?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-docs: Fix typos.
[Samba/gbeck.git] / source3 / smbd / reply.c
blob0adc4e80f69ef654932f1f8d519390546e51b7a0
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "rpc_client/cli_spoolss.h"
36 #include "rpc_client/init_spoolss.h"
37 #include "rpc_server/rpc_ncacn_np.h"
38 #include "libcli/security/security.h"
39 #include "libsmb/nmblib.h"
40 #include "auth.h"
41 #include "smbprofile.h"
42 #include "../lib/tsocket/tsocket.h"
43
44 /****************************************************************************
45 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
46 path or anything including wildcards.
47 We're assuming here that '/' is not the second byte in any multibyte char
48 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
49 set.
50 ****************************************************************************/
51
52 /* Custom version for processing POSIX paths. */
53 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
54
55 static NTSTATUS check_path_syntax_internal(char *path,
56 bool posix_path,
57 bool *p_last_component_contains_wcard)
58 {
59 char *d = path;
60 const char *s = path;
61 NTSTATUS ret = NT_STATUS_OK;
62 bool start_of_name_component = True;
63 bool stream_started = false;
64
65 *p_last_component_contains_wcard = False;
66
67 while (*s) {
68 if (stream_started) {
69 switch (*s) {
70 case '/':
71 case '\\':
72 return NT_STATUS_OBJECT_NAME_INVALID;
73 case ':':
74 if (s[1] == '\0') {
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 }
77 if (strchr_m(&s[1], ':')) {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 break;
81 }
82 }
83
84 if ((*s == ':') && !posix_path && !stream_started) {
85 if (*p_last_component_contains_wcard) {
86 return NT_STATUS_OBJECT_NAME_INVALID;
87 }
88 /* Stream names allow more characters than file names.
89 We're overloading posix_path here to allow a wider
90 range of characters. If stream_started is true this
91 is still a Windows path even if posix_path is true.
92 JRA.
93 */
94 stream_started = true;
95 start_of_name_component = false;
96 posix_path = true;
97
98 if (s[1] == '\0') {
99 return NT_STATUS_OBJECT_NAME_INVALID;
100 }
101 }
102
103 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
104 /*
105 * Safe to assume is not the second part of a mb char
106 * as this is handled below.
107 */
108 /* Eat multiple '/' or '\\' */
109 while (IS_PATH_SEP(*s,posix_path)) {
110 s++;
111 }
112 if ((d != path) && (*s != '\0')) {
113 /* We only care about non-leading or trailing '/' or '\\' */
114 *d++ = '/';
115 }
116
117 start_of_name_component = True;
118 /* New component. */
119 *p_last_component_contains_wcard = False;
120 continue;
121 }
122
123 if (start_of_name_component) {
124 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
125 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
126
127 /*
128 * No mb char starts with '.' so we're safe checking the directory separator here.
129 */
130
131 /* If we just added a '/' - delete it */
132 if ((d > path) && (*(d-1) == '/')) {
133 *(d-1) = '\0';
134 d--;
135 }
136
137 /* Are we at the start ? Can't go back further if so. */
138 if (d <= path) {
139 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
140 break;
141 }
142 /* Go back one level... */
143 /* We know this is safe as '/' cannot be part of a mb sequence. */
144 /* NOTE - if this assumption is invalid we are not in good shape... */
145 /* Decrement d first as d points to the *next* char to write into. */
146 for (d--; d > path; d--) {
147 if (*d == '/')
148 break;
149 }
150 s += 2; /* Else go past the .. */
151 /* We're still at the start of a name component, just the previous one. */
152 continue;
153
154 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
155 if (posix_path) {
156 /* Eat the '.' */
157 s++;
158 continue;
159 }
160 }
161
162 }
163
164 if (!(*s & 0x80)) {
165 if (!posix_path) {
166 if (*s <= 0x1f || *s == '|') {
167 return NT_STATUS_OBJECT_NAME_INVALID;
168 }
169 switch (*s) {
170 case '*':
171 case '?':
172 case '<':
173 case '>':
174 case '"':
175 *p_last_component_contains_wcard = True;
176 break;
177 default:
178 break;
179 }
180 }
181 *d++ = *s++;
182 } else {
183 size_t siz;
184 /* Get the size of the next MB character. */
185 next_codepoint(s,&siz);
186 switch(siz) {
187 case 5:
188 *d++ = *s++;
189 /*fall through*/
190 case 4:
191 *d++ = *s++;
192 /*fall through*/
193 case 3:
194 *d++ = *s++;
195 /*fall through*/
196 case 2:
197 *d++ = *s++;
198 /*fall through*/
199 case 1:
200 *d++ = *s++;
201 break;
202 default:
203 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
204 *d = '\0';
205 return NT_STATUS_INVALID_PARAMETER;
206 }
207 }
208 start_of_name_component = False;
209 }
210
211 *d = '\0';
212
213 return ret;
214 }
215
216 /****************************************************************************
217 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
218 No wildcards allowed.
219 ****************************************************************************/
220
221 NTSTATUS check_path_syntax(char *path)
222 {
223 bool ignore;
224 return check_path_syntax_internal(path, False, &ignore);
225 }
226
227 /****************************************************************************
228 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
229 Wildcards allowed - p_contains_wcard returns true if the last component contained
230 a wildcard.
231 ****************************************************************************/
232
233 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
234 {
235 return check_path_syntax_internal(path, False, p_contains_wcard);
236 }
237
238 /****************************************************************************
239 Check the path for a POSIX client.
240 We're assuming here that '/' is not the second byte in any multibyte char
241 set (a safe assumption).
242 ****************************************************************************/
243
244 NTSTATUS check_path_syntax_posix(char *path)
245 {
246 bool ignore;
247 return check_path_syntax_internal(path, True, &ignore);
248 }
249
250 /****************************************************************************
251 Pull a string and check the path allowing a wilcard - provide for error return.
252 ****************************************************************************/
253
254 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
255 const char *base_ptr,
256 uint16 smb_flags2,
257 char **pp_dest,
258 const char *src,
259 size_t src_len,
260 int flags,
261 NTSTATUS *err,
262 bool *contains_wcard)
263 {
264 size_t ret;
265
266 *pp_dest = NULL;
267
268 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
269 src_len, flags);
270
271 if (!*pp_dest) {
272 *err = NT_STATUS_INVALID_PARAMETER;
273 return ret;
274 }
275
276 *contains_wcard = False;
277
278 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
279 /*
280 * For a DFS path the function parse_dfs_path()
281 * will do the path processing, just make a copy.
282 */
283 *err = NT_STATUS_OK;
284 return ret;
285 }
286
287 if (lp_posix_pathnames()) {
288 *err = check_path_syntax_posix(*pp_dest);
289 } else {
290 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
291 }
292
293 return ret;
294 }
295
296 /****************************************************************************
297 Pull a string and check the path - provide for error return.
298 ****************************************************************************/
299
300 size_t srvstr_get_path(TALLOC_CTX *ctx,
301 const char *base_ptr,
302 uint16 smb_flags2,
303 char **pp_dest,
304 const char *src,
305 size_t src_len,
306 int flags,
307 NTSTATUS *err)
308 {
309 bool ignore;
310 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
311 src_len, flags, err, &ignore);
312 }
313
314 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err, bool *contains_wcard)
317 {
318 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
319 pp_dest, src, smbreq_bufrem(req, src),
320 flags, err, contains_wcard);
321 }
322
323 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
324 char **pp_dest, const char *src, int flags,
325 NTSTATUS *err)
326 {
327 bool ignore;
328 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
329 flags, err, &ignore);
330 }
331
332 /****************************************************************************
333 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
334 ****************************************************************************/
335
336 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
337 files_struct *fsp)
338 {
339 if ((fsp == NULL) || (conn == NULL)) {
340 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
341 return False;
342 }
343 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
344 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
345 return False;
346 }
347 return True;
348 }
349
350 /****************************************************************************
351 Check if we have a correct fsp pointing to a file.
352 ****************************************************************************/
353
354 bool check_fsp(connection_struct *conn, struct smb_request *req,
355 files_struct *fsp)
356 {
357 if (!check_fsp_open(conn, req, fsp)) {
358 return False;
359 }
360 if (fsp->is_directory) {
361 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
362 return False;
363 }
364 if (fsp->fh->fd == -1) {
365 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
366 return False;
367 }
368 fsp->num_smb_operations++;
369 return True;
370 }
371
372 /****************************************************************************
373 Check if we have a correct fsp pointing to a quota fake file. Replacement for
374 the CHECK_NTQUOTA_HANDLE_OK macro.
375 ****************************************************************************/
376
377 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
378 files_struct *fsp)
379 {
380 if (!check_fsp_open(conn, req, fsp)) {
381 return false;
382 }
383
384 if (fsp->is_directory) {
385 return false;
386 }
387
388 if (fsp->fake_file_handle == NULL) {
389 return false;
390 }
391
392 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
393 return false;
394 }
395
396 if (fsp->fake_file_handle->private_data == NULL) {
397 return false;
398 }
399
400 return true;
401 }
402
403 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
404 const char *name, int name_type)
405 {
406 char *trim_name;
407 char *trim_name_type;
408 const char *retarget_parm;
409 char *retarget;
410 char *p;
411 int retarget_type = 0x20;
412 int retarget_port = 139;
413 struct sockaddr_storage retarget_addr;
414 struct sockaddr_in *in_addr;
415 bool ret = false;
416 uint8_t outbuf[10];
417
418 if (get_socket_port(sconn->sock) != 139) {
419 return false;
420 }
421
422 trim_name = talloc_strdup(talloc_tos(), name);
423 if (trim_name == NULL) {
424 goto fail;
425 }
426 trim_char(trim_name, ' ', ' ');
427
428 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
429 name_type);
430 if (trim_name_type == NULL) {
431 goto fail;
432 }
433
434 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
435 trim_name_type, NULL);
436 if (retarget_parm == NULL) {
437 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
438 trim_name, NULL);
439 }
440 if (retarget_parm == NULL) {
441 goto fail;
442 }
443
444 retarget = talloc_strdup(trim_name, retarget_parm);
445 if (retarget == NULL) {
446 goto fail;
447 }
448
449 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
450
451 p = strchr(retarget, ':');
452 if (p != NULL) {
453 *p++ = '\0';
454 retarget_port = atoi(p);
455 }
456
457 p = strchr_m(retarget, '#');
458 if (p != NULL) {
459 *p++ = '\0';
460 if (sscanf(p, "%x", &retarget_type) != 1) {
461 goto fail;
462 }
463 }
464
465 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
466 if (!ret) {
467 DEBUG(10, ("could not resolve %s\n", retarget));
468 goto fail;
469 }
470
471 if (retarget_addr.ss_family != AF_INET) {
472 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
473 goto fail;
474 }
475
476 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
477
478 _smb_setlen(outbuf, 6);
479 SCVAL(outbuf, 0, 0x84);
480 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
481 *(uint16_t *)(outbuf+8) = htons(retarget_port);
482
483 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
484 NULL)) {
485 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
486 "failed.");
487 }
488
489 ret = true;
490 fail:
491 TALLOC_FREE(trim_name);
492 return ret;
493 }
494
495 static void reply_called_name_not_present(char *outbuf)
496 {
497 smb_setlen(outbuf, 1);
498 SCVAL(outbuf, 0, 0x83);
499 SCVAL(outbuf, 4, 0x82);
500 }
501
502 /****************************************************************************
503 Reply to a (netbios-level) special message.
504 ****************************************************************************/
505
506 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
507 {
508 int msg_type = CVAL(inbuf,0);
509 int msg_flags = CVAL(inbuf,1);
510 /*
511 * We only really use 4 bytes of the outbuf, but for the smb_setlen
512 * calculation & friends (srv_send_smb uses that) we need the full smb
513 * header.
514 */
515 char outbuf[smb_size];
516
517 memset(outbuf, '\0', sizeof(outbuf));
518
519 smb_setlen(outbuf,0);
520
521 switch (msg_type) {
522 case NBSSrequest: /* session request */
523 {
524 /* inbuf_size is guarenteed to be at least 4. */
525 fstring name1,name2;
526 int name_type1, name_type2;
527 int name_len1, name_len2;
528
529 *name1 = *name2 = 0;
530
531 if (sconn->nbt.got_session) {
532 exit_server_cleanly("multiple session request not permitted");
533 }
534
535 SCVAL(outbuf,0,NBSSpositive);
536 SCVAL(outbuf,3,0);
537
538 /* inbuf_size is guaranteed to be at least 4. */
539 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
540 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
541 DEBUG(0,("Invalid name length in session request\n"));
542 reply_called_name_not_present(outbuf);
543 break;
544 }
545 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
546 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
547 DEBUG(0,("Invalid name length in session request\n"));
548 reply_called_name_not_present(outbuf);
549 break;
550 }
551
552 name_type1 = name_extract((unsigned char *)inbuf,
553 inbuf_size,(unsigned int)4,name1);
554 name_type2 = name_extract((unsigned char *)inbuf,
555 inbuf_size,(unsigned int)(4 + name_len1),name2);
556
557 if (name_type1 == -1 || name_type2 == -1) {
558 DEBUG(0,("Invalid name type in session request\n"));
559 reply_called_name_not_present(outbuf);
560 break;
561 }
562
563 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
564 name1, name_type1, name2, name_type2));
565
566 if (netbios_session_retarget(sconn, name1, name_type1)) {
567 exit_server_cleanly("retargeted client");
568 }
569
570 /*
571 * Windows NT/2k uses "*SMBSERVER" and XP uses
572 * "*SMBSERV" arrggg!!!
573 */
574 if (strequal(name1, "*SMBSERVER ")
575 || strequal(name1, "*SMBSERV ")) {
576 char *raddr;
577
578 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
579 talloc_tos());
580 if (raddr == NULL) {
581 exit_server_cleanly("could not allocate raddr");
582 }
583
584 fstrcpy(name1, raddr);
585 }
586
587 set_local_machine_name(name1, True);
588 set_remote_machine_name(name2, True);
589
590 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
591 get_local_machine_name(), get_remote_machine_name(),
592 name_type2));
593
594 if (name_type2 == 'R') {
595 /* We are being asked for a pathworks session ---
596 no thanks! */
597 reply_called_name_not_present(outbuf);
598 break;
599 }
600
601 /* only add the client's machine name to the list
602 of possibly valid usernames if we are operating
603 in share mode security */
604 if (lp_security() == SEC_SHARE) {
605 add_session_user(sconn, get_remote_machine_name());
606 }
607
608 reload_services(sconn->msg_ctx, sconn->sock, True);
609 reopen_logs();
610
611 sconn->nbt.got_session = true;
612 break;
613 }
614
615 case 0x89: /* session keepalive request
616 (some old clients produce this?) */
617 SCVAL(outbuf,0,NBSSkeepalive);
618 SCVAL(outbuf,3,0);
619 break;
620
621 case NBSSpositive: /* positive session response */
622 case NBSSnegative: /* negative session response */
623 case NBSSretarget: /* retarget session response */
624 DEBUG(0,("Unexpected session response\n"));
625 break;
626
627 case NBSSkeepalive: /* session keepalive */
628 default:
629 return;
630 }
631
632 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
633 msg_type, msg_flags));
634
635 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
636
637 if (CVAL(outbuf, 0) != 0x82) {
638 exit_server_cleanly("invalid netbios session");
639 }
640 return;
641 }
642
643 /****************************************************************************
644 Reply to a tcon.
645 conn POINTER CAN BE NULL HERE !
646 ****************************************************************************/
647
648 void reply_tcon(struct smb_request *req)
649 {
650 connection_struct *conn = req->conn;
651 const char *service;
652 char *service_buf = NULL;
653 char *password = NULL;
654 char *dev = NULL;
655 int pwlen=0;
656 NTSTATUS nt_status;
657 const char *p;
658 DATA_BLOB password_blob;
659 TALLOC_CTX *ctx = talloc_tos();
660 struct smbd_server_connection *sconn = req->sconn;
661
662 START_PROFILE(SMBtcon);
663
664 if (req->buflen < 4) {
665 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
666 END_PROFILE(SMBtcon);
667 return;
668 }
669
670 p = (const char *)req->buf + 1;
671 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
672 p += 1;
673 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
674 p += pwlen+1;
675 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
676 p += 1;
677
678 if (service_buf == NULL || password == NULL || dev == NULL) {
679 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
680 END_PROFILE(SMBtcon);
681 return;
682 }
683 p = strrchr_m(service_buf,'\\');
684 if (p) {
685 service = p+1;
686 } else {
687 service = service_buf;
688 }
689
690 password_blob = data_blob(password, pwlen+1);
691
692 conn = make_connection(sconn,service,password_blob,dev,
693 req->vuid,&nt_status);
694 req->conn = conn;
695
696 data_blob_clear_free(&password_blob);
697
698 if (!conn) {
699 reply_nterror(req, nt_status);
700 END_PROFILE(SMBtcon);
701 return;
702 }
703
704 reply_outbuf(req, 2, 0);
705 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
706 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
707 SSVAL(req->outbuf,smb_tid,conn->cnum);
708
709 DEBUG(3,("tcon service=%s cnum=%d\n",
710 service, conn->cnum));
711
712 END_PROFILE(SMBtcon);
713 return;
714 }
715
716 /****************************************************************************
717 Reply to a tcon and X.
718 conn POINTER CAN BE NULL HERE !
