mode,
1540 convert_timespec_to_time_t(date),
1541 !allow_long_path_components)) {
1542 reply_nterror(req, NT_STATUS_NO_MEMORY);
1543 goto out;
1544 }
1545 if (!dptr_fill(buf+12,dptr_num)) {
1546 break;
1547 }
1548 if (message_push_blob(&req->outbuf,
1549 data_blob_const(buf, sizeof(buf)))
1550 == -1) {
1551 reply_nterror(req, NT_STATUS_NO_MEMORY);
1552 goto out;
1553 }
1554 numentries++;
1555 }
1556 }
1557 }
1558
1559 SearchEmpty:
1560
1561 /* If we were called as SMBffirst with smb_search_id == NULL
1562 and no entries were found then return error and close dirptr
1563 (X/Open spec) */
1564
1565 if (numentries == 0) {
1566 dptr_close(&dptr_num);
1567 } else if(expect_close && status_len == 0) {
1568 /* Close the dptr - we know it's gone */
1569 dptr_close(&dptr_num);
1570 }
1571
1572 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1573 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1574 dptr_close(&dptr_num);
1575 }
1576
1577 if ((numentries == 0) && !mask_contains_wcard) {
1578 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1579 goto out;
1580 }
1581
1582 SSVAL(req->outbuf,smb_vwv0,numentries);
1583 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1584 SCVAL(smb_buf(req->outbuf),0,5);
1585 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1586
1587 /* The replies here are never long name. */
1588 SSVAL(req->outbuf, smb_flg2,
1589 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1590 if (!allow_long_path_components) {
1591 SSVAL(req->outbuf, smb_flg2,
1592 SVAL(req->outbuf, smb_flg2)
1593 & (~FLAGS2_LONG_PATH_COMPONENTS));
1594 }
1595
1596 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1597 SSVAL(req->outbuf, smb_flg2,
1598 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1599
1600 if (!directory) {
1601 directory = dptr_path(dptr_num);
1602 }
1603
1604 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1605 smb_fn_name(req->cmd),
1606 mask,
1607 directory ? directory : "./",
1608 dirtype,
1609 numentries,
1610 maxentries ));
1611 out:
1612 TALLOC_FREE(smb_fname);
1613 END_PROFILE(SMBsearch);
1614 return;
1615 }
1616
1617 /****************************************************************************
1618 Reply to a fclose (stop directory search).
1619 ****************************************************************************/
1620
1621 void reply_fclose(struct smb_request *req)
1622 {
1623 int status_len;
1624 char status[21];
1625 int dptr_num= -2;
1626 const char *p;
1627 char *path = NULL;
1628 NTSTATUS err;
1629 bool path_contains_wcard = False;
1630 TALLOC_CTX *ctx = talloc_tos();
1631
1632 START_PROFILE(SMBfclose);
1633
1634 if (lp_posix_pathnames()) {
1635 reply_unknown_new(req, req->cmd);
1636 END_PROFILE(SMBfclose);
1637 return;
1638 }
1639
1640 p = (const char *)req->buf + 1;
1641 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1642 &err, &path_contains_wcard);
1643 if (!NT_STATUS_IS_OK(err)) {
1644 reply_nterror(req, err);
1645 END_PROFILE(SMBfclose);
1646 return;
1647 }
1648 p++;
1649 status_len = SVAL(p,0);
1650 p += 2;
1651
1652 if (status_len == 0) {
1653 reply_doserror(req, ERRSRV, ERRsrverror);
1654 END_PROFILE(SMBfclose);
1655 return;
1656 }
1657
1658 memcpy(status,p,21);
1659
1660 if(dptr_fetch(status+12,&dptr_num)) {
1661 /* Close the dptr - we know it's gone */
1662 dptr_close(&dptr_num);
1663 }
1664
1665 reply_outbuf(req, 1, 0);
1666 SSVAL(req->outbuf,smb_vwv0,0);
1667
1668 DEBUG(3,("search close\n"));
1669
1670 END_PROFILE(SMBfclose);
1671 return;
1672 }
1673
1674 /****************************************************************************
1675 Reply to an open.
1676 ****************************************************************************/
1677
1678 void reply_open(struct smb_request *req)
1679 {
1680 connection_struct *conn = req->conn;
1681 struct smb_filename *smb_fname = NULL;
1682 char *fname = NULL;
1683 uint32 fattr=0;
1684 SMB_OFF_T size = 0;
1685 time_t mtime=0;
1686 int info;
1687 files_struct *fsp;
1688 int oplock_request;
1689 int deny_mode;
1690 uint32 dos_attr;
1691 uint32 access_mask;
1692 uint32 share_mode;
1693 uint32 create_disposition;
1694 uint32 create_options = 0;
1695 NTSTATUS status;
1696 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1697 TALLOC_CTX *ctx = talloc_tos();
1698
1699 START_PROFILE(SMBopen);
1700
1701 if (req->wct < 2) {
1702 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1703 goto out;
1704 }
1705
1706 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1707 deny_mode = SVAL(req->vwv+0, 0);
1708 dos_attr = SVAL(req->vwv+1, 0);
1709
1710 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1711 STR_TERMINATE, &status);
1712 if (!NT_STATUS_IS_OK(status)) {
1713 reply_nterror(req, status);
1714 goto out;
1715 }
1716
1717 status = filename_convert(ctx,
1718 conn,
1719 req->flags2 & FLAGS2_DFS_PATHNAMES,
1720 fname,
1721 0,
1722 NULL,
1723 &smb_fname);
1724 if (!NT_STATUS_IS_OK(status)) {
1725 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1726 reply_botherror(req,
1727 NT_STATUS_PATH_NOT_COVERED,
1728 ERRSRV, ERRbadpath);
1729 goto out;
1730 }
1731 reply_nterror(req, status);
1732 goto out;
1733 }
1734
1735 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1736 OPENX_FILE_EXISTS_OPEN, &access_mask,
1737 &share_mode, &create_disposition,
1738 &create_options)) {
1739 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1740 goto out;
1741 }
1742
1743 status = SMB_VFS_CREATE_FILE(
1744 conn, /* conn */
1745 req, /* req */
1746 0, /* root_dir_fid */
1747 smb_fname, /* fname */
1748 access_mask, /* access_mask */
1749 share_mode, /* share_access */
1750 create_disposition, /* create_disposition*/
1751 create_options, /* create_options */
1752 dos_attr, /* file_attributes */
1753 oplock_request, /* oplock_request */
1754 0, /* allocation_size */
1755 NULL, /* sd */
1756 NULL, /* ea_list */
1757 &fsp, /* result */
1758 &info); /* pinfo */
1759
1760 if (!NT_STATUS_IS_OK(status)) {
1761 if (open_was_deferred(req->mid)) {
1762 /* We have re-scheduled this call. */
1763 goto out;
1764 }
1765 reply_openerror(req, status);
1766 goto out;
1767 }
1768
1769 size = smb_fname->st.st_ex_size;
1770 fattr = dos_mode(conn, smb_fname);
1771
1772 /* Deal with other possible opens having a modified
1773 write time. JRA. */
1774 if (ask_sharemode) {
1775 struct timespec write_time_ts;
1776
1777 ZERO_STRUCT(write_time_ts);
1778 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1779 if (!null_timespec(write_time_ts)) {
1780 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1781 }
1782 }
1783
1784 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1785
1786 if (fattr & aDIR) {
1787 DEBUG(3,("attempt to open a directory %s\n",
1788 fsp_str_dbg(fsp)));
1789 close_file(req, fsp, ERROR_CLOSE);
1790 reply_doserror(req, ERRDOS,ERRnoaccess);
1791 goto out;
1792 }
1793
1794 reply_outbuf(req, 7, 0);
1795 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1796 SSVAL(req->outbuf,smb_vwv1,fattr);
1797 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1798 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1799 } else {
1800 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1801 }
1802 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1803 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1804
1805 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1806 SCVAL(req->outbuf,smb_flg,
1807 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1808 }
1809
1810 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1811 SCVAL(req->outbuf,smb_flg,
1812 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1813 }
1814 out:
1815 TALLOC_FREE(smb_fname);
1816 END_PROFILE(SMBopen);
1817 return;
1818 }
1819
1820 /****************************************************************************
1821 Reply to an open and X.
1822 ****************************************************************************/
1823
1824 void reply_open_and_X(struct smb_request *req)
1825 {
1826 connection_struct *conn = req->conn;
1827 struct smb_filename *smb_fname = NULL;
1828 char *fname = NULL;
1829 uint16 open_flags;
1830 int deny_mode;
1831 uint32 smb_attr;
1832 /* Breakout the oplock request bits so we can set the
1833 reply bits separately. */
1834 int ex_oplock_request;
1835 int core_oplock_request;
1836 int oplock_request;
1837 #if 0
1838 int smb_sattr = SVAL(req->vwv+4, 0);
1839 uint32 smb_time = make_unix_date3(req->vwv+6);
1840 #endif
1841 int smb_ofun;
1842 uint32 fattr=0;
1843 int mtime=0;
1844 int smb_action = 0;
1845 files_struct *fsp;
1846 NTSTATUS status;
1847 uint64_t allocation_size;
1848 ssize_t retval = -1;
1849 uint32 access_mask;
1850 uint32 share_mode;
1851 uint32 create_disposition;
1852 uint32 create_options = 0;
1853 TALLOC_CTX *ctx = talloc_tos();
1854
1855 START_PROFILE(SMBopenX);
1856
1857 if (req->wct < 15) {
1858 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1859 goto out;
1860 }
1861
1862 open_flags = SVAL(req->vwv+2, 0);
1863 deny_mode = SVAL(req->vwv+3, 0);
1864 smb_attr = SVAL(req->vwv+5, 0);
1865 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1866 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1867 oplock_request = ex_oplock_request | core_oplock_request;
1868 smb_ofun = SVAL(req->vwv+8, 0);
1869 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1870
1871 /* If it's an IPC, pass off the pipe handler. */
1872 if (IS_IPC(conn)) {
1873 if (lp_nt_pipe_support()) {
1874 reply_open_pipe_and_X(conn, req);
1875 } else {
1876 reply_doserror(req, ERRSRV, ERRaccess);
1877 }
1878 goto out;
1879 }
1880
1881 /* XXXX we need to handle passed times, sattr and flags */
1882 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1883 STR_TERMINATE, &status);
1884 if (!NT_STATUS_IS_OK(status)) {
1885 reply_nterror(req, status);
1886 goto out;
1887 }
1888
1889 status = filename_convert(ctx,
1890 conn,
1891 req->flags2 & FLAGS2_DFS_PATHNAMES,
1892 fname,
1893 0,
1894 NULL,
1895 &smb_fname);
1896 if (!NT_STATUS_IS_OK(status)) {
1897 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1898 reply_botherror(req,
1899 NT_STATUS_PATH_NOT_COVERED,
1900 ERRSRV, ERRbadpath);
1901 goto out;
1902 }
1903 reply_nterror(req, status);
1904 goto out;
1905 }
1906
1907 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1908 &access_mask, &share_mode,
1909 &create_disposition,
1910 &create_options)) {
1911 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1912 goto out;
1913 }
1914
1915 status = SMB_VFS_CREATE_FILE(
1916 conn, /* conn */
1917 req, /* req */
1918 0, /* root_dir_fid */
1919 smb_fname, /* fname */
1920 access_mask, /* access_mask */
1921 share_mode, /* share_access */
1922 create_disposition, /* create_disposition*/
1923 create_options, /* create_options */
1924 smb_attr, /* file_attributes */
1925 oplock_request, /* oplock_request */
1926 0, /* allocation_size */
1927 NULL, /* sd */
1928 NULL, /* ea_list */
1929 &fsp, /* result */
1930 &smb_action); /* pinfo */
1931
1932 if (!NT_STATUS_IS_OK(status)) {
1933 if (open_was_deferred(req->mid)) {
1934 /* We have re-scheduled this call. */
1935 goto out;
1936 }
1937 reply_openerror(req, status);
1938 goto out;
1939 }
1940
1941 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1942 if the file is truncated or created. */
1943 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1944 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1945 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1946 close_file(req, fsp, ERROR_CLOSE);
1947 reply_nterror(req, NT_STATUS_DISK_FULL);
1948 goto out;
1949 }
1950 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1951 if (retval < 0) {
1952 close_file(req, fsp, ERROR_CLOSE);
1953 reply_nterror(req, NT_STATUS_DISK_FULL);
1954 goto out;
1955 }
1956 smb_fname->st.st_ex_size =
1957 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1958 }
1959
1960 fattr = dos_mode(conn, smb_fname);
1961 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1962 if (fattr & aDIR) {
1963 close_file(req, fsp, ERROR_CLOSE);
1964 reply_doserror(req, ERRDOS, ERRnoaccess);
1965 goto out;
1966 }
1967
1968 /* If the caller set the extended oplock request bit
1969 and we granted one (by whatever means) - set the
1970 correct bit for extended oplock reply.
1971 */
1972
1973 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1974 smb_action |= EXTENDED_OPLOCK_GRANTED;
1975 }
1976
1977 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1978 smb_action |= EXTENDED_OPLOCK_GRANTED;
1979 }
1980
1981 /* If the caller set the core oplock request bit
1982 and we granted one (by whatever means) - set the
1983 correct bit for core oplock reply.
1984 */
1985
1986 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1987 reply_outbuf(req, 19, 0);
1988 } else {
1989 reply_outbuf(req, 15, 0);
1990 }
1991
1992 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1993 SCVAL(req->outbuf, smb_flg,
1994 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1995 }
1996
1997 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1998 SCVAL(req->outbuf, smb_flg,
1999 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2000 }
2001
2002 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2003 SSVAL(req->outbuf,smb_vwv3,fattr);
2004 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2005 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2006 } else {
2007 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2008 }
2009 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2010 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2011 SSVAL(req->outbuf,smb_vwv11,smb_action);
2012
2013 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2014 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2015 }
2016
2017 chain_reply(req);
2018 out:
2019 TALLOC_FREE(smb_fname);
2020 END_PROFILE(SMBopenX);
2021 return;
2022 }
2023
2024 /****************************************************************************
2025 Reply to a SMBulogoffX.
2026 ****************************************************************************/
2027
2028 void reply_ulogoffX(struct smb_request *req)
2029 {
2030 struct smbd_server_connection *sconn = smbd_server_conn;
2031 user_struct *vuser;
2032
2033 START_PROFILE(SMBulogoffX);
2034
2035 vuser = get_valid_user_struct(sconn, req->vuid);
2036
2037 if(vuser == NULL) {
2038 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2039 req->vuid));
2040 }
2041
2042 /* in user level security we are supposed to close any files
2043 open by this user */
2044 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2045 file_close_user(req->vuid);
2046 }
2047
2048 invalidate_vuid(sconn, req->vuid);
2049
2050 reply_outbuf(req, 2, 0);
2051
2052 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2053
2054 END_PROFILE(SMBulogoffX);
2055 req->vuid = UID_FIELD_INVALID;
2056 chain_reply(req);
2057 }
2058
2059 /****************************************************************************
2060 Reply to a mknew or a create.
2061 ****************************************************************************/
2062
2063 void reply_mknew(struct smb_request *req)
2064 {
2065 connection_struct *conn = req->conn;
2066 struct smb_filename *smb_fname = NULL;
2067 char *fname = NULL;
2068 uint32 fattr = 0;
2069 struct smb_file_time ft;
2070 files_struct *fsp;
2071 int oplock_request = 0;
2072 NTSTATUS status;
2073 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2074 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2075 uint32 create_disposition;
2076 uint32 create_options = 0;
2077 TALLOC_CTX *ctx = talloc_tos();
2078
2079 START_PROFILE(SMBcreate);
2080 ZERO_STRUCT(ft);
2081
2082 if (req->wct < 3) {
2083 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2084 goto out;
2085 }
2086
2087 fattr = SVAL(req->vwv+0, 0);
2088 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2089
2090 /* mtime. */
2091 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2092
2093 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2094 STR_TERMINATE, &status);
2095 if (!NT_STATUS_IS_OK(status)) {
2096 reply_nterror(req, status);
2097 goto out;
2098 }
2099
2100 status = filename_convert(ctx,
2101 conn,
2102 req->flags2 & FLAGS2_DFS_PATHNAMES,
2103 fname,
2104 0,
2105 NULL,
2106 &smb_fname);
2107 if (!NT_STATUS_IS_OK(status)) {
2108 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2109 reply_botherror(req,
2110 NT_STATUS_PATH_NOT_COVERED,
2111 ERRSRV, ERRbadpath);
2112 goto out;
2113 }
2114 reply_nterror(req, status);
2115 goto out;
2116 }
2117
2118 if (fattr & aVOLID) {
2119 DEBUG(0,("Attempt to create file (%s) with volid set - "
2120 "please report this\n",
2121 smb_fname_str_dbg(smb_fname)));
2122 }
2123
2124 if(req->cmd == SMBmknew) {
2125 /* We should fail if file exists. */
2126 create_disposition = FILE_CREATE;
2127 } else {
2128 /* Create if file doesn't exist, truncate if it does. */
2129 create_disposition = FILE_OVERWRITE_IF;
2130 }
2131
2132 status = SMB_VFS_CREATE_FILE(
2133 conn, /* conn */
2134 req, /* req */
2135 0, /* root_dir_fid */
2136 smb_fname, /* fname */
2137 access_mask, /* access_mask */
2138 share_mode, /* share_access */
2139 create_disposition, /* create_disposition*/
2140 create_options, /* create_options */
2141 fattr, /* file_attributes */
2142 oplock_request, /* oplock_request */
2143 0, /* allocation_size */
2144 NULL, /* sd */
2145 NULL, /* ea_list */
2146 &fsp, /* result */
2147 NULL); /* pinfo */
2148
2149 if (!NT_STATUS_IS_OK(status)) {
2150 if (open_was_deferred(req->mid)) {
2151 /* We have re-scheduled this call. */
2152 goto out;
2153 }
2154 reply_openerror(req, status);
2155 goto out;
2156 }
2157
2158 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2159 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2160 if (!NT_STATUS_IS_OK(status)) {
2161 END_PROFILE(SMBcreate);
2162 goto out;
2163 }
2164
2165 reply_outbuf(req, 1, 0);
2166 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2167
2168 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2169 SCVAL(req->outbuf,smb_flg,
2170 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2171 }
2172
2173 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2174 SCVAL(req->outbuf,smb_flg,
2175 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2176 }
2177
2178 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2179 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2180 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2181 (unsigned int)fattr));
2182
2183 out:
2184 TALLOC_FREE(smb_fname);
2185 END_PROFILE(SMBcreate);
2186 return;
2187 }
2188
2189 /****************************************************************************
2190 Reply to a create temporary file.
2191 ****************************************************************************/
2192
2193 void reply_ctemp(struct smb_request *req)
2194 {
2195 connection_struct *conn = req->conn;
2196 struct smb_filename *smb_fname = NULL;
2197 char *fname = NULL;
2198 uint32 fattr;
2199 files_struct *fsp;
2200 int oplock_request;
2201 int tmpfd;
2202 char *s;
2203 NTSTATUS status;
2204 TALLOC_CTX *ctx = talloc_tos();
2205
2206 START_PROFILE(SMBctemp);
2207
2208 if (req->wct < 3) {
2209 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2210 goto out;
2211 }
2212
2213 fattr = SVAL(req->vwv+0, 0);
2214 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2215
2216 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2217 STR_TERMINATE, &status);
2218 if (!NT_STATUS_IS_OK(status)) {
2219 reply_nterror(req, status);
2220 goto out;
2221 }
2222 if (*fname) {
2223 fname = talloc_asprintf(ctx,
2224 "%s/TMXXXXXX",
2225 fname);
2226 } else {
2227 fname = talloc_strdup(ctx, "TMXXXXXX");
2228 }
2229
2230 if (!fname) {
2231 reply_nterror(req, NT_STATUS_NO_MEMORY);
2232 goto out;
2233 }
2234
2235 status = filename_convert(ctx, conn,
2236 req->flags2 & FLAGS2_DFS_PATHNAMES,
2237 fname,
2238 0,
2239 NULL,
2240 &smb_fname);
2241 if (!NT_STATUS_IS_OK(status)) {
2242 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2243 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2244 ERRSRV, ERRbadpath);
2245 goto out;
2246 }
2247 reply_nterror(req, status);
2248 goto out;
2249 }
2250
2251 tmpfd = mkstemp(smb_fname->base_name);
2252 if (tmpfd == -1) {
2253 reply_nterror(req, map_nt_error_from_unix(errno));
2254 goto out;
2255 }
2256
2257 SMB_VFS_STAT(conn, smb_fname);
2258
2259 /* We should fail if file does not exist. */
2260 status = SMB_VFS_CREATE_FILE(
2261 conn, /* conn */
2262 req, /* req */
2263 0, /* root_dir_fid */
2264 smb_fname, /* fname */
2265 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2266 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2267 FILE_OPEN, /* create_disposition*/
2268 0, /* create_options */
2269 fattr, /* file_attributes */
2270 oplock_request, /* oplock_request */
2271 0, /* allocation_size */
2272 NULL, /* sd */
2273 NULL, /* ea_list */
2274 &fsp, /* result */
2275 NULL); /* pinfo */
2276
2277 /* close fd from mkstemp() */
2278 close(tmpfd);
2279
2280 if (!NT_STATUS_IS_OK(status)) {
2281 if (open_was_deferred(req->mid)) {
2282 /* We have re-scheduled this call. */
2283 goto out;
2284 }
2285 reply_openerror(req, status);
2286 goto out;
2287 }
2288
2289 reply_outbuf(req, 1, 0);
2290 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2291
2292 /* the returned filename is relative to the directory */
2293 s = strrchr_m(fsp->fsp_name->base_name, '/');
2294 if (!s) {
2295 s = fsp->fsp_name->base_name;
2296 } else {
2297 s++;
2298 }
2299
2300 #if 0
2301 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2302 thing in the byte section. JRA */
2303 SSVALS(p, 0, -1); /* what is this? not in spec */
2304 #endif
2305 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2306 == -1) {
2307 reply_nterror(req, NT_STATUS_NO_MEMORY);
2308 goto out;
2309 }
2310
2311 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2312 SCVAL(req->outbuf, smb_flg,
2313 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2314 }
2315
2316 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2317 SCVAL(req->outbuf, smb_flg,
2318 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2319 }
2320
2321 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2322 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2323 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2324 out:
2325 TALLOC_FREE(smb_fname);
2326 END_PROFILE(SMBctemp);
2327 return;
2328 }
2329
2330 /*******************************************************************
2331 Check if a user is allowed to rename a file.
2332 ********************************************************************/
2333
2334 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2335 uint16 dirtype, SMB_STRUCT_STAT *pst)
2336 {
2337 uint32 fmode;
2338
2339 if (!CAN_WRITE(conn)) {
2340 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2341 }
2342
2343 fmode = dos_mode(conn, fsp->fsp_name);
2344 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2345 return NT_STATUS_NO_SUCH_FILE;
2346 }
2347
2348 if (S_ISDIR(pst->st_ex_mode)) {
2349 if (fsp->posix_open) {
2350 return NT_STATUS_OK;
2351 }
2352
2353 /* If no pathnames are open below this
2354 directory, allow the rename. */
2355
2356 if (file_find_subpath(fsp)) {
2357 return NT_STATUS_ACCESS_DENIED;
2358 }
2359 return NT_STATUS_OK;
2360 }
2361
2362 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2363 return NT_STATUS_OK;
2364 }
2365
2366 return NT_STATUS_ACCESS_DENIED;
2367 }
2368
2369 /*******************************************************************
2370 * unlink a file with all relevant access checks
2371 *******************************************************************/
2372
2373 static NTSTATUS do_unlink(connection_struct *conn,
2374 struct smb_request *req,
2375 struct smb_filename *smb_fname,
2376 uint32 dirtype)
2377 {
2378 uint32 fattr;
2379 files_struct *fsp;
2380 uint32 dirtype_orig = dirtype;
2381 NTSTATUS status;
2382
2383 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2384 smb_fname_str_dbg(smb_fname),
2385 dirtype));
2386
2387 if (!CAN_WRITE(conn)) {
2388 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2389 }
2390
2391 if (SMB_VFS_LSTAT(conn, smb_fname) != 0) {
2392 return map_nt_error_from_unix(errno);
2393 }
2394
2395 fattr = dos_mode(conn, smb_fname);
2396
2397 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2398 dirtype = aDIR|aARCH|aRONLY;
2399 }
2400
2401 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2402 if (!dirtype) {
2403 return NT_STATUS_NO_SUCH_FILE;
2404 }
2405
2406 if (!dir_check_ftype(conn, fattr, dirtype)) {
2407 if (fattr & aDIR) {
2408 return NT_STATUS_FILE_IS_A_DIRECTORY;
2409 }
2410 return NT_STATUS_NO_SUCH_FILE;
2411 }
2412
2413 if (dirtype_orig & 0x8000) {
2414 /* These will never be set for POSIX. */
2415 return NT_STATUS_NO_SUCH_FILE;
2416 }
2417
2418 #if 0
2419 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2420 return NT_STATUS_FILE_IS_A_DIRECTORY;
2421 }
2422
2423 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2424 return NT_STATUS_NO_SUCH_FILE;
2425 }
2426
2427 if (dirtype & 0xFF00) {
2428 /* These will never be set for POSIX. */
2429 return NT_STATUS_NO_SUCH_FILE;
2430 }
2431
2432 dirtype &= 0xFF;
2433 if (!dirtype) {
2434 return NT_STATUS_NO_SUCH_FILE;
2435 }
2436
2437 /* Can't delete a directory. */
2438 if (fattr & aDIR) {
2439 return NT_STATUS_FILE_IS_A_DIRECTORY;
2440 }
2441 #endif
2442
2443 #if 0 /* JRATEST */
2444 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2445 return NT_STATUS_OBJECT_NAME_INVALID;
2446 #endif /* JRATEST */
2447
2448 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2449
2450 On a Windows share, a file with read-only dosmode can be opened with
2451 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2452 fails with NT_STATUS_CANNOT_DELETE error.
2453
2454 This semantic causes a problem that a user can not
2455 rename a file with read-only dosmode on a Samba share
2456 from a Windows command prompt (i.e. cmd.exe, but can rename
2457 from Windows Explorer).
2458 */
2459
2460 if (!lp_delete_readonly(SNUM(conn))) {
2461 if (fattr & aRONLY) {
2462 return NT_STATUS_CANNOT_DELETE;
2463 }
2464 }
2465
2466 /* On open checks the open itself will check the share mode, so
2467 don't do it here as we'll get it wrong. */
2468
2469 status = SMB_VFS_CREATE_FILE
2470 (conn, /* conn */
2471 req, /* req */
2472 0, /* root_dir_fid */
2473 smb_fname, /* fname */
2474 DELETE_ACCESS, /* access_mask */
2475 FILE_SHARE_NONE, /* share_access */
2476 FILE_OPEN, /* create_disposition*/
2477 FILE_NON_DIRECTORY_FILE, /* create_options */
2478 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2479 0, /* oplock_request */
2480 0, /* allocation_size */
2481 NULL, /* sd */
2482 NULL, /* ea_list */
2483 &fsp, /* result */
2484 NULL); /* pinfo */
2485
2486 if (!NT_STATUS_IS_OK(status)) {
2487 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2488 nt_errstr(status)));
2489 return status;
2490 }
2491
2492 /* The set is across all open files on this dev/inode pair. */
2493 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2494 close_file(req, fsp, NORMAL_CLOSE);
2495 return NT_STATUS_ACCESS_DENIED;
2496 }
2497
2498 return close_file(req, fsp, NORMAL_CLOSE);
2499 }
2500
2501 /****************************************************************************
2502 The guts of the unlink command, split out so it may be called by the NT SMB
2503 code.
2504 ****************************************************************************/
2505
2506 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2507 uint32 dirtype, struct smb_filename *smb_fname,
2508 bool has_wild)
2509 {
2510 char *fname_dir = NULL;
2511 char *fname_mask = NULL;
2512 int count=0;
2513 NTSTATUS status = NT_STATUS_OK;
2514 TALLOC_CTX *ctx = talloc_tos();
2515
2516 /* Split up the directory from the filename/mask. */
2517 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2518 &fname_dir, &fname_mask);
2519 if (!NT_STATUS_IS_OK(status)) {
2520 goto out;
2521 }
2522
2523 /*
2524 * We should only check the mangled cache
2525 * here if unix_convert failed. This means
2526 * that the path in 'mask' doesn't exist
2527 * on the file system and so we need to look
2528 * for a possible mangle. This patch from
2529 * Tine Smukavec <valentin.smukavec@hermes.si>.
2530 */
2531
2532 if (!VALID_STAT(smb_fname->st) &&
2533 mangle_is_mangled(fname_mask, conn->params)) {
2534 char *new_mask = NULL;
2535 mangle_lookup_name_from_8_3(ctx, fname_mask,
2536 &new_mask, conn->params);
2537 if (new_mask) {
2538 TALLOC_FREE(fname_mask);
2539 fname_mask = new_mask;
2540 }
2541 }
2542
2543 if (!has_wild) {
2544
2545 /*
2546 * Only one file needs to be unlinked. Append the mask back
2547 * onto the directory.
2548 */
2549 TALLOC_FREE(smb_fname->base_name);
2550 smb_fname->base_name = talloc_asprintf(smb_fname,
2551 "%s/%s",
2552 fname_dir,
2553 fname_mask);
2554 if (!smb_fname->base_name) {
2555 status = NT_STATUS_NO_MEMORY;
2556 goto out;
2557 }
2558 if (dirtype == 0) {
2559 dirtype = FILE_ATTRIBUTE_NORMAL;
2560 }
2561
2562 status = check_name(conn, smb_fname->base_name);
2563 if (!NT_STATUS_IS_OK(status)) {
2564 goto out;
2565 }
2566
2567 status = do_unlink(conn, req, smb_fname, dirtype);
2568 if (!NT_STATUS_IS_OK(status)) {
2569 goto out;
2570 }
2571
2572 count++;
2573 } else {
2574 struct smb_Dir *dir_hnd = NULL;
2575 long offset = 0;
2576 const char *dname;
2577
2578 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2579 status = NT_STATUS_OBJECT_NAME_INVALID;
2580 goto out;
2581 }
2582
2583 if (strequal(fname_mask,"????????.???")) {
2584 TALLOC_FREE(fname_mask);
2585 fname_mask = talloc_strdup(ctx, "*");
2586 if (!fname_mask) {
2587 status = NT_STATUS_NO_MEMORY;
2588 goto out;
2589 }
2590 }
2591
2592 status = check_name(conn, fname_dir);
2593 if (!NT_STATUS_IS_OK(status)) {
2594 goto out;
2595 }
2596
2597 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2598 dirtype);
2599 if (dir_hnd == NULL) {
2600 status = map_nt_error_from_unix(errno);
2601 goto out;
2602 }
2603
2604 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2605 the pattern matches against the long name, otherwise the short name
2606 We don't implement this yet XXXX
2607 */
2608
2609 status = NT_STATUS_NO_SUCH_FILE;
2610
2611 while ((dname = ReadDirName(dir_hnd, &offset,
2612 &smb_fname->st))) {
2613 TALLOC_CTX *frame = talloc_stackframe();
2614
2615 if (!is_visible_file(conn, fname_dir, dname,
2616 &smb_fname->st, true)) {
2617 TALLOC_FREE(frame);
2618 continue;
2619 }
2620
2621 /* Quick check for "." and ".." */
2622 if (ISDOT(dname) || ISDOTDOT(dname)) {
2623 TALLOC_FREE(frame);
2624 continue;
2625 }
2626
2627 if(!mask_match(dname, fname_mask,
2628 conn->case_sensitive)) {
2629 TALLOC_FREE(frame);
2630 continue;
2631 }
2632
2633 TALLOC_FREE(smb_fname->base_name);
2634 smb_fname->base_name =
2635 talloc_asprintf(smb_fname, "%s/%s",
2636 fname_dir, dname);
2637
2638 if (!smb_fname->base_name) {
2639 TALLOC_FREE(dir_hnd);
2640 status = NT_STATUS_NO_MEMORY;
2641 TALLOC_FREE(frame);
2642 goto out;
2643 }
2644
2645 status = check_name(conn, smb_fname->base_name);
2646 if (!NT_STATUS_IS_OK(status)) {
2647 TALLOC_FREE(dir_hnd);
2648 TALLOC_FREE(frame);
2649 goto out;
2650 }
2651
2652 status = do_unlink(conn, req, smb_fname, dirtype);
2653 if (!NT_STATUS_IS_OK(status)) {
2654 TALLOC_FREE(frame);
2655 continue;
2656 }
2657
2658 count++;
2659 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2660 smb_fname->base_name));
2661
2662 TALLOC_FREE(frame);
2663 }
2664 TALLOC_FREE(dir_hnd);
2665 }
2666
2667 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2668 status = map_nt_error_from_unix(errno);
2669 }
2670
2671 out:
2672 TALLOC_FREE(fname_dir);
2673 TALLOC_FREE(fname_mask);
2674 return status;
2675 }
2676
2677 /****************************************************************************
2678 Reply to a unlink
2679 ****************************************************************************/
2680
2681 void reply_unlink(struct smb_request *req)
2682 {
2683 connection_struct *conn = req->conn;
2684 char *name = NULL;
2685 struct smb_filename *smb_fname = NULL;
2686 uint32 dirtype;
2687 NTSTATUS status;
2688 bool path_contains_wcard = False;
2689 TALLOC_CTX *ctx = talloc_tos();
2690
2691 START_PROFILE(SMBunlink);
2692
2693 if (req->wct < 1) {
2694 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2695 goto out;
2696 }
2697
2698 dirtype = SVAL(req->vwv+0, 0);
2699
2700 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2701 STR_TERMINATE, &status,
2702 &path_contains_wcard);
2703 if (!NT_STATUS_IS_OK(status)) {
2704 reply_nterror(req, status);
2705 goto out;
2706 }
2707
2708 status = filename_convert(ctx, conn,
2709 req->flags2 & FLAGS2_DFS_PATHNAMES,
2710 name,
2711 UCF_COND_ALLOW_WCARD_LCOMP,
2712 &path_contains_wcard,
2713 &smb_fname);
2714 if (!NT_STATUS_IS_OK(status)) {
2715 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2716 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2717 ERRSRV, ERRbadpath);
2718 goto out;
2719 }
2720 reply_nterror(req, status);
2721 goto out;
2722 }
2723
2724 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2725
2726 status = unlink_internals(conn, req, dirtype, smb_fname,
2727 path_contains_wcard);
2728 if (!NT_STATUS_IS_OK(status)) {
2729 if (open_was_deferred(req->mid)) {
2730 /* We have re-scheduled this call. */
2731 goto out;
2732 }
2733 reply_nterror(req, status);
2734 goto out;
2735 }
2736
2737 reply_outbuf(req, 0, 0);
2738 out:
2739 TALLOC_FREE(smb_fname);
2740 END_PROFILE(SMBunlink);
2741 return;
2742 }
2743
2744 /****************************************************************************
2745 Fail for readbraw.
2746 ****************************************************************************/
2747
2748 static void fail_readraw(void)
2749 {
2750 const char *errstr = talloc_asprintf(talloc_tos(),
2751 "FAIL ! reply_readbraw: socket write fail (%s)",
2752 strerror(errno));
2753 if (!errstr) {
2754 errstr = "";
2755 }
2756 exit_server_cleanly(errstr);
2757 }
2758
2759 /****************************************************************************
2760 Fake (read/write) sendfile. Returns -1 on read or write fail.
2761 ****************************************************************************/
2762
2763 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2764 size_t nread)
2765 {
2766 size_t bufsize;
2767 size_t tosend = nread;
2768 char *buf;
2769
2770 if (nread == 0) {
2771 return 0;
2772 }
2773
2774 bufsize = MIN(nread, 65536);
2775
2776 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2777 return -1;
2778 }
2779
2780 while (tosend > 0) {
2781 ssize_t ret;
2782 size_t cur_read;
2783
2784 if (tosend > bufsize) {
2785 cur_read = bufsize;
2786 } else {
2787 cur_read = tosend;
2788 }
2789 ret = read_file(fsp,buf,startpos,cur_read);
2790 if (ret == -1) {
2791 SAFE_FREE(buf);
2792 return -1;
2793 }
2794
2795 /* If we had a short read, fill with zeros. */
2796 if (ret < cur_read) {
2797 memset(buf + ret, '\0', cur_read - ret);
2798 }
2799
2800 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2801 SAFE_FREE(buf);
2802 return -1;
2803 }
2804 tosend -= cur_read;
2805 startpos += cur_read;
2806 }
2807
2808 SAFE_FREE(buf);
2809 return (ssize_t)nread;
2810 }
2811
2812 #if defined(WITH_SENDFILE)
2813 /****************************************************************************
2814 Deal with the case of sendfile reading less bytes from the file than
2815 requested. Fill with zeros (all we can do).
2816 ****************************************************************************/
2817
2818 static void sendfile_short_send(files_struct *fsp,
2819 ssize_t nread,
2820 size_t headersize,
2821 size_t smb_maxcnt)
2822 {
2823 #define SHORT_SEND_BUFSIZE 1024
2824 if (nread < headersize) {
2825 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2826 "header for file %s (%s). Terminating\n",
2827 fsp_str_dbg(fsp), strerror(errno)));
2828 exit_server_cleanly("sendfile_short_send failed");
2829 }
2830
2831 nread -= headersize;
2832
2833 if (nread < smb_maxcnt) {
2834 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2835 if (!buf) {
2836 exit_server_cleanly("sendfile_short_send: "
2837 "malloc failed");
2838 }
2839
2840 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2841 "with zeros !\n", fsp_str_dbg(fsp)));
2842
2843 while (nread < smb_maxcnt) {
2844 /*
2845 * We asked for the real file size and told sendfile
2846 * to not go beyond the end of the file. But it can
2847 * happen that in between our fstat call and the
2848 * sendfile call the file was truncated. This is very
2849 * bad because we have already announced the larger
2850 * number of bytes to the client.
2851 *
2852 * The best we can do now is to send 0-bytes, just as
2853 * a read from a hole in a sparse file would do.
2854 *
2855 * This should happen rarely enough that I don't care
2856 * about efficiency here :-)
2857 */
2858 size_t to_write;
2859
2860 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2861 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2862 exit_server_cleanly("sendfile_short_send: "
2863 "write_data failed");
2864 }
2865 nread += to_write;
2866 }
2867 SAFE_FREE(buf);
2868 }
2869 }
2870 #endif /* defined WITH_SENDFILE */
2871
2872 /****************************************************************************
2873 Return a readbraw error (4 bytes of zero).
2874 ****************************************************************************/
2875
2876 static void reply_readbraw_error(void)
2877 {
2878 char header[4];
2879 SIVAL(header,0,0);
2880 if (write_data(smbd_server_fd(),header,4) != 4) {
2881 fail_readraw();
2882 }
2883 }
2884
2885 /****************************************************************************
2886 Use sendfile in readbraw.
2887 ****************************************************************************/
2888
2889 static void send_file_readbraw(connection_struct *conn,
2890 struct smb_request *req,
2891 files_struct *fsp,
2892 SMB_OFF_T startpos,
2893 size_t nread,
2894 ssize_t mincount)
2895 {
2896 char *outbuf = NULL;
2897 ssize_t ret=0;
2898
2899 #if defined(WITH_SENDFILE)
2900 /*
2901 * We can only use sendfile on a non-chained packet
2902 * but we can use on a non-oplocked file. tridge proved this
2903 * on a train in Germany :-). JRA.
2904 * reply_readbraw has already checked the length.
2905 */
2906
2907 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2908 (fsp->wcp == NULL) &&
2909 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2910 ssize_t sendfile_read = -1;
2911 char header[4];
2912 DATA_BLOB header_blob;
2913
2914 _smb_setlen(header,nread);
2915 header_blob = data_blob_const(header, 4);
2916
2917 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2918 &header_blob, startpos, nread)) == -1) {
2919 /* Returning ENOSYS means no data at all was sent.
2920 * Do this as a normal read. */
2921 if (errno == ENOSYS) {
2922 goto normal_readbraw;
2923 }
2924
2925 /*
2926 * Special hack for broken Linux with no working sendfile. If we
2927 * return EINTR we sent the header but not the rest of the data.
2928 * Fake this up by doing read/write calls.
2929 */
2930 if (errno == EINTR) {
2931 /* Ensure we don't do this again. */
2932 set_use_sendfile(SNUM(conn), False);
2933 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2934
2935 if (fake_sendfile(fsp, startpos, nread) == -1) {
2936 DEBUG(0,("send_file_readbraw: "
2937 "fake_sendfile failed for "
2938 "file %s (%s).\n",
2939 fsp_str_dbg(fsp),
2940 strerror(errno)));
2941 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2942 }
2943 return;
2944 }
2945
2946 DEBUG(0,("send_file_readbraw: sendfile failed for "
2947 "file %s (%s). Terminating\n",
2948 fsp_str_dbg(fsp), strerror(errno)));
2949 exit_server_cleanly("send_file_readbraw sendfile failed");
2950 } else if (sendfile_read == 0) {
2951 /*
2952 * Some sendfile implementations return 0 to indicate
2953 * that there was a short read, but nothing was
2954 * actually written to the socket. In this case,
2955 * fallback to the normal read path so the header gets
2956 * the correct byte count.
2957 */
2958 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2959 "bytes falling back to the normal read: "
2960 "%s\n", fsp_str_dbg(fsp)));
2961 goto normal_readbraw;
2962 }
2963
2964 /* Deal with possible short send. */
2965 if (sendfile_read != 4+nread) {
2966 sendfile_short_send(fsp, sendfile_read, 4, nread);
2967 }
2968 return;
2969 }
2970
2971 normal_readbraw:
2972 #endif
2973
2974 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2975 if (!outbuf) {
2976 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2977 (unsigned)(nread+4)));
2978 reply_readbraw_error();
2979 return;
2980 }
2981
2982 if (nread > 0) {
2983 ret = read_file(fsp,outbuf+4,startpos,nread);
2984 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2985 if (ret < mincount)
2986 ret = 0;
2987 #else
2988 if (ret < nread)
2989 ret = 0;
2990 #endif
2991 }
2992
2993 _smb_setlen(outbuf,ret);
2994 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2995 fail_readraw();
2996
2997 TALLOC_FREE(outbuf);
2998 }
2999
3000 /****************************************************************************
3001 Reply to a readbraw (core+ protocol).
3002 ****************************************************************************/
3003
3004 void reply_readbraw(struct smb_request *req)
3005 {
3006 connection_struct *conn = req->conn;
3007 ssize_t maxcount,mincount;
3008 size_t nread = 0;
3009 SMB_OFF_T startpos;
3010 files_struct *fsp;
3011 struct lock_struct lock;
3012 SMB_STRUCT_STAT st;
3013 SMB_OFF_T size = 0;
3014
3015 START_PROFILE(SMBreadbraw);
3016
3017 if (srv_is_signing_active(smbd_server_conn) ||
3018 is_encrypted_packet(req->inbuf)) {
3019 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3020 "raw reads/writes are disallowed.");
3021 }
3022
3023 if (req->wct < 8) {
3024 reply_readbraw_error();
3025 END_PROFILE(SMBreadbraw);
3026 return;
3027 }
3028
3029 /*
3030 * Special check if an oplock break has been issued
3031 * and the readraw request croses on the wire, we must
3032 * return a zero length response here.
3033 */
3034
3035 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3036
3037 /*
3038 * We have to do a check_fsp by hand here, as
3039 * we must always return 4 zero bytes on error,
3040 * not a NTSTATUS.
3041 */
3042
3043 if (!fsp || !conn || conn != fsp->conn ||
3044 req->vuid != fsp->vuid ||
3045 fsp->is_directory || fsp->fh->fd == -1) {
3046 /*
3047 * fsp could be NULL here so use the value from the packet. JRA.
3048 */
3049 DEBUG(3,("reply_readbraw: fnum %d not valid "
3050 "- cache prime?\n",
3051 (int)SVAL(req->vwv+0, 0)));
3052 reply_readbraw_error();
3053 END_PROFILE(SMBreadbraw);
3054 return;
3055 }
3056
3057 /* Do a "by hand" version of CHECK_READ. */
3058 if (!(fsp->can_read ||
3059 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3060 (fsp->access_mask & FILE_EXECUTE)))) {
3061 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3062 (int)SVAL(req->vwv+0, 0)));
3063 reply_readbraw_error();
3064 END_PROFILE(SMBreadbraw);
3065 return;
3066 }
3067
3068 flush_write_cache(fsp, READRAW_FLUSH);
3069
3070 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3071 if(req->wct == 10) {
3072 /*
3073 * This is a large offset (64 bit) read.
3074 */
3075 #ifdef LARGE_SMB_OFF_T
3076
3077 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3078
3079 #else /* !LARGE_SMB_OFF_T */
3080
3081 /*
3082 * Ensure we haven't been sent a >32 bit offset.