719 ****************************************************************************/
720
721 void reply_tcon_and_X(struct smb_request *req)
722 {
723 connection_struct *conn = req->conn;
724 const char *service = NULL;
725 DATA_BLOB password;
726 TALLOC_CTX *ctx = talloc_tos();
727 /* what the cleint thinks the device is */
728 char *client_devicetype = NULL;
729 /* what the server tells the client the share represents */
730 const char *server_devicetype;
731 NTSTATUS nt_status;
732 int passlen;
733 char *path = NULL;
734 const char *p, *q;
735 uint16 tcon_flags;
736 struct smbd_server_connection *sconn = req->sconn;
737
738 START_PROFILE(SMBtconX);
739
740 if (req->wct < 4) {
741 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
742 END_PROFILE(SMBtconX);
743 return;
744 }
745
746 passlen = SVAL(req->vwv+3, 0);
747 tcon_flags = SVAL(req->vwv+2, 0);
748
749 /* we might have to close an old one */
750 if ((tcon_flags & 0x1) && conn) {
751 close_cnum(conn,req->vuid);
752 req->conn = NULL;
753 conn = NULL;
754 }
755
756 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
757 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
758 END_PROFILE(SMBtconX);
759 return;
760 }
761
762 if (sconn->smb1.negprot.encrypted_passwords) {
763 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
764 if (lp_security() == SEC_SHARE) {
765 /*
766 * Security = share always has a pad byte
767 * after the password.
768 */
769 p = (const char *)req->buf + passlen + 1;
770 } else {
771 p = (const char *)req->buf + passlen;
772 }
773 } else {
774 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
775 /* Ensure correct termination */
776 password.data[passlen]=0;
777 p = (const char *)req->buf + passlen + 1;
778 }
779
780 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
781
782 if (path == NULL) {
783 data_blob_clear_free(&password);
784 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
785 END_PROFILE(SMBtconX);
786 return;
787 }
788
789 /*
790 * the service name can be either: \\server\share
791 * or share directly like on the DELL PowerVault 705
792 */
793 if (*path=='\\') {
794 q = strchr_m(path+2,'\\');
795 if (!q) {
796 data_blob_clear_free(&password);
797 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
798 END_PROFILE(SMBtconX);
799 return;
800 }
801 service = q+1;
802 } else {
803 service = path;
804 }
805
806 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
807 &client_devicetype, p,
808 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
809
810 if (client_devicetype == NULL) {
811 data_blob_clear_free(&password);
812 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
813 END_PROFILE(SMBtconX);
814 return;
815 }
816
817 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
818
819 conn = make_connection(sconn, service, password, client_devicetype,
820 req->vuid, &nt_status);
821 req->conn =conn;
822
823 data_blob_clear_free(&password);
824
825 if (!conn) {
826 reply_nterror(req, nt_status);
827 END_PROFILE(SMBtconX);
828 return;
829 }
830
831 if ( IS_IPC(conn) )
832 server_devicetype = "IPC";
833 else if ( IS_PRINT(conn) )
834 server_devicetype = "LPT1:";
835 else
836 server_devicetype = "A:";
837
838 if (get_Protocol() < PROTOCOL_NT1) {
839 reply_outbuf(req, 2, 0);
840 if (message_push_string(&req->outbuf, server_devicetype,
841 STR_TERMINATE|STR_ASCII) == -1) {
842 reply_nterror(req, NT_STATUS_NO_MEMORY);
843 END_PROFILE(SMBtconX);
844 return;
845 }
846 } else {
847 /* NT sets the fstype of IPC$ to the null string */
848 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
849
850 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
851 /* Return permissions. */
852 uint32 perm1 = 0;
853 uint32 perm2 = 0;
854
855 reply_outbuf(req, 7, 0);
856
857 if (IS_IPC(conn)) {
858 perm1 = FILE_ALL_ACCESS;
859 perm2 = FILE_ALL_ACCESS;
860 } else {
861 perm1 = conn->share_access;
862 }
863
864 SIVAL(req->outbuf, smb_vwv3, perm1);
865 SIVAL(req->outbuf, smb_vwv5, perm2);
866 } else {
867 reply_outbuf(req, 3, 0);
868 }
869
870 if ((message_push_string(&req->outbuf, server_devicetype,
871 STR_TERMINATE|STR_ASCII) == -1)
872 || (message_push_string(&req->outbuf, fstype,
873 STR_TERMINATE) == -1)) {
874 reply_nterror(req, NT_STATUS_NO_MEMORY);
875 END_PROFILE(SMBtconX);
876 return;
877 }
878
879 /* what does setting this bit do? It is set by NT4 and
880 may affect the ability to autorun mounted cdroms */
881 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
882 (lp_csc_policy(SNUM(conn)) << 2));
883
884 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
885 DEBUG(2,("Serving %s as a Dfs root\n",
886 lp_servicename(SNUM(conn)) ));
887 SSVAL(req->outbuf, smb_vwv2,
888 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
889 }
890 }
891
892
893 DEBUG(3,("tconX service=%s \n",
894 service));
895
896 /* set the incoming and outgoing tid to the just created one */
897 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
898 SSVAL(req->outbuf,smb_tid,conn->cnum);
899
900 END_PROFILE(SMBtconX);
901
902 req->tid = conn->cnum;
903 chain_reply(req);
904 return;
905 }
906
907 /****************************************************************************
908 Reply to an unknown type.
909 ****************************************************************************/
910
911 void reply_unknown_new(struct smb_request *req, uint8 type)
912 {
913 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
914 smb_fn_name(type), type, type));
915 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
916 return;
917 }
918
919 /****************************************************************************
920 Reply to an ioctl.
921 conn POINTER CAN BE NULL HERE !
922 ****************************************************************************/
923
924 void reply_ioctl(struct smb_request *req)
925 {
926 connection_struct *conn = req->conn;
927 uint16 device;
928 uint16 function;
929 uint32 ioctl_code;
930 int replysize;
931 char *p;
932
933 START_PROFILE(SMBioctl);
934
935 if (req->wct < 3) {
936 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
937 END_PROFILE(SMBioctl);
938 return;
939 }
940
941 device = SVAL(req->vwv+1, 0);
942 function = SVAL(req->vwv+2, 0);
943 ioctl_code = (device << 16) + function;
944
945 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
946
947 switch (ioctl_code) {
948 case IOCTL_QUERY_JOB_INFO:
949 replysize = 32;
950 break;
951 default:
952 reply_force_doserror(req, ERRSRV, ERRnosupport);
953 END_PROFILE(SMBioctl);
954 return;
955 }
956
957 reply_outbuf(req, 8, replysize+1);
958 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
959 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
960 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
961 p = smb_buf(req->outbuf);
962 memset(p, '\0', replysize+1); /* valgrind-safe. */
963 p += 1; /* Allow for alignment */
964
965 switch (ioctl_code) {
966 case IOCTL_QUERY_JOB_INFO:
967 {
968 files_struct *fsp = file_fsp(
969 req, SVAL(req->vwv+0, 0));
970 if (!fsp) {
971 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
972 END_PROFILE(SMBioctl);
973 return;
974 }
975 /* Job number */
976 if (fsp->print_file) {
977 SSVAL(p, 0, fsp->print_file->rap_jobid);
978 } else {
979 SSVAL(p, 0, 0);
980 }
981 srvstr_push((char *)req->outbuf, req->flags2, p+2,
982 lp_netbios_name(), 15,
983 STR_TERMINATE|STR_ASCII);
984 if (conn) {
985 srvstr_push((char *)req->outbuf, req->flags2,
986 p+18, lp_servicename(SNUM(conn)),
987 13, STR_TERMINATE|STR_ASCII);
988 } else {
989 memset(p+18, 0, 13);
990 }
991 break;
992 }
993 }
994
995 END_PROFILE(SMBioctl);
996 return;
997 }
998
999 /****************************************************************************
1000 Strange checkpath NTSTATUS mapping.
1001 ****************************************************************************/
1002
1003 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1004 {
1005 /* Strange DOS error code semantics only for checkpath... */
1006 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1007 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1008 /* We need to map to ERRbadpath */
1009 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1010 }
1011 }
1012 return status;
1013 }
1014
1015 /****************************************************************************
1016 Reply to a checkpath.
1017 ****************************************************************************/
1018
1019 void reply_checkpath(struct smb_request *req)
1020 {
1021 connection_struct *conn = req->conn;
1022 struct smb_filename *smb_fname = NULL;
1023 char *name = NULL;
1024 NTSTATUS status;
1025 TALLOC_CTX *ctx = talloc_tos();
1026
1027 START_PROFILE(SMBcheckpath);
1028
1029 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1030 STR_TERMINATE, &status);
1031
1032 if (!NT_STATUS_IS_OK(status)) {
1033 status = map_checkpath_error(req->flags2, status);
1034 reply_nterror(req, status);
1035 END_PROFILE(SMBcheckpath);
1036 return;
1037 }
1038
1039 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1040
1041 status = filename_convert(ctx,
1042 conn,
1043 req->flags2 & FLAGS2_DFS_PATHNAMES,
1044 name,
1045 0,
1046 NULL,
1047 &smb_fname);
1048
1049 if (!NT_STATUS_IS_OK(status)) {
1050 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1051 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1052 ERRSRV, ERRbadpath);
1053 END_PROFILE(SMBcheckpath);
1054 return;
1055 }
1056 goto path_err;
1057 }
1058
1059 if (!VALID_STAT(smb_fname->st) &&
1060 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1061 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1062 smb_fname_str_dbg(smb_fname), strerror(errno)));
1063 status = map_nt_error_from_unix(errno);
1064 goto path_err;
1065 }
1066
1067 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1068 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1069 ERRDOS, ERRbadpath);
1070 goto out;
1071 }
1072
1073 reply_outbuf(req, 0, 0);
1074
1075 path_err:
1076 /* We special case this - as when a Windows machine
1077 is parsing a path is steps through the components
1078 one at a time - if a component fails it expects
1079 ERRbadpath, not ERRbadfile.
1080 */
1081 status = map_checkpath_error(req->flags2, status);
1082 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1083 /*
1084 * Windows returns different error codes if
1085 * the parent directory is valid but not the
1086 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1087 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1088 * if the path is invalid.
1089 */
1090 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1091 ERRDOS, ERRbadpath);
1092 goto out;
1093 }
1094
1095 reply_nterror(req, status);
1096
1097 out:
1098 TALLOC_FREE(smb_fname);
1099 END_PROFILE(SMBcheckpath);
1100 return;
1101 }
1102
1103 /****************************************************************************
1104 Reply to a getatr.
1105 ****************************************************************************/
1106
1107 void reply_getatr(struct smb_request *req)
1108 {
1109 connection_struct *conn = req->conn;
1110 struct smb_filename *smb_fname = NULL;
1111 char *fname = NULL;
1112 int mode=0;
1113 SMB_OFF_T size=0;
1114 time_t mtime=0;
1115 const char *p;
1116 NTSTATUS status;
1117 TALLOC_CTX *ctx = talloc_tos();
1118 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1119
1120 START_PROFILE(SMBgetatr);
1121
1122 p = (const char *)req->buf + 1;
1123 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1124 if (!NT_STATUS_IS_OK(status)) {
1125 reply_nterror(req, status);
1126 goto out;
1127 }
1128
1129 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1130 under WfWg - weird! */
1131 if (*fname == '\0') {
1132 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1133 if (!CAN_WRITE(conn)) {
1134 mode |= FILE_ATTRIBUTE_READONLY;
1135 }
1136 size = 0;
1137 mtime = 0;
1138 } else {
1139 status = filename_convert(ctx,
1140 conn,
1141 req->flags2 & FLAGS2_DFS_PATHNAMES,
1142 fname,
1143 0,
1144 NULL,
1145 &smb_fname);
1146 if (!NT_STATUS_IS_OK(status)) {
1147 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1148 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1149 ERRSRV, ERRbadpath);
1150 goto out;
1151 }
1152 reply_nterror(req, status);
1153 goto out;
1154 }
1155 if (!VALID_STAT(smb_fname->st) &&
1156 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1157 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1158 smb_fname_str_dbg(smb_fname),
1159 strerror(errno)));
1160 reply_nterror(req, map_nt_error_from_unix(errno));
1161 goto out;
1162 }
1163
1164 mode = dos_mode(conn, smb_fname);
1165 size = smb_fname->st.st_ex_size;
1166
1167 if (ask_sharemode) {
1168 struct timespec write_time_ts;
1169 struct file_id fileid;
1170
1171 ZERO_STRUCT(write_time_ts);
1172 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1173 get_file_infos(fileid, 0, NULL, &write_time_ts);
1174 if (!null_timespec(write_time_ts)) {
1175 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1176 }
1177 }
1178
1179 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1180 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1181 size = 0;
1182 }
1183 }
1184
1185 reply_outbuf(req, 10, 0);
1186
1187 SSVAL(req->outbuf,smb_vwv0,mode);
1188 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1189 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1190 } else {
1191 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1192 }
1193 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1194
1195 if (get_Protocol() >= PROTOCOL_NT1) {
1196 SSVAL(req->outbuf, smb_flg2,
1197 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1198 }
1199
1200 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1201 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1202
1203 out:
1204 TALLOC_FREE(smb_fname);
1205 TALLOC_FREE(fname);
1206 END_PROFILE(SMBgetatr);
1207 return;
1208 }
1209
1210 /****************************************************************************
1211 Reply to a setatr.
1212 ****************************************************************************/
1213
1214 void reply_setatr(struct smb_request *req)
1215 {
1216 struct smb_file_time ft;
1217 connection_struct *conn = req->conn;
1218 struct smb_filename *smb_fname = NULL;
1219 char *fname = NULL;
1220 int mode;
1221 time_t mtime;
1222 const char *p;
1223 NTSTATUS status;
1224 TALLOC_CTX *ctx = talloc_tos();
1225
1226 START_PROFILE(SMBsetatr);
1227
1228 ZERO_STRUCT(ft);
1229
1230 if (req->wct < 2) {
1231 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1232 goto out;
1233 }
1234
1235 p = (const char *)req->buf + 1;
1236 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1237 if (!NT_STATUS_IS_OK(status)) {
1238 reply_nterror(req, status);
1239 goto out;
1240 }
1241
1242 status = filename_convert(ctx,
1243 conn,
1244 req->flags2 & FLAGS2_DFS_PATHNAMES,
1245 fname,
1246 0,
1247 NULL,
1248 &smb_fname);
1249 if (!NT_STATUS_IS_OK(status)) {
1250 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1251 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1252 ERRSRV, ERRbadpath);
1253 goto out;
1254 }
1255 reply_nterror(req, status);
1256 goto out;
1257 }
1258
1259 if (smb_fname->base_name[0] == '.' &&
1260 smb_fname->base_name[1] == '\0') {
1261 /*
1262 * Not sure here is the right place to catch this
1263 * condition. Might be moved to somewhere else later -- vl
1264 */
1265 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1266 goto out;
1267 }
1268
1269 mode = SVAL(req->vwv+0, 0);
1270 mtime = srv_make_unix_date3(req->vwv+1);
1271
1272 ft.mtime = convert_time_t_to_timespec(mtime);
1273 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1274 if (!NT_STATUS_IS_OK(status)) {
1275 reply_nterror(req, status);
1276 goto out;
1277 }
1278
1279 if (mode != FILE_ATTRIBUTE_NORMAL) {
1280 if (VALID_STAT_OF_DIR(smb_fname->st))
1281 mode |= FILE_ATTRIBUTE_DIRECTORY;
1282 else
1283 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1284
1285 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1286 false) != 0) {
1287 reply_nterror(req, map_nt_error_from_unix(errno));
1288 goto out;
1289 }
1290 }
1291
1292 reply_outbuf(req, 0, 0);
1293
1294 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1295 mode));
1296 out:
1297 TALLOC_FREE(smb_fname);
1298 END_PROFILE(SMBsetatr);
1299 return;
1300 }
1301
1302 /****************************************************************************
1303 Reply to a dskattr.
1304 ****************************************************************************/
1305
1306 void reply_dskattr(struct smb_request *req)
1307 {
1308 connection_struct *conn = req->conn;
1309 uint64_t dfree,dsize,bsize;
1310 START_PROFILE(SMBdskattr);
1311
1312 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1313 reply_nterror(req, map_nt_error_from_unix(errno));
1314 END_PROFILE(SMBdskattr);
1315 return;
1316 }
1317
1318 reply_outbuf(req, 5, 0);
1319
1320 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1321 double total_space, free_space;
1322 /* we need to scale this to a number that DOS6 can handle. We
1323 use floating point so we can handle large drives on systems
1324 that don't have 64 bit integers
1325
1326 we end up displaying a maximum of 2G to DOS systems
1327 */
1328 total_space = dsize * (double)bsize;
1329 free_space = dfree * (double)bsize;
1330
1331 dsize = (uint64_t)((total_space+63*512) / (64*512));
1332 dfree = (uint64_t)((free_space+63*512) / (64*512));
1333
1334 if (dsize > 0xFFFF) dsize = 0xFFFF;
1335 if (dfree > 0xFFFF) dfree = 0xFFFF;
1336
1337 SSVAL(req->outbuf,smb_vwv0,dsize);
1338 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1339 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1340 SSVAL(req->outbuf,smb_vwv3,dfree);
1341 } else {
1342 SSVAL(req->outbuf,smb_vwv0,dsize);
1343 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1344 SSVAL(req->outbuf,smb_vwv2,512);
1345 SSVAL(req->outbuf,smb_vwv3,dfree);
1346 }
1347
1348 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1349
1350 END_PROFILE(SMBdskattr);
1351 return;
1352 }
1353
1354 /*
1355 * Utility function to split the filename from the directory.