3083 */
3084
3085 if(IVAL(req->vwv+8, 0) != 0) {
3086 DEBUG(0,("reply_readbraw: large offset "
3087 "(%x << 32) used and we don't support "
3088 "64 bit offsets.\n",
3089 (unsigned int)IVAL(req->vwv+8, 0) ));
3090 reply_readbraw_error();
3091 END_PROFILE(SMBreadbraw);
3092 return;
3093 }
3094
3095 #endif /* LARGE_SMB_OFF_T */
3096
3097 if(startpos < 0) {
3098 DEBUG(0,("reply_readbraw: negative 64 bit "
3099 "readraw offset (%.0f) !\n",
3100 (double)startpos ));
3101 reply_readbraw_error();
3102 END_PROFILE(SMBreadbraw);
3103 return;
3104 }
3105 }
3106
3107 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3108 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3109
3110 /* ensure we don't overrun the packet size */
3111 maxcount = MIN(65535,maxcount);
3112
3113 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3114 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3115 &lock);
3116
3117 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3118 reply_readbraw_error();
3119 END_PROFILE(SMBreadbraw);
3120 return;
3121 }
3122
3123 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
3124 size = st.st_ex_size;
3125 }
3126
3127 if (startpos >= size) {
3128 nread = 0;
3129 } else {
3130 nread = MIN(maxcount,(size - startpos));
3131 }
3132
3133 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3134 if (nread < mincount)
3135 nread = 0;
3136 #endif
3137
3138 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3139 "min=%lu nread=%lu\n",
3140 fsp->fnum, (double)startpos,
3141 (unsigned long)maxcount,
3142 (unsigned long)mincount,
3143 (unsigned long)nread ) );
3144
3145 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3146
3147 DEBUG(5,("reply_readbraw finished\n"));
3148
3149 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3150
3151 END_PROFILE(SMBreadbraw);
3152 return;
3153 }
3154
3155 #undef DBGC_CLASS
3156 #define DBGC_CLASS DBGC_LOCKING
3157
3158 /****************************************************************************
3159 Reply to a lockread (core+ protocol).
3160 ****************************************************************************/
3161
3162 void reply_lockread(struct smb_request *req)
3163 {
3164 connection_struct *conn = req->conn;
3165 ssize_t nread = -1;
3166 char *data;
3167 SMB_OFF_T startpos;
3168 size_t numtoread;
3169 NTSTATUS status;
3170 files_struct *fsp;
3171 struct byte_range_lock *br_lck = NULL;
3172 char *p = NULL;
3173 struct smbd_server_connection *sconn = smbd_server_conn;
3174
3175 START_PROFILE(SMBlockread);
3176
3177 if (req->wct < 5) {
3178 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3179 END_PROFILE(SMBlockread);
3180 return;
3181 }
3182
3183 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3184
3185 if (!check_fsp(conn, req, fsp)) {
3186 END_PROFILE(SMBlockread);
3187 return;
3188 }
3189
3190 if (!CHECK_READ(fsp,req)) {
3191 reply_doserror(req, ERRDOS, ERRbadaccess);
3192 END_PROFILE(SMBlockread);
3193 return;
3194 }
3195
3196 numtoread = SVAL(req->vwv+1, 0);
3197 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3198
3199 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3200
3201 reply_outbuf(req, 5, numtoread + 3);
3202
3203 data = smb_buf(req->outbuf) + 3;
3204
3205 /*
3206 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3207 * protocol request that predates the read/write lock concept.
3208 * Thus instead of asking for a read lock here we need to ask
3209 * for a write lock. JRA.
3210 * Note that the requested lock size is unaffected by max_recv.
3211 */
3212
3213 br_lck = do_lock(smbd_messaging_context(),
3214 fsp,
3215 req->smbpid,
3216 (uint64_t)numtoread,
3217 (uint64_t)startpos,
3218 WRITE_LOCK,
3219 WINDOWS_LOCK,
3220 False, /* Non-blocking lock. */
3221 &status,
3222 NULL,
3223 NULL);
3224 TALLOC_FREE(br_lck);
3225
3226 if (NT_STATUS_V(status)) {
3227 reply_nterror(req, status);
3228 END_PROFILE(SMBlockread);
3229 return;
3230 }
3231
3232 /*
3233 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3234 */
3235
3236 if (numtoread > sconn->smb1.negprot.max_recv) {
3237 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3238 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3239 (unsigned int)numtoread,
3240 (unsigned int)sconn->smb1.negprot.max_recv));
3241 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3242 }
3243 nread = read_file(fsp,data,startpos,numtoread);
3244
3245 if (nread < 0) {
3246 reply_nterror(req, map_nt_error_from_unix(errno));
3247 END_PROFILE(SMBlockread);
3248 return;
3249 }
3250
3251 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3252
3253 SSVAL(req->outbuf,smb_vwv0,nread);
3254 SSVAL(req->outbuf,smb_vwv5,nread+3);
3255 p = smb_buf(req->outbuf);
3256 SCVAL(p,0,0); /* pad byte. */
3257 SSVAL(p,1,nread);
3258
3259 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3260 fsp->fnum, (int)numtoread, (int)nread));
3261
3262 END_PROFILE(SMBlockread);
3263 return;
3264 }
3265
3266 #undef DBGC_CLASS
3267 #define DBGC_CLASS DBGC_ALL
3268
3269 /****************************************************************************
3270 Reply to a read.
3271 ****************************************************************************/
3272
3273 void reply_read(struct smb_request *req)
3274 {
3275 connection_struct *conn = req->conn;
3276 size_t numtoread;
3277 ssize_t nread = 0;
3278 char *data;
3279 SMB_OFF_T startpos;
3280 int outsize = 0;
3281 files_struct *fsp;
3282 struct lock_struct lock;
3283 struct smbd_server_connection *sconn = smbd_server_conn;
3284
3285 START_PROFILE(SMBread);
3286
3287 if (req->wct < 3) {
3288 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3289 END_PROFILE(SMBread);
3290 return;
3291 }
3292
3293 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3294
3295 if (!check_fsp(conn, req, fsp)) {
3296 END_PROFILE(SMBread);
3297 return;
3298 }
3299
3300 if (!CHECK_READ(fsp,req)) {
3301 reply_doserror(req, ERRDOS, ERRbadaccess);
3302 END_PROFILE(SMBread);
3303 return;
3304 }
3305
3306 numtoread = SVAL(req->vwv+1, 0);
3307 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3308
3309 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3310
3311 /*
3312 * The requested read size cannot be greater than max_recv. JRA.
3313 */
3314 if (numtoread > sconn->smb1.negprot.max_recv) {
3315 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3316 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3317 (unsigned int)numtoread,
3318 (unsigned int)sconn->smb1.negprot.max_recv));
3319 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3320 }
3321
3322 reply_outbuf(req, 5, numtoread+3);
3323
3324 data = smb_buf(req->outbuf) + 3;
3325
3326 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3327 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3328 &lock);
3329
3330 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3331 reply_doserror(req, ERRDOS,ERRlock);
3332 END_PROFILE(SMBread);
3333 return;
3334 }
3335
3336 if (numtoread > 0)
3337 nread = read_file(fsp,data,startpos,numtoread);
3338
3339 if (nread < 0) {
3340 reply_nterror(req, map_nt_error_from_unix(errno));
3341 goto strict_unlock;
3342 }
3343
3344 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3345
3346 SSVAL(req->outbuf,smb_vwv0,nread);
3347 SSVAL(req->outbuf,smb_vwv5,nread+3);
3348 SCVAL(smb_buf(req->outbuf),0,1);
3349 SSVAL(smb_buf(req->outbuf),1,nread);
3350
3351 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3352 fsp->fnum, (int)numtoread, (int)nread ) );
3353
3354 strict_unlock:
3355 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3356
3357 END_PROFILE(SMBread);
3358 return;
3359 }
3360
3361 /****************************************************************************
3362 Setup readX header.
3363 ****************************************************************************/
3364
3365 static int setup_readX_header(struct smb_request *req, char *outbuf,
3366 size_t smb_maxcnt)
3367 {
3368 int outsize;
3369 char *data;
3370
3371 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3372 data = smb_buf(outbuf);
3373
3374 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3375
3376 SCVAL(outbuf,smb_vwv0,0xFF);
3377 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3378 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3379 SSVAL(outbuf,smb_vwv6,
3380 req_wct_ofs(req)
3381 + 1 /* the wct field */
3382 + 12 * sizeof(uint16_t) /* vwv */
3383 + 2); /* the buflen field */
3384 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3385 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3386 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3387 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3388 return outsize;
3389 }
3390
3391 /****************************************************************************
3392 Reply to a read and X - possibly using sendfile.
3393 ****************************************************************************/
3394
3395 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3396 files_struct *fsp, SMB_OFF_T startpos,
3397 size_t smb_maxcnt)
3398 {
3399 SMB_STRUCT_STAT sbuf;
3400 ssize_t nread = -1;
3401 struct lock_struct lock;
3402 int saved_errno = 0;
3403
3404 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3405 reply_nterror(req, map_nt_error_from_unix(errno));
3406 return;
3407 }
3408
3409 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3410 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3411 &lock);
3412
3413 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3414 reply_doserror(req, ERRDOS, ERRlock);
3415 return;
3416 }
3417
3418 if (!S_ISREG(sbuf.st_ex_mode) || (startpos > sbuf.st_ex_size)
3419 || (smb_maxcnt > (sbuf.st_ex_size - startpos))) {
3420 /*
3421 * We already know that we would do a short read, so don't
3422 * try the sendfile() path.
3423 */
3424 goto nosendfile_read;
3425 }
3426
3427 #if defined(WITH_SENDFILE)
3428 /*
3429 * We can only use sendfile on a non-chained packet
3430 * but we can use on a non-oplocked file. tridge proved this
3431 * on a train in Germany :-). JRA.
3432 */
3433
3434 if (!req_is_in_chain(req) &&
3435 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3436 (fsp->wcp == NULL) &&
3437 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3438 uint8 headerbuf[smb_size + 12 * 2];
3439 DATA_BLOB header;
3440
3441 /*
3442 * Set up the packet header before send. We
3443 * assume here the sendfile will work (get the
3444 * correct amount of data).
3445 */
3446
3447 header = data_blob_const(headerbuf, sizeof(headerbuf));
3448
3449 construct_reply_common_req(req, (char *)headerbuf);
3450 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3451
3452 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3453 /* Returning ENOSYS means no data at all was sent.
3454 Do this as a normal read. */
3455 if (errno == ENOSYS) {
3456 goto normal_read;
3457 }
3458
3459 /*
3460 * Special hack for broken Linux with no working sendfile. If we
3461 * return EINTR we sent the header but not the rest of the data.
3462 * Fake this up by doing read/write calls.
3463 */
3464
3465 if (errno == EINTR) {
3466 /* Ensure we don't do this again. */
3467 set_use_sendfile(SNUM(conn), False);
3468 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3469 nread = fake_sendfile(fsp, startpos,
3470 smb_maxcnt);
3471 if (nread == -1) {
3472 DEBUG(0,("send_file_readX: "
3473 "fake_sendfile failed for "
3474 "file %s (%s).\n",
3475 fsp_str_dbg(fsp),
3476 strerror(errno)));
3477 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3478 }
3479 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3480 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3481 /* No outbuf here means successful sendfile. */
3482 goto strict_unlock;
3483 }
3484
3485 DEBUG(0,("send_file_readX: sendfile failed for file "
3486 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3487 strerror(errno)));
3488 exit_server_cleanly("send_file_readX sendfile failed");
3489 } else if (nread == 0) {
3490 /*
3491 * Some sendfile implementations return 0 to indicate
3492 * that there was a short read, but nothing was
3493 * actually written to the socket. In this case,
3494 * fallback to the normal read path so the header gets
3495 * the correct byte count.
3496 */
3497 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3498 "falling back to the normal read: %s\n",
3499 fsp_str_dbg(fsp)));
3500 goto normal_read;
3501 }
3502
3503 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3504 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3505
3506 /* Deal with possible short send. */
3507 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3508 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3509 }
3510 /* No outbuf here means successful sendfile. */
3511 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3512 SMB_PERFCOUNT_END(&req->pcd);
3513 goto strict_unlock;
3514 }
3515
3516 normal_read:
3517
3518 #endif
3519
3520 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3521 uint8 headerbuf[smb_size + 2*12];
3522
3523 construct_reply_common_req(req, (char *)headerbuf);
3524 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3525
3526 /* Send out the header. */
3527 if (write_data(smbd_server_fd(), (char *)headerbuf,
3528 sizeof(headerbuf)) != sizeof(headerbuf)) {
3529 DEBUG(0,("send_file_readX: write_data failed for file "
3530 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3531 strerror(errno)));
3532 exit_server_cleanly("send_file_readX sendfile failed");
3533 }
3534 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3535 if (nread == -1) {
3536 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3537 "file %s (%s).\n", fsp_str_dbg(fsp),
3538 strerror(errno)));
3539 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3540 }
3541 goto strict_unlock;
3542 }
3543
3544 nosendfile_read:
3545
3546 reply_outbuf(req, 12, smb_maxcnt);
3547
3548 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3549 saved_errno = errno;
3550
3551 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3552
3553 if (nread < 0) {
3554 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3555 return;
3556 }
3557
3558 setup_readX_header(req, (char *)req->outbuf, nread);
3559
3560 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3561 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3562
3563 chain_reply(req);
3564 return;
3565
3566 strict_unlock:
3567 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3568 TALLOC_FREE(req->outbuf);
3569 return;
3570 }
3571
3572 /****************************************************************************
3573 Reply to a read and X.
3574 ****************************************************************************/
3575
3576 void reply_read_and_X(struct smb_request *req)
3577 {
3578 connection_struct *conn = req->conn;
3579 files_struct *fsp;
3580 SMB_OFF_T startpos;
3581 size_t smb_maxcnt;
3582 bool big_readX = False;
3583 #if 0
3584 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3585 #endif
3586
3587 START_PROFILE(SMBreadX);
3588
3589 if ((req->wct != 10) && (req->wct != 12)) {
3590 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3591 return;
3592 }
3593
3594 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3595 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3596 smb_maxcnt = SVAL(req->vwv+5, 0);
3597
3598 /* If it's an IPC, pass off the pipe handler. */
3599 if (IS_IPC(conn)) {
3600 reply_pipe_read_and_X(req);
3601 END_PROFILE(SMBreadX);
3602 return;
3603 }
3604
3605 if (!check_fsp(conn, req, fsp)) {
3606 END_PROFILE(SMBreadX);
3607 return;
3608 }
3609
3610 if (!CHECK_READ(fsp,req)) {
3611 reply_doserror(req, ERRDOS,ERRbadaccess);
3612 END_PROFILE(SMBreadX);
3613 return;
3614 }
3615
3616 if (global_client_caps & CAP_LARGE_READX) {
3617 size_t upper_size = SVAL(req->vwv+7, 0);
3618 smb_maxcnt |= (upper_size<<16);
3619 if (upper_size > 1) {
3620 /* Can't do this on a chained packet. */
3621 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3622 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3623 END_PROFILE(SMBreadX);
3624 return;
3625 }
3626 /* We currently don't do this on signed or sealed data. */
3627 if (srv_is_signing_active(smbd_server_conn) ||
3628 is_encrypted_packet(req->inbuf)) {
3629 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3630 END_PROFILE(SMBreadX);
3631 return;
3632 }
3633 /* Is there room in the reply for this data ? */
3634 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3635 reply_nterror(req,
3636 NT_STATUS_INVALID_PARAMETER);
3637 END_PROFILE(SMBreadX);
3638 return;
3639 }
3640 big_readX = True;
3641 }
3642 }
3643
3644 if (req->wct == 12) {
3645 #ifdef LARGE_SMB_OFF_T
3646 /*
3647 * This is a large offset (64 bit) read.
3648 */
3649 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3650
3651 #else /* !LARGE_SMB_OFF_T */
3652
3653 /*
3654 * Ensure we haven't been sent a >32 bit offset.
3655 */
3656
3657 if(IVAL(req->vwv+10, 0) != 0) {
3658 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3659 "used and we don't support 64 bit offsets.\n",
3660 (unsigned int)IVAL(req->vwv+10, 0) ));
3661 END_PROFILE(SMBreadX);
3662 reply_doserror(req, ERRDOS, ERRbadaccess);
3663 return;
3664 }
3665
3666 #endif /* LARGE_SMB_OFF_T */
3667
3668 }
3669
3670 if (!big_readX &&
3671 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3672 goto out;
3673 }
3674
3675 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3676
3677 out:
3678 END_PROFILE(SMBreadX);
3679 return;
3680 }
3681
3682 /****************************************************************************
3683 Error replies to writebraw must have smb_wct == 1. Fix this up.
3684 ****************************************************************************/
3685
3686 void error_to_writebrawerr(struct smb_request *req)
3687 {
3688 uint8 *old_outbuf = req->outbuf;
3689
3690 reply_outbuf(req, 1, 0);
3691
3692 memcpy(req->outbuf, old_outbuf, smb_size);
3693 TALLOC_FREE(old_outbuf);
3694 }
3695
3696 /****************************************************************************
3697 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3698 ****************************************************************************/
3699
3700 void reply_writebraw(struct smb_request *req)
3701 {
3702 connection_struct *conn = req->conn;
3703 char *buf = NULL;
3704 ssize_t nwritten=0;
3705 ssize_t total_written=0;
3706 size_t numtowrite=0;
3707 size_t tcount;
3708 SMB_OFF_T startpos;
3709 char *data=NULL;
3710 bool write_through;
3711 files_struct *fsp;
3712 struct lock_struct lock;
3713 NTSTATUS status;
3714
3715 START_PROFILE(SMBwritebraw);
3716
3717 /*
3718 * If we ever reply with an error, it must have the SMB command
3719 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3720 * we're finished.
3721 */
3722 SCVAL(req->inbuf,smb_com,SMBwritec);
3723
3724 if (srv_is_signing_active(smbd_server_conn)) {
3725 END_PROFILE(SMBwritebraw);
3726 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3727 "raw reads/writes are disallowed.");
3728 }
3729
3730 if (req->wct < 12) {
3731 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3732 error_to_writebrawerr(req);
3733 END_PROFILE(SMBwritebraw);
3734 return;
3735 }
3736
3737 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3738 if (!check_fsp(conn, req, fsp)) {
3739 error_to_writebrawerr(req);
3740 END_PROFILE(SMBwritebraw);
3741 return;
3742 }
3743
3744 if (!CHECK_WRITE(fsp)) {
3745 reply_doserror(req, ERRDOS, ERRbadaccess);
3746 error_to_writebrawerr(req);
3747 END_PROFILE(SMBwritebraw);
3748 return;
3749 }
3750
3751 tcount = IVAL(req->vwv+1, 0);
3752 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3753 write_through = BITSETW(req->vwv+7,0);
3754
3755 /* We have to deal with slightly different formats depending
3756 on whether we are using the core+ or lanman1.0 protocol */
3757
3758 if(Protocol <= PROTOCOL_COREPLUS) {
3759 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3760 data = smb_buf(req->inbuf);
3761 } else {
3762 numtowrite = SVAL(req->vwv+10, 0);
3763 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3764 }
3765
3766 /* Ensure we don't write bytes past the end of this packet. */
3767 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3768 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3769 error_to_writebrawerr(req);
3770 END_PROFILE(SMBwritebraw);
3771 return;
3772 }
3773
3774 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3775 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3776 &lock);
3777
3778 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3779 reply_doserror(req, ERRDOS, ERRlock);
3780 error_to_writebrawerr(req);
3781 END_PROFILE(SMBwritebraw);
3782 return;
3783 }
3784
3785 if (numtowrite>0) {
3786 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3787 }
3788
3789 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3790 "wrote=%d sync=%d\n",
3791 fsp->fnum, (double)startpos, (int)numtowrite,
3792 (int)nwritten, (int)write_through));
3793
3794 if (nwritten < (ssize_t)numtowrite) {
3795 reply_doserror(req, ERRHRD, ERRdiskfull);
3796 error_to_writebrawerr(req);
3797 goto strict_unlock;
3798 }
3799
3800 total_written = nwritten;
3801
3802 /* Allocate a buffer of 64k + length. */
3803 buf = TALLOC_ARRAY(NULL, char, 65540);
3804 if (!buf) {
3805 reply_doserror(req, ERRDOS, ERRnomem);
3806 error_to_writebrawerr(req);
3807 goto strict_unlock;
3808 }
3809
3810 /* Return a SMBwritebraw message to the redirector to tell
3811 * it to send more bytes */
3812
3813 memcpy(buf, req->inbuf, smb_size);
3814 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3815 SCVAL(buf,smb_com,SMBwritebraw);
3816 SSVALS(buf,smb_vwv0,0xFFFF);
3817 show_msg(buf);
3818 if (!srv_send_smb(smbd_server_fd(),
3819 buf,
3820 false, 0, /* no signing */
3821 IS_CONN_ENCRYPTED(conn),
3822 &req->pcd)) {
3823 exit_server_cleanly("reply_writebraw: srv_send_smb "
3824 "failed.");
3825 }
3826
3827 /* Now read the raw data into the buffer and write it */
3828 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3829 &numtowrite);
3830 if (!NT_STATUS_IS_OK(status)) {
3831 exit_server_cleanly("secondary writebraw failed");
3832 }
3833
3834 /* Set up outbuf to return the correct size */
3835 reply_outbuf(req, 1, 0);
3836
3837 if (numtowrite != 0) {
3838
3839 if (numtowrite > 0xFFFF) {
3840 DEBUG(0,("reply_writebraw: Oversize secondary write "
3841 "raw requested (%u). Terminating\n",
3842 (unsigned int)numtowrite ));
3843 exit_server_cleanly("secondary writebraw failed");
3844 }
3845
3846 if (tcount > nwritten+numtowrite) {
3847 DEBUG(3,("reply_writebraw: Client overestimated the "
3848 "write %d %d %d\n",
3849 (int)tcount,(int)nwritten,(int)numtowrite));
3850 }
3851
3852 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3853
3854 if (!NT_STATUS_IS_OK(status)) {
3855 DEBUG(0,("reply_writebraw: Oversize secondary write "
3856 "raw read failed (%s). Terminating\n",
3857 nt_errstr(status)));
3858 exit_server_cleanly("secondary writebraw failed");
3859 }
3860
3861 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3862 if (nwritten == -1) {
3863 TALLOC_FREE(buf);
3864 reply_nterror(req, map_nt_error_from_unix(errno));
3865 error_to_writebrawerr(req);
3866 goto strict_unlock;
3867 }
3868
3869 if (nwritten < (ssize_t)numtowrite) {
3870 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3871 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3872 }
3873
3874 if (nwritten > 0) {
3875 total_written += nwritten;
3876 }
3877 }
3878
3879 TALLOC_FREE(buf);
3880 SSVAL(req->outbuf,smb_vwv0,total_written);
3881
3882 status = sync_file(conn, fsp, write_through);
3883 if (!NT_STATUS_IS_OK(status)) {
3884 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3885 fsp_str_dbg(fsp), nt_errstr(status)));
3886 reply_nterror(req, status);
3887 error_to_writebrawerr(req);
3888 goto strict_unlock;
3889 }
3890
3891 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3892 "wrote=%d\n",
3893 fsp->fnum, (double)startpos, (int)numtowrite,
3894 (int)total_written));
3895
3896 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3897
3898 /* We won't return a status if write through is not selected - this
3899 * follows what WfWg does */
3900 END_PROFILE(SMBwritebraw);
3901
3902 if (!write_through && total_written==tcount) {
3903
3904 #if RABBIT_PELLET_FIX
3905 /*
3906 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3907 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3908 * JRA.
3909 */
3910 if (!send_keepalive(smbd_server_fd())) {
3911 exit_server_cleanly("reply_writebraw: send of "
3912 "keepalive failed");
3913 }
3914 #endif
3915 TALLOC_FREE(req->outbuf);
3916 }
3917 return;
3918
3919 strict_unlock:
3920 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3921
3922 END_PROFILE(SMBwritebraw);
3923 return;
3924 }
3925
3926 #undef DBGC_CLASS
3927 #define DBGC_CLASS DBGC_LOCKING
3928
3929 /****************************************************************************
3930 Reply to a writeunlock (core+).
3931 ****************************************************************************/
3932
3933 void reply_writeunlock(struct smb_request *req)
3934 {
3935 connection_struct *conn = req->conn;
3936 ssize_t nwritten = -1;
3937 size_t numtowrite;
3938 SMB_OFF_T startpos;
3939 const char *data;
3940 NTSTATUS status = NT_STATUS_OK;
3941 files_struct *fsp;
3942 struct lock_struct lock;
3943 int saved_errno = 0;
3944
3945 START_PROFILE(SMBwriteunlock);
3946
3947 if (req->wct < 5) {
3948 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3949 END_PROFILE(SMBwriteunlock);
3950 return;
3951 }
3952
3953 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3954
3955 if (!check_fsp(conn, req, fsp)) {
3956 END_PROFILE(SMBwriteunlock);
3957 return;
3958 }
3959
3960 if (!CHECK_WRITE(fsp)) {
3961 reply_doserror(req, ERRDOS,ERRbadaccess);
3962 END_PROFILE(SMBwriteunlock);
3963 return;
3964 }
3965
3966 numtowrite = SVAL(req->vwv+1, 0);
3967 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3968 data = (const char *)req->buf + 3;
3969
3970 if (numtowrite) {
3971 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3972 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3973 &lock);
3974
3975 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3976 reply_doserror(req, ERRDOS, ERRlock);
3977 END_PROFILE(SMBwriteunlock);
3978 return;
3979 }
3980 }
3981
3982 /* The special X/Open SMB protocol handling of
3983 zero length writes is *NOT* done for
3984 this call */
3985 if(numtowrite == 0) {
3986 nwritten = 0;
3987 } else {
3988 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3989 saved_errno = errno;
3990 }
3991
3992 status = sync_file(conn, fsp, False /* write through */);
3993 if (!NT_STATUS_IS_OK(status)) {
3994 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3995 fsp_str_dbg(fsp), nt_errstr(status)));
3996 reply_nterror(req, status);
3997 goto strict_unlock;
3998 }
3999
4000 if(nwritten < 0) {
4001 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4002 goto strict_unlock;
4003 }
4004
4005 if((nwritten < numtowrite) && (numtowrite != 0)) {
4006 reply_doserror(req, ERRHRD, ERRdiskfull);
4007 goto strict_unlock;
4008 }
4009
4010 if (numtowrite) {
4011 status = do_unlock(smbd_messaging_context(),
4012 fsp,
4013 req->smbpid,
4014 (uint64_t)numtowrite,
4015 (uint64_t)startpos,
4016 WINDOWS_LOCK);
4017
4018 if (NT_STATUS_V(status)) {
4019 reply_nterror(req, status);
4020 goto strict_unlock;
4021 }
4022 }
4023
4024 reply_outbuf(req, 1, 0);
4025
4026 SSVAL(req->outbuf,smb_vwv0,nwritten);
4027
4028 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4029 fsp->fnum, (int)numtowrite, (int)nwritten));
4030
4031 strict_unlock:
4032 if (numtowrite) {
4033 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4034 }
4035
4036 END_PROFILE(SMBwriteunlock);
4037 return;
4038 }
4039
4040 #undef DBGC_CLASS
4041 #define DBGC_CLASS DBGC_ALL
4042
4043 /****************************************************************************
4044 Reply to a write.
4045 ****************************************************************************/
4046
4047 void reply_write(struct smb_request *req)
4048 {
4049 connection_struct *conn = req->conn;
4050 size_t numtowrite;
4051 ssize_t nwritten = -1;
4052 SMB_OFF_T startpos;
4053 const char *data;
4054 files_struct *fsp;
4055 struct lock_struct lock;
4056 NTSTATUS status;
4057 int saved_errno = 0;
4058
4059 START_PROFILE(SMBwrite);
4060
4061 if (req->wct < 5) {
4062 END_PROFILE(SMBwrite);
4063 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4064 return;
4065 }
4066
4067 /* If it's an IPC, pass off the pipe handler. */
4068 if (IS_IPC(conn)) {
4069 reply_pipe_write(req);
4070 END_PROFILE(SMBwrite);
4071 return;
4072 }
4073
4074 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4075
4076 if (!check_fsp(conn, req, fsp)) {
4077 END_PROFILE(SMBwrite);
4078 return;
4079 }
4080
4081 if (!CHECK_WRITE(fsp)) {
4082 reply_doserror(req, ERRDOS, ERRbadaccess);
4083 END_PROFILE(SMBwrite);
4084 return;
4085 }
4086
4087 numtowrite = SVAL(req->vwv+1, 0);
4088 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4089 data = (const char *)req->buf + 3;
4090
4091 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4092 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4093 &lock);
4094
4095 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4096 reply_doserror(req, ERRDOS, ERRlock);
4097 END_PROFILE(SMBwrite);
4098 return;
4099 }
4100
4101 /*
4102 * X/Open SMB protocol says that if smb_vwv1 is
4103 * zero then the file size should be extended or
4104 * truncated to the size given in smb_vwv[2-3].
4105 */
4106
4107 if(numtowrite == 0) {
4108 /*
4109 * This is actually an allocate call, and set EOF. JRA.
4110 */
4111 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4112 if (nwritten < 0) {
4113 reply_nterror(req, NT_STATUS_DISK_FULL);
4114 goto strict_unlock;
4115 }
4116 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4117 if (nwritten < 0) {
4118 reply_nterror(req, NT_STATUS_DISK_FULL);
4119 goto strict_unlock;
4120 }
4121 trigger_write_time_update_immediate(fsp);
4122 } else {
4123 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4124 }
4125
4126 status = sync_file(conn, fsp, False);
4127 if (!NT_STATUS_IS_OK(status)) {
4128 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4129 fsp_str_dbg(fsp), nt_errstr(status)));
4130 reply_nterror(req, status);
4131 goto strict_unlock;
4132 }
4133
4134 if(nwritten < 0) {
4135 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4136 goto strict_unlock;
4137 }
4138
4139 if((nwritten == 0) && (numtowrite != 0)) {
4140 reply_doserror(req, ERRHRD, ERRdiskfull);
4141 goto strict_unlock;
4142 }
4143
4144 reply_outbuf(req, 1, 0);
4145
4146 SSVAL(req->outbuf,smb_vwv0,nwritten);
4147
4148 if (nwritten < (ssize_t)numtowrite) {
4149 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4150 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4151 }
4152
4153 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4154
4155 strict_unlock:
4156 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4157
4158 END_PROFILE(SMBwrite);
4159 return;
4160 }
4161
4162 /****************************************************************************
4163 Ensure a buffer is a valid writeX for recvfile purposes.
4164 ****************************************************************************/
4165
4166 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4167 (2*14) + /* word count (including bcc) */ \
4168 1 /* pad byte */)
4169
4170 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4171 {
4172 size_t numtowrite;
4173 connection_struct *conn = NULL;
4174 unsigned int doff = 0;
4175 size_t len = smb_len_large(inbuf);
4176 struct smbd_server_connection *sconn = smbd_server_conn;
4177
4178 if (is_encrypted_packet(inbuf)) {
4179 /* Can't do this on encrypted
4180 * connections. */
4181 return false;
4182 }
4183
4184 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4185 return false;
4186 }
4187
4188 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4189 CVAL(inbuf,smb_wct) != 14) {
4190 DEBUG(10,("is_valid_writeX_buffer: chained or "
4191 "invalid word length.\n"));
4192 return false;
4193 }
4194
4195 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4196 if (conn == NULL) {
4197 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4198 return false;
4199 }
4200 if (IS_IPC(conn)) {
4201 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4202 return false;
4203 }
4204 if (IS_PRINT(conn)) {
4205 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4206 return false;
4207 }
4208 doff = SVAL(inbuf,smb_vwv11);
4209
4210 numtowrite = SVAL(inbuf,smb_vwv10);
4211
4212 if (len > doff && len - doff > 0xFFFF) {
4213 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4214 }
4215
4216 if (numtowrite == 0) {
4217 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4218 return false;
4219 }
4220
4221 /* Ensure the sizes match up. */
4222 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4223 /* no pad byte...old smbclient :-( */
4224 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4225 (unsigned int)doff,
4226 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4227 return false;
4228 }
4229
4230 if (len - doff != numtowrite) {
4231 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4232 "len = %u, doff = %u, numtowrite = %u\n",
4233 (unsigned int)len,
4234 (unsigned int)doff,
4235 (unsigned int)numtowrite ));
4236 return false;
4237 }
4238
4239 DEBUG(10,("is_valid_writeX_buffer: true "
4240 "len = %u, doff = %u, numtowrite = %u\n",
4241 (unsigned int)len,
4242 (unsigned int)doff,
4243 (unsigned int)numtowrite ));
4244
4245 return true;
4246 }
4247
4248 /****************************************************************************
4249 Reply to a write and X.
4250 ****************************************************************************/
4251
4252 void reply_write_and_X(struct smb_request *req)
4253 {
4254 connection_struct *conn = req->conn;
4255 files_struct *fsp;
4256 struct lock_struct lock;
4257 SMB_OFF_T startpos;
4258 size_t numtowrite;
4259 bool write_through;
4260 ssize_t nwritten;
4261 unsigned int smb_doff;
4262 unsigned int smblen;
4263 char *data;
4264 NTSTATUS status;
4265
4266 START_PROFILE(SMBwriteX);
4267
4268 if ((req->wct != 12) && (req->wct != 14)) {
4269 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4270 END_PROFILE(SMBwriteX);
4271 return;
4272 }
4273
4274 numtowrite = SVAL(req->vwv+10, 0);
4275 smb_doff = SVAL(req->vwv+11, 0);
4276 smblen = smb_len(req->inbuf);
4277
4278 if (req->unread_bytes > 0xFFFF ||
4279 (smblen > smb_doff &&
4280 smblen - smb_doff > 0xFFFF)) {
4281 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4282 }
4283
4284 if (req->unread_bytes) {
4285 /* Can't do a recvfile write on IPC$ */
4286 if (IS_IPC(conn)) {
4287 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4288 END_PROFILE(SMBwriteX);
4289 return;
4290 }
4291 if (numtowrite != req->unread_bytes) {
4292 reply_doserror(req, ERRDOS, ERRbadmem);
4293 END_PROFILE(SMBwriteX);
4294 return;
4295 }
4296 } else {
4297 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4298 smb_doff + numtowrite > smblen) {
4299 reply_doserror(req, ERRDOS, ERRbadmem);
4300 END_PROFILE(SMBwriteX);
4301 return;
4302 }
4303 }
4304
4305 /* If it's an IPC, pass off the pipe handler. */
4306 if (IS_IPC(conn)) {
4307 if (req->unread_bytes) {
4308 reply_doserror(req, ERRDOS, ERRbadmem);
4309 END_PROFILE(SMBwriteX);
4310 return;
4311 }
4312 reply_pipe_write_and_X(req);
4313 END_PROFILE(SMBwriteX);
4314 return;
4315 }
4316
4317 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4318 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4319 write_through = BITSETW(req->vwv+7,0);
4320
4321 if (!check_fsp(conn, req, fsp)) {
4322 END_PROFILE(SMBwriteX);
4323 return;
4324 }
4325
4326 if (!CHECK_WRITE(fsp)) {
4327 reply_doserror(req, ERRDOS, ERRbadaccess);
4328 END_PROFILE(SMBwriteX);
4329 return;
4330 }
4331
4332 data = smb_base(req->inbuf) + smb_doff;
4333
4334 if(req->wct == 14) {
4335 #ifdef LARGE_SMB_OFF_T
4336 /*
4337 * This is a large offset (64 bit) write.
4338 */
4339 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4340
4341 #else /* !LARGE_SMB_OFF_T */
4342
4343 /*
4344 * Ensure we haven't been sent a >32 bit offset.
4345 */
4346
4347 if(IVAL(req->vwv+12, 0) != 0) {
4348 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4349 "used and we don't support 64 bit offsets.\n",
4350 (unsigned int)IVAL(req->vwv+12, 0) ));
4351 reply_doserror(req, ERRDOS, ERRbadaccess);
4352 END_PROFILE(SMBwriteX);
4353 return;
4354 }
4355
4356 #endif /* LARGE_SMB_OFF_T */
4357 }
4358
4359 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4360 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4361 &lock);
4362
4363 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4364 reply_doserror(req, ERRDOS, ERRlock);
4365 END_PROFILE(SMBwriteX);
4366 return;
4367 }
4368
4369 /* X/Open SMB protocol says that, unlike SMBwrite
4370 if the length is zero then NO truncation is
4371 done, just a write of zero. To truncate a file,
4372 use SMBwrite. */
4373
4374 if(numtowrite == 0) {
4375 nwritten = 0;
4376 } else {
4377
4378 if ((req->unread_bytes == 0) &&
4379 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4380 numtowrite)) {
4381 goto strict_unlock;
4382 }
4383
4384 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4385 }
4386
4387 if(nwritten < 0) {
4388 reply_nterror(req, map_nt_error_from_unix(errno));
4389 goto strict_unlock;
4390 }
4391
4392 if((nwritten == 0) && (numtowrite != 0)) {
4393 reply_doserror(req, ERRHRD, ERRdiskfull);
4394 goto strict_unlock;
4395 }
4396
4397 reply_outbuf(req, 6, 0);
4398 SSVAL(req->outbuf,smb_vwv2,nwritten);
4399 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4400
4401 if (nwritten < (ssize_t)numtowrite) {
4402 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4403 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4404 }
4405
4406 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4407 fsp->fnum, (int)numtowrite, (int)nwritten));
4408
4409 status = sync_file(conn, fsp, write_through);
4410 if (!NT_STATUS_IS_OK(status)) {
4411 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4412 fsp_str_dbg(fsp), nt_errstr(status)));
4413 reply_nterror(req, status);
4414 goto strict_unlock;
4415 }
4416
4417 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4418
4419 END_PROFILE(SMBwriteX);
4420 chain_reply(req);
4421 return;
4422
4423 strict_unlock:
4424 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4425
4426 END_PROFILE(SMBwriteX);
4427 return;
4428 }
4429
4430 /****************************************************************************
4431 Reply to a lseek.
4432 ****************************************************************************/
4433
4434 void reply_lseek(struct smb_request *req)
4435 {
4436 connection_struct *conn = req->conn;
4437 SMB_OFF_T startpos;
4438 SMB_OFF_T res= -1;
4439 int mode,umode;
4440 files_struct *fsp;
4441
4442 START_PROFILE(SMBlseek);
4443
4444 if (req->wct < 4) {
4445 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4446 END_PROFILE(SMBlseek);
4447 return;
4448 }
4449
4450 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4451
4452 if (!check_fsp(conn, req, fsp)) {
4453 return;
4454 }
4455
4456 flush_write_cache(fsp, SEEK_FLUSH);
4457
4458 mode = SVAL(req->vwv+1, 0) & 3;
4459 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4460 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4461
4462 switch (mode) {
4463 case 0:
4464 umode = SEEK_SET;
4465 res = startpos;
4466 break;
4467 case 1:
4468 umode = SEEK_CUR;
4469 res = fsp->fh->pos + startpos;
4470 break;
4471 case 2:
4472 umode = SEEK_END;
4473 break;
4474 default:
4475 umode = SEEK_SET;
4476 res = startpos;
4477 break;
4478 }
4479
4480 if (umode == SEEK_END) {
4481 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4482 if(errno == EINVAL) {
4483 SMB_OFF_T current_pos = startpos;
4484 SMB_STRUCT_STAT sbuf;
4485
4486 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4487 reply_nterror(req,
4488 map_nt_error_from_unix(errno));
4489 END_PROFILE(SMBlseek);
4490 return;
4491 }
4492
4493 current_pos += sbuf.st_ex_size;
4494 if(current_pos < 0)
4495 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4496 }
4497 }
4498
4499 if(res == -1) {
4500 reply_nterror(req, map_nt_error_from_unix(errno));
4501 END_PROFILE(SMBlseek);
4502 return;
4503 }
4504 }
4505
4506 fsp->fh->pos = res;
4507
4508 reply_outbuf(req, 2, 0);
4509 SIVAL(req->outbuf,smb_vwv0,res);
4510
4511 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4512 fsp->fnum, (double)startpos, (double)res, mode));
4513
4514 END_PROFILE(SMBlseek);
4515 return;
4516 }
4517
4518 /****************************************************************************
4519 Reply to a flush.
4520 ****************************************************************************/
4521
4522 void reply_flush(struct smb_request *req)
4523 {
4524 connection_struct *conn = req->conn;
4525 uint16 fnum;
4526 files_struct *fsp;
4527
4528 START_PROFILE(SMBflush);
4529
4530 if (req->wct < 1) {
4531 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4532 return;
4533 }
4534
4535 fnum = SVAL(req->vwv+0, 0);
4536 fsp = file_fsp(req, fnum);
4537
4538 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4539 return;
4540 }
4541
4542 if (!fsp) {
4543 file_sync_all(conn);
4544 } else {
4545 NTSTATUS status = sync_file(conn, fsp, True);
4546 if (!NT_STATUS_IS_OK(status)) {
4547 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4548 fsp_str_dbg(fsp), nt_errstr(status)));
4549 reply_nterror(req, status);
4550 END_PROFILE(SMBflush);
4551 return;
4552 }
4553 }
4554
4555 reply_outbuf(req, 0, 0);
4556
4557 DEBUG(3,("flush\n"));
4558 END_PROFILE(SMBflush);
4559 return;
4560 }
4561
4562 /****************************************************************************
4563 Reply to a exit.
4564 conn POINTER CAN BE NULL HERE !
4565 ****************************************************************************/
4566
4567 void reply_exit(struct smb_request *req)
4568 {
4569 START_PROFILE(SMBexit);
4570
4571 file_close_pid(req->smbpid, req->vuid);
4572
4573 reply_outbuf(req, 0, 0);
4574
4575 DEBUG(3,("exit\n"));
4576
4577 END_PROFILE(SMBexit);
4578 return;
4579 }
4580
4581 /****************************************************************************
4582 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4583 ****************************************************************************/
4584
4585 void reply_close(struct smb_request *req)
4586 {
4587 connection_struct *conn = req->conn;
4588 NTSTATUS status = NT_STATUS_OK;
4589 files_struct *fsp = NULL;
4590 START_PROFILE(SMBclose);
4591
4592 if (req->wct < 3) {
4593 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4594 END_PROFILE(SMBclose);
4595 return;
4596 }
4597
4598 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4599
4600 /*
4601 * We can only use check_fsp if we know it's not a directory.
4602 */
4603
4604 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4605 reply_doserror(req, ERRDOS, ERRbadfid);
4606 END_PROFILE(SMBclose);
4607 return;
4608 }
4609
4610 if(fsp->is_directory) {
4611 /*
4612 * Special case - close NT SMB directory handle.
4613 */
4614 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4615 status = close_file(req, fsp, NORMAL_CLOSE);
4616 } else {
4617 time_t t;
4618 /*
4619 * Close ordinary file.
4620 */
4621
4622 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4623 fsp->fh->fd, fsp->fnum,
4624 conn->num_files_open));
4625
4626 /*
4627 * Take care of any time sent in the close.
4628 */
4629
4630 t = srv_make_unix_date3(req->vwv+1);
4631 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4632
4633 /*
4634 * close_file() returns the unix errno if an error
4635 * was detected on close - normally this is due to
4636 * a disk full error. If not then it was probably an I/O error.
4637 */
4638
4639 status = close_file(req, fsp, NORMAL_CLOSE);
4640 }
4641
4642 if (!NT_STATUS_IS_OK(status)) {
4643 reply_nterror(req, status);
4644 END_PROFILE(SMBclose);
4645 return;
4646 }
4647
4648 reply_outbuf(req, 0, 0);
4649 END_PROFILE(SMBclose);
4650 return;
4651 }
4652
4653 /****************************************************************************
4654 Reply to a writeclose (Core+ protocol).
4655 ****************************************************************************/
4656
4657 void reply_writeclose(struct smb_request *req)
4658 {
4659 connection_struct *conn = req->conn;
4660 size_t numtowrite;
4661 ssize_t nwritten = -1;
4662 NTSTATUS close_status = NT_STATUS_OK;
4663 SMB_OFF_T startpos;
4664 const char *data;
4665 struct timespec mtime;
4666 files_struct *fsp;
4667 struct lock_struct lock;
4668
4669 START_PROFILE(SMBwriteclose);
4670
4671 if (req->wct < 6) {
4672 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4673 END_PROFILE(SMBwriteclose);
4674 return;
4675 }
4676
4677 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4678
4679 if (!check_fsp(conn, req, fsp)) {
4680 END_PROFILE(SMBwriteclose);
4681 return;
4682 }
4683 if (!CHECK_WRITE(fsp)) {
4684 reply_doserror(req, ERRDOS,ERRbadaccess);
4685 END_PROFILE(SMBwriteclose);
4686 return;
4687 }
4688
4689 numtowrite = SVAL(req->vwv+1, 0);
4690 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4691 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4692 data = (const char *)req->buf + 1;
4693
4694 if (numtowrite) {
4695 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4696 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4697 &lock);
4698
4699 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4700 reply_doserror(req, ERRDOS,ERRlock);
4701 END_PROFILE(SMBwriteclose);
4702 return;
4703 }
4704 }
4705
4706 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4707
4708 set_close_write_time(fsp, mtime);
4709
4710 /*
4711 * More insanity. W2K only closes the file if writelen > 0.
4712 * JRA.