1356 */
1357 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1358 char **fname_dir_out,
1359 char **fname_mask_out)
1360 {
1361 const char *p = NULL;
1362 char *fname_dir = NULL;
1363 char *fname_mask = NULL;
1364
1365 p = strrchr_m(fname_in, '/');
1366 if (!p) {
1367 fname_dir = talloc_strdup(ctx, ".");
1368 fname_mask = talloc_strdup(ctx, fname_in);
1369 } else {
1370 fname_dir = talloc_strndup(ctx, fname_in,
1371 PTR_DIFF(p, fname_in));
1372 fname_mask = talloc_strdup(ctx, p+1);
1373 }
1374
1375 if (!fname_dir || !fname_mask) {
1376 TALLOC_FREE(fname_dir);
1377 TALLOC_FREE(fname_mask);
1378 return NT_STATUS_NO_MEMORY;
1379 }
1380
1381 *fname_dir_out = fname_dir;
1382 *fname_mask_out = fname_mask;
1383 return NT_STATUS_OK;
1384 }
1385
1386 /****************************************************************************
1387 Reply to a search.
1388 Can be called from SMBsearch, SMBffirst or SMBfunique.
1389 ****************************************************************************/
1390
1391 void reply_search(struct smb_request *req)
1392 {
1393 connection_struct *conn = req->conn;
1394 char *path = NULL;
1395 const char *mask = NULL;
1396 char *directory = NULL;
1397 struct smb_filename *smb_fname = NULL;
1398 char *fname = NULL;
1399 SMB_OFF_T size;
1400 uint32 mode;
1401 struct timespec date;
1402 uint32 dirtype;
1403 unsigned int numentries = 0;
1404 unsigned int maxentries = 0;
1405 bool finished = False;
1406 const char *p;
1407 int status_len;
1408 char status[21];
1409 int dptr_num= -1;
1410 bool check_descend = False;
1411 bool expect_close = False;
1412 NTSTATUS nt_status;
1413 bool mask_contains_wcard = False;
1414 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1415 TALLOC_CTX *ctx = talloc_tos();
1416 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1417 struct dptr_struct *dirptr = NULL;
1418 struct smbd_server_connection *sconn = req->sconn;
1419
1420 START_PROFILE(SMBsearch);
1421
1422 if (req->wct < 2) {
1423 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1424 goto out;
1425 }
1426
1427 if (lp_posix_pathnames()) {
1428 reply_unknown_new(req, req->cmd);
1429 goto out;
1430 }
1431
1432 /* If we were called as SMBffirst then we must expect close. */
1433 if(req->cmd == SMBffirst) {
1434 expect_close = True;
1435 }
1436
1437 reply_outbuf(req, 1, 3);
1438 maxentries = SVAL(req->vwv+0, 0);
1439 dirtype = SVAL(req->vwv+1, 0);
1440 p = (const char *)req->buf + 1;
1441 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1442 &nt_status, &mask_contains_wcard);
1443 if (!NT_STATUS_IS_OK(nt_status)) {
1444 reply_nterror(req, nt_status);
1445 goto out;
1446 }
1447
1448 p++;
1449 status_len = SVAL(p, 0);
1450 p += 2;
1451
1452 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1453
1454 if (status_len == 0) {
1455 nt_status = filename_convert(ctx, conn,
1456 req->flags2 & FLAGS2_DFS_PATHNAMES,
1457 path,
1458 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1459 &mask_contains_wcard,
1460 &smb_fname);
1461 if (!NT_STATUS_IS_OK(nt_status)) {
1462 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1463 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1464 ERRSRV, ERRbadpath);
1465 goto out;
1466 }
1467 reply_nterror(req, nt_status);
1468 goto out;
1469 }
1470
1471 directory = smb_fname->base_name;
1472
1473 p = strrchr_m(directory,'/');
1474 if ((p != NULL) && (*directory != '/')) {
1475 mask = p + 1;
1476 directory = talloc_strndup(ctx, directory,
1477 PTR_DIFF(p, directory));
1478 } else {
1479 mask = directory;
1480 directory = talloc_strdup(ctx,".");
1481 }
1482
1483 if (!directory) {
1484 reply_nterror(req, NT_STATUS_NO_MEMORY);
1485 goto out;
1486 }
1487
1488 memset((char *)status,'\0',21);
1489 SCVAL(status,0,(dirtype & 0x1F));
1490
1491 nt_status = dptr_create(conn,
1492 NULL, /* fsp */
1493 directory,
1494 True,
1495 expect_close,
1496 req->smbpid,
1497 mask,
1498 mask_contains_wcard,
1499 dirtype,
1500 &dirptr);
1501 if (!NT_STATUS_IS_OK(nt_status)) {
1502 reply_nterror(req, nt_status);
1503 goto out;
1504 }
1505 dptr_num = dptr_dnum(dirptr);
1506 } else {
1507 int status_dirtype;
1508 const char *dirpath;
1509
1510 memcpy(status,p,21);
1511 status_dirtype = CVAL(status,0) & 0x1F;
1512 if (status_dirtype != (dirtype & 0x1F)) {
1513 dirtype = status_dirtype;
1514 }
1515
1516 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1517 if (!dirptr) {
1518 goto SearchEmpty;
1519 }
1520 dirpath = dptr_path(sconn, dptr_num);
1521 directory = talloc_strdup(ctx, dirpath);
1522 if (!directory) {
1523 reply_nterror(req, NT_STATUS_NO_MEMORY);
1524 goto out;
1525 }
1526
1527 mask = dptr_wcard(sconn, dptr_num);
1528 if (!mask) {
1529 goto SearchEmpty;
1530 }
1531 /*
1532 * For a 'continue' search we have no string. So
1533 * check from the initial saved string.
1534 */
1535 mask_contains_wcard = ms_has_wild(mask);
1536 dirtype = dptr_attr(sconn, dptr_num);
1537 }
1538
1539 DEBUG(4,("dptr_num is %d\n",dptr_num));
1540
1541 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1542 dptr_init_search_op(dirptr);
1543
1544 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1545 char buf[DIR_STRUCT_SIZE];
1546 memcpy(buf,status,21);
1547 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1548 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1549 reply_nterror(req, NT_STATUS_NO_MEMORY);
1550 goto out;
1551 }
1552 dptr_fill(sconn, buf+12,dptr_num);
1553 if (dptr_zero(buf+12) && (status_len==0)) {
1554 numentries = 1;
1555 } else {
1556 numentries = 0;
1557 }
1558 if (message_push_blob(&req->outbuf,
1559 data_blob_const(buf, sizeof(buf)))
1560 == -1) {
1561 reply_nterror(req, NT_STATUS_NO_MEMORY);
1562 goto out;
1563 }
1564 } else {
1565 unsigned int i;
1566 maxentries = MIN(
1567 maxentries,
1568 ((BUFFER_SIZE -
1569 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1570 /DIR_STRUCT_SIZE));
1571
1572 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1573 directory,lp_dontdescend(SNUM(conn))));
1574 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1575 check_descend = True;
1576 }
1577
1578 for (i=numentries;(i<maxentries) && !finished;i++) {
1579 finished = !get_dir_entry(ctx,
1580 dirptr,
1581 mask,
1582 dirtype,
1583 &fname,
1584 &size,
1585 &mode,
1586 &date,
1587 check_descend,
1588 ask_sharemode);
1589 if (!finished) {
1590 char buf[DIR_STRUCT_SIZE];
1591 memcpy(buf,status,21);
1592 if (!make_dir_struct(ctx,
1593 buf,
1594 mask,
1595 fname,
1596 size,
1597 mode,
1598 convert_timespec_to_time_t(date),
1599 !allow_long_path_components)) {
1600 reply_nterror(req, NT_STATUS_NO_MEMORY);
1601 goto out;
1602 }
1603 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1604 break;
1605 }
1606 if (message_push_blob(&req->outbuf,
1607 data_blob_const(buf, sizeof(buf)))
1608 == -1) {
1609 reply_nterror(req, NT_STATUS_NO_MEMORY);
1610 goto out;
1611 }
1612 numentries++;
1613 }
1614 }
1615 }
1616
1617 SearchEmpty:
1618
1619 /* If we were called as SMBffirst with smb_search_id == NULL
1620 and no entries were found then return error and close dirptr
1621 (X/Open spec) */
1622
1623 if (numentries == 0) {
1624 dptr_close(sconn, &dptr_num);
1625 } else if(expect_close && status_len == 0) {
1626 /* Close the dptr - we know it's gone */
1627 dptr_close(sconn, &dptr_num);
1628 }
1629
1630 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1631 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1632 dptr_close(sconn, &dptr_num);
1633 }
1634
1635 if ((numentries == 0) && !mask_contains_wcard) {
1636 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1637 goto out;
1638 }
1639
1640 SSVAL(req->outbuf,smb_vwv0,numentries);
1641 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1642 SCVAL(smb_buf(req->outbuf),0,5);
1643 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1644
1645 /* The replies here are never long name. */
1646 SSVAL(req->outbuf, smb_flg2,
1647 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1648 if (!allow_long_path_components) {
1649 SSVAL(req->outbuf, smb_flg2,
1650 SVAL(req->outbuf, smb_flg2)
1651 & (~FLAGS2_LONG_PATH_COMPONENTS));
1652 }
1653
1654 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1655 SSVAL(req->outbuf, smb_flg2,
1656 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1657
1658 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1659 smb_fn_name(req->cmd),
1660 mask,
1661 directory,
1662 dirtype,
1663 numentries,
1664 maxentries ));
1665 out:
1666 TALLOC_FREE(directory);
1667 TALLOC_FREE(smb_fname);
1668 END_PROFILE(SMBsearch);
1669 return;
1670 }
1671
1672 /****************************************************************************
1673 Reply to a fclose (stop directory search).
1674 ****************************************************************************/
1675
1676 void reply_fclose(struct smb_request *req)
1677 {
1678 int status_len;
1679 char status[21];
1680 int dptr_num= -2;
1681 const char *p;
1682 char *path = NULL;
1683 NTSTATUS err;
1684 bool path_contains_wcard = False;
1685 TALLOC_CTX *ctx = talloc_tos();
1686 struct smbd_server_connection *sconn = req->sconn;
1687
1688 START_PROFILE(SMBfclose);
1689
1690 if (lp_posix_pathnames()) {
1691 reply_unknown_new(req, req->cmd);
1692 END_PROFILE(SMBfclose);
1693 return;
1694 }
1695
1696 p = (const char *)req->buf + 1;
1697 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1698 &err, &path_contains_wcard);
1699 if (!NT_STATUS_IS_OK(err)) {
1700 reply_nterror(req, err);
1701 END_PROFILE(SMBfclose);
1702 return;
1703 }
1704 p++;
1705 status_len = SVAL(p,0);
1706 p += 2;
1707
1708 if (status_len == 0) {
1709 reply_force_doserror(req, ERRSRV, ERRsrverror);
1710 END_PROFILE(SMBfclose);
1711 return;
1712 }
1713
1714 memcpy(status,p,21);
1715
1716 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1717 /* Close the dptr - we know it's gone */
1718 dptr_close(sconn, &dptr_num);
1719 }
1720
1721 reply_outbuf(req, 1, 0);
1722 SSVAL(req->outbuf,smb_vwv0,0);
1723
1724 DEBUG(3,("search close\n"));
1725
1726 END_PROFILE(SMBfclose);
1727 return;
1728 }
1729
1730 /****************************************************************************
1731 Reply to an open.
1732 ****************************************************************************/
1733
1734 void reply_open(struct smb_request *req)
1735 {
1736 connection_struct *conn = req->conn;
1737 struct smb_filename *smb_fname = NULL;
1738 char *fname = NULL;
1739 uint32 fattr=0;
1740 SMB_OFF_T size = 0;
1741 time_t mtime=0;
1742 int info;
1743 files_struct *fsp;
1744 int oplock_request;
1745 int deny_mode;
1746 uint32 dos_attr;
1747 uint32 access_mask;
1748 uint32 share_mode;
1749 uint32 create_disposition;
1750 uint32 create_options = 0;
1751 uint32_t private_flags = 0;
1752 NTSTATUS status;
1753 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1754 TALLOC_CTX *ctx = talloc_tos();
1755
1756 START_PROFILE(SMBopen);
1757
1758 if (req->wct < 2) {
1759 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1760 goto out;
1761 }
1762
1763 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1764 deny_mode = SVAL(req->vwv+0, 0);
1765 dos_attr = SVAL(req->vwv+1, 0);
1766
1767 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1768 STR_TERMINATE, &status);
1769 if (!NT_STATUS_IS_OK(status)) {
1770 reply_nterror(req, status);
1771 goto out;
1772 }
1773
1774 status = filename_convert(ctx,
1775 conn,
1776 req->flags2 & FLAGS2_DFS_PATHNAMES,
1777 fname,
1778 0,
1779 NULL,
1780 &smb_fname);
1781 if (!NT_STATUS_IS_OK(status)) {
1782 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1783 reply_botherror(req,
1784 NT_STATUS_PATH_NOT_COVERED,
1785 ERRSRV, ERRbadpath);
1786 goto out;
1787 }
1788 reply_nterror(req, status);
1789 goto out;
1790 }
1791
1792 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1793 OPENX_FILE_EXISTS_OPEN, &access_mask,
1794 &share_mode, &create_disposition,
1795 &create_options, &private_flags)) {
1796 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1797 goto out;
1798 }
1799
1800 status = SMB_VFS_CREATE_FILE(
1801 conn, /* conn */
1802 req, /* req */
1803 0, /* root_dir_fid */
1804 smb_fname, /* fname */
1805 access_mask, /* access_mask */
1806 share_mode, /* share_access */
1807 create_disposition, /* create_disposition*/
1808 create_options, /* create_options */
1809 dos_attr, /* file_attributes */
1810 oplock_request, /* oplock_request */
1811 0, /* allocation_size */
1812 private_flags,
1813 NULL, /* sd */
1814 NULL, /* ea_list */
1815 &fsp, /* result */
1816 &info); /* pinfo */
1817
1818 if (!NT_STATUS_IS_OK(status)) {
1819 if (open_was_deferred(req->sconn, req->mid)) {
1820 /* We have re-scheduled this call. */
1821 goto out;
1822 }
1823 reply_openerror(req, status);
1824 goto out;
1825 }
1826
1827 size = smb_fname->st.st_ex_size;
1828 fattr = dos_mode(conn, smb_fname);
1829
1830 /* Deal with other possible opens having a modified
1831 write time. JRA. */
1832 if (ask_sharemode) {
1833 struct timespec write_time_ts;
1834
1835 ZERO_STRUCT(write_time_ts);
1836 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1837 if (!null_timespec(write_time_ts)) {
1838 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1839 }
1840 }
1841
1842 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1843
1844 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1845 DEBUG(3,("attempt to open a directory %s\n",
1846 fsp_str_dbg(fsp)));
1847 close_file(req, fsp, ERROR_CLOSE);
1848 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1849 ERRDOS, ERRnoaccess);
1850 goto out;
1851 }
1852
1853 reply_outbuf(req, 7, 0);
1854 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1855 SSVAL(req->outbuf,smb_vwv1,fattr);
1856 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1857 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1858 } else {
1859 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1860 }
1861 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1862 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1863
1864 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1865 SCVAL(req->outbuf,smb_flg,
1866 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1867 }
1868
1869 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1870 SCVAL(req->outbuf,smb_flg,
1871 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1872 }
1873 out:
1874 TALLOC_FREE(smb_fname);
1875 END_PROFILE(SMBopen);
1876 return;
1877 }
1878
1879 /****************************************************************************