4713 */
4714
4715 if (numtowrite) {
4716 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4717 "file %s\n", fsp_str_dbg(fsp)));
4718 close_status = close_file(req, fsp, NORMAL_CLOSE);
4719 }
4720
4721 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4722 fsp->fnum, (int)numtowrite, (int)nwritten,
4723 conn->num_files_open));
4724
4725 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4726 reply_doserror(req, ERRHRD, ERRdiskfull);
4727 goto strict_unlock;
4728 }
4729
4730 if(!NT_STATUS_IS_OK(close_status)) {
4731 reply_nterror(req, close_status);
4732 goto strict_unlock;
4733 }
4734
4735 reply_outbuf(req, 1, 0);
4736
4737 SSVAL(req->outbuf,smb_vwv0,nwritten);
4738
4739 strict_unlock:
4740 if (numtowrite) {
4741 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4742 }
4743
4744 END_PROFILE(SMBwriteclose);
4745 return;
4746 }
4747
4748 #undef DBGC_CLASS
4749 #define DBGC_CLASS DBGC_LOCKING
4750
4751 /****************************************************************************
4752 Reply to a lock.
4753 ****************************************************************************/
4754
4755 void reply_lock(struct smb_request *req)
4756 {
4757 connection_struct *conn = req->conn;
4758 uint64_t count,offset;
4759 NTSTATUS status;
4760 files_struct *fsp;
4761 struct byte_range_lock *br_lck = NULL;
4762
4763 START_PROFILE(SMBlock);
4764
4765 if (req->wct < 5) {
4766 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4767 END_PROFILE(SMBlock);
4768 return;
4769 }
4770
4771 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4772
4773 if (!check_fsp(conn, req, fsp)) {
4774 END_PROFILE(SMBlock);
4775 return;
4776 }
4777
4778 count = (uint64_t)IVAL(req->vwv+1, 0);
4779 offset = (uint64_t)IVAL(req->vwv+3, 0);
4780
4781 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4782 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4783
4784 br_lck = do_lock(smbd_messaging_context(),
4785 fsp,
4786 req->smbpid,
4787 count,
4788 offset,
4789 WRITE_LOCK,
4790 WINDOWS_LOCK,
4791 False, /* Non-blocking lock. */
4792 &status,
4793 NULL,
4794 NULL);
4795
4796 TALLOC_FREE(br_lck);
4797
4798 if (NT_STATUS_V(status)) {
4799 reply_nterror(req, status);
4800 END_PROFILE(SMBlock);
4801 return;
4802 }
4803
4804 reply_outbuf(req, 0, 0);
4805
4806 END_PROFILE(SMBlock);
4807 return;
4808 }
4809
4810 /****************************************************************************
4811 Reply to a unlock.
4812 ****************************************************************************/
4813
4814 void reply_unlock(struct smb_request *req)
4815 {
4816 connection_struct *conn = req->conn;
4817 uint64_t count,offset;
4818 NTSTATUS status;
4819 files_struct *fsp;
4820
4821 START_PROFILE(SMBunlock);
4822
4823 if (req->wct < 5) {
4824 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4825 END_PROFILE(SMBunlock);
4826 return;
4827 }
4828
4829 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4830
4831 if (!check_fsp(conn, req, fsp)) {
4832 END_PROFILE(SMBunlock);
4833 return;
4834 }
4835
4836 count = (uint64_t)IVAL(req->vwv+1, 0);
4837 offset = (uint64_t)IVAL(req->vwv+3, 0);
4838
4839 status = do_unlock(smbd_messaging_context(),
4840 fsp,
4841 req->smbpid,
4842 count,
4843 offset,
4844 WINDOWS_LOCK);
4845
4846 if (NT_STATUS_V(status)) {
4847 reply_nterror(req, status);
4848 END_PROFILE(SMBunlock);
4849 return;
4850 }
4851
4852 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4853 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4854
4855 reply_outbuf(req, 0, 0);
4856
4857 END_PROFILE(SMBunlock);
4858 return;
4859 }
4860
4861 #undef DBGC_CLASS
4862 #define DBGC_CLASS DBGC_ALL
4863
4864 /****************************************************************************
4865 Reply to a tdis.
4866 conn POINTER CAN BE NULL HERE !
4867 ****************************************************************************/
4868
4869 void reply_tdis(struct smb_request *req)
4870 {
4871 struct smbd_server_connection *sconn = smbd_server_conn;
4872 connection_struct *conn = req->conn;
4873 START_PROFILE(SMBtdis);
4874
4875 if (!conn) {
4876 DEBUG(4,("Invalid connection in tdis\n"));
4877 reply_doserror(req, ERRSRV, ERRinvnid);
4878 END_PROFILE(SMBtdis);
4879 return;
4880 }
4881
4882 conn->used = False;
4883
4884 close_cnum(sconn, conn,req->vuid);
4885 req->conn = NULL;
4886
4887 reply_outbuf(req, 0, 0);
4888 END_PROFILE(SMBtdis);
4889 return;
4890 }
4891
4892 /****************************************************************************
4893 Reply to a echo.
4894 conn POINTER CAN BE NULL HERE !
4895 ****************************************************************************/
4896
4897 void reply_echo(struct smb_request *req)
4898 {
4899 connection_struct *conn = req->conn;
4900 struct smb_perfcount_data local_pcd;
4901 struct smb_perfcount_data *cur_pcd;
4902 int smb_reverb;
4903 int seq_num;
4904
4905 START_PROFILE(SMBecho);
4906
4907 smb_init_perfcount_data(&local_pcd);
4908
4909 if (req->wct < 1) {
4910 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4911 END_PROFILE(SMBecho);
4912 return;
4913 }
4914
4915 smb_reverb = SVAL(req->vwv+0, 0);
4916
4917 reply_outbuf(req, 1, req->buflen);
4918
4919 /* copy any incoming data back out */
4920 if (req->buflen > 0) {
4921 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4922 }
4923
4924 if (smb_reverb > 100) {
4925 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4926 smb_reverb = 100;
4927 }
4928
4929 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4930
4931 /* this makes sure we catch the request pcd */
4932 if (seq_num == smb_reverb) {
4933 cur_pcd = &req->pcd;
4934 } else {
4935 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4936 cur_pcd = &local_pcd;
4937 }
4938
4939 SSVAL(req->outbuf,smb_vwv0,seq_num);
4940
4941 show_msg((char *)req->outbuf);
4942 if (!srv_send_smb(smbd_server_fd(),
4943 (char *)req->outbuf,
4944 true, req->seqnum+1,
4945 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4946 cur_pcd))
4947 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4948 }
4949
4950 DEBUG(3,("echo %d times\n", smb_reverb));
4951
4952 TALLOC_FREE(req->outbuf);
4953
4954 END_PROFILE(SMBecho);
4955 return;
4956 }
4957
4958 /****************************************************************************
4959 Reply to a printopen.
4960 ****************************************************************************/
4961
4962 void reply_printopen(struct smb_request *req)
4963 {
4964 connection_struct *conn = req->conn;
4965 files_struct *fsp;
4966 SMB_STRUCT_STAT sbuf;
4967 NTSTATUS status;
4968
4969 START_PROFILE(SMBsplopen);
4970
4971 if (req->wct < 2) {
4972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4973 END_PROFILE(SMBsplopen);
4974 return;
4975 }
4976
4977 if (!CAN_PRINT(conn)) {
4978 reply_doserror(req, ERRDOS, ERRnoaccess);
4979 END_PROFILE(SMBsplopen);
4980 return;
4981 }
4982
4983 status = file_new(req, conn, &fsp);
4984 if(!NT_STATUS_IS_OK(status)) {
4985 reply_nterror(req, status);
4986 END_PROFILE(SMBsplopen);
4987 return;
4988 }
4989
4990 /* Open for exclusive use, write only. */
4991 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4992
4993 if (!NT_STATUS_IS_OK(status)) {
4994 file_free(req, fsp);
4995 reply_nterror(req, status);
4996 END_PROFILE(SMBsplopen);
4997 return;
4998 }
4999
5000 reply_outbuf(req, 1, 0);
5001 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5002
5003 DEBUG(3,("openprint fd=%d fnum=%d\n",
5004 fsp->fh->fd, fsp->fnum));
5005
5006 END_PROFILE(SMBsplopen);
5007 return;
5008 }
5009
5010 /****************************************************************************
5011 Reply to a printclose.
5012 ****************************************************************************/
5013
5014 void reply_printclose(struct smb_request *req)
5015 {
5016 connection_struct *conn = req->conn;
5017 files_struct *fsp;
5018 NTSTATUS status;
5019
5020 START_PROFILE(SMBsplclose);
5021
5022 if (req->wct < 1) {
5023 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5024 END_PROFILE(SMBsplclose);
5025 return;
5026 }
5027
5028 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5029
5030 if (!check_fsp(conn, req, fsp)) {
5031 END_PROFILE(SMBsplclose);
5032 return;
5033 }
5034
5035 if (!CAN_PRINT(conn)) {
5036 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
5037 END_PROFILE(SMBsplclose);
5038 return;
5039 }
5040
5041 DEBUG(3,("printclose fd=%d fnum=%d\n",
5042 fsp->fh->fd,fsp->fnum));
5043
5044 status = close_file(req, fsp, NORMAL_CLOSE);
5045
5046 if(!NT_STATUS_IS_OK(status)) {
5047 reply_nterror(req, status);
5048 END_PROFILE(SMBsplclose);
5049 return;
5050 }
5051
5052 reply_outbuf(req, 0, 0);
5053
5054 END_PROFILE(SMBsplclose);
5055 return;
5056 }
5057
5058 /****************************************************************************
5059 Reply to a printqueue.
5060 ****************************************************************************/
5061
5062 void reply_printqueue(struct smb_request *req)
5063 {
5064 connection_struct *conn = req->conn;
5065 int max_count;
5066 int start_index;
5067
5068 START_PROFILE(SMBsplretq);
5069
5070 if (req->wct < 2) {
5071 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5072 END_PROFILE(SMBsplretq);
5073 return;
5074 }
5075
5076 max_count = SVAL(req->vwv+0, 0);
5077 start_index = SVAL(req->vwv+1, 0);
5078
5079 /* we used to allow the client to get the cnum wrong, but that
5080 is really quite gross and only worked when there was only
5081 one printer - I think we should now only accept it if they
5082 get it right (tridge) */
5083 if (!CAN_PRINT(conn)) {
5084 reply_doserror(req, ERRDOS, ERRnoaccess);
5085 END_PROFILE(SMBsplretq);
5086 return;
5087 }
5088
5089 reply_outbuf(req, 2, 3);
5090 SSVAL(req->outbuf,smb_vwv0,0);
5091 SSVAL(req->outbuf,smb_vwv1,0);
5092 SCVAL(smb_buf(req->outbuf),0,1);
5093 SSVAL(smb_buf(req->outbuf),1,0);
5094
5095 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5096 start_index, max_count));
5097
5098 {
5099 print_queue_struct *queue = NULL;
5100 print_status_struct status;
5101 int count = print_queue_status(SNUM(conn), &queue, &status);
5102 int num_to_get = ABS(max_count);
5103 int first = (max_count>0?start_index:start_index+max_count+1);
5104 int i;
5105
5106 if (first >= count)
5107 num_to_get = 0;
5108 else
5109 num_to_get = MIN(num_to_get,count-first);
5110
5111
5112 for (i=first;i<first+num_to_get;i++) {
5113 char blob[28];
5114 char *p = blob;
5115
5116 srv_put_dos_date2(p,0,queue[i].time);
5117 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5118 SSVAL(p,5, queue[i].job);
5119 SIVAL(p,7,queue[i].size);
5120 SCVAL(p,11,0);
5121 srvstr_push(blob, req->flags2, p+12,
5122 queue[i].fs_user, 16, STR_ASCII);
5123
5124 if (message_push_blob(
5125 &req->outbuf,
5126 data_blob_const(
5127 blob, sizeof(blob))) == -1) {
5128 reply_nterror(req, NT_STATUS_NO_MEMORY);
5129 END_PROFILE(SMBsplretq);
5130 return;
5131 }
5132 }
5133
5134 if (count > 0) {
5135 SSVAL(req->outbuf,smb_vwv0,count);
5136 SSVAL(req->outbuf,smb_vwv1,
5137 (max_count>0?first+count:first-1));
5138 SCVAL(smb_buf(req->outbuf),0,1);
5139 SSVAL(smb_buf(req->outbuf),1,28*count);
5140 }
5141
5142 SAFE_FREE(queue);
5143
5144 DEBUG(3,("%d entries returned in queue\n",count));
5145 }
5146
5147 END_PROFILE(SMBsplretq);
5148 return;
5149 }
5150
5151 /****************************************************************************
5152 Reply to a printwrite.
5153 ****************************************************************************/
5154
5155 void reply_printwrite(struct smb_request *req)
5156 {
5157 connection_struct *conn = req->conn;
5158 int numtowrite;
5159 const char *data;
5160 files_struct *fsp;
5161
5162 START_PROFILE(SMBsplwr);
5163
5164 if (req->wct < 1) {
5165 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5166 END_PROFILE(SMBsplwr);
5167 return;
5168 }
5169
5170 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5171
5172 if (!check_fsp(conn, req, fsp)) {
5173 END_PROFILE(SMBsplwr);
5174 return;
5175 }
5176
5177 if (!CAN_PRINT(conn)) {
5178 reply_doserror(req, ERRDOS, ERRnoaccess);
5179 END_PROFILE(SMBsplwr);
5180 return;
5181 }
5182
5183 if (!CHECK_WRITE(fsp)) {
5184 reply_doserror(req, ERRDOS, ERRbadaccess);
5185 END_PROFILE(SMBsplwr);
5186 return;
5187 }
5188
5189 numtowrite = SVAL(req->buf, 1);
5190
5191 if (req->buflen < numtowrite + 3) {
5192 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5193 END_PROFILE(SMBsplwr);
5194 return;
5195 }
5196
5197 data = (const char *)req->buf + 3;
5198
5199 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5200 reply_nterror(req, map_nt_error_from_unix(errno));
5201 END_PROFILE(SMBsplwr);
5202 return;
5203 }
5204
5205 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5206
5207 END_PROFILE(SMBsplwr);
5208 return;
5209 }
5210
5211 /****************************************************************************
5212 Reply to a mkdir.
5213 ****************************************************************************/
5214
5215 void reply_mkdir(struct smb_request *req)
5216 {
5217 connection_struct *conn = req->conn;
5218 struct smb_filename *smb_dname = NULL;
5219 char *directory = NULL;
5220 NTSTATUS status;
5221 TALLOC_CTX *ctx = talloc_tos();
5222
5223 START_PROFILE(SMBmkdir);
5224
5225 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5226 STR_TERMINATE, &status);
5227 if (!NT_STATUS_IS_OK(status)) {
5228 reply_nterror(req, status);
5229 goto out;
5230 }
5231
5232 status = filename_convert(ctx, conn,
5233 req->flags2 & FLAGS2_DFS_PATHNAMES,
5234 directory,
5235 0,
5236 NULL,
5237 &smb_dname);
5238 if (!NT_STATUS_IS_OK(status)) {
5239 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5240 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5241 ERRSRV, ERRbadpath);
5242 goto out;
5243 }
5244 reply_nterror(req, status);
5245 goto out;
5246 }
5247
5248 status = create_directory(conn, req, smb_dname);
5249
5250 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5251
5252 if (!NT_STATUS_IS_OK(status)) {
5253
5254 if (!use_nt_status()
5255 && NT_STATUS_EQUAL(status,
5256 NT_STATUS_OBJECT_NAME_COLLISION)) {
5257 /*
5258 * Yes, in the DOS error code case we get a
5259 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5260 * samba4 torture test.
5261 */
5262 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5263 }
5264
5265 reply_nterror(req, status);
5266 goto out;
5267 }
5268
5269 reply_outbuf(req, 0, 0);
5270
5271 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5272 out:
5273 TALLOC_FREE(smb_dname);
5274 END_PROFILE(SMBmkdir);
5275 return;
5276 }
5277
5278 /****************************************************************************
5279 Static function used by reply_rmdir to delete an entire directory
5280 tree recursively. Return True on ok, False on fail.
5281 ****************************************************************************/
5282
5283 static bool recursive_rmdir(TALLOC_CTX *ctx,
5284 connection_struct *conn,
5285 struct smb_filename *smb_dname)
5286 {
5287 const char *dname = NULL;
5288 bool ret = True;
5289 long offset = 0;
5290 SMB_STRUCT_STAT st;
5291 struct smb_Dir *dir_hnd;
5292
5293 SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5294
5295 dir_hnd = OpenDir(talloc_tos(), conn, smb_dname->base_name, NULL, 0);
5296 if(dir_hnd == NULL)
5297 return False;
5298
5299 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5300 struct smb_filename *smb_dname_full = NULL;
5301 char *fullname = NULL;
5302 bool do_break = true;
5303 NTSTATUS status;
5304
5305 if (ISDOT(dname) || ISDOTDOT(dname)) {
5306 continue;
5307 }
5308
5309 if (!is_visible_file(conn, smb_dname->base_name, dname, &st,
5310 false)) {
5311 continue;
5312 }
5313
5314 /* Construct the full name. */
5315 fullname = talloc_asprintf(ctx,
5316 "%s/%s",
5317 smb_dname->base_name,
5318 dname);
5319 if (!fullname) {
5320 errno = ENOMEM;
5321 goto err_break;
5322 }
5323
5324 status = create_synthetic_smb_fname(talloc_tos(), fullname,
5325 NULL, NULL,
5326 &smb_dname_full);
5327 if (!NT_STATUS_IS_OK(status)) {
5328 goto err_break;
5329 }
5330
5331 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5332 goto err_break;
5333 }
5334
5335 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5336 if(!recursive_rmdir(ctx, conn, smb_dname_full)) {
5337 goto err_break;
5338 }
5339 if(SMB_VFS_RMDIR(conn,
5340 smb_dname_full->base_name) != 0) {
5341 goto err_break;
5342 }
5343 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5344 goto err_break;
5345 }
5346
5347 /* Successful iteration. */
5348 do_break = false;
5349
5350 err_break:
5351 TALLOC_FREE(smb_dname_full);
5352 TALLOC_FREE(fullname);
5353 if (do_break) {
5354 ret = false;
5355 break;
5356 }
5357 }
5358 TALLOC_FREE(dir_hnd);
5359 return ret;
5360 }
5361
5362 /****************************************************************************
5363 The internals of the rmdir code - called elsewhere.
5364 ****************************************************************************/
5365
5366 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5367 connection_struct *conn,
5368 struct smb_filename *smb_dname)
5369 {
5370 int ret;
5371 SMB_STRUCT_STAT st;
5372
5373 SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5374
5375 /* Might be a symlink. */
5376 if(SMB_VFS_LSTAT(conn, smb_dname) != 0) {
5377 return map_nt_error_from_unix(errno);
5378 }
5379
5380 if (S_ISLNK(smb_dname->st.st_ex_mode)) {
5381 /* Is what it points to a directory ? */
5382 if(SMB_VFS_STAT(conn, smb_dname) != 0) {
5383 return map_nt_error_from_unix(errno);
5384 }
5385 if (!(S_ISDIR(smb_dname->st.st_ex_mode))) {
5386 return NT_STATUS_NOT_A_DIRECTORY;
5387 }
5388 ret = SMB_VFS_UNLINK(conn, smb_dname);
5389 } else {
5390 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5391 }
5392 if (ret == 0) {
5393 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5394 FILE_NOTIFY_CHANGE_DIR_NAME,
5395 smb_dname->base_name);
5396 return NT_STATUS_OK;
5397 }
5398
5399 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5400 /*
5401 * Check to see if the only thing in this directory are
5402 * vetoed files/directories. If so then delete them and
5403 * retry. If we fail to delete any of them (and we *don't*
5404 * do a recursive delete) then fail the rmdir.
5405 */
5406 const char *dname;
5407 long dirpos = 0;
5408 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5409 smb_dname->base_name, NULL,
5410 0);
5411
5412 if(dir_hnd == NULL) {
5413 errno = ENOTEMPTY;
5414 goto err;
5415 }
5416
5417 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5418 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5419 continue;
5420 if (!is_visible_file(conn, smb_dname->base_name, dname,
5421 &st, false))
5422 continue;
5423 if(!IS_VETO_PATH(conn, dname)) {
5424 TALLOC_FREE(dir_hnd);
5425 errno = ENOTEMPTY;
5426 goto err;
5427 }
5428 }
5429
5430 /* We only have veto files/directories.
5431 * Are we allowed to delete them ? */
5432
5433 if(!lp_recursive_veto_delete(SNUM(conn))) {
5434 TALLOC_FREE(dir_hnd);
5435 errno = ENOTEMPTY;
5436 goto err;
5437 }
5438
5439 /* Do a recursive delete. */
5440 RewindDir(dir_hnd,&dirpos);
5441 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5442 struct smb_filename *smb_dname_full = NULL;
5443 char *fullname = NULL;
5444 bool do_break = true;
5445 NTSTATUS status;
5446
5447 if (ISDOT(dname) || ISDOTDOT(dname)) {
5448 continue;
5449 }
5450 if (!is_visible_file(conn, smb_dname->base_name, dname,
5451 &st, false)) {
5452 continue;
5453 }
5454
5455 fullname = talloc_asprintf(ctx,
5456 "%s/%s",
5457 smb_dname->base_name,
5458 dname);
5459
5460 if(!fullname) {
5461 errno = ENOMEM;
5462 goto err_break;
5463 }
5464
5465 status = create_synthetic_smb_fname(talloc_tos(),
5466 fullname, NULL,
5467 NULL,
5468 &smb_dname_full);
5469 if (!NT_STATUS_IS_OK(status)) {
5470 errno = map_errno_from_nt_status(status);
5471 goto err_break;
5472 }
5473
5474 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5475 goto err_break;
5476 }
5477 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5478 if(!recursive_rmdir(ctx, conn,
5479 smb_dname_full)) {
5480 goto err_break;
5481 }
5482 if(SMB_VFS_RMDIR(conn,
5483 smb_dname_full->base_name) != 0) {
5484 goto err_break;
5485 }
5486 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5487 goto err_break;
5488 }
5489
5490 /* Successful iteration. */
5491 do_break = false;
5492
5493 err_break:
5494 TALLOC_FREE(fullname);
5495 TALLOC_FREE(smb_dname_full);
5496 if (do_break)
5497 break;
5498 }
5499 TALLOC_FREE(dir_hnd);
5500 /* Retry the rmdir */
5501 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5502 }
5503
5504 err:
5505
5506 if (ret != 0) {
5507 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5508 "%s\n", smb_fname_str_dbg(smb_dname),
5509 strerror(errno)));
5510 return map_nt_error_from_unix(errno);
5511 }
5512
5513 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5514 FILE_NOTIFY_CHANGE_DIR_NAME,
5515 smb_dname->base_name);
5516
5517 return NT_STATUS_OK;
5518 }
5519
5520 /****************************************************************************
5521 Reply to a rmdir.
5522 ****************************************************************************/
5523
5524 void reply_rmdir(struct smb_request *req)
5525 {
5526 connection_struct *conn = req->conn;
5527 struct smb_filename *smb_dname = NULL;
5528 char *directory = NULL;
5529 NTSTATUS status;
5530 TALLOC_CTX *ctx = talloc_tos();
5531
5532 START_PROFILE(SMBrmdir);
5533
5534 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5535 STR_TERMINATE, &status);
5536 if (!NT_STATUS_IS_OK(status)) {
5537 reply_nterror(req, status);
5538 goto out;
5539 }
5540
5541 status = filename_convert(ctx, conn,
5542 req->flags2 & FLAGS2_DFS_PATHNAMES,
5543 directory,
5544 0,
5545 NULL,
5546 &smb_dname);
5547 if (!NT_STATUS_IS_OK(status)) {
5548 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5549 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5550 ERRSRV, ERRbadpath);
5551 goto out;
5552 }
5553 reply_nterror(req, status);
5554 goto out;
5555 }
5556
5557 if (is_ntfs_stream_smb_fname(smb_dname)) {
5558 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5559 goto out;
5560 }
5561
5562 dptr_closepath(smb_dname->base_name, req->smbpid);
5563 status = rmdir_internals(ctx, conn, smb_dname);
5564 if (!NT_STATUS_IS_OK(status)) {
5565 reply_nterror(req, status);
5566 goto out;
5567 }
5568
5569 reply_outbuf(req, 0, 0);
5570
5571 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5572 out:
5573 TALLOC_FREE(smb_dname);
5574 END_PROFILE(SMBrmdir);
5575 return;