1880 Reply to an open and X.
1881 ****************************************************************************/
1882
1883 void reply_open_and_X(struct smb_request *req)
1884 {
1885 connection_struct *conn = req->conn;
1886 struct smb_filename *smb_fname = NULL;
1887 char *fname = NULL;
1888 uint16 open_flags;
1889 int deny_mode;
1890 uint32 smb_attr;
1891 /* Breakout the oplock request bits so we can set the
1892 reply bits separately. */
1893 int ex_oplock_request;
1894 int core_oplock_request;
1895 int oplock_request;
1896 #if 0
1897 int smb_sattr = SVAL(req->vwv+4, 0);
1898 uint32 smb_time = make_unix_date3(req->vwv+6);
1899 #endif
1900 int smb_ofun;
1901 uint32 fattr=0;
1902 int mtime=0;
1903 int smb_action = 0;
1904 files_struct *fsp;
1905 NTSTATUS status;
1906 uint64_t allocation_size;
1907 ssize_t retval = -1;
1908 uint32 access_mask;
1909 uint32 share_mode;
1910 uint32 create_disposition;
1911 uint32 create_options = 0;
1912 uint32_t private_flags = 0;
1913 TALLOC_CTX *ctx = talloc_tos();
1914
1915 START_PROFILE(SMBopenX);
1916
1917 if (req->wct < 15) {
1918 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1919 goto out;
1920 }
1921
1922 open_flags = SVAL(req->vwv+2, 0);
1923 deny_mode = SVAL(req->vwv+3, 0);
1924 smb_attr = SVAL(req->vwv+5, 0);
1925 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1926 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1927 oplock_request = ex_oplock_request | core_oplock_request;
1928 smb_ofun = SVAL(req->vwv+8, 0);
1929 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1930
1931 /* If it's an IPC, pass off the pipe handler. */
1932 if (IS_IPC(conn)) {
1933 if (lp_nt_pipe_support()) {
1934 reply_open_pipe_and_X(conn, req);
1935 } else {
1936 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1937 }
1938 goto out;
1939 }
1940
1941 /* XXXX we need to handle passed times, sattr and flags */
1942 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1943 STR_TERMINATE, &status);
1944 if (!NT_STATUS_IS_OK(status)) {
1945 reply_nterror(req, status);
1946 goto out;
1947 }
1948
1949 status = filename_convert(ctx,
1950 conn,
1951 req->flags2 & FLAGS2_DFS_PATHNAMES,
1952 fname,
1953 0,
1954 NULL,
1955 &smb_fname);
1956 if (!NT_STATUS_IS_OK(status)) {
1957 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1958 reply_botherror(req,
1959 NT_STATUS_PATH_NOT_COVERED,
1960 ERRSRV, ERRbadpath);
1961 goto out;
1962 }
1963 reply_nterror(req, status);
1964 goto out;
1965 }
1966
1967 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1968 smb_ofun,
1969 &access_mask, &share_mode,
1970 &create_disposition,
1971 &create_options,
1972 &private_flags)) {
1973 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1974 goto out;
1975 }
1976
1977 status = SMB_VFS_CREATE_FILE(
1978 conn, /* conn */
1979 req, /* req */
1980 0, /* root_dir_fid */
1981 smb_fname, /* fname */
1982 access_mask, /* access_mask */
1983 share_mode, /* share_access */
1984 create_disposition, /* create_disposition*/
1985 create_options, /* create_options */
1986 smb_attr, /* file_attributes */
1987 oplock_request, /* oplock_request */
1988 0, /* allocation_size */
1989 private_flags,
1990 NULL, /* sd */
1991 NULL, /* ea_list */
1992 &fsp, /* result */
1993 &smb_action); /* pinfo */
1994
1995 if (!NT_STATUS_IS_OK(status)) {
1996 if (open_was_deferred(req->sconn, req->mid)) {
1997 /* We have re-scheduled this call. */
1998 goto out;
1999 }
2000 reply_openerror(req, status);
2001 goto out;
2002 }
2003
2004 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2005 if the file is truncated or created. */
2006 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2007 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2008 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2009 close_file(req, fsp, ERROR_CLOSE);
2010 reply_nterror(req, NT_STATUS_DISK_FULL);
2011 goto out;
2012 }
2013 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
2014 if (retval < 0) {
2015 close_file(req, fsp, ERROR_CLOSE);
2016 reply_nterror(req, NT_STATUS_DISK_FULL);
2017 goto out;
2018 }
2019 status = vfs_stat_fsp(fsp);
2020 if (!NT_STATUS_IS_OK(status)) {
2021 close_file(req, fsp, ERROR_CLOSE);
2022 reply_nterror(req, status);
2023 goto out;
2024 }
2025 }
2026
2027 fattr = dos_mode(conn, fsp->fsp_name);
2028 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2029 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2030 close_file(req, fsp, ERROR_CLOSE);
2031 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2032 goto out;
2033 }
2034
2035 /* If the caller set the extended oplock request bit
2036 and we granted one (by whatever means) - set the
2037 correct bit for extended oplock reply.
2038 */
2039
2040 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2041 smb_action |= EXTENDED_OPLOCK_GRANTED;
2042 }
2043
2044 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2045 smb_action |= EXTENDED_OPLOCK_GRANTED;
2046 }
2047
2048 /* If the caller set the core oplock request bit
2049 and we granted one (by whatever means) - set the
2050 correct bit for core oplock reply.
2051 */
2052
2053 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2054 reply_outbuf(req, 19, 0);
2055 } else {
2056 reply_outbuf(req, 15, 0);
2057 }
2058
2059 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2060 SCVAL(req->outbuf, smb_flg,
2061 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2062 }
2063
2064 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2065 SCVAL(req->outbuf, smb_flg,
2066 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2067 }
2068
2069 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2070 SSVAL(req->outbuf,smb_vwv3,fattr);
2071 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2072 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2073 } else {
2074 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2075 }
2076 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2077 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2078 SSVAL(req->outbuf,smb_vwv11,smb_action);
2079
2080 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2081 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2082 }
2083
2084 chain_reply(req);
2085 out:
2086 TALLOC_FREE(smb_fname);
2087 END_PROFILE(SMBopenX);
2088 return;
2089 }
2090
2091 /****************************************************************************
2092 Reply to a SMBulogoffX.
2093 ****************************************************************************/
2094
2095 void reply_ulogoffX(struct smb_request *req)
2096 {
2097 struct smbd_server_connection *sconn = req->sconn;
2098 user_struct *vuser;
2099
2100 START_PROFILE(SMBulogoffX);
2101
2102 vuser = get_valid_user_struct(sconn, req->vuid);
2103
2104 if(vuser == NULL) {
2105 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2106 req->vuid));
2107 }
2108
2109 /* in user level security we are supposed to close any files
2110 open by this user */
2111 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2112 file_close_user(sconn, req->vuid);
2113 }
2114
2115 invalidate_vuid(sconn, req->vuid);
2116
2117 reply_outbuf(req, 2, 0);
2118
2119 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2120
2121 END_PROFILE(SMBulogoffX);
2122 req->vuid = UID_FIELD_INVALID;
2123 chain_reply(req);
2124 }
2125
2126 /****************************************************************************
2127 Reply to a mknew or a create.
2128 ****************************************************************************/
2129
2130 void reply_mknew(struct smb_request *req)
2131 {
2132 connection_struct *conn = req->conn;
2133 struct smb_filename *smb_fname = NULL;
2134 char *fname = NULL;
2135 uint32 fattr = 0;
2136 struct smb_file_time ft;
2137 files_struct *fsp;
2138 int oplock_request = 0;
2139 NTSTATUS status;
2140 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2141 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2142 uint32 create_disposition;
2143 uint32 create_options = 0;
2144 TALLOC_CTX *ctx = talloc_tos();
2145
2146 START_PROFILE(SMBcreate);
2147 ZERO_STRUCT(ft);
2148
2149 if (req->wct < 3) {
2150 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2151 goto out;
2152 }
2153
2154 fattr = SVAL(req->vwv+0, 0);
2155 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2156
2157 /* mtime. */
2158 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2159
2160 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2161 STR_TERMINATE, &status);
2162 if (!NT_STATUS_IS_OK(status)) {
2163 reply_nterror(req, status);
2164 goto out;
2165 }
2166
2167 status = filename_convert(ctx,
2168 conn,
2169 req->flags2 & FLAGS2_DFS_PATHNAMES,
2170 fname,
2171 0,
2172 NULL,
2173 &smb_fname);
2174 if (!NT_STATUS_IS_OK(status)) {
2175 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2176 reply_botherror(req,
2177 NT_STATUS_PATH_NOT_COVERED,
2178 ERRSRV, ERRbadpath);
2179 goto out;
2180 }
2181 reply_nterror(req, status);
2182 goto out;
2183 }
2184
2185 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2186 DEBUG(0,("Attempt to create file (%s) with volid set - "
2187 "please report this\n",
2188 smb_fname_str_dbg(smb_fname)));
2189 }
2190
2191 if(req->cmd == SMBmknew) {
2192 /* We should fail if file exists. */
2193 create_disposition = FILE_CREATE;
2194 } else {
2195 /* Create if file doesn't exist, truncate if it does. */
2196 create_disposition = FILE_OVERWRITE_IF;
2197 }
2198
2199 status = SMB_VFS_CREATE_FILE(
2200 conn, /* conn */
2201 req, /* req */
2202 0, /* root_dir_fid */
2203 smb_fname, /* fname */
2204 access_mask, /* access_mask */
2205 share_mode, /* share_access */
2206 create_disposition, /* create_disposition*/
2207 create_options, /* create_options */
2208 fattr, /* file_attributes */
2209 oplock_request, /* oplock_request */
2210 0, /* allocation_size */
2211 0, /* private_flags */
2212 NULL, /* sd */
2213 NULL, /* ea_list */
2214 &fsp, /* result */
2215 NULL); /* pinfo */
2216
2217 if (!NT_STATUS_IS_OK(status)) {
2218 if (open_was_deferred(req->sconn, req->mid)) {
2219 /* We have re-scheduled this call. */
2220 goto out;
2221 }
2222 reply_openerror(req, status);
2223 goto out;
2224 }
2225
2226 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2227 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2228 if (!NT_STATUS_IS_OK(status)) {
2229 END_PROFILE(SMBcreate);
2230 goto out;
2231 }
2232
2233 reply_outbuf(req, 1, 0);
2234 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2235
2236 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2237 SCVAL(req->outbuf,smb_flg,
2238 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2239 }
2240
2241 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2242 SCVAL(req->outbuf,smb_flg,
2243 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2244 }
2245
2246 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2247 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2248 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2249 (unsigned int)fattr));
2250
2251 out:
2252 TALLOC_FREE(smb_fname);
2253 END_PROFILE(SMBcreate);
2254 return;
2255 }
2256
2257 /****************************************************************************
2258 Reply to a create temporary file.
2259 ****************************************************************************/
2260
2261 void reply_ctemp(struct smb_request *req)
2262 {
2263 connection_struct *conn = req->conn;
2264 struct smb_filename *smb_fname = NULL;
2265 char *fname = NULL;
2266 uint32 fattr;
2267 files_struct *fsp;
2268 int oplock_request;
2269 int tmpfd;
2270 char *s;
2271 NTSTATUS status;
2272 TALLOC_CTX *ctx = talloc_tos();
2273
2274 START_PROFILE(SMBctemp);
2275
2276 if (req->wct < 3) {
2277 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2278 goto out;
2279 }
2280
2281 fattr = SVAL(req->vwv+0, 0);
2282 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2283
2284 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2285 STR_TERMINATE, &status);
2286 if (!NT_STATUS_IS_OK(status)) {
2287 reply_nterror(req, status);
2288 goto out;
2289 }
2290 if (*fname) {
2291 fname = talloc_asprintf(ctx,
2292 "%s/TMXXXXXX",
2293 fname);
2294 } else {
2295 fname = talloc_strdup(ctx, "TMXXXXXX");
2296 }
2297
2298 if (!fname) {
2299 reply_nterror(req, NT_STATUS_NO_MEMORY);
2300 goto out;
2301 }
2302
2303 status = filename_convert(ctx, conn,
2304 req->flags2 & FLAGS2_DFS_PATHNAMES,
2305 fname,
2306 0,
2307 NULL,
2308 &smb_fname);
2309 if (!NT_STATUS_IS_OK(status)) {
2310 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2311 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2312 ERRSRV, ERRbadpath);
2313 goto out;
2314 }
2315 reply_nterror(req, status);
2316 goto out;
2317 }
2318
2319 tmpfd = mkstemp(smb_fname->base_name);
2320 if (tmpfd == -1) {
2321 reply_nterror(req, map_nt_error_from_unix(errno));
2322 goto out;
2323 }
2324
2325 SMB_VFS_STAT(conn, smb_fname);
2326
2327 /* We should fail if file does not exist. */
2328 status = SMB_VFS_CREATE_FILE(
2329 conn, /* conn */
2330 req, /* req */
2331 0, /* root_dir_fid */
2332 smb_fname, /* fname */
2333 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2334 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2335 FILE_OPEN, /* create_disposition*/
2336 0, /* create_options */
2337 fattr, /* file_attributes */
2338 oplock_request, /* oplock_request */
2339 0, /* allocation_size */
2340 0, /* private_flags */
2341 NULL, /* sd */
2342 NULL, /* ea_list */
2343 &fsp, /* result */
2344 NULL); /* pinfo */
2345
2346 /* close fd from mkstemp() */
2347 close(tmpfd);
2348
2349 if (!NT_STATUS_IS_OK(status)) {
2350 if (open_was_deferred(req->sconn, req->mid)) {
2351 /* We have re-scheduled this call. */
2352 goto out;
2353 }
2354 reply_openerror(req, status);
2355 goto out;
2356 }
2357
2358 reply_outbuf(req, 1, 0);
2359 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2360
2361 /* the returned filename is relative to the directory */
2362 s = strrchr_m(fsp->fsp_name->base_name, '/');
2363 if (!s) {
2364 s = fsp->fsp_name->base_name;
2365 } else {
2366 s++;
2367 }
2368
2369 #if 0
2370 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2371 thing in the byte section. JRA */
2372 SSVALS(p, 0, -1); /* what is this? not in spec */
2373 #endif
2374 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2375 == -1) {
2376 reply_nterror(req, NT_STATUS_NO_MEMORY);
2377 goto out;
2378 }
2379
2380 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2381 SCVAL(req->outbuf, smb_flg,
2382 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2383 }
2384
2385 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2386 SCVAL(req->outbuf, smb_flg,
2387 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2388 }
2389
2390 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2391 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2392 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2393 out:
2394 TALLOC_FREE(smb_fname);
2395 END_PROFILE(SMBctemp);
2396 return;
2397 }
2398
2399 /*******************************************************************
2400 Check if a user is allowed to rename a file.
2401 ********************************************************************/
2402
2403 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2404 uint16 dirtype)
2405 {
2406 if (!CAN_WRITE(conn)) {
2407 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2408 }
2409
2410 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2411 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2412 /* Only bother to read the DOS attribute if we might deny the
2413 rename on the grounds of attribute missmatch. */
2414 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2415 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2416 return NT_STATUS_NO_SUCH_FILE;
2417 }
2418 }
2419
2420 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2421 if (fsp->posix_open) {
2422 return NT_STATUS_OK;
2423 }
2424
2425 /* If no pathnames are open below this
2426 directory, allow the rename. */
2427
2428 if (file_find_subpath(fsp)) {
2429 return NT_STATUS_ACCESS_DENIED;
2430 }
2431 return NT_STATUS_OK;
2432 }
2433
2434 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2435 return NT_STATUS_OK;
2436 }
2437
2438 return NT_STATUS_ACCESS_DENIED;
2439 }
2440
2441 /*******************************************************************
2442 * unlink a file with all relevant access checks
2443 *******************************************************************/
2444
2445 static NTSTATUS do_unlink(connection_struct *conn,
2446 struct smb_request *req,
2447 struct smb_filename *smb_fname,
2448 uint32 dirtype)
2449 {
2450 uint32 fattr;
2451 files_struct *fsp;
2452 uint32 dirtype_orig = dirtype;
2453 NTSTATUS status;
2454 int ret;
2455 bool posix_paths = lp_posix_pathnames();
2456
2457 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2458 smb_fname_str_dbg(smb_fname),
2459 dirtype));
2460
2461 if (!CAN_WRITE(conn)) {
2462 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2463 }
2464
2465 if (posix_paths) {
2466 ret = SMB_VFS_LSTAT(conn, smb_fname);
2467 } else {
2468 ret = SMB_VFS_STAT(conn, smb_fname);
2469 }
2470 if (ret != 0) {
2471 return map_nt_error_from_unix(errno);
2472 }
2473
2474 fattr = dos_mode(conn, smb_fname);
2475
2476 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2477 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2478 }
2479
2480 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2481 if (!dirtype) {
2482 return NT_STATUS_NO_SUCH_FILE;
2483 }
2484
2485 if (!dir_check_ftype(conn, fattr, dirtype)) {
2486 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2487 return NT_STATUS_FILE_IS_A_DIRECTORY;
2488 }
2489 return NT_STATUS_NO_SUCH_FILE;
2490 }
2491
2492 if (dirtype_orig & 0x8000) {
2493 /* These will never be set for POSIX. */
2494 return NT_STATUS_NO_SUCH_FILE;
2495 }
2496
2497 #if 0
2498 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2499 return NT_STATUS_FILE_IS_A_DIRECTORY;
2500 }
2501
2502 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2503 return NT_STATUS_NO_SUCH_FILE;
2504 }
2505
2506 if (dirtype & 0xFF00) {
2507 /* These will never be set for POSIX. */
2508 return NT_STATUS_NO_SUCH_FILE;
2509 }
2510
2511 dirtype &= 0xFF;
2512 if (!dirtype) {
2513 return NT_STATUS_NO_SUCH_FILE;
2514 }
2515
2516 /* Can't delete a directory. */
2517 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2518 return NT_STATUS_FILE_IS_A_DIRECTORY;
2519 }
2520 #endif
2521
2522 #if 0 /* JRATEST */
2523 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2524 return NT_STATUS_OBJECT_NAME_INVALID;
2525 #endif /* JRATEST */
2526
2527 /* On open checks the open itself will check the share mode, so
2528 don't do it here as we'll get it wrong. */
2529
2530 status = SMB_VFS_CREATE_FILE
2531 (conn, /* conn */
2532 req, /* req */
2533 0, /* root_dir_fid */
2534 smb_fname, /* fname */
2535 DELETE_ACCESS, /* access_mask */
2536 FILE_SHARE_NONE, /* share_access */
2537 FILE_OPEN, /* create_disposition*/
2538 FILE_NON_DIRECTORY_FILE, /* create_options */
2539 /* file_attributes */
2540 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2541 FILE_ATTRIBUTE_NORMAL,
2542 0, /* oplock_request */
2543 0, /* allocation_size */
2544 0, /* private_flags */
2545 NULL, /* sd */
2546 NULL, /* ea_list */
2547 &fsp, /* result */
2548 NULL); /* pinfo */
2549
2550 if (!NT_STATUS_IS_OK(status)) {
2551 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2552 nt_errstr(status)));
2553 return status;
2554 }
2555
2556 status = can_set_delete_on_close(fsp, fattr);
2557 if (!NT_STATUS_IS_OK(status)) {
2558 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2559 "(%s)\n",
2560 smb_fname_str_dbg(smb_fname),
2561 nt_errstr(status)));
2562 close_file(req, fsp, NORMAL_CLOSE);
2563 return status;
2564 }
2565
2566 /* The set is across all open files on this dev/inode pair. */
2567 if (!set_delete_on_close(fsp, True, conn->session_info->unix_token)) {
2568 close_file(req, fsp, NORMAL_CLOSE);
2569 return NT_STATUS_ACCESS_DENIED;
2570 }
2571
2572 return close_file(req, fsp, NORMAL_CLOSE);
2573 }
2574
2575 /****************************************************************************
2576 The guts of the unlink command, split out so it may be called by the NT SMB
2577 code.
2578 ****************************************************************************/
2579
2580 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2581 uint32 dirtype, struct smb_filename *smb_fname,
2582 bool has_wild)
2583 {
2584 char *fname_dir = NULL;
2585 char *fname_mask = NULL;
2586 int count=0;
2587 NTSTATUS status = NT_STATUS_OK;
2588 TALLOC_CTX *ctx = talloc_tos();
2589
2590 /* Split up the directory from the filename/mask. */
2591 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2592 &fname_dir, &fname_mask);
2593 if (!NT_STATUS_IS_OK(status)) {
2594 goto out;
2595 }
2596
2597 /*
2598 * We should only check the mangled cache
2599 * here if unix_convert failed. This means
2600 * that the path in 'mask' doesn't exist
2601 * on the file system and so we need to look
2602 * for a possible mangle. This patch from
2603 * Tine Smukavec <valentin.smukavec@hermes.si>.
2604 */
2605
2606 if (!VALID_STAT(smb_fname->st) &&
2607 mangle_is_mangled(fname_mask, conn->params)) {
2608 char *new_mask = NULL;
2609 mangle_lookup_name_from_8_3(ctx, fname_mask,
2610 &new_mask, conn->params);
2611 if (new_mask) {
2612 TALLOC_FREE(fname_mask);
2613 fname_mask = new_mask;
2614 }
2615 }
2616
2617 if (!has_wild) {
2618
2619 /*
2620 * Only one file needs to be unlinked. Append the mask back
2621 * onto the directory.
2622 */
2623 TALLOC_FREE(smb_fname->base_name);
2624 if (ISDOT(fname_dir)) {
2625 /* Ensure we use canonical names on open. */
2626 smb_fname->base_name = talloc_asprintf(smb_fname,
2627 "%s",
2628 fname_mask);
2629 } else {
2630 smb_fname->base_name = talloc_asprintf(smb_fname,
2631 "%s/%s",
2632 fname_dir,
2633 fname_mask);
2634 }
2635 if (!smb_fname->base_name) {
2636 status = NT_STATUS_NO_MEMORY;
2637 goto out;
2638 }
2639 if (dirtype == 0) {
2640 dirtype = FILE_ATTRIBUTE_NORMAL;
2641 }
2642
2643 status = check_name(conn, smb_fname->base_name);
2644 if (!NT_STATUS_IS_OK(status)) {
2645 goto out;
2646 }
2647
2648 status = do_unlink(conn, req, smb_fname, dirtype);
2649 if (!NT_STATUS_IS_OK(status)) {
2650 goto out;
2651 }
2652
2653 count++;
2654 } else {
2655 struct smb_Dir *dir_hnd = NULL;
2656 long offset = 0;
2657 const char *dname = NULL;
2658 char *talloced = NULL;
2659
2660 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2661 status = NT_STATUS_OBJECT_NAME_INVALID;
2662 goto out;
2663 }
2664
2665 if (strequal(fname_mask,"????????.???")) {
2666 TALLOC_FREE(fname_mask);
2667 fname_mask = talloc_strdup(ctx, "*");
2668 if (!fname_mask) {
2669 status = NT_STATUS_NO_MEMORY;
2670 goto out;
2671 }
2672 }
2673
2674 status = check_name(conn, fname_dir);
2675 if (!NT_STATUS_IS_OK(status)) {
2676 goto out;
2677 }
2678
2679 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2680 dirtype);
2681 if (dir_hnd == NULL) {
2682 status = map_nt_error_from_unix(errno);
2683 goto out;
2684 }
2685
2686 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2687 the pattern matches against the long name, otherwise the short name
2688 We don't implement this yet XXXX
2689 */
2690
2691 status = NT_STATUS_NO_SUCH_FILE;
2692
2693 while ((dname = ReadDirName(dir_hnd, &offset,
2694 &smb_fname->st, &talloced))) {
2695 TALLOC_CTX *frame = talloc_stackframe();
2696
2697 if (!is_visible_file(conn, fname_dir, dname,
2698 &smb_fname->st, true)) {
2699 TALLOC_FREE(frame);
2700 TALLOC_FREE(talloced);
2701 continue;
2702 }
2703
2704 /* Quick check for "." and ".." */
2705 if (ISDOT(dname) || ISDOTDOT(dname)) {
2706 TALLOC_FREE(frame);
2707 TALLOC_FREE(talloced);
2708 continue;
2709 }
2710
2711 if(!mask_match(dname, fname_mask,
2712 conn->case_sensitive)) {
2713 TALLOC_FREE(frame);
2714 TALLOC_FREE(talloced);
2715 continue;
2716 }
2717
2718 TALLOC_FREE(smb_fname->base_name);
2719 if (ISDOT(fname_dir)) {
2720 /* Ensure we use canonical names on open. */
2721 smb_fname->base_name =
2722 talloc_asprintf(smb_fname, "%s",
2723 dname);
2724 } else {
2725 smb_fname->base_name =
2726 talloc_asprintf(smb_fname, "%s/%s",
2727 fname_dir, dname);
2728 }
2729
2730 if (!smb_fname->base_name) {
2731 TALLOC_FREE(dir_hnd);
2732 status = NT_STATUS_NO_MEMORY;
2733 TALLOC_FREE(frame);
2734 TALLOC_FREE(talloced);
2735 goto out;
2736 }
2737
2738 status = check_name(conn, smb_fname->base_name);
2739 if (!NT_STATUS_IS_OK(status)) {
2740 TALLOC_FREE(dir_hnd);
2741 TALLOC_FREE(frame);
2742 TALLOC_FREE(talloced);
2743 goto out;
2744 }
2745
2746 status = do_unlink(conn, req, smb_fname, dirtype);
2747 if (!NT_STATUS_IS_OK(status)) {
2748 TALLOC_FREE(frame);
2749 TALLOC_FREE(talloced);
2750 continue;
2751 }
2752
2753 count++;
2754 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2755 smb_fname->base_name));
2756
2757 TALLOC_FREE(frame);
2758 TALLOC_FREE(talloced);
2759 }
2760 TALLOC_FREE(dir_hnd);
2761 }
2762
2763 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2764 status = map_nt_error_from_unix(errno);
2765 }
2766
2767 out:
2768 TALLOC_FREE(fname_dir);
2769 TALLOC_FREE(fname_mask);
2770 return status;
2771 }
2772
2773 /****************************************************************************
2774 Reply to a unlink
2775 ****************************************************************************/
2776
2777 void reply_unlink(struct smb_request *req)
2778 {
2779 connection_struct *conn = req->conn;
2780 char *name = NULL;
2781 struct smb_filename *smb_fname = NULL;
2782 uint32 dirtype;
2783 NTSTATUS status;
2784 bool path_contains_wcard = False;
2785 TALLOC_CTX *ctx = talloc_tos();
2786
2787 START_PROFILE(SMBunlink);
2788
2789 if (req->wct < 1) {
2790 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2791 goto out;
2792 }
2793
2794 dirtype = SVAL(req->vwv+0, 0);
2795
2796 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2797 STR_TERMINATE, &status,
2798 &path_contains_wcard);
2799 if (!NT_STATUS_IS_OK(status)) {
2800 reply_nterror(req, status);
2801 goto out;
2802 }
2803
2804 status = filename_convert(ctx, conn,
2805 req->flags2 & FLAGS2_DFS_PATHNAMES,
2806 name,
2807 UCF_COND_ALLOW_WCARD_LCOMP,
2808 &path_contains_wcard,
2809 &smb_fname);
2810 if (!NT_STATUS_IS_OK(status)) {
2811 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2812 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2813 ERRSRV, ERRbadpath);
2814 goto out;
2815 }
2816 reply_nterror(req, status);
2817 goto out;
2818 }
2819
2820 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2821
2822 status = unlink_internals(conn, req, dirtype, smb_fname,
2823 path_contains_wcard);
2824 if (!NT_STATUS_IS_OK(status)) {
2825 if (open_was_deferred(req->sconn, req->mid)) {
2826 /* We have re-scheduled this call. */
2827 goto out;
2828 }
2829 reply_nterror(req, status);
2830 goto out;
2831 }
2832
2833 reply_outbuf(req, 0, 0);
2834 out:
2835 TALLOC_FREE(smb_fname);
2836 END_PROFILE(SMBunlink);
2837 return;
2838 }
2839
2840 /****************************************************************************
2841 Fail for readbraw.
2842 ****************************************************************************/
2843
2844 static void fail_readraw(void)
2845 {
2846 const char *errstr = talloc_asprintf(talloc_tos(),
2847 "FAIL ! reply_readbraw: socket write fail (%s)",
2848 strerror(errno));
2849 if (!errstr) {
2850 errstr = "";
2851 }
2852 exit_server_cleanly(errstr);
2853 }
2854
2855 /****************************************************************************
2856 Fake (read/write) sendfile. Returns -1 on read or write fail.
2857 ****************************************************************************/
2858
2859 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2860 {
2861 size_t bufsize;
2862 size_t tosend = nread;
2863 char *buf;
2864
2865 if (nread == 0) {
2866 return 0;
2867 }
2868
2869 bufsize = MIN(nread, 65536);
2870
2871 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2872 return -1;
2873 }
2874
2875 while (tosend > 0) {
2876 ssize_t ret;
2877 size_t cur_read;
2878
2879 if (tosend > bufsize) {
2880 cur_read = bufsize;
2881 } else {
2882 cur_read = tosend;
2883 }
2884 ret = read_file(fsp,buf,startpos,cur_read);
2885 if (ret == -1) {
2886 SAFE_FREE(buf);
2887 return -1;
2888 }
2889
2890 /* If we had a short read, fill with zeros. */
2891 if (ret < cur_read) {
2892 memset(buf + ret, '\0', cur_read - ret);
2893 }
2894
2895 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2896 != cur_read) {
2897 char addr[INET6_ADDRSTRLEN];
2898 /*
2899 * Try and give an error message saying what
2900 * client failed.
2901 */
2902 DEBUG(0, ("write_data failed for client %s. "
2903 "Error %s\n",
2904 get_peer_addr(fsp->conn->sconn->sock, addr,
2905 sizeof(addr)),
2906 strerror(errno)));
2907 SAFE_FREE(buf);
2908 return -1;
2909 }
2910 tosend -= cur_read;
2911 startpos += cur_read;
2912 }
2913
2914 SAFE_FREE(buf);
2915 return (ssize_t)nread;
2916 }
2917
2918 /****************************************************************************
2919 Deal with the case of sendfile reading less bytes from the file than
2920 requested. Fill with zeros (all we can do).
2921 ****************************************************************************/
2922
2923 void sendfile_short_send(files_struct *fsp,
2924 ssize_t nread,
2925 size_t headersize,
2926 size_t smb_maxcnt)
2927 {
2928 #define SHORT_SEND_BUFSIZE 1024
2929 if (nread < headersize) {
2930 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2931 "header for file %s (%s). Terminating\n",
2932 fsp_str_dbg(fsp), strerror(errno)));
2933 exit_server_cleanly("sendfile_short_send failed");
2934 }
2935
2936 nread -= headersize;
2937
2938 if (nread < smb_maxcnt) {
2939 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2940 if (!buf) {
2941 exit_server_cleanly("sendfile_short_send: "
2942 "malloc failed");
2943 }
2944
2945 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2946 "with zeros !\n", fsp_str_dbg(fsp)));
2947
2948 while (nread < smb_maxcnt) {
2949 /*
2950 * We asked for the real file size and told sendfile
2951 * to not go beyond the end of the file. But it can
2952 * happen that in between our fstat call and the
2953 * sendfile call the file was truncated. This is very
2954 * bad because we have already announced the larger
2955 * number of bytes to the client.
2956 *
2957 * The best we can do now is to send 0-bytes, just as
2958 * a read from a hole in a sparse file would do.
2959 *
2960 * This should happen rarely enough that I don't care
2961 * about efficiency here :-)
2962 */
2963 size_t to_write;
2964
2965 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2966 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2967 != to_write) {
2968 char addr[INET6_ADDRSTRLEN];
2969 /*
2970 * Try and give an error message saying what
2971 * client failed.
2972 */
2973 DEBUG(0, ("write_data failed for client %s. "
2974 "Error %s\n",
2975 get_peer_addr(
2976 fsp->conn->sconn->sock, addr,
2977 sizeof(addr)),
2978 strerror(errno)));
2979 exit_server_cleanly("sendfile_short_send: "
2980 "write_data failed");
2981 }
2982 nread += to_write;
2983 }
2984 SAFE_FREE(buf);
2985 }
2986 }
2987
2988 /****************************************************************************
2989 Return a readbraw error (4 bytes of zero).
2990 ****************************************************************************/
2991
2992 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2993 {
2994 char header[4];
2995
2996 SIVAL(header,0,0);
2997
2998 smbd_lock_socket(sconn);
2999 if (write_data(sconn->sock,header,4) != 4) {
3000 char addr[INET6_ADDRSTRLEN];
3001 /*
3002 * Try and give an error message saying what
3003 * client failed.
3004 */
3005 DEBUG(0, ("write_data failed for client %s. "
3006 "Error %s\n",
3007 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3008 strerror(errno)));
3009
3010 fail_readraw();
3011 }
3012 smbd_unlock_socket(sconn);
3013 }
3014
3015 /****************************************************************************
3016 Use sendfile in readbraw.
3017 ****************************************************************************/
3018
3019 static void send_file_readbraw(connection_struct *conn,
3020 struct smb_request *req,
3021 files_struct *fsp,
3022 SMB_OFF_T startpos,
3023 size_t nread,
3024 ssize_t mincount)
3025 {
3026 struct smbd_server_connection *sconn = req->sconn;
3027 char *outbuf = NULL;
3028 ssize_t ret=0;
3029
3030 /*
3031 * We can only use sendfile on a non-chained packet
3032 * but we can use on a non-oplocked file. tridge proved this
3033 * on a train in Germany :-). JRA.
3034 * reply_readbraw has already checked the length.
3035 */
3036
3037 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3038 (fsp->wcp == NULL) &&
3039 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3040 ssize_t sendfile_read = -1;
3041 char header[4];
3042 DATA_BLOB header_blob;
3043
3044 _smb_setlen(header,nread);
3045 header_blob = data_blob_const(header, 4);
3046
3047 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3048 &header_blob, startpos,
3049 nread);
3050 if (sendfile_read == -1) {
3051 /* Returning ENOSYS means no data at all was sent.