5576 }
5577
5578 /*******************************************************************
5579 Resolve wildcards in a filename rename.
5580 ********************************************************************/
5581
5582 static bool resolve_wildcards(TALLOC_CTX *ctx,
5583 const char *name1,
5584 const char *name2,
5585 char **pp_newname)
5586 {
5587 char *name2_copy = NULL;
5588 char *root1 = NULL;
5589 char *root2 = NULL;
5590 char *ext1 = NULL;
5591 char *ext2 = NULL;
5592 char *p,*p2, *pname1, *pname2;
5593
5594 name2_copy = talloc_strdup(ctx, name2);
5595 if (!name2_copy) {
5596 return False;
5597 }
5598
5599 pname1 = strrchr_m(name1,'/');
5600 pname2 = strrchr_m(name2_copy,'/');
5601
5602 if (!pname1 || !pname2) {
5603 return False;
5604 }
5605
5606 /* Truncate the copy of name2 at the last '/' */
5607 *pname2 = '\0';
5608
5609 /* Now go past the '/' */
5610 pname1++;
5611 pname2++;
5612
5613 root1 = talloc_strdup(ctx, pname1);
5614 root2 = talloc_strdup(ctx, pname2);
5615
5616 if (!root1 || !root2) {
5617 return False;
5618 }
5619
5620 p = strrchr_m(root1,'.');
5621 if (p) {
5622 *p = 0;
5623 ext1 = talloc_strdup(ctx, p+1);
5624 } else {
5625 ext1 = talloc_strdup(ctx, "");
5626 }
5627 p = strrchr_m(root2,'.');
5628 if (p) {
5629 *p = 0;
5630 ext2 = talloc_strdup(ctx, p+1);
5631 } else {
5632 ext2 = talloc_strdup(ctx, "");
5633 }
5634
5635 if (!ext1 || !ext2) {
5636 return False;
5637 }
5638
5639 p = root1;
5640 p2 = root2;
5641 while (*p2) {
5642 if (*p2 == '?') {
5643 /* Hmmm. Should this be mb-aware ? */
5644 *p2 = *p;
5645 p2++;
5646 } else if (*p2 == '*') {
5647 *p2 = '\0';
5648 root2 = talloc_asprintf(ctx, "%s%s",
5649 root2,
5650 p);
5651 if (!root2) {
5652 return False;
5653 }
5654 break;
5655 } else {
5656 p2++;
5657 }
5658 if (*p) {
5659 p++;
5660 }
5661 }
5662
5663 p = ext1;
5664 p2 = ext2;
5665 while (*p2) {
5666 if (*p2 == '?') {
5667 /* Hmmm. Should this be mb-aware ? */
5668 *p2 = *p;
5669 p2++;
5670 } else if (*p2 == '*') {
5671 *p2 = '\0';
5672 ext2 = talloc_asprintf(ctx, "%s%s",
5673 ext2,
5674 p);
5675 if (!ext2) {
5676 return False;
5677 }
5678 break;
5679 } else {
5680 p2++;
5681 }
5682 if (*p) {
5683 p++;
5684 }
5685 }
5686
5687 if (*ext2) {
5688 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5689 name2_copy,
5690 root2,
5691 ext2);
5692 } else {
5693 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5694 name2_copy,
5695 root2);
5696 }
5697
5698 if (!*pp_newname) {
5699 return False;
5700 }
5701
5702 return True;
5703 }
5704
5705 /****************************************************************************
5706 Ensure open files have their names updated. Updated to notify other smbd's
5707 asynchronously.
5708 ****************************************************************************/
5709
5710 static void rename_open_files(connection_struct *conn,
5711 struct share_mode_lock *lck,
5712 const struct smb_filename *smb_fname_dst)
5713 {
5714 files_struct *fsp;
5715 bool did_rename = False;
5716 NTSTATUS status;
5717
5718 for(fsp = file_find_di_first(lck->id); fsp;
5719 fsp = file_find_di_next(fsp)) {
5720 /* fsp_name is a relative path under the fsp. To change this for other
5721 sharepaths we need to manipulate relative paths. */
5722 /* TODO - create the absolute path and manipulate the newname
5723 relative to the sharepath. */
5724 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5725 continue;
5726 }
5727 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5728 "(file_id %s) from %s -> %s\n", fsp->fnum,
5729 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5730 smb_fname_str_dbg(smb_fname_dst)));
5731
5732 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5733 if (NT_STATUS_IS_OK(status)) {
5734 did_rename = True;
5735 }
5736 }
5737
5738 if (!did_rename) {
5739 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5740 "for %s\n", file_id_string_tos(&lck->id),
5741 smb_fname_str_dbg(smb_fname_dst)));
5742 }
5743
5744 /* Send messages to all smbd's (not ourself) that the name has changed. */
5745 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5746 smb_fname_dst);
5747
5748 }
5749
5750 /****************************************************************************
5751 We need to check if the source path is a parent directory of the destination
5752 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5753 refuse the rename with a sharing violation. Under UNIX the above call can
5754 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5755 probably need to check that the client is a Windows one before disallowing
5756 this as a UNIX client (one with UNIX extensions) can know the source is a
5757 symlink and make this decision intelligently. Found by an excellent bug
5758 report from <AndyLiebman@aol.com>.
5759 ****************************************************************************/
5760
5761 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5762 const struct smb_filename *smb_fname_dst)
5763 {
5764 const char *psrc = smb_fname_src->base_name;
5765 const char *pdst = smb_fname_dst->base_name;
5766 size_t slen;
5767
5768 if (psrc[0] == '.' && psrc[1] == '/') {
5769 psrc += 2;
5770 }
5771 if (pdst[0] == '.' && pdst[1] == '/') {
5772 pdst += 2;
5773 }
5774 if ((slen = strlen(psrc)) > strlen(pdst)) {
5775 return False;
5776 }
5777 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5778 }
5779
5780 /*
5781 * Do the notify calls from a rename
5782 */
5783
5784 static void notify_rename(connection_struct *conn, bool is_dir,
5785 const struct smb_filename *smb_fname_src,
5786 const struct smb_filename *smb_fname_dst)
5787 {
5788 char *parent_dir_src = NULL;
5789 char *parent_dir_dst = NULL;
5790 uint32 mask;
5791
5792 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5793 : FILE_NOTIFY_CHANGE_FILE_NAME;
5794
5795 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5796 &parent_dir_src, NULL) ||
5797 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5798 &parent_dir_dst, NULL)) {
5799 goto out;
5800 }
5801
5802 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5803 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5804 smb_fname_src->base_name);
5805 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5806 smb_fname_dst->base_name);
5807 }
5808 else {
5809 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5810 smb_fname_src->base_name);
5811 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5812 smb_fname_dst->base_name);
5813 }
5814
5815 /* this is a strange one. w2k3 gives an additional event for
5816 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5817 files, but not directories */
5818 if (!is_dir) {
5819 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5820 FILE_NOTIFY_CHANGE_ATTRIBUTES
5821 |FILE_NOTIFY_CHANGE_CREATION,
5822 smb_fname_dst->base_name);
5823 }
5824 out:
5825 TALLOC_FREE(parent_dir_src);
5826 TALLOC_FREE(parent_dir_dst);
5827 }
5828
5829 /****************************************************************************
5830 Rename an open file - given an fsp.
5831 ****************************************************************************/
5832
5833 NTSTATUS rename_internals_fsp(connection_struct *conn,
5834 files_struct *fsp,
5835 const struct smb_filename *smb_fname_dst_in,
5836 uint32 attrs,
5837 bool replace_if_exists)
5838 {
5839 TALLOC_CTX *ctx = talloc_tos();
5840 struct smb_filename *smb_fname_src = NULL;
5841 struct smb_filename *smb_fname_dst = NULL;
5842 SMB_STRUCT_STAT sbuf;
5843 NTSTATUS status = NT_STATUS_OK;
5844 struct share_mode_lock *lck = NULL;
5845 bool dst_exists, old_is_stream, new_is_stream;
5846
5847 ZERO_STRUCT(sbuf);
5848
5849 status = check_name(conn, smb_fname_dst_in->base_name);
5850 if (!NT_STATUS_IS_OK(status)) {
5851 return status;
5852 }
5853
5854 /* Make a copy of the src and dst smb_fname structs */
5855 status = copy_smb_filename(ctx, fsp->fsp_name, &smb_fname_src);
5856 if (!NT_STATUS_IS_OK(status)) {
5857 goto out;
5858 }
5859
5860 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5861 if (!NT_STATUS_IS_OK(status)) {
5862 goto out;
5863 }
5864
5865 /* Ensure the dst smb_fname contains a '/' */
5866 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5867 char * tmp;
5868 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5869 smb_fname_dst->base_name);
5870 if (!tmp) {
5871 status = NT_STATUS_NO_MEMORY;
5872 goto out;
5873 }
5874 TALLOC_FREE(smb_fname_dst->base_name);
5875 smb_fname_dst->base_name = tmp;
5876 }
5877
5878 /*
5879 * Check for special case with case preserving and not
5880 * case sensitive. If the old last component differs from the original
5881 * last component only by case, then we should allow
5882 * the rename (user is trying to change the case of the
5883 * filename).
5884 */
5885 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5886 strequal(smb_fname_src->base_name, smb_fname_dst->base_name) &&
5887 strequal(smb_fname_src->stream_name, smb_fname_dst->stream_name)) {
5888 char *last_slash;
5889 char *fname_dst_lcomp_base_mod = NULL;
5890 struct smb_filename *smb_fname_orig_lcomp = NULL;
5891
5892 /*
5893 * Get the last component of the destination name. Note that
5894 * we guarantee that destination name contains a '/' character
5895 * above.
5896 */
5897 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5898 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5899 if (!fname_dst_lcomp_base_mod) {
5900 status = NT_STATUS_NO_MEMORY;
5901 goto out;
5902 }
5903
5904 /*
5905 * Create an smb_filename struct using the original last
5906 * component of the destination.
5907 */
5908 status = create_synthetic_smb_fname_split(ctx,
5909 smb_fname_dst->original_lcomp, NULL,
5910 &smb_fname_orig_lcomp);
5911 if (!NT_STATUS_IS_OK(status)) {
5912 TALLOC_FREE(fname_dst_lcomp_base_mod);
5913 goto out;
5914 }
5915
5916 /* If the base names only differ by case, use original. */
5917 if(!strcsequal(fname_dst_lcomp_base_mod,
5918 smb_fname_orig_lcomp->base_name)) {
5919 char *tmp;
5920 /*
5921 * Replace the modified last component with the
5922 * original.
5923 */
5924 *last_slash = '\0'; /* Truncate at the '/' */
5925 tmp = talloc_asprintf(smb_fname_dst,
5926 "%s/%s",
5927 smb_fname_dst->base_name,
5928 smb_fname_orig_lcomp->base_name);
5929 if (tmp == NULL) {
5930 status = NT_STATUS_NO_MEMORY;
5931 TALLOC_FREE(fname_dst_lcomp_base_mod);
5932 TALLOC_FREE(smb_fname_orig_lcomp);
5933 goto out;
5934 }
5935 TALLOC_FREE(smb_fname_dst->base_name);
5936 smb_fname_dst->base_name = tmp;
5937 }
5938
5939 /* If the stream_names only differ by case, use original. */
5940 if(!strcsequal(smb_fname_dst->stream_name,
5941 smb_fname_orig_lcomp->stream_name)) {
5942 char *tmp = NULL;
5943 /* Use the original stream. */
5944 tmp = talloc_strdup(smb_fname_dst,
5945 smb_fname_orig_lcomp->stream_name);
5946 if (tmp == NULL) {
5947 status = NT_STATUS_NO_MEMORY;
5948 TALLOC_FREE(fname_dst_lcomp_base_mod);
5949 TALLOC_FREE(smb_fname_orig_lcomp);
5950 goto out;
5951 }
5952 TALLOC_FREE(smb_fname_dst->stream_name);
5953 smb_fname_dst->stream_name = tmp;
5954 }
5955 TALLOC_FREE(fname_dst_lcomp_base_mod);
5956 TALLOC_FREE(smb_fname_orig_lcomp);
5957 }
5958
5959 /*
5960 * If the src and dest names are identical - including case,
5961 * don't do the rename, just return success.
5962 */
5963
5964 if (strcsequal(smb_fname_src->base_name, smb_fname_dst->base_name) &&
5965 strcsequal(smb_fname_src->stream_name,
5966 smb_fname_dst->stream_name)) {
5967 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5968 "- returning success\n",
5969 smb_fname_str_dbg(smb_fname_dst)));
5970 status = NT_STATUS_OK;
5971 goto out;
5972 }
5973
5974 old_is_stream = is_ntfs_stream_smb_fname(smb_fname_src);
5975 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5976
5977 /* Return the correct error code if both names aren't streams. */
5978 if (!old_is_stream && new_is_stream) {
5979 status = NT_STATUS_OBJECT_NAME_INVALID;
5980 goto out;
5981 }
5982
5983 if (old_is_stream && !new_is_stream) {
5984 status = NT_STATUS_INVALID_PARAMETER;
5985 goto out;
5986 }
5987
5988 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5989
5990 if(!replace_if_exists && dst_exists) {
5991 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5992 "%s -> %s\n", smb_fname_str_dbg(smb_fname_src),
5993 smb_fname_str_dbg(smb_fname_dst)));
5994 status = NT_STATUS_OBJECT_NAME_COLLISION;
5995 goto out;
5996 }
5997
5998 if (dst_exists) {
5999 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6000 &smb_fname_dst->st);
6001 files_struct *dst_fsp = file_find_di_first(fileid);
6002 /* The file can be open when renaming a stream */
6003 if (dst_fsp && !new_is_stream) {
6004 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6005 status = NT_STATUS_ACCESS_DENIED;
6006 goto out;
6007 }
6008 }
6009
6010 /* Ensure we have a valid stat struct for the source. */
6011 if (fsp->fh->fd != -1) {
6012 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
6013 status = map_nt_error_from_unix(errno);
6014 goto out;
6015 }
6016 } else {
6017 int ret = -1;
6018 if (fsp->posix_open) {
6019 ret = SMB_VFS_LSTAT(conn, smb_fname_src);
6020 } else {
6021
6022 ret = SMB_VFS_STAT(conn, smb_fname_src);
6023 }
6024 if (ret == -1) {
6025 status = map_nt_error_from_unix(errno);
6026 goto out;
6027 }
6028 sbuf = smb_fname_src->st;
6029 }
6030
6031 status = can_rename(conn, fsp, attrs, &sbuf);
6032
6033 if (!NT_STATUS_IS_OK(status)) {
6034 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6035 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6036 smb_fname_str_dbg(smb_fname_dst)));
6037 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6038 status = NT_STATUS_ACCESS_DENIED;
6039 goto out;
6040 }
6041
6042 if (rename_path_prefix_equal(smb_fname_src, smb_fname_dst)) {
6043 status = NT_STATUS_ACCESS_DENIED;
6044 }
6045
6046 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6047 NULL);
6048
6049 /*
6050 * We have the file open ourselves, so not being able to get the
6051 * corresponding share mode lock is a fatal error.
6052 */
6053
6054 SMB_ASSERT(lck != NULL);
6055
6056 if(SMB_VFS_RENAME(conn, smb_fname_src, smb_fname_dst) == 0) {
6057 uint32 create_options = fsp->fh->private_options;
6058
6059 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6060 "%s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6061 smb_fname_str_dbg(smb_fname_dst)));
6062
6063 notify_rename(conn, fsp->is_directory, smb_fname_src,
6064 smb_fname_dst);
6065
6066 rename_open_files(conn, lck, smb_fname_dst);
6067
6068 /*
6069 * A rename acts as a new file create w.r.t. allowing an initial delete
6070 * on close, probably because in Windows there is a new handle to the
6071 * new file. If initial delete on close was requested but not
6072 * originally set, we need to set it here. This is probably not 100% correct,
6073 * but will work for the CIFSFS client which in non-posix mode
6074 * depends on these semantics. JRA.
6075 */
6076
6077 if (create_options & FILE_DELETE_ON_CLOSE) {
6078 status = can_set_delete_on_close(fsp, True, 0);
6079
6080 if (NT_STATUS_IS_OK(status)) {
6081 /* Note that here we set the *inital* delete on close flag,
6082 * not the regular one. The magic gets handled in close. */
6083 fsp->initial_delete_on_close = True;
6084 }
6085 }
6086 TALLOC_FREE(lck);
6087 status = NT_STATUS_OK;
6088 goto out;
6089 }
6090
6091 TALLOC_FREE(lck);
6092
6093 if (errno == ENOTDIR || errno == EISDIR) {
6094 status = NT_STATUS_OBJECT_NAME_COLLISION;
6095 } else {
6096 status = map_nt_error_from_unix(errno);
6097 }
6098
6099 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6100 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6101 smb_fname_str_dbg(smb_fname_dst)));
6102
6103 out:
6104 TALLOC_FREE(smb_fname_src);
6105 TALLOC_FREE(smb_fname_dst);
6106
6107 return status;
6108 }
6109
6110 /****************************************************************************
6111 The guts of the rename command, split out so it may be called by the NT SMB
6112 code.
6113 ****************************************************************************/
6114
6115 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6116 connection_struct *conn,
6117 struct smb_request *req,
6118 struct smb_filename *smb_fname_src,
6119 struct smb_filename *smb_fname_dst,
6120 uint32 attrs,
6121 bool replace_if_exists,
6122 bool src_has_wild,
6123 bool dest_has_wild,
6124 uint32_t access_mask)
6125 {
6126 char *fname_src_dir = NULL;
6127 char *fname_src_mask = NULL;
6128 int count=0;
6129 NTSTATUS status = NT_STATUS_OK;
6130 struct smb_Dir *dir_hnd = NULL;
6131 const char *dname;
6132 long offset = 0;
6133 int create_options = 0;
6134 bool posix_pathnames = lp_posix_pathnames();
6135
6136 /*
6137 * Split the old name into directory and last component
6138 * strings. Note that unix_convert may have stripped off a
6139 * leading ./ from both name and newname if the rename is
6140 * at the root of the share. We need to make sure either both
6141 * name and newname contain a / character or neither of them do
6142 * as this is checked in resolve_wildcards().
6143 */
6144
6145 /* Split up the directory from the filename/mask. */
6146 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6147 &fname_src_dir, &fname_src_mask);
6148 if (!NT_STATUS_IS_OK(status)) {
6149 status = NT_STATUS_NO_MEMORY;
6150 goto out;
6151 }
6152
6153 /*
6154 * We should only check the mangled cache
6155 * here if unix_convert failed. This means
6156 * that the path in 'mask' doesn't exist
6157 * on the file system and so we need to look
6158 * for a possible mangle. This patch from
6159 * Tine Smukavec <valentin.smukavec@hermes.si>.
6160 */
6161
6162 if (!VALID_STAT(smb_fname_src->st) &&
6163 mangle_is_mangled(fname_src_mask, conn->params)) {
6164 char *new_mask = NULL;
6165 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6166 conn->params);
6167 if (new_mask) {
6168 TALLOC_FREE(fname_src_mask);
6169 fname_src_mask = new_mask;
6170 }
6171 }
6172
6173 if (!src_has_wild) {
6174 files_struct *fsp;
6175
6176 /*
6177 * Only one file needs to be renamed. Append the mask back
6178 * onto the directory.
6179 */
6180 TALLOC_FREE(smb_fname_src->base_name);
6181 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6182 "%s/%s",
6183 fname_src_dir,
6184 fname_src_mask);
6185 if (!smb_fname_src->base_name) {
6186 status = NT_STATUS_NO_MEMORY;
6187 goto out;
6188 }
6189
6190 /* Ensure dst fname contains a '/' also */
6191 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6192 char *tmp;
6193 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6194 smb_fname_dst->base_name);
6195 if (!tmp) {
6196 status = NT_STATUS_NO_MEMORY;
6197 goto out;
6198 }
6199 TALLOC_FREE(smb_fname_dst->base_name);
6200 smb_fname_dst->base_name = tmp;
6201 }
6202
6203 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6204 "case_preserve = %d, short case preserve = %d, "
6205 "directory = %s, newname = %s, "
6206 "last_component_dest = %s\n",
6207 conn->case_sensitive, conn->case_preserve,
6208 conn->short_case_preserve,
6209 smb_fname_str_dbg(smb_fname_src),
6210 smb_fname_str_dbg(smb_fname_dst),
6211 smb_fname_dst->original_lcomp));
6212
6213 /* The dest name still may have wildcards. */
6214 if (dest_has_wild) {
6215 char *fname_dst_mod = NULL;
6216 if (!resolve_wildcards(smb_fname_dst,
6217 smb_fname_src->base_name,
6218 smb_fname_dst->base_name,
6219 &fname_dst_mod)) {
6220 DEBUG(6, ("rename_internals: resolve_wildcards "
6221 "%s %s failed\n",
6222 smb_fname_src->base_name,
6223 smb_fname_dst->base_name));
6224 status = NT_STATUS_NO_MEMORY;
6225 goto out;
6226 }
6227 TALLOC_FREE(smb_fname_dst->base_name);
6228 smb_fname_dst->base_name = fname_dst_mod;
6229 }
6230
6231 ZERO_STRUCT(smb_fname_src->st);
6232 if (posix_pathnames) {
6233 SMB_VFS_LSTAT(conn, smb_fname_src);
6234 } else {
6235 SMB_VFS_STAT(conn, smb_fname_src);
6236 }
6237
6238 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6239 create_options |= FILE_DIRECTORY_FILE;
6240 }
6241
6242 status = SMB_VFS_CREATE_FILE(
6243 conn, /* conn */
6244 req, /* req */
6245 0, /* root_dir_fid */
6246 smb_fname_src, /* fname */
6247 access_mask, /* access_mask */
6248 (FILE_SHARE_READ | /* share_access */
6249 FILE_SHARE_WRITE),
6250 FILE_OPEN, /* create_disposition*/
6251 create_options, /* create_options */
6252 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6253 0, /* oplock_request */
6254 0, /* allocation_size */
6255 NULL, /* sd */
6256 NULL, /* ea_list */
6257 &fsp, /* result */
6258 NULL); /* pinfo */
6259
6260 if (!NT_STATUS_IS_OK(status)) {
6261 DEBUG(3, ("Could not open rename source %s: %s\n",
6262 smb_fname_str_dbg(smb_fname_src),
6263 nt_errstr(status)));
6264 goto out;
6265 }
6266
6267 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6268 attrs, replace_if_exists);
6269
6270 close_file(req, fsp, NORMAL_CLOSE);
6271
6272 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6273 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6274 smb_fname_str_dbg(smb_fname_dst)));
6275
6276 goto out;
6277 }
6278
6279 /*
6280 * Wildcards - process each file that matches.