3052 * Do this as a normal read. */
3053 if (errno == ENOSYS) {
3054 goto normal_readbraw;
3055 }
3056
3057 /*
3058 * Special hack for broken Linux with no working sendfile. If we
3059 * return EINTR we sent the header but not the rest of the data.
3060 * Fake this up by doing read/write calls.
3061 */
3062 if (errno == EINTR) {
3063 /* Ensure we don't do this again. */
3064 set_use_sendfile(SNUM(conn), False);
3065 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3066
3067 if (fake_sendfile(fsp, startpos, nread) == -1) {
3068 DEBUG(0,("send_file_readbraw: "
3069 "fake_sendfile failed for "
3070 "file %s (%s).\n",
3071 fsp_str_dbg(fsp),
3072 strerror(errno)));
3073 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3074 }
3075 return;
3076 }
3077
3078 DEBUG(0,("send_file_readbraw: sendfile failed for "
3079 "file %s (%s). Terminating\n",
3080 fsp_str_dbg(fsp), strerror(errno)));
3081 exit_server_cleanly("send_file_readbraw sendfile failed");
3082 } else if (sendfile_read == 0) {
3083 /*
3084 * Some sendfile implementations return 0 to indicate
3085 * that there was a short read, but nothing was
3086 * actually written to the socket. In this case,
3087 * fallback to the normal read path so the header gets
3088 * the correct byte count.
3089 */
3090 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3091 "bytes falling back to the normal read: "
3092 "%s\n", fsp_str_dbg(fsp)));
3093 goto normal_readbraw;
3094 }
3095
3096 /* Deal with possible short send. */
3097 if (sendfile_read != 4+nread) {
3098 sendfile_short_send(fsp, sendfile_read, 4, nread);
3099 }
3100 return;
3101 }
3102
3103 normal_readbraw:
3104
3105 outbuf = talloc_array(NULL, char, nread+4);
3106 if (!outbuf) {
3107 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3108 (unsigned)(nread+4)));
3109 reply_readbraw_error(sconn);
3110 return;
3111 }
3112
3113 if (nread > 0) {
3114 ret = read_file(fsp,outbuf+4,startpos,nread);
3115 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3116 if (ret < mincount)
3117 ret = 0;
3118 #else
3119 if (ret < nread)
3120 ret = 0;
3121 #endif
3122 }
3123
3124 _smb_setlen(outbuf,ret);
3125 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3126 char addr[INET6_ADDRSTRLEN];
3127 /*
3128 * Try and give an error message saying what
3129 * client failed.
3130 */
3131 DEBUG(0, ("write_data failed for client %s. "
3132 "Error %s\n",
3133 get_peer_addr(fsp->conn->sconn->sock, addr,
3134 sizeof(addr)),
3135 strerror(errno)));
3136
3137 fail_readraw();
3138 }
3139
3140 TALLOC_FREE(outbuf);
3141 }
3142
3143 /****************************************************************************
3144 Reply to a readbraw (core+ protocol).
3145 ****************************************************************************/
3146
3147 void reply_readbraw(struct smb_request *req)
3148 {
3149 connection_struct *conn = req->conn;
3150 struct smbd_server_connection *sconn = req->sconn;
3151 ssize_t maxcount,mincount;
3152 size_t nread = 0;
3153 SMB_OFF_T startpos;
3154 files_struct *fsp;
3155 struct lock_struct lock;
3156 SMB_OFF_T size = 0;
3157
3158 START_PROFILE(SMBreadbraw);
3159
3160 if (srv_is_signing_active(sconn) ||
3161 is_encrypted_packet(sconn, req->inbuf)) {
3162 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3163 "raw reads/writes are disallowed.");
3164 }
3165
3166 if (req->wct < 8) {
3167 reply_readbraw_error(sconn);
3168 END_PROFILE(SMBreadbraw);
3169 return;
3170 }
3171
3172 if (sconn->smb1.echo_handler.trusted_fde) {
3173 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3174 "'async smb echo handler = yes'\n"));
3175 reply_readbraw_error(sconn);
3176 END_PROFILE(SMBreadbraw);
3177 return;
3178 }
3179
3180 /*
3181 * Special check if an oplock break has been issued
3182 * and the readraw request croses on the wire, we must
3183 * return a zero length response here.
3184 */
3185
3186 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3187
3188 /*
3189 * We have to do a check_fsp by hand here, as
3190 * we must always return 4 zero bytes on error,
3191 * not a NTSTATUS.
3192 */
3193
3194 if (!fsp || !conn || conn != fsp->conn ||
3195 req->vuid != fsp->vuid ||
3196 fsp->is_directory || fsp->fh->fd == -1) {
3197 /*
3198 * fsp could be NULL here so use the value from the packet. JRA.
3199 */
3200 DEBUG(3,("reply_readbraw: fnum %d not valid "
3201 "- cache prime?\n",
3202 (int)SVAL(req->vwv+0, 0)));
3203 reply_readbraw_error(sconn);
3204 END_PROFILE(SMBreadbraw);
3205 return;
3206 }
3207
3208 /* Do a "by hand" version of CHECK_READ. */
3209 if (!(fsp->can_read ||
3210 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3211 (fsp->access_mask & FILE_EXECUTE)))) {
3212 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3213 (int)SVAL(req->vwv+0, 0)));
3214 reply_readbraw_error(sconn);
3215 END_PROFILE(SMBreadbraw);
3216 return;
3217 }
3218
3219 flush_write_cache(fsp, READRAW_FLUSH);
3220
3221 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3222 if(req->wct == 10) {
3223 /*
3224 * This is a large offset (64 bit) read.
3225 */
3226 #ifdef LARGE_SMB_OFF_T
3227
3228 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3229
3230 #else /* !LARGE_SMB_OFF_T */
3231
3232 /*
3233 * Ensure we haven't been sent a >32 bit offset.
3234 */
3235
3236 if(IVAL(req->vwv+8, 0) != 0) {
3237 DEBUG(0,("reply_readbraw: large offset "
3238 "(%x << 32) used and we don't support "
3239 "64 bit offsets.\n",
3240 (unsigned int)IVAL(req->vwv+8, 0) ));
3241 reply_readbraw_error(sconn);
3242 END_PROFILE(SMBreadbraw);
3243 return;
3244 }
3245
3246 #endif /* LARGE_SMB_OFF_T */
3247
3248 if(startpos < 0) {
3249 DEBUG(0,("reply_readbraw: negative 64 bit "
3250 "readraw offset (%.0f) !\n",
3251 (double)startpos ));
3252 reply_readbraw_error(sconn);
3253 END_PROFILE(SMBreadbraw);
3254 return;
3255 }
3256 }
3257
3258 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3259 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3260
3261 /* ensure we don't overrun the packet size */
3262 maxcount = MIN(65535,maxcount);
3263
3264 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3265 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3266 &lock);
3267
3268 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3269 reply_readbraw_error(sconn);
3270 END_PROFILE(SMBreadbraw);
3271 return;
3272 }
3273
3274 if (fsp_stat(fsp) == 0) {
3275 size = fsp->fsp_name->st.st_ex_size;
3276 }
3277
3278 if (startpos >= size) {
3279 nread = 0;
3280 } else {
3281 nread = MIN(maxcount,(size - startpos));
3282 }
3283
3284 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3285 if (nread < mincount)
3286 nread = 0;
3287 #endif
3288
3289 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3290 "min=%lu nread=%lu\n",
3291 fsp->fnum, (double)startpos,
3292 (unsigned long)maxcount,
3293 (unsigned long)mincount,
3294 (unsigned long)nread ) );
3295
3296 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3297
3298 DEBUG(5,("reply_readbraw finished\n"));
3299
3300 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3301
3302 END_PROFILE(SMBreadbraw);
3303 return;
3304 }
3305
3306 #undef DBGC_CLASS
3307 #define DBGC_CLASS DBGC_LOCKING
3308
3309 /****************************************************************************
3310 Reply to a lockread (core+ protocol).
3311 ****************************************************************************/
3312
3313 void reply_lockread(struct smb_request *req)
3314 {
3315 connection_struct *conn = req->conn;
3316 ssize_t nread = -1;
3317 char *data;
3318 SMB_OFF_T startpos;
3319 size_t numtoread;
3320 NTSTATUS status;
3321 files_struct *fsp;
3322 struct byte_range_lock *br_lck = NULL;
3323 char *p = NULL;
3324 struct smbd_server_connection *sconn = req->sconn;
3325
3326 START_PROFILE(SMBlockread);
3327
3328 if (req->wct < 5) {
3329 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3330 END_PROFILE(SMBlockread);
3331 return;
3332 }
3333
3334 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3335
3336 if (!check_fsp(conn, req, fsp)) {
3337 END_PROFILE(SMBlockread);
3338 return;
3339 }
3340
3341 if (!CHECK_READ(fsp,req)) {
3342 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3343 END_PROFILE(SMBlockread);
3344 return;
3345 }
3346
3347 numtoread = SVAL(req->vwv+1, 0);
3348 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3349
3350 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3351
3352 reply_outbuf(req, 5, numtoread + 3);
3353
3354 data = smb_buf(req->outbuf) + 3;
3355
3356 /*
3357 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3358 * protocol request that predates the read/write lock concept.
3359 * Thus instead of asking for a read lock here we need to ask
3360 * for a write lock. JRA.
3361 * Note that the requested lock size is unaffected by max_recv.
3362 */
3363
3364 br_lck = do_lock(req->sconn->msg_ctx,
3365 fsp,
3366 (uint64_t)req->smbpid,
3367 (uint64_t)numtoread,
3368 (uint64_t)startpos,
3369 WRITE_LOCK,
3370 WINDOWS_LOCK,
3371 False, /* Non-blocking lock. */
3372 &status,
3373 NULL,
3374 NULL);
3375 TALLOC_FREE(br_lck);
3376
3377 if (NT_STATUS_V(status)) {
3378 reply_nterror(req, status);
3379 END_PROFILE(SMBlockread);
3380 return;
3381 }
3382
3383 /*
3384 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3385 */
3386
3387 if (numtoread > sconn->smb1.negprot.max_recv) {
3388 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3389 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3390 (unsigned int)numtoread,
3391 (unsigned int)sconn->smb1.negprot.max_recv));
3392 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3393 }
3394 nread = read_file(fsp,data,startpos,numtoread);
3395
3396 if (nread < 0) {
3397 reply_nterror(req, map_nt_error_from_unix(errno));
3398 END_PROFILE(SMBlockread);
3399 return;
3400 }
3401
3402 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3403
3404 SSVAL(req->outbuf,smb_vwv0,nread);
3405 SSVAL(req->outbuf,smb_vwv5,nread+3);
3406 p = smb_buf(req->outbuf);
3407 SCVAL(p,0,0); /* pad byte. */
3408 SSVAL(p,1,nread);
3409
3410 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3411 fsp->fnum, (int)numtoread, (int)nread));
3412
3413 END_PROFILE(SMBlockread);
3414 return;
3415 }
3416
3417 #undef DBGC_CLASS
3418 #define DBGC_CLASS DBGC_ALL
3419
3420 /****************************************************************************
3421 Reply to a read.
3422 ****************************************************************************/
3423
3424 void reply_read(struct smb_request *req)
3425 {
3426 connection_struct *conn = req->conn;
3427 size_t numtoread;
3428 ssize_t nread = 0;
3429 char *data;
3430 SMB_OFF_T startpos;
3431 int outsize = 0;
3432 files_struct *fsp;
3433 struct lock_struct lock;
3434 struct smbd_server_connection *sconn = req->sconn;
3435
3436 START_PROFILE(SMBread);
3437
3438 if (req->wct < 3) {
3439 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3440 END_PROFILE(SMBread);
3441 return;
3442 }
3443
3444 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3445
3446 if (!check_fsp(conn, req, fsp)) {
3447 END_PROFILE(SMBread);
3448 return;
3449 }
3450
3451 if (!CHECK_READ(fsp,req)) {
3452 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3453 END_PROFILE(SMBread);
3454 return;
3455 }
3456
3457 numtoread = SVAL(req->vwv+1, 0);
3458 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3459
3460 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3461
3462 /*
3463 * The requested read size cannot be greater than max_recv. JRA.
3464 */
3465 if (numtoread > sconn->smb1.negprot.max_recv) {
3466 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3467 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3468 (unsigned int)numtoread,
3469 (unsigned int)sconn->smb1.negprot.max_recv));
3470 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3471 }
3472
3473 reply_outbuf(req, 5, numtoread+3);
3474
3475 data = smb_buf(req->outbuf) + 3;
3476
3477 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3478 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3479 &lock);
3480
3481 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3482 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3483 END_PROFILE(SMBread);
3484 return;
3485 }
3486
3487 if (numtoread > 0)
3488 nread = read_file(fsp,data,startpos,numtoread);
3489
3490 if (nread < 0) {
3491 reply_nterror(req, map_nt_error_from_unix(errno));
3492 goto strict_unlock;
3493 }
3494
3495 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3496
3497 SSVAL(req->outbuf,smb_vwv0,nread);
3498 SSVAL(req->outbuf,smb_vwv5,nread+3);
3499 SCVAL(smb_buf(req->outbuf),0,1);
3500 SSVAL(smb_buf(req->outbuf),1,nread);
3501
3502 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3503 fsp->fnum, (int)numtoread, (int)nread ) );
3504
3505 strict_unlock:
3506 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3507
3508 END_PROFILE(SMBread);
3509 return;
3510 }
3511
3512 /****************************************************************************
3513 Setup readX header.
3514 ****************************************************************************/
3515
3516 static int setup_readX_header(struct smb_request *req, char *outbuf,
3517 size_t smb_maxcnt)
3518 {
3519 int outsize;
3520 char *data;
3521
3522 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3523 data = smb_buf(outbuf);
3524
3525 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3526
3527 SCVAL(outbuf,smb_vwv0,0xFF);
3528 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3529 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3530 SSVAL(outbuf,smb_vwv6,
3531 req_wct_ofs(req)
3532 + 1 /* the wct field */
3533 + 12 * sizeof(uint16_t) /* vwv */
3534 + 2); /* the buflen field */
3535 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3536 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3537 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3538 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3539 return outsize;
3540 }
3541
3542 /****************************************************************************
3543 Reply to a read and X - possibly using sendfile.
3544 ****************************************************************************/
3545
3546 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3547 files_struct *fsp, SMB_OFF_T startpos,
3548 size_t smb_maxcnt)
3549 {
3550 ssize_t nread = -1;
3551 struct lock_struct lock;
3552 int saved_errno = 0;
3553
3554 if(fsp_stat(fsp) == -1) {
3555 reply_nterror(req, map_nt_error_from_unix(errno));
3556 return;
3557 }
3558
3559 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3560 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3561 &lock);
3562
3563 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3564 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3565 return;
3566 }
3567
3568 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3569 (startpos > fsp->fsp_name->st.st_ex_size)
3570 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3571 /*
3572 * We already know that we would do a short read, so don't
3573 * try the sendfile() path.
3574 */
3575 goto nosendfile_read;
3576 }
3577
3578 /*
3579 * We can only use sendfile on a non-chained packet
3580 * but we can use on a non-oplocked file. tridge proved this
3581 * on a train in Germany :-). JRA.
3582 */
3583
3584 if (!req_is_in_chain(req) &&
3585 !is_encrypted_packet(req->sconn, req->inbuf) &&
3586 (fsp->base_fsp == NULL) &&
3587 (fsp->wcp == NULL) &&
3588 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3589 uint8 headerbuf[smb_size + 12 * 2];
3590 DATA_BLOB header;
3591
3592 /*
3593 * Set up the packet header before send. We
3594 * assume here the sendfile will work (get the
3595 * correct amount of data).
3596 */
3597
3598 header = data_blob_const(headerbuf, sizeof(headerbuf));
3599
3600 construct_reply_common_req(req, (char *)headerbuf);
3601 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3602
3603 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3604 startpos, smb_maxcnt);
3605 if (nread == -1) {
3606 /* Returning ENOSYS means no data at all was sent.
3607 Do this as a normal read. */
3608 if (errno == ENOSYS) {
3609 goto normal_read;
3610 }
3611
3612 /*
3613 * Special hack for broken Linux with no working sendfile. If we
3614 * return EINTR we sent the header but not the rest of the data.
3615 * Fake this up by doing read/write calls.
3616 */
3617
3618 if (errno == EINTR) {
3619 /* Ensure we don't do this again. */
3620 set_use_sendfile(SNUM(conn), False);
3621 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3622 nread = fake_sendfile(fsp, startpos,
3623 smb_maxcnt);
3624 if (nread == -1) {
3625 DEBUG(0,("send_file_readX: "
3626 "fake_sendfile failed for "
3627 "file %s (%s).\n",
3628 fsp_str_dbg(fsp),
3629 strerror(errno)));
3630 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3631 }
3632 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3633 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3634 /* No outbuf here means successful sendfile. */
3635 goto strict_unlock;
3636 }
3637
3638 DEBUG(0,("send_file_readX: sendfile failed for file "
3639 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3640 strerror(errno)));
3641 exit_server_cleanly("send_file_readX sendfile failed");
3642 } else if (nread == 0) {
3643 /*
3644 * Some sendfile implementations return 0 to indicate
3645 * that there was a short read, but nothing was
3646 * actually written to the socket. In this case,
3647 * fallback to the normal read path so the header gets
3648 * the correct byte count.
3649 */
3650 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3651 "falling back to the normal read: %s\n",
3652 fsp_str_dbg(fsp)));
3653 goto normal_read;
3654 }
3655
3656 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3657 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3658
3659 /* Deal with possible short send. */
3660 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3661 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3662 }
3663 /* No outbuf here means successful sendfile. */
3664 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3665 SMB_PERFCOUNT_END(&req->pcd);
3666 goto strict_unlock;
3667 }
3668
3669 normal_read:
3670
3671 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3672 uint8 headerbuf[smb_size + 2*12];
3673
3674 construct_reply_common_req(req, (char *)headerbuf);
3675 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3676
3677 /* Send out the header. */
3678 if (write_data(req->sconn->sock, (char *)headerbuf,
3679 sizeof(headerbuf)) != sizeof(headerbuf)) {
3680
3681 char addr[INET6_ADDRSTRLEN];
3682 /*
3683 * Try and give an error message saying what
3684 * client failed.
3685 */
3686 DEBUG(0, ("write_data failed for client %s. "
3687 "Error %s\n",
3688 get_peer_addr(req->sconn->sock, addr,
3689 sizeof(addr)),
3690 strerror(errno)));
3691
3692 DEBUG(0,("send_file_readX: write_data failed for file "
3693 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3694 strerror(errno)));
3695 exit_server_cleanly("send_file_readX sendfile failed");
3696 }
3697 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3698 if (nread == -1) {
3699 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3700 "file %s (%s).\n", fsp_str_dbg(fsp),
3701 strerror(errno)));
3702 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3703 }
3704 goto strict_unlock;
3705 }
3706
3707 nosendfile_read:
3708
3709 reply_outbuf(req, 12, smb_maxcnt);
3710
3711 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3712 saved_errno = errno;
3713
3714 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3715
3716 if (nread < 0) {
3717 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3718 return;
3719 }
3720
3721 setup_readX_header(req, (char *)req->outbuf, nread);
3722
3723 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3724 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3725
3726 chain_reply(req);
3727 return;
3728
3729 strict_unlock:
3730 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3731 TALLOC_FREE(req->outbuf);
3732 return;
3733 }
3734
3735 /****************************************************************************
3736 Reply to a read and X.
3737 ****************************************************************************/
3738
3739 void reply_read_and_X(struct smb_request *req)
3740 {
3741 struct smbd_server_connection *sconn = req->sconn;
3742 connection_struct *conn = req->conn;
3743 files_struct *fsp;
3744 SMB_OFF_T startpos;
3745 size_t smb_maxcnt;
3746 bool big_readX = False;
3747 #if 0
3748 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3749 #endif
3750
3751 START_PROFILE(SMBreadX);
3752
3753 if ((req->wct != 10) && (req->wct != 12)) {
3754 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3755 return;
3756 }
3757
3758 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3759 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3760 smb_maxcnt = SVAL(req->vwv+5, 0);
3761
3762 /* If it's an IPC, pass off the pipe handler. */
3763 if (IS_IPC(conn)) {
3764 reply_pipe_read_and_X(req);
3765 END_PROFILE(SMBreadX);
3766 return;
3767 }
3768
3769 if (!check_fsp(conn, req, fsp)) {
3770 END_PROFILE(SMBreadX);
3771 return;
3772 }
3773
3774 if (!CHECK_READ(fsp,req)) {
3775 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3776 END_PROFILE(SMBreadX);
3777 return;
3778 }
3779
3780 if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3781 (get_remote_arch() == RA_SAMBA)) {
3782 /*
3783 * This is Samba only behavior (up to Samba 3.6)!
3784 *
3785 * Windows 2008 R2 ignores the upper_size,
3786 * so we do unless unix extentions are active
3787 * or "smbclient" is talking to us.
3788 */
3789 size_t upper_size = SVAL(req->vwv+7, 0);
3790 smb_maxcnt |= (upper_size<<16);
3791 if (upper_size > 1) {
3792 /* Can't do this on a chained packet. */
3793 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3794 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3795 END_PROFILE(SMBreadX);
3796 return;
3797 }
3798 /* We currently don't do this on signed or sealed data. */
3799 if (srv_is_signing_active(req->sconn) ||
3800 is_encrypted_packet(req->sconn, req->inbuf)) {
3801 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3802 END_PROFILE(SMBreadX);
3803 return;
3804 }
3805 /* Is there room in the reply for this data ? */
3806 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3807 reply_nterror(req,
3808 NT_STATUS_INVALID_PARAMETER);
3809 END_PROFILE(SMBreadX);
3810 return;
3811 }
3812 big_readX = True;
3813 }
3814 }
3815
3816 if (req->wct == 12) {
3817 #ifdef LARGE_SMB_OFF_T
3818 /*
3819 * This is a large offset (64 bit) read.
3820 */
3821 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3822
3823 #else /* !LARGE_SMB_OFF_T */
3824
3825 /*
3826 * Ensure we haven't been sent a >32 bit offset.
3827 */
3828
3829 if(IVAL(req->vwv+10, 0) != 0) {
3830 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3831 "used and we don't support 64 bit offsets.\n",
3832 (unsigned int)IVAL(req->vwv+10, 0) ));
3833 END_PROFILE(SMBreadX);
3834 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3835 return;
3836 }
3837
3838 #endif /* LARGE_SMB_OFF_T */
3839
3840 }
3841
3842 if (!big_readX) {
3843 NTSTATUS status = schedule_aio_read_and_X(conn,
3844 req,
3845 fsp,
3846 startpos,
3847 smb_maxcnt);
3848 if (NT_STATUS_IS_OK(status)) {
3849 /* Read scheduled - we're done. */
3850 goto out;
3851 }
3852 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3853 /* Real error - report to client. */
3854 END_PROFILE(SMBreadX);
3855 reply_nterror(req, status);
3856 return;
3857 }
3858 /* NT_STATUS_RETRY - fall back to sync read. */
3859 }
3860
3861 smbd_lock_socket(req->sconn);
3862 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3863 smbd_unlock_socket(req->sconn);
3864
3865 out:
3866 END_PROFILE(SMBreadX);
3867 return;
3868 }
3869
3870 /****************************************************************************
3871 Error replies to writebraw must have smb_wct == 1. Fix this up.
3872 ****************************************************************************/
3873
3874 void error_to_writebrawerr(struct smb_request *req)
3875 {
3876 uint8 *old_outbuf = req->outbuf;
3877
3878 reply_outbuf(req, 1, 0);
3879
3880 memcpy(req->outbuf, old_outbuf, smb_size);
3881 TALLOC_FREE(old_outbuf);
3882 }
3883
3884 /****************************************************************************
3885 Read 4 bytes of a smb packet and return the smb length of the packet.
3886 Store the result in the buffer. This version of the function will
3887 never return a session keepalive (length of zero).
3888 Timeout is in milliseconds.
3889 ****************************************************************************/
3890
3891 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3892 size_t *len)
3893 {
3894 uint8_t msgtype = NBSSkeepalive;
3895
3896 while (msgtype == NBSSkeepalive) {
3897 NTSTATUS status;
3898
3899 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3900 len);
3901 if (!NT_STATUS_IS_OK(status)) {
3902 char addr[INET6_ADDRSTRLEN];
3903 /* Try and give an error message
3904 * saying what client failed. */
3905 DEBUG(0, ("read_fd_with_timeout failed for "
3906 "client %s read error = %s.\n",
3907 get_peer_addr(fd,addr,sizeof(addr)),
3908 nt_errstr(status)));
3909 return status;
3910 }
3911
3912 msgtype = CVAL(inbuf, 0);
3913 }
3914
3915 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3916 (unsigned long)len));
3917
3918 return NT_STATUS_OK;
3919 }
3920
3921 /****************************************************************************
3922 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3923 ****************************************************************************/
3924
3925 void reply_writebraw(struct smb_request *req)
3926 {
3927 connection_struct *conn = req->conn;
3928 char *buf = NULL;
3929 ssize_t nwritten=0;
3930 ssize_t total_written=0;
3931 size_t numtowrite=0;
3932 size_t tcount;
3933 SMB_OFF_T startpos;
3934 const char *data=NULL;
3935 bool write_through;
3936 files_struct *fsp;
3937 struct lock_struct lock;
3938 NTSTATUS status;
3939
3940 START_PROFILE(SMBwritebraw);
3941
3942 /*
3943 * If we ever reply with an error, it must have the SMB command
3944 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3945 * we're finished.
3946 */
3947 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3948
3949 if (srv_is_signing_active(req->sconn)) {
3950 END_PROFILE(SMBwritebraw);
3951 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3952 "raw reads/writes are disallowed.");
3953 }
3954
3955 if (req->wct < 12) {
3956 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3957 error_to_writebrawerr(req);
3958 END_PROFILE(SMBwritebraw);
3959 return;
3960 }
3961
3962 if (req->sconn->smb1.echo_handler.trusted_fde) {
3963 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3964 "'async smb echo handler = yes'\n"));
3965 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3966 error_to_writebrawerr(req);
3967 END_PROFILE(SMBwritebraw);
3968 return;
3969 }
3970
3971 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3972 if (!check_fsp(conn, req, fsp)) {
3973 error_to_writebrawerr(req);
3974 END_PROFILE(SMBwritebraw);
3975 return;
3976 }
3977
3978 if (!CHECK_WRITE(fsp)) {
3979 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3980 error_to_writebrawerr(req);
3981 END_PROFILE(SMBwritebraw);
3982 return;
3983 }
3984
3985 tcount = IVAL(req->vwv+1, 0);
3986 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3987 write_through = BITSETW(req->vwv+7,0);
3988
3989 /* We have to deal with slightly different formats depending
3990 on whether we are using the core+ or lanman1.0 protocol */
3991
3992 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3993 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
3994 data = smb_buf_const(req->inbuf);
3995 } else {
3996 numtowrite = SVAL(req->vwv+10, 0);
3997 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3998 }
3999
4000 /* Ensure we don't write bytes past the end of this packet. */
4001 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4002 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4003 error_to_writebrawerr(req);
4004 END_PROFILE(SMBwritebraw);
4005 return;
4006 }
4007
4008 if (!fsp->print_file) {
4009 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4010 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4011 &lock);
4012
4013 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4014 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4015 error_to_writebrawerr(req);
4016 END_PROFILE(SMBwritebraw);
4017 return;
4018 }
4019 }
4020
4021 if (numtowrite>0) {
4022 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4023 }
4024
4025 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4026 "wrote=%d sync=%d\n",
4027 fsp->fnum, (double)startpos, (int)numtowrite,
4028 (int)nwritten, (int)write_through));
4029
4030 if (nwritten < (ssize_t)numtowrite) {
4031 reply_nterror(req, NT_STATUS_DISK_FULL);
4032 error_to_writebrawerr(req);
4033 goto strict_unlock;
4034 }
4035
4036 total_written = nwritten;
4037
4038 /* Allocate a buffer of 64k + length. */
4039 buf = talloc_array(NULL, char, 65540);
4040 if (!buf) {
4041 reply_nterror(req, NT_STATUS_NO_MEMORY);
4042 error_to_writebrawerr(req);
4043 goto strict_unlock;
4044 }
4045
4046 /* Return a SMBwritebraw message to the redirector to tell
4047 * it to send more bytes */
4048
4049 memcpy(buf, req->inbuf, smb_size);
4050 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4051 SCVAL(buf,smb_com,SMBwritebraw);
4052 SSVALS(buf,smb_vwv0,0xFFFF);
4053 show_msg(buf);
4054 if (!srv_send_smb(req->sconn,
4055 buf,
4056 false, 0, /* no signing */
4057 IS_CONN_ENCRYPTED(conn),
4058 &req->pcd)) {
4059 exit_server_cleanly("reply_writebraw: srv_send_smb "
4060 "failed.");
4061 }
4062
4063 /* Now read the raw data into the buffer and write it */
4064 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4065 &numtowrite);
4066 if (!NT_STATUS_IS_OK(status)) {
4067 exit_server_cleanly("secondary writebraw failed");
4068 }
4069
4070 /* Set up outbuf to return the correct size */
4071 reply_outbuf(req, 1, 0);
4072
4073 if (numtowrite != 0) {
4074
4075 if (numtowrite > 0xFFFF) {
4076 DEBUG(0,("reply_writebraw: Oversize secondary write "
4077 "raw requested (%u). Terminating\n",
4078 (unsigned int)numtowrite ));
4079 exit_server_cleanly("secondary writebraw failed");
4080 }
4081
4082 if (tcount > nwritten+numtowrite) {
4083 DEBUG(3,("reply_writebraw: Client overestimated the "
4084 "write %d %d %d\n",
4085 (int)tcount,(int)nwritten,(int)numtowrite));
4086 }
4087
4088 status = read_data(req->sconn->sock, buf+4, numtowrite);
4089
4090 if (!NT_STATUS_IS_OK(status)) {
4091 char addr[INET6_ADDRSTRLEN];
4092 /* Try and give an error message
4093 * saying what client failed. */
4094 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4095 "raw read failed (%s) for client %s. "
4096 "Terminating\n", nt_errstr(status),
4097 get_peer_addr(req->sconn->sock, addr,
4098 sizeof(addr))));
4099 exit_server_cleanly("secondary writebraw failed");
4100 }
4101
4102 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4103 if (nwritten == -1) {
4104 TALLOC_FREE(buf);
4105 reply_nterror(req, map_nt_error_from_unix(errno));
4106 error_to_writebrawerr(req);
4107 goto strict_unlock;
4108 }
4109
4110 if (nwritten < (ssize_t)numtowrite) {
4111 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4112 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4113 }
4114
4115 if (nwritten > 0) {
4116 total_written += nwritten;
4117 }
4118 }
4119
4120 TALLOC_FREE(buf);
4121 SSVAL(req->outbuf,smb_vwv0,total_written);
4122
4123 status = sync_file(conn, fsp, write_through);
4124 if (!NT_STATUS_IS_OK(status)) {
4125 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4126 fsp_str_dbg(fsp), nt_errstr(status)));
4127 reply_nterror(req, status);
4128 error_to_writebrawerr(req);
4129 goto strict_unlock;
4130 }
4131
4132 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4133 "wrote=%d\n",
4134 fsp->fnum, (double)startpos, (int)numtowrite,
4135 (int)total_written));
4136
4137 if (!fsp->print_file) {
4138 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4139 }
4140
4141 /* We won't return a status if write through is not selected - this
4142 * follows what WfWg does */
4143 END_PROFILE(SMBwritebraw);
4144
4145 if (!write_through && total_written==tcount) {
4146
4147 #if RABBIT_PELLET_FIX
4148 /*
4149 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4150 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4151 * JRA.