6281 */
6282 if (strequal(fname_src_mask, "????????.???")) {
6283 TALLOC_FREE(fname_src_mask);
6284 fname_src_mask = talloc_strdup(ctx, "*");
6285 if (!fname_src_mask) {
6286 status = NT_STATUS_NO_MEMORY;
6287 goto out;
6288 }
6289 }
6290
6291 status = check_name(conn, fname_src_dir);
6292 if (!NT_STATUS_IS_OK(status)) {
6293 goto out;
6294 }
6295
6296 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6297 attrs);
6298 if (dir_hnd == NULL) {
6299 status = map_nt_error_from_unix(errno);
6300 goto out;
6301 }
6302
6303 status = NT_STATUS_NO_SUCH_FILE;
6304 /*
6305 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6306 * - gentest fix. JRA
6307 */
6308
6309 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st))) {
6310 files_struct *fsp = NULL;
6311 char *destname = NULL;
6312 bool sysdir_entry = False;
6313
6314 /* Quick check for "." and ".." */
6315 if (ISDOT(dname) || ISDOTDOT(dname)) {
6316 if (attrs & aDIR) {
6317 sysdir_entry = True;
6318 } else {
6319 continue;
6320 }
6321 }
6322
6323 if (!is_visible_file(conn, fname_src_dir, dname,
6324 &smb_fname_src->st, false)) {
6325 continue;
6326 }
6327
6328 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6329 continue;
6330 }
6331
6332 if (sysdir_entry) {
6333 status = NT_STATUS_OBJECT_NAME_INVALID;
6334 break;
6335 }
6336
6337 TALLOC_FREE(smb_fname_src->base_name);
6338 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6339 "%s/%s",
6340 fname_src_dir,
6341 dname);
6342 if (!smb_fname_src->base_name) {
6343 status = NT_STATUS_NO_MEMORY;
6344 goto out;
6345 }
6346
6347 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6348 smb_fname_dst->base_name,
6349 &destname)) {
6350 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6351 smb_fname_src->base_name, destname));
6352 continue;
6353 }
6354 if (!destname) {
6355 status = NT_STATUS_NO_MEMORY;
6356 goto out;
6357 }
6358
6359 TALLOC_FREE(smb_fname_dst->base_name);
6360 smb_fname_dst->base_name = destname;
6361
6362 ZERO_STRUCT(smb_fname_src->st);
6363 if (posix_pathnames) {
6364 SMB_VFS_LSTAT(conn, smb_fname_src);
6365 } else {
6366 SMB_VFS_STAT(conn, smb_fname_src);
6367 }
6368
6369 create_options = 0;
6370
6371 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6372 create_options |= FILE_DIRECTORY_FILE;
6373 }
6374
6375 status = SMB_VFS_CREATE_FILE(
6376 conn, /* conn */
6377 req, /* req */
6378 0, /* root_dir_fid */
6379 smb_fname_src, /* fname */
6380 access_mask, /* access_mask */
6381 (FILE_SHARE_READ | /* share_access */
6382 FILE_SHARE_WRITE),
6383 FILE_OPEN, /* create_disposition*/
6384 create_options, /* create_options */
6385 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6386 0, /* oplock_request */
6387 0, /* allocation_size */
6388 NULL, /* sd */
6389 NULL, /* ea_list */
6390 &fsp, /* result */
6391 NULL); /* pinfo */
6392
6393 if (!NT_STATUS_IS_OK(status)) {
6394 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6395 "returned %s rename %s -> %s\n",
6396 nt_errstr(status),
6397 smb_fname_str_dbg(smb_fname_src),
6398 smb_fname_str_dbg(smb_fname_dst)));
6399 break;
6400 }
6401
6402 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6403 dname);
6404 if (!smb_fname_dst->original_lcomp) {
6405 status = NT_STATUS_NO_MEMORY;
6406 goto out;
6407 }
6408
6409 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6410 attrs, replace_if_exists);
6411
6412 close_file(req, fsp, NORMAL_CLOSE);
6413
6414 if (!NT_STATUS_IS_OK(status)) {
6415 DEBUG(3, ("rename_internals_fsp returned %s for "
6416 "rename %s -> %s\n", nt_errstr(status),
6417 smb_fname_str_dbg(smb_fname_src),
6418 smb_fname_str_dbg(smb_fname_dst)));
6419 break;
6420 }
6421
6422 count++;
6423
6424 DEBUG(3,("rename_internals: doing rename on %s -> "
6425 "%s\n", smb_fname_str_dbg(smb_fname_src),
6426 smb_fname_str_dbg(smb_fname_src)));
6427
6428 }
6429 TALLOC_FREE(dir_hnd);
6430
6431 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6432 status = map_nt_error_from_unix(errno);
6433 }
6434
6435 out:
6436 TALLOC_FREE(fname_src_dir);
6437 TALLOC_FREE(fname_src_mask);
6438 return status;
6439 }
6440
6441 /****************************************************************************
6442 Reply to a mv.
6443 ****************************************************************************/
6444
6445 void reply_mv(struct smb_request *req)
6446 {
6447 connection_struct *conn = req->conn;
6448 char *name = NULL;
6449 char *newname = NULL;
6450 const char *p;
6451 uint32 attrs;
6452 NTSTATUS status;
6453 bool src_has_wcard = False;
6454 bool dest_has_wcard = False;
6455 TALLOC_CTX *ctx = talloc_tos();
6456 struct smb_filename *smb_fname_src = NULL;
6457 struct smb_filename *smb_fname_dst = NULL;
6458
6459 START_PROFILE(SMBmv);
6460
6461 if (req->wct < 1) {
6462 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6463 goto out;
6464 }
6465
6466 attrs = SVAL(req->vwv+0, 0);
6467
6468 p = (const char *)req->buf + 1;
6469 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6470 &status, &src_has_wcard);
6471 if (!NT_STATUS_IS_OK(status)) {
6472 reply_nterror(req, status);
6473 goto out;
6474 }
6475 p++;
6476 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6477 &status, &dest_has_wcard);
6478 if (!NT_STATUS_IS_OK(status)) {
6479 reply_nterror(req, status);
6480 goto out;
6481 }
6482
6483 status = filename_convert(ctx,
6484 conn,
6485 req->flags2 & FLAGS2_DFS_PATHNAMES,
6486 name,
6487 UCF_COND_ALLOW_WCARD_LCOMP,
6488 &src_has_wcard,
6489 &smb_fname_src);
6490
6491 if (!NT_STATUS_IS_OK(status)) {
6492 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6493 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6494 ERRSRV, ERRbadpath);
6495 goto out;
6496 }
6497 reply_nterror(req, status);
6498 goto out;
6499 }
6500
6501 status = filename_convert(ctx,
6502 conn,
6503 req->flags2 & FLAGS2_DFS_PATHNAMES,
6504 newname,
6505 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6506 &dest_has_wcard,
6507 &smb_fname_dst);
6508
6509 if (!NT_STATUS_IS_OK(status)) {
6510 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6511 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6512 ERRSRV, ERRbadpath);
6513 goto out;
6514 }
6515 reply_nterror(req, status);
6516 goto out;
6517 }
6518
6519 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6520 smb_fname_str_dbg(smb_fname_dst)));
6521
6522 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6523 attrs, False, src_has_wcard, dest_has_wcard,
6524 DELETE_ACCESS);
6525 if (!NT_STATUS_IS_OK(status)) {
6526 if (open_was_deferred(req->mid)) {
6527 /* We have re-scheduled this call. */
6528 goto out;
6529 }
6530 reply_nterror(req, status);
6531 goto out;
6532 }
6533
6534 reply_outbuf(req, 0, 0);
6535 out:
6536 TALLOC_FREE(smb_fname_src);
6537 TALLOC_FREE(smb_fname_dst);
6538 END_PROFILE(SMBmv);
6539 return;
6540 }
6541
6542 /*******************************************************************
6543 Copy a file as part of a reply_copy.
6544 ******************************************************************/
6545
6546 /*
6547 * TODO: check error codes on all callers
6548 */
6549
6550 NTSTATUS copy_file(TALLOC_CTX *ctx,
6551 connection_struct *conn,
6552 struct smb_filename *smb_fname_src,
6553 struct smb_filename *smb_fname_dst,
6554 int ofun,
6555 int count,
6556 bool target_is_directory)
6557 {
6558 struct smb_filename *smb_fname_dst_tmp = NULL;
6559 SMB_OFF_T ret=-1;
6560 files_struct *fsp1,*fsp2;
6561 uint32 dosattrs;
6562 uint32 new_create_disposition;
6563 NTSTATUS status;
6564
6565
6566 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6567 if (!NT_STATUS_IS_OK(status)) {
6568 return status;
6569 }
6570
6571 /*
6572 * If the target is a directory, extract the last component from the
6573 * src filename and append it to the dst filename
6574 */
6575 if (target_is_directory) {
6576 const char *p;
6577
6578 /* dest/target can't be a stream if it's a directory. */
6579 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6580
6581 p = strrchr_m(smb_fname_src->base_name,'/');
6582 if (p) {
6583 p++;
6584 } else {
6585 p = smb_fname_src->base_name;
6586 }
6587 smb_fname_dst_tmp->base_name =
6588 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6589 p);
6590 if (!smb_fname_dst_tmp->base_name) {
6591 status = NT_STATUS_NO_MEMORY;
6592 goto out;
6593 }
6594 }
6595
6596 status = vfs_file_exist(conn, smb_fname_src);
6597 if (!NT_STATUS_IS_OK(status)) {
6598 goto out;
6599 }
6600
6601 if (!target_is_directory && count) {
6602 new_create_disposition = FILE_OPEN;
6603 } else {
6604 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6605 NULL, NULL,
6606 &new_create_disposition,
6607 NULL)) {
6608 status = NT_STATUS_INVALID_PARAMETER;
6609 goto out;
6610 }
6611 }
6612
6613 /* Open the src file for reading. */
6614 status = SMB_VFS_CREATE_FILE(
6615 conn, /* conn */
6616 NULL, /* req */
6617 0, /* root_dir_fid */
6618 smb_fname_src, /* fname */
6619 FILE_GENERIC_READ, /* access_mask */
6620 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6621 FILE_OPEN, /* create_disposition*/
6622 0, /* create_options */
6623 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6624 INTERNAL_OPEN_ONLY, /* oplock_request */
6625 0, /* allocation_size */
6626 NULL, /* sd */
6627 NULL, /* ea_list */
6628 &fsp1, /* result */
6629 NULL); /* psbuf */
6630
6631 if (!NT_STATUS_IS_OK(status)) {
6632 goto out;
6633 }
6634
6635 dosattrs = dos_mode(conn, smb_fname_src);
6636
6637 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6638 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6639 }
6640
6641 /* Open the dst file for writing. */
6642 status = SMB_VFS_CREATE_FILE(
6643 conn, /* conn */
6644 NULL, /* req */
6645 0, /* root_dir_fid */
6646 smb_fname_dst, /* fname */
6647 FILE_GENERIC_WRITE, /* access_mask */
6648 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6649 new_create_disposition, /* create_disposition*/
6650 0, /* create_options */
6651 dosattrs, /* file_attributes */
6652 INTERNAL_OPEN_ONLY, /* oplock_request */
6653 0, /* allocation_size */
6654 NULL, /* sd */
6655 NULL, /* ea_list */
6656 &fsp2, /* result */
6657 NULL); /* psbuf */
6658
6659 if (!NT_STATUS_IS_OK(status)) {
6660 close_file(NULL, fsp1, ERROR_CLOSE);
6661 goto out;
6662 }
6663
6664 if ((ofun&3) == 1) {
6665 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6666 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6667 /*
6668 * Stop the copy from occurring.
6669 */
6670 ret = -1;
6671 smb_fname_src->st.st_ex_size = 0;
6672 }
6673 }
6674
6675 /* Do the actual copy. */
6676 if (smb_fname_src->st.st_ex_size) {
6677 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6678 }
6679
6680 close_file(NULL, fsp1, NORMAL_CLOSE);
6681
6682 /* Ensure the modtime is set correctly on the destination file. */
6683 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6684
6685 /*
6686 * As we are opening fsp1 read-only we only expect
6687 * an error on close on fsp2 if we are out of space.
6688 * Thus we don't look at the error return from the
6689 * close of fsp1.
6690 */
6691 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6692
6693 if (!NT_STATUS_IS_OK(status)) {
6694 goto out;
6695 }
6696
6697 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6698 status = NT_STATUS_DISK_FULL;
6699 goto out;
6700 }
6701
6702 status = NT_STATUS_OK;
6703
6704 out:
6705 TALLOC_FREE(smb_fname_dst_tmp);
6706 return status;
6707 }
6708
6709 /****************************************************************************
6710 Reply to a file copy.
6711 ****************************************************************************/
6712
6713 void reply_copy(struct smb_request *req)
6714 {
6715 connection_struct *conn = req->conn;
6716 struct smb_filename *smb_fname_src = NULL;
6717 struct smb_filename *smb_fname_dst = NULL;
6718 char *fname_src = NULL;
6719 char *fname_dst = NULL;
6720 char *fname_src_mask = NULL;
6721 char *fname_src_dir = NULL;
6722 const char *p;
6723 int count=0;
6724 int error = ERRnoaccess;
6725 int tid2;
6726 int ofun;
6727 int flags;
6728 bool target_is_directory=False;
6729 bool source_has_wild = False;
6730 bool dest_has_wild = False;
6731 NTSTATUS status;
6732 TALLOC_CTX *ctx = talloc_tos();
6733
6734 START_PROFILE(SMBcopy);
6735
6736 if (req->wct < 3) {
6737 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6738 goto out;
6739 }
6740
6741 tid2 = SVAL(req->vwv+0, 0);
6742 ofun = SVAL(req->vwv+1, 0);
6743 flags = SVAL(req->vwv+2, 0);
6744
6745 p = (const char *)req->buf;
6746 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6747 &status, &source_has_wild);
6748 if (!NT_STATUS_IS_OK(status)) {
6749 reply_nterror(req, status);
6750 goto out;
6751 }
6752 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6753 &status, &dest_has_wild);
6754 if (!NT_STATUS_IS_OK(status)) {
6755 reply_nterror(req, status);
6756 goto out;
6757 }
6758
6759 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6760
6761 if (tid2 != conn->cnum) {
6762 /* can't currently handle inter share copies XXXX */
6763 DEBUG(3,("Rejecting inter-share copy\n"));
6764 reply_doserror(req, ERRSRV, ERRinvdevice);
6765 goto out;
6766 }
6767
6768 status = filename_convert(ctx, conn,
6769 req->flags2 & FLAGS2_DFS_PATHNAMES,
6770 fname_src,
6771 UCF_COND_ALLOW_WCARD_LCOMP,
6772 &source_has_wild,
6773 &smb_fname_src);
6774 if (!NT_STATUS_IS_OK(status)) {
6775 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6776 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6777 ERRSRV, ERRbadpath);
6778 goto out;
6779 }
6780 reply_nterror(req, status);
6781 goto out;
6782 }
6783
6784 status = filename_convert(ctx, conn,
6785 req->flags2 & FLAGS2_DFS_PATHNAMES,
6786 fname_dst,
6787 UCF_COND_ALLOW_WCARD_LCOMP,
6788 &dest_has_wild,
6789 &smb_fname_dst);
6790 if (!NT_STATUS_IS_OK(status)) {
6791 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6792 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6793 ERRSRV, ERRbadpath);
6794 goto out;
6795 }
6796 reply_nterror(req, status);
6797 goto out;
6798 }
6799
6800 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6801
6802 if ((flags&1) && target_is_directory) {
6803 reply_doserror(req, ERRDOS, ERRbadfile);
6804 goto out;
6805 }
6806
6807 if ((flags&2) && !target_is_directory) {
6808 reply_doserror(req, ERRDOS, ERRbadpath);
6809 goto out;
6810 }
6811
6812 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6813 /* wants a tree copy! XXXX */
6814 DEBUG(3,("Rejecting tree copy\n"));
6815 reply_doserror(req, ERRSRV, ERRerror);
6816 goto out;
6817 }
6818
6819 /* Split up the directory from the filename/mask. */
6820 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6821 &fname_src_dir, &fname_src_mask);
6822 if (!NT_STATUS_IS_OK(status)) {
6823 reply_nterror(req, NT_STATUS_NO_MEMORY);
6824 goto out;
6825 }
6826
6827 /*
6828 * We should only check the mangled cache
6829 * here if unix_convert failed. This means
6830 * that the path in 'mask' doesn't exist
6831 * on the file system and so we need to look
6832 * for a possible mangle. This patch from
6833 * Tine Smukavec <valentin.smukavec@hermes.si>.
6834 */
6835 if (!VALID_STAT(smb_fname_src->st) &&
6836 mangle_is_mangled(fname_src_mask, conn->params)) {
6837 char *new_mask = NULL;
6838 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6839 &new_mask, conn->params);
6840
6841 /* Use demangled name if one was successfully found. */
6842 if (new_mask) {
6843 TALLOC_FREE(fname_src_mask);
6844 fname_src_mask = new_mask;
6845 }
6846 }
6847
6848 if (!source_has_wild) {
6849
6850 /*
6851 * Only one file needs to be copied. Append the mask back onto
6852 * the directory.
6853 */
6854 TALLOC_FREE(smb_fname_src->base_name);
6855 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6856 "%s/%s",
6857 fname_src_dir,
6858 fname_src_mask);
6859 if (!smb_fname_src->base_name) {
6860 reply_nterror(req, NT_STATUS_NO_MEMORY);
6861 goto out;
6862 }
6863
6864 if (dest_has_wild) {
6865 char *fname_dst_mod = NULL;
6866 if (!resolve_wildcards(smb_fname_dst,
6867 smb_fname_src->base_name,
6868 smb_fname_dst->base_name,
6869 &fname_dst_mod)) {
6870 reply_nterror(req, NT_STATUS_NO_MEMORY);
6871 goto out;
6872 }
6873 TALLOC_FREE(smb_fname_dst->base_name);
6874 smb_fname_dst->base_name = fname_dst_mod;
6875 }
6876
6877 status = check_name(conn, smb_fname_src->base_name);
6878 if (!NT_STATUS_IS_OK(status)) {
6879 reply_nterror(req, status);
6880 goto out;
6881 }
6882
6883 status = check_name(conn, smb_fname_dst->base_name);
6884 if (!NT_STATUS_IS_OK(status)) {
6885 reply_nterror(req, status);
6886 goto out;
6887 }
6888
6889 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6890 ofun, count, target_is_directory);
6891
6892 if(!NT_STATUS_IS_OK(status)) {
6893 reply_nterror(req, status);
6894 goto out;
6895 } else {
6896 count++;
6897 }
6898 } else {
6899 struct smb_Dir *dir_hnd = NULL;
6900 const char *dname = NULL;
6901 long offset = 0;
6902
6903 /*
6904 * There is a wildcard that requires us to actually read the
6905 * src dir and copy each file matching the mask to the dst.
6906 * Right now streams won't be copied, but this could
6907 * presumably be added with a nested loop for reach dir entry.
6908 */
6909 SMB_ASSERT(!smb_fname_src->stream_name);
6910 SMB_ASSERT(!smb_fname_dst->stream_name);
6911
6912 smb_fname_src->stream_name = NULL;
6913 smb_fname_dst->stream_name = NULL;
6914
6915 if (strequal(fname_src_mask,"????????.???")) {
6916 TALLOC_FREE(fname_src_mask);
6917 fname_src_mask = talloc_strdup(ctx, "*");
6918 if (!fname_src_mask) {
6919 reply_nterror(req, NT_STATUS_NO_MEMORY);
6920 goto out;
6921 }
6922 }
6923
6924 status = check_name(conn, fname_src_dir);
6925 if (!NT_STATUS_IS_OK(status)) {
6926 reply_nterror(req, status);
6927 goto out;
6928 }
6929
6930 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6931 if (dir_hnd == NULL) {
6932 status = map_nt_error_from_unix(errno);
6933 reply_nterror(req, status);
6934 goto out;
6935 }
6936
6937 error = ERRbadfile;
6938
6939 /* Iterate over the src dir copying each entry to the dst. */
6940 while ((dname = ReadDirName(dir_hnd, &offset,
6941 &smb_fname_src->st))) {
6942 char *destname = NULL;
6943
6944 if (ISDOT(dname) || ISDOTDOT(dname)) {
6945 continue;
6946 }
6947
6948 if (!is_visible_file(conn, fname_src_dir, dname,
6949 &smb_fname_src->st, false)) {
6950 continue;
6951 }
6952
6953 if(!mask_match(dname, fname_src_mask,
6954 conn->case_sensitive)) {
6955 continue;
6956 }
6957
6958 error = ERRnoaccess;
6959
6960 /* Get the src smb_fname struct setup. */
6961 TALLOC_FREE(smb_fname_src->base_name);
6962 smb_fname_src->base_name =
6963 talloc_asprintf(smb_fname_src, "%s/%s",
6964 fname_src_dir, dname);
6965
6966 if (!smb_fname_src->base_name) {
6967 TALLOC_FREE(dir_hnd);
6968 reply_nterror(req, NT_STATUS_NO_MEMORY);
6969 goto out;
6970 }
6971
6972 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6973 smb_fname_dst->base_name,
6974 &destname)) {
6975 continue;
6976 }
6977 if (!destname) {
6978 TALLOC_FREE(dir_hnd);
6979 reply_nterror(req, NT_STATUS_NO_MEMORY);
6980 goto out;
6981 }
6982
6983 TALLOC_FREE(smb_fname_dst->base_name);
6984 smb_fname_dst->base_name = destname;
6985
6986 status = check_name(conn, smb_fname_src->base_name);
6987 if (!NT_STATUS_IS_OK(status)) {
6988 TALLOC_FREE(dir_hnd);
6989 reply_nterror(req, status);
6990 goto out;
6991 }
6992
6993 status = check_name(conn, smb_fname_dst->base_name);
6994 if (!NT_STATUS_IS_OK(status)) {
6995 TALLOC_FREE(dir_hnd);
6996 reply_nterror(req, status);
6997 goto out;
6998 }
6999
7000 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7001 smb_fname_src->base_name,
7002 smb_fname_dst->base_name));
7003
7004 status = copy_file(ctx, conn, smb_fname_src,
7005 smb_fname_dst, ofun, count,
7006 target_is_directory);
7007 if (NT_STATUS_IS_OK(status)) {
7008 count++;
7009 }
7010 }
7011 TALLOC_FREE(dir_hnd);
7012 }
7013
7014 if (count == 0) {
7015 reply_doserror(req, ERRDOS, error);
7016 goto out;
7017 }
7018
7019 reply_outbuf(req, 1, 0);
7020 SSVAL(req->outbuf,smb_vwv0,count);
7021 out:
7022 TALLOC_FREE(smb_fname_src);
7023 TALLOC_FREE(smb_fname_dst);
7024 TALLOC_FREE(fname_src);
7025 TALLOC_FREE(fname_dst);
7026 TALLOC_FREE(fname_src_mask);
7027 TALLOC_FREE(fname_src_dir);
7028
7029 END_PROFILE(SMBcopy);
7030 return;
7031 }
7032
7033 #undef DBGC_CLASS
7034 #define DBGC_CLASS DBGC_LOCKING
7035
7036 /****************************************************************************
7037 Get a lock pid, dealing with large count requests.
7038 ****************************************************************************/
7039
7040 uint32 get_lock_pid(const uint8_t *data, int data_offset,
7041 bool large_file_format)
7042 {
7043 if(!large_file_format)
7044 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
7045 else
7046 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7047 }
7048
7049 /****************************************************************************
7050 Get a lock count, dealing with large count requests.
7051 ****************************************************************************/
7052
7053 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7054 bool large_file_format)
7055 {
7056 uint64_t count = 0;
7057
7058 if(!large_file_format) {
7059 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7060 } else {
7061
7062 #if defined(HAVE_LONGLONG)
7063 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7064 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7065 #else /* HAVE_LONGLONG */
7066
7067 /*
7068 * NT4.x seems to be broken in that it sends large file (64 bit)
7069 * lockingX calls even if the CAP_LARGE_FILES was *not*
7070 * negotiated. For boxes without large unsigned ints truncate the
7071 * lock count by dropping the top 32 bits.
7072 */
7073
7074 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7075 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7076 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7077 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7078 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7079 }
7080
7081 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7082 #endif /* HAVE_LONGLONG */
7083 }
7084
7085 return count;
7086 }
7087
7088 #if !defined(HAVE_LONGLONG)
7089 /****************************************************************************
7090 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7091 ****************************************************************************/
7092
7093 static uint32 map_lock_offset(uint32 high, uint32 low)
7094 {
7095 unsigned int i;
7096 uint32 mask = 0;
7097 uint32 highcopy = high;
7098
7099 /*
7100 * Try and find out how many significant bits there are in high.
7101 */
7102
7103 for(i = 0; highcopy; i++)
7104 highcopy >>= 1;
7105
7106 /*
7107 * We use 31 bits not 32 here as POSIX
7108 * lock offsets may not be negative.
7109 */
7110
7111 mask = (~0) << (31 - i);
7112
7113 if(low & mask)
7114 return 0; /* Fail. */
7115
7116 high <<= (31 - i);
7117
7118 return (high|low);
7119 }
7120 #endif /* !defined(HAVE_LONGLONG) */
7121
7122 /****************************************************************************
7123 Get a lock offset, dealing with large offset requests.
7124 ****************************************************************************/
7125
7126 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7127 bool large_file_format, bool *err)
7128 {
7129 uint64_t offset = 0;
7130
7131 *err = False;
7132
7133 if(!large_file_format) {
7134 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7135 } else {
7136
7137 #if defined(HAVE_LONGLONG)
7138 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7139 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7140 #else /* HAVE_LONGLONG */
7141
7142 /*
7143 * NT4.x seems to be broken in that it sends large file (64 bit)
7144 * lockingX calls even if the CAP_LARGE_FILES was *not*
7145 * negotiated. For boxes without large unsigned ints mangle the
7146 * lock offset by mapping the top 32 bits onto the lower 32.
7147 */
7148
7149 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7150 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7151 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7152 uint32 new_low = 0;
7153
7154 if((new_low = map_lock_offset(high, low)) == 0) {
7155 *err = True;
7156 return (uint64_t)-1;
7157 }
7158
7159 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7160 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7161 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7162 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7163 }
7164
7165 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7166 #endif /* HAVE_LONGLONG */
7167 }
7168
7169 return offset;
7170 }
7171
7172 NTSTATUS smbd_do_locking(struct smb_request *req,
7173 files_struct *fsp,
7174 uint8_t type,
7175 int32_t timeout,
7176 uint16_t num_ulocks,
7177 struct smbd_lock_element *ulocks,
7178 uint16_t num_locks,
7179 struct smbd_lock_element *locks,
7180 bool *async)
7181 {
7182 connection_struct *conn = req->conn;
7183 int i;
7184 NTSTATUS status = NT_STATUS_OK;
7185
7186 *async = false;
7187
7188 /* Data now points at the beginning of the list
7189 of smb_unlkrng structs */
7190 for(i = 0; i < (int)num_ulocks; i++) {
7191 struct smbd_lock_element *e = &ulocks[i];
7192
7193 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7194 "pid %u, file %s\n",
7195 (double)e->offset,
7196 (double)e->count,
7197 (unsigned int)e->smbpid,
7198 fsp_str_dbg(fsp)));
7199
7200 if (e->brltype != UNLOCK_LOCK) {
7201 /* this can only happen with SMB2 */
7202 return NT_STATUS_INVALID_PARAMETER;
7203 }
7204
7205 status = do_unlock(smbd_messaging_context(),
7206 fsp,
7207 e->smbpid,
7208 e->count,
7209 e->offset,
7210 WINDOWS_LOCK);
7211
7212 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7213 nt_errstr(status)));
7214
7215 if (!NT_STATUS_IS_OK(status)) {
7216 return status;
7217 }
7218 }
7219
7220 /* Setup the timeout in seconds. */
7221
7222 if (!lp_blocking_locks(SNUM(conn))) {
7223 timeout = 0;
7224 }
7225
7226 /* Data now points at the beginning of the list
7227 of smb_lkrng structs */
7228
7229 for(i = 0; i < (int)num_locks; i++) {
7230 struct smbd_lock_element *e = &locks[i];
7231
7232 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7233 "%u, file %s timeout = %d\n",
7234 (double)e->offset,
7235 (double)e->count,
7236 (unsigned int)e->smbpid,
7237 fsp_str_dbg(fsp),
7238 (int)timeout));
7239
7240 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7241 struct blocking_lock_record *blr = NULL;
7242
7243 if (lp_blocking_locks(SNUM(conn))) {
7244
7245 /* Schedule a message to ourselves to
7246 remove the blocking lock record and
7247 return the right error. */
7248
7249 blr = blocking_lock_cancel(fsp,
7250 e->smbpid,
7251 e->offset,
7252 e->count,
7253 WINDOWS_LOCK,
7254 type,
7255 NT_STATUS_FILE_LOCK_CONFLICT);
7256 if (blr == NULL) {
7257 return NT_STATUS_DOS(
7258 ERRDOS,
7259 ERRcancelviolation);
7260 }
7261 }
7262 /* Remove a matching pending lock. */
7263 status = do_lock_cancel(fsp,
7264 e->smbpid,
7265 e->count,
7266 e->offset,
7267 WINDOWS_LOCK,
7268 blr);
7269 } else {
7270 bool blocking_lock = timeout ? true : false;
7271 bool defer_lock = false;
7272 struct byte_range_lock *br_lck;
7273 uint32_t block_smbpid;
7274
7275 br_lck = do_lock(smbd_messaging_context(),
7276 fsp,
7277 e->smbpid,
7278 e->count,
7279 e->offset,
7280 e->brltype,
7281 WINDOWS_LOCK,
7282 blocking_lock,
7283 &status,
7284 &block_smbpid,
7285 NULL);
7286
7287 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7288 /* Windows internal resolution for blocking locks seems
7289 to be about 200ms... Don't wait for less than that. JRA. */
7290 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7291 timeout = lp_lock_spin_time();
7292 }
7293 defer_lock = true;
7294 }
7295
7296 /* This heuristic seems to match W2K3 very well. If a
7297 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7298 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7299 far as I can tell. Replacement for do_lock_spin(). JRA. */
7300
7301 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7302 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7303 defer_lock = true;
7304 timeout = lp_lock_spin_time();
7305 }
7306
7307 if (br_lck && defer_lock) {
7308 /*
7309 * A blocking lock was requested. Package up
7310 * this smb into a queued request and push it
7311 * onto the blocking lock queue.
7312 */
7313 if(push_blocking_lock_request(br_lck,
7314 req,
7315 fsp,
7316 timeout,
7317 i,
7318 e->smbpid,
7319 e->brltype,
7320 WINDOWS_LOCK,
7321 e->offset,
7322 e->count,
7323 block_smbpid)) {
7324 TALLOC_FREE(br_lck);
7325 *async = true;
7326 return NT_STATUS_OK;
7327 }
7328 }
7329
7330 TALLOC_FREE(br_lck);
7331 }
7332
7333 if (!NT_STATUS_IS_OK(status)) {
7334 break;
7335 }
7336 }
7337
7338 /* If any of the above locks failed, then we must unlock
7339 all of the previous locks (X/Open spec). */
7340
7341 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7342
7343 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7344 i = -1; /* we want to skip the for loop */
7345 }
7346
7347 /*
7348 * Ensure we don't do a remove on the lock that just failed,
7349 * as under POSIX rules, if we have a lock already there, we
7350 * will delete it (and we shouldn't) .....
7351 */
7352 for(i--; i >= 0; i--) {
7353 struct smbd_lock_element *e = &locks[i];
7354
7355 do_unlock(smbd_messaging_context(),
7356 fsp,
7357 e->smbpid,
7358 e->count,
7359 e->offset,
7360 WINDOWS_LOCK);
7361 }
7362 return status;
7363 }
7364
7365 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7366 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7367
7368 return NT_STATUS_OK;
7369 }
7370
7371 /****************************************************************************
7372 Reply to a lockingX request.
7373 ****************************************************************************/
7374
7375 void reply_lockingX(struct smb_request *req)
7376 {
7377 connection_struct *conn = req->conn;
7378 files_struct *fsp;
7379 unsigned char locktype;
7380 unsigned char oplocklevel;
7381 uint16 num_ulocks;
7382 uint16 num_locks;
7383 int32 lock_timeout;
7384 int i;
7385 const uint8_t *data;
7386 bool large_file_format;
7387 bool err;
7388 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7389 struct smbd_lock_element *ulocks;
7390 struct smbd_lock_element *locks;
7391 bool async = false;
7392
7393 START_PROFILE(SMBlockingX);
7394
7395 if (req->wct < 8) {
7396 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7397 END_PROFILE(SMBlockingX);
7398 return;
7399 }
7400
7401 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7402 locktype = CVAL(req->vwv+3, 0);
7403 oplocklevel = CVAL(req->vwv+3, 1);
7404 num_ulocks = SVAL(req->vwv+6, 0);
7405 num_locks = SVAL(req->vwv+7, 0);
7406 lock_timeout = IVAL(req->vwv+4, 0);
7407 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7408
7409 if (!check_fsp(conn, req, fsp)) {
7410 END_PROFILE(SMBlockingX);
7411 return;
7412 }
7413
7414 data = req->buf;
7415
7416 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7417 /* we don't support these - and CANCEL_LOCK makes w2k
7418 and XP reboot so I don't really want to be
7419 compatible! (tridge) */
7420 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
7421 END_PROFILE(SMBlockingX);
7422 return;
7423 }
7424
7425 /* Check if this is an oplock break on a file
7426 we have granted an oplock on.
7427 */
7428 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7429 /* Client can insist on breaking to none. */
7430 bool break_to_none = (oplocklevel == 0);
7431 bool result;
7432
7433 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7434 "for fnum = %d\n", (unsigned int)oplocklevel,
7435 fsp->fnum ));
7436
7437 /*
7438 * Make sure we have granted an exclusive or batch oplock on
7439 * this file.
7440 */
7441
7442 if (fsp->oplock_type == 0) {
7443
7444 /* The Samba4 nbench simulator doesn't understand
7445 the difference between break to level2 and break
7446 to none from level2 - it sends oplock break
7447 replies in both cases. Don't keep logging an error
7448 message here - just ignore it. JRA. */
7449
7450 DEBUG(5,("reply_lockingX: Error : oplock break from "
7451 "client for fnum = %d (oplock=%d) and no "
7452 "oplock granted on this file (%s).\n",
7453 fsp->fnum, fsp->oplock_type,
7454 fsp_str_dbg(fsp)));
7455
7456 /* if this is a pure oplock break request then don't
7457 * send a reply */
7458 if (num_locks == 0 && num_ulocks == 0) {
7459 END_PROFILE(SMBlockingX);
7460 return;
7461 } else {
7462 END_PROFILE(SMBlockingX);
7463 reply_doserror(req, ERRDOS, ERRlock);
7464 return;
7465 }
7466 }
7467
7468 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7469 (break_to_none)) {
7470 result = remove_oplock(fsp);
7471 } else {
7472 result = downgrade_oplock(fsp);
7473 }
7474
7475 if (!result) {
7476 DEBUG(0, ("reply_lockingX: error in removing "
7477 "oplock on file %s\n", fsp_str_dbg(fsp)));
7478 /* Hmmm. Is this panic justified? */
7479 smb_panic("internal tdb error");
7480 }
7481
7482 reply_to_oplock_break_requests(fsp);
7483
7484 /* if this is a pure oplock break request then don't send a
7485 * reply */
7486 if (num_locks == 0 && num_ulocks == 0) {
7487 /* Sanity check - ensure a pure oplock break is not a
7488 chained request. */
7489 if(CVAL(req->vwv+0, 0) != 0xff)
7490 DEBUG(0,("reply_lockingX: Error : pure oplock "
7491 "break is a chained %d request !\n",
7492 (unsigned int)CVAL(req->vwv+0, 0)));
7493 END_PROFILE(SMBlockingX);
7494 return;
7495 }
7496 }
7497
7498 if (req->buflen <
7499 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7500 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7501 END_PROFILE(SMBlockingX);
7502 return;
7503 }
7504
7505 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7506 if (ulocks == NULL) {
7507 reply_nterror(req, NT_STATUS_NO_MEMORY);
7508 END_PROFILE(SMBlockingX);
7509 return;
7510 }
7511
7512 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7513 if (locks == NULL) {
7514 reply_nterror(req, NT_STATUS_NO_MEMORY);
7515 END_PROFILE(SMBlockingX);
7516 return;
7517 }
7518
7519 /* Data now points at the beginning of the list
7520 of smb_unlkrng structs */
7521 for(i = 0; i < (int)num_ulocks; i++) {
7522 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7523 ulocks[i].count = get_lock_count(data, i, large_file_format);
7524 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7525 ulocks[i].brltype = UNLOCK_LOCK;
7526
7527 /*
7528 * There is no error code marked "stupid client bug".... :-).
7529 */
7530 if(err) {
7531 END_PROFILE(SMBlockingX);
7532 reply_doserror(req, ERRDOS, ERRnoaccess);
7533 return;
7534 }
7535 }
7536
7537 /* Now do any requested locks */
7538 data += ((large_file_format ? 20 : 10)*num_ulocks);
7539
7540 /* Data now points at the beginning of the list
7541 of smb_lkrng structs */
7542
7543 for(i = 0; i < (int)num_locks; i++) {
7544 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7545 locks[i].count = get_lock_count(data, i, large_file_format);
7546 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7547
7548 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7549 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7550 locks[i].brltype = PENDING_READ_LOCK;
7551 } else {
7552 locks[i].brltype = READ_LOCK;
7553 }
7554 } else {
7555 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7556 locks[i].brltype = PENDING_WRITE_LOCK;
7557 } else {
7558 locks[i].brltype = WRITE_LOCK;
7559 }
7560 }
7561
7562 /*
7563 * There is no error code marked "stupid client bug".... :-).
7564 */
7565 if(err) {
7566 END_PROFILE(SMBlockingX);
7567 reply_doserror(req, ERRDOS, ERRnoaccess);
7568 return;
7569 }
7570 }
7571
7572 status = smbd_do_locking(req, fsp,
7573 locktype, lock_timeout,
7574 num_ulocks, ulocks,
7575 num_locks, locks,
7576 &async);
7577 if (!NT_STATUS_IS_OK(status)) {
7578 END_PROFILE(SMBlockingX);
7579 reply_nterror(req, status);
7580 return;
7581 }
7582 if (async) {
7583 END_PROFILE(SMBlockingX);
7584 return;
7585 }
7586
7587 reply_outbuf(req, 2, 0);
7588
7589 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7590 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7591
7592 END_PROFILE(SMBlockingX);
7593 chain_reply(req);
7594 }
7595
7596 #undef DBGC_CLASS
7597 #define DBGC_CLASS DBGC_ALL
7598
7599 /****************************************************************************
7600 Reply to a SMBreadbmpx (read block multiplex) request.
7601 Always reply with an error, if someone has a platform really needs this,
7602 please contact vl@samba.org
7603 ****************************************************************************/
7604
7605 void reply_readbmpx(struct smb_request *req)
7606 {
7607 START_PROFILE(SMBreadBmpx);
7608 reply_doserror(req, ERRSRV, ERRuseSTD);
7609 END_PROFILE(SMBreadBmpx);
7610 return;
7611 }
7612
7613 /****************************************************************************
7614 Reply to a SMBreadbs (read block multiplex secondary) request.
7615 Always reply with an error, if someone has a platform really needs this,
7616 please contact vl@samba.org
7617 ****************************************************************************/
7618
7619 void reply_readbs(struct smb_request *req)
7620 {
7621 START_PROFILE(SMBreadBs);
7622 reply_doserror(req, ERRSRV, ERRuseSTD);
7623 END_PROFILE(SMBreadBs);
7624 return;
7625 }
7626
7627 /****************************************************************************
7628 Reply to a SMBsetattrE.
7629 ****************************************************************************/
7630
7631 void reply_setattrE(struct smb_request *req)
7632 {
7633 connection_struct *conn = req->conn;
7634 struct smb_file_time ft;
7635 files_struct *fsp;
7636 NTSTATUS status;
7637
7638 START_PROFILE(SMBsetattrE);
7639 ZERO_STRUCT(ft);
7640
7641 if (req->wct < 7) {
7642 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7643 goto out;
7644 }
7645
7646 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7647
7648 if(!fsp || (fsp->conn != conn)) {
7649 reply_doserror(req, ERRDOS, ERRbadfid);
7650 goto out;
7651 }
7652
7653 /*
7654 * Convert the DOS times into unix times.
7655 */
7656
7657 ft.atime = convert_time_t_to_timespec(
7658 srv_make_unix_date2(req->vwv+3));
7659 ft.mtime = convert_time_t_to_timespec(
7660 srv_make_unix_date2(req->vwv+5));
7661 ft.create_time = convert_time_t_to_timespec(
7662 srv_make_unix_date2(req->vwv+1));
7663
7664 reply_outbuf(req, 0, 0);
7665
7666 /*
7667 * Patch from Ray Frush <frush@engr.colostate.edu>
7668 * Sometimes times are sent as zero - ignore them.
7669 */
7670
7671 /* Ensure we have a valid stat struct for the source. */
7672 if (fsp->fh->fd != -1) {
7673 if (SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st) == -1) {
7674 status = map_nt_error_from_unix(errno);
7675 reply_nterror(req, status);
7676 goto out;
7677 }
7678 } else {
7679 int ret = -1;
7680
7681 if (fsp->posix_open) {
7682 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name);
7683 } else {
7684 ret = SMB_VFS_STAT(conn, fsp->fsp_name);
7685 }
7686 if (ret == -1) {
7687 status = map_nt_error_from_unix(errno);
7688 reply_nterror(req, status);
7689 goto out;
7690 }
7691 }
7692
7693 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7694 if (!NT_STATUS_IS_OK(status)) {
7695 reply_doserror(req, ERRDOS, ERRnoaccess);
7696 goto out;
7697 }
7698
7699 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7700 " createtime=%u\n",
7701 fsp->fnum,
7702 (unsigned int)ft.atime.tv_sec,
7703 (unsigned int)ft.mtime.tv_sec,
7704 (unsigned int)ft.create_time.tv_sec
7705 ));
7706 out:
7707 END_PROFILE(SMBsetattrE);
7708 return;
7709 }
7710
7711
7712 /* Back from the dead for OS/2..... JRA. */
7713
7714 /****************************************************************************
7715 Reply to a SMBwritebmpx (write block multiplex primary) request.
7716 Always reply with an error, if someone has a platform really needs this,
7717 please contact vl@samba.org
7718 ****************************************************************************/
7719
7720 void reply_writebmpx(struct smb_request *req)
7721 {
7722 START_PROFILE(SMBwriteBmpx);
7723 reply_doserror(req, ERRSRV, ERRuseSTD);
7724 END_PROFILE(SMBwriteBmpx);
7725 return;
7726 }
7727
7728 /****************************************************************************
7729 Reply to a SMBwritebs (write block multiplex secondary) request.
7730 Always reply with an error, if someone has a platform really needs this,
7731 please contact vl@samba.org
7732 ****************************************************************************/
7733
7734 void reply_writebs(struct smb_request *req)
7735 {
7736 START_PROFILE(SMBwriteBs);
7737 reply_doserror(req, ERRSRV, ERRuseSTD);
7738 END_PROFILE(SMBwriteBs);
7739 return;
7740 }
7741
7742 /****************************************************************************
7743 Reply to a SMBgetattrE.
7744 ****************************************************************************/
7745
7746 void reply_getattrE(struct smb_request *req)
7747 {
7748 connection_struct *conn = req->conn;
7749 SMB_STRUCT_STAT sbuf;
7750 int mode;
7751 files_struct *fsp;
7752 struct timespec create_ts;
7753
7754 START_PROFILE(SMBgetattrE);
7755
7756 if (req->wct < 1) {
7757 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7758 END_PROFILE(SMBgetattrE);
7759 return;
7760 }
7761
7762 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7763
7764 if(!fsp || (fsp->conn != conn)) {
7765 reply_doserror(req, ERRDOS, ERRbadfid);
7766 END_PROFILE(SMBgetattrE);
7767 return;
7768 }
7769
7770 /* Do an fstat on this file */
7771 if(fsp_stat(fsp, &sbuf)) {
7772 reply_nterror(req, map_nt_error_from_unix(errno));
7773 END_PROFILE(SMBgetattrE);
7774 return;
7775 }
7776
7777 fsp->fsp_name->st = sbuf;
7778
7779 mode = dos_mode(conn, fsp->fsp_name);
7780
7781 /*
7782 * Convert the times into dos times. Set create
7783 * date to be last modify date as UNIX doesn't save
7784 * this.
7785 */
7786
7787 reply_outbuf(req, 11, 0);
7788
7789 create_ts = sbuf.st_ex_btime;
7790 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7791 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7792 convert_timespec_to_time_t(sbuf.st_ex_atime));
7793 /* Should we check pending modtime here ? JRA */
7794 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7795 convert_timespec_to_time_t(sbuf.st_ex_mtime));
7796
7797 if (mode & aDIR) {
7798 SIVAL(req->outbuf, smb_vwv6, 0);
7799 SIVAL(req->outbuf, smb_vwv8, 0);
7800 } else {
7801 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7802 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_ex_size);
7803 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7804 }
7805 SSVAL(req->outbuf,smb_vwv10, mode);
7806
7807 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7808
7809 END_PROFILE(SMBgetattrE);
7810 return;
7811 }
fernandojvsilva's samba4 branch