4152 */
4153 if (!send_keepalive(req->sconn->sock)) {
4154 exit_server_cleanly("reply_writebraw: send of "
4155 "keepalive failed");
4156 }
4157 #endif
4158 TALLOC_FREE(req->outbuf);
4159 }
4160 return;
4161
4162 strict_unlock:
4163 if (!fsp->print_file) {
4164 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4165 }
4166
4167 END_PROFILE(SMBwritebraw);
4168 return;
4169 }
4170
4171 #undef DBGC_CLASS
4172 #define DBGC_CLASS DBGC_LOCKING
4173
4174 /****************************************************************************
4175 Reply to a writeunlock (core+).
4176 ****************************************************************************/
4177
4178 void reply_writeunlock(struct smb_request *req)
4179 {
4180 connection_struct *conn = req->conn;
4181 ssize_t nwritten = -1;
4182 size_t numtowrite;
4183 SMB_OFF_T startpos;
4184 const char *data;
4185 NTSTATUS status = NT_STATUS_OK;
4186 files_struct *fsp;
4187 struct lock_struct lock;
4188 int saved_errno = 0;
4189
4190 START_PROFILE(SMBwriteunlock);
4191
4192 if (req->wct < 5) {
4193 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4194 END_PROFILE(SMBwriteunlock);
4195 return;
4196 }
4197
4198 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4199
4200 if (!check_fsp(conn, req, fsp)) {
4201 END_PROFILE(SMBwriteunlock);
4202 return;
4203 }
4204
4205 if (!CHECK_WRITE(fsp)) {
4206 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4207 END_PROFILE(SMBwriteunlock);
4208 return;
4209 }
4210
4211 numtowrite = SVAL(req->vwv+1, 0);
4212 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4213 data = (const char *)req->buf + 3;
4214
4215 if (!fsp->print_file && numtowrite > 0) {
4216 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4217 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4218 &lock);
4219
4220 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4221 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4222 END_PROFILE(SMBwriteunlock);
4223 return;
4224 }
4225 }
4226
4227 /* The special X/Open SMB protocol handling of
4228 zero length writes is *NOT* done for
4229 this call */
4230 if(numtowrite == 0) {
4231 nwritten = 0;
4232 } else {
4233 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4234 saved_errno = errno;
4235 }
4236
4237 status = sync_file(conn, fsp, False /* write through */);
4238 if (!NT_STATUS_IS_OK(status)) {
4239 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4240 fsp_str_dbg(fsp), nt_errstr(status)));
4241 reply_nterror(req, status);
4242 goto strict_unlock;
4243 }
4244
4245 if(nwritten < 0) {
4246 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4247 goto strict_unlock;
4248 }
4249
4250 if((nwritten < numtowrite) && (numtowrite != 0)) {
4251 reply_nterror(req, NT_STATUS_DISK_FULL);
4252 goto strict_unlock;
4253 }
4254
4255 if (numtowrite && !fsp->print_file) {
4256 status = do_unlock(req->sconn->msg_ctx,
4257 fsp,
4258 (uint64_t)req->smbpid,
4259 (uint64_t)numtowrite,
4260 (uint64_t)startpos,
4261 WINDOWS_LOCK);
4262
4263 if (NT_STATUS_V(status)) {
4264 reply_nterror(req, status);
4265 goto strict_unlock;
4266 }
4267 }
4268
4269 reply_outbuf(req, 1, 0);
4270
4271 SSVAL(req->outbuf,smb_vwv0,nwritten);
4272
4273 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4274 fsp->fnum, (int)numtowrite, (int)nwritten));
4275
4276 strict_unlock:
4277 if (numtowrite && !fsp->print_file) {
4278 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4279 }
4280
4281 END_PROFILE(SMBwriteunlock);
4282 return;
4283 }
4284
4285 #undef DBGC_CLASS
4286 #define DBGC_CLASS DBGC_ALL
4287
4288 /****************************************************************************
4289 Reply to a write.
4290 ****************************************************************************/
4291
4292 void reply_write(struct smb_request *req)
4293 {
4294 connection_struct *conn = req->conn;
4295 size_t numtowrite;
4296 ssize_t nwritten = -1;
4297 SMB_OFF_T startpos;
4298 const char *data;
4299 files_struct *fsp;
4300 struct lock_struct lock;
4301 NTSTATUS status;
4302 int saved_errno = 0;
4303
4304 START_PROFILE(SMBwrite);
4305
4306 if (req->wct < 5) {
4307 END_PROFILE(SMBwrite);
4308 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4309 return;
4310 }
4311
4312 /* If it's an IPC, pass off the pipe handler. */
4313 if (IS_IPC(conn)) {
4314 reply_pipe_write(req);
4315 END_PROFILE(SMBwrite);
4316 return;
4317 }
4318
4319 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4320
4321 if (!check_fsp(conn, req, fsp)) {
4322 END_PROFILE(SMBwrite);
4323 return;
4324 }
4325
4326 if (!CHECK_WRITE(fsp)) {
4327 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4328 END_PROFILE(SMBwrite);
4329 return;
4330 }
4331
4332 numtowrite = SVAL(req->vwv+1, 0);
4333 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4334 data = (const char *)req->buf + 3;
4335
4336 if (!fsp->print_file) {
4337 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4338 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4339 &lock);
4340
4341 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4342 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4343 END_PROFILE(SMBwrite);
4344 return;
4345 }
4346 }
4347
4348 /*
4349 * X/Open SMB protocol says that if smb_vwv1 is
4350 * zero then the file size should be extended or
4351 * truncated to the size given in smb_vwv[2-3].
4352 */
4353
4354 if(numtowrite == 0) {
4355 /*
4356 * This is actually an allocate call, and set EOF. JRA.
4357 */
4358 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4359 if (nwritten < 0) {
4360 reply_nterror(req, NT_STATUS_DISK_FULL);
4361 goto strict_unlock;
4362 }
4363 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4364 if (nwritten < 0) {
4365 reply_nterror(req, NT_STATUS_DISK_FULL);
4366 goto strict_unlock;
4367 }
4368 trigger_write_time_update_immediate(fsp);
4369 } else {
4370 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4371 }
4372
4373 status = sync_file(conn, fsp, False);
4374 if (!NT_STATUS_IS_OK(status)) {
4375 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4376 fsp_str_dbg(fsp), nt_errstr(status)));
4377 reply_nterror(req, status);
4378 goto strict_unlock;
4379 }
4380
4381 if(nwritten < 0) {
4382 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4383 goto strict_unlock;
4384 }
4385
4386 if((nwritten == 0) && (numtowrite != 0)) {
4387 reply_nterror(req, NT_STATUS_DISK_FULL);
4388 goto strict_unlock;
4389 }
4390
4391 reply_outbuf(req, 1, 0);
4392
4393 SSVAL(req->outbuf,smb_vwv0,nwritten);
4394
4395 if (nwritten < (ssize_t)numtowrite) {
4396 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4397 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4398 }
4399
4400 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4401
4402 strict_unlock:
4403 if (!fsp->print_file) {
4404 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4405 }
4406
4407 END_PROFILE(SMBwrite);
4408 return;
4409 }
4410
4411 /****************************************************************************
4412 Ensure a buffer is a valid writeX for recvfile purposes.
4413 ****************************************************************************/
4414
4415 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4416 (2*14) + /* word count (including bcc) */ \
4417 1 /* pad byte */)
4418
4419 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4420 const uint8_t *inbuf)
4421 {
4422 size_t numtowrite;
4423 connection_struct *conn = NULL;
4424 unsigned int doff = 0;
4425 size_t len = smb_len_large(inbuf);
4426
4427 if (is_encrypted_packet(sconn, inbuf)) {
4428 /* Can't do this on encrypted
4429 * connections. */
4430 return false;
4431 }
4432
4433 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4434 return false;
4435 }
4436
4437 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4438 CVAL(inbuf,smb_wct) != 14) {
4439 DEBUG(10,("is_valid_writeX_buffer: chained or "
4440 "invalid word length.\n"));
4441 return false;
4442 }
4443
4444 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4445 if (conn == NULL) {
4446 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4447 return false;
4448 }
4449 if (IS_IPC(conn)) {
4450 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4451 return false;
4452 }
4453 if (IS_PRINT(conn)) {
4454 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4455 return false;
4456 }
4457 doff = SVAL(inbuf,smb_vwv11);
4458
4459 numtowrite = SVAL(inbuf,smb_vwv10);
4460
4461 if (len > doff && len - doff > 0xFFFF) {
4462 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4463 }
4464
4465 if (numtowrite == 0) {
4466 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4467 return false;
4468 }
4469
4470 /* Ensure the sizes match up. */
4471 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4472 /* no pad byte...old smbclient :-( */
4473 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4474 (unsigned int)doff,
4475 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4476 return false;
4477 }
4478
4479 if (len - doff != numtowrite) {
4480 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4481 "len = %u, doff = %u, numtowrite = %u\n",
4482 (unsigned int)len,
4483 (unsigned int)doff,
4484 (unsigned int)numtowrite ));
4485 return false;
4486 }
4487
4488 DEBUG(10,("is_valid_writeX_buffer: true "
4489 "len = %u, doff = %u, numtowrite = %u\n",
4490 (unsigned int)len,
4491 (unsigned int)doff,
4492 (unsigned int)numtowrite ));
4493
4494 return true;
4495 }
4496
4497 /****************************************************************************
4498 Reply to a write and X.
4499 ****************************************************************************/
4500
4501 void reply_write_and_X(struct smb_request *req)
4502 {
4503 connection_struct *conn = req->conn;
4504 files_struct *fsp;
4505 struct lock_struct lock;
4506 SMB_OFF_T startpos;
4507 size_t numtowrite;
4508 bool write_through;
4509 ssize_t nwritten;
4510 unsigned int smb_doff;
4511 unsigned int smblen;
4512 const char *data;
4513 NTSTATUS status;
4514 int saved_errno = 0;
4515
4516 START_PROFILE(SMBwriteX);
4517
4518 if ((req->wct != 12) && (req->wct != 14)) {
4519 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4520 END_PROFILE(SMBwriteX);
4521 return;
4522 }
4523
4524 numtowrite = SVAL(req->vwv+10, 0);
4525 smb_doff = SVAL(req->vwv+11, 0);
4526 smblen = smb_len(req->inbuf);
4527
4528 if (req->unread_bytes > 0xFFFF ||
4529 (smblen > smb_doff &&
4530 smblen - smb_doff > 0xFFFF)) {
4531 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4532 }
4533
4534 if (req->unread_bytes) {
4535 /* Can't do a recvfile write on IPC$ */
4536 if (IS_IPC(conn)) {
4537 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4538 END_PROFILE(SMBwriteX);
4539 return;
4540 }
4541 if (numtowrite != req->unread_bytes) {
4542 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4543 END_PROFILE(SMBwriteX);
4544 return;
4545 }
4546 } else {
4547 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4548 smb_doff + numtowrite > smblen) {
4549 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4550 END_PROFILE(SMBwriteX);
4551 return;
4552 }
4553 }
4554
4555 /* If it's an IPC, pass off the pipe handler. */
4556 if (IS_IPC(conn)) {
4557 if (req->unread_bytes) {
4558 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4559 END_PROFILE(SMBwriteX);
4560 return;
4561 }
4562 reply_pipe_write_and_X(req);
4563 END_PROFILE(SMBwriteX);
4564 return;
4565 }
4566
4567 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4568 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4569 write_through = BITSETW(req->vwv+7,0);
4570
4571 if (!check_fsp(conn, req, fsp)) {
4572 END_PROFILE(SMBwriteX);
4573 return;
4574 }
4575
4576 if (!CHECK_WRITE(fsp)) {
4577 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4578 END_PROFILE(SMBwriteX);
4579 return;
4580 }
4581
4582 data = smb_base(req->inbuf) + smb_doff;
4583
4584 if(req->wct == 14) {
4585 #ifdef LARGE_SMB_OFF_T
4586 /*
4587 * This is a large offset (64 bit) write.
4588 */
4589 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4590
4591 #else /* !LARGE_SMB_OFF_T */
4592
4593 /*
4594 * Ensure we haven't been sent a >32 bit offset.
4595 */
4596
4597 if(IVAL(req->vwv+12, 0) != 0) {
4598 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4599 "used and we don't support 64 bit offsets.\n",
4600 (unsigned int)IVAL(req->vwv+12, 0) ));
4601 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4602 END_PROFILE(SMBwriteX);
4603 return;
4604 }
4605
4606 #endif /* LARGE_SMB_OFF_T */
4607 }
4608
4609 /* X/Open SMB protocol says that, unlike SMBwrite
4610 if the length is zero then NO truncation is
4611 done, just a write of zero. To truncate a file,
4612 use SMBwrite. */
4613
4614 if(numtowrite == 0) {
4615 nwritten = 0;
4616 } else {
4617 if (req->unread_bytes == 0) {
4618 status = schedule_aio_write_and_X(conn,
4619 req,
4620 fsp,
4621 data,
4622 startpos,
4623 numtowrite);
4624
4625 if (NT_STATUS_IS_OK(status)) {
4626 /* write scheduled - we're done. */
4627 goto out;
4628 }
4629 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4630 /* Real error - report to client. */
4631 reply_nterror(req, status);
4632 goto out;
4633 }
4634 /* NT_STATUS_RETRY - fall through to sync write. */
4635 }
4636
4637 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4638 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4639 &lock);
4640
4641 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4642 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4643 goto out;
4644 }
4645
4646 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4647 saved_errno = errno;
4648
4649 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4650 }
4651
4652 if(nwritten < 0) {
4653 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4654 goto out;
4655 }
4656
4657 if((nwritten == 0) && (numtowrite != 0)) {
4658 reply_nterror(req, NT_STATUS_DISK_FULL);
4659 goto out;
4660 }
4661
4662 reply_outbuf(req, 6, 0);
4663 SSVAL(req->outbuf,smb_vwv2,nwritten);
4664 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4665
4666 if (nwritten < (ssize_t)numtowrite) {
4667 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4668 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4669 }
4670
4671 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4672 fsp->fnum, (int)numtowrite, (int)nwritten));
4673
4674 status = sync_file(conn, fsp, write_through);
4675 if (!NT_STATUS_IS_OK(status)) {
4676 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4677 fsp_str_dbg(fsp), nt_errstr(status)));
4678 reply_nterror(req, status);
4679 goto out;
4680 }
4681
4682 END_PROFILE(SMBwriteX);
4683 chain_reply(req);
4684 return;
4685
4686 out:
4687 END_PROFILE(SMBwriteX);
4688 return;
4689 }
4690
4691 /****************************************************************************
4692 Reply to a lseek.
4693 ****************************************************************************/
4694
4695 void reply_lseek(struct smb_request *req)
4696 {
4697 connection_struct *conn = req->conn;
4698 SMB_OFF_T startpos;
4699 SMB_OFF_T res= -1;
4700 int mode,umode;
4701 files_struct *fsp;
4702
4703 START_PROFILE(SMBlseek);
4704
4705 if (req->wct < 4) {
4706 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4707 END_PROFILE(SMBlseek);
4708 return;
4709 }
4710
4711 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4712
4713 if (!check_fsp(conn, req, fsp)) {
4714 return;
4715 }
4716
4717 flush_write_cache(fsp, SEEK_FLUSH);
4718
4719 mode = SVAL(req->vwv+1, 0) & 3;
4720 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4721 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4722
4723 switch (mode) {
4724 case 0:
4725 umode = SEEK_SET;
4726 res = startpos;
4727 break;
4728 case 1:
4729 umode = SEEK_CUR;
4730 res = fsp->fh->pos + startpos;
4731 break;
4732 case 2:
4733 umode = SEEK_END;
4734 break;
4735 default:
4736 umode = SEEK_SET;
4737 res = startpos;
4738 break;
4739 }
4740
4741 if (umode == SEEK_END) {
4742 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4743 if(errno == EINVAL) {
4744 SMB_OFF_T current_pos = startpos;
4745
4746 if(fsp_stat(fsp) == -1) {
4747 reply_nterror(req,
4748 map_nt_error_from_unix(errno));
4749 END_PROFILE(SMBlseek);
4750 return;
4751 }
4752
4753 current_pos += fsp->fsp_name->st.st_ex_size;
4754 if(current_pos < 0)
4755 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4756 }
4757 }
4758
4759 if(res == -1) {
4760 reply_nterror(req, map_nt_error_from_unix(errno));
4761 END_PROFILE(SMBlseek);
4762 return;
4763 }
4764 }
4765
4766 fsp->fh->pos = res;
4767
4768 reply_outbuf(req, 2, 0);
4769 SIVAL(req->outbuf,smb_vwv0,res);
4770
4771 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4772 fsp->fnum, (double)startpos, (double)res, mode));
4773
4774 END_PROFILE(SMBlseek);
4775 return;
4776 }
4777
4778 /****************************************************************************
4779 Reply to a flush.
4780 ****************************************************************************/
4781
4782 void reply_flush(struct smb_request *req)
4783 {
4784 connection_struct *conn = req->conn;
4785 uint16 fnum;
4786 files_struct *fsp;
4787
4788 START_PROFILE(SMBflush);
4789
4790 if (req->wct < 1) {
4791 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4792 return;
4793 }
4794
4795 fnum = SVAL(req->vwv+0, 0);
4796 fsp = file_fsp(req, fnum);
4797
4798 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4799 return;
4800 }
4801
4802 if (!fsp) {
4803 file_sync_all(conn);
4804 } else {
4805 NTSTATUS status = sync_file(conn, fsp, True);
4806 if (!NT_STATUS_IS_OK(status)) {
4807 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4808 fsp_str_dbg(fsp), nt_errstr(status)));
4809 reply_nterror(req, status);
4810 END_PROFILE(SMBflush);
4811 return;
4812 }
4813 }
4814
4815 reply_outbuf(req, 0, 0);
4816
4817 DEBUG(3,("flush\n"));
4818 END_PROFILE(SMBflush);
4819 return;
4820 }
4821
4822 /****************************************************************************
4823 Reply to a exit.
4824 conn POINTER CAN BE NULL HERE !
4825 ****************************************************************************/
4826
4827 void reply_exit(struct smb_request *req)
4828 {
4829 START_PROFILE(SMBexit);
4830
4831 file_close_pid(req->sconn, req->smbpid, req->vuid);
4832
4833 reply_outbuf(req, 0, 0);
4834
4835 DEBUG(3,("exit\n"));
4836
4837 END_PROFILE(SMBexit);
4838 return;
4839 }
4840
4841 /****************************************************************************
4842 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4843 ****************************************************************************/
4844
4845 void reply_close(struct smb_request *req)
4846 {
4847 connection_struct *conn = req->conn;
4848 NTSTATUS status = NT_STATUS_OK;
4849 files_struct *fsp = NULL;
4850 START_PROFILE(SMBclose);
4851
4852 if (req->wct < 3) {
4853 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4854 END_PROFILE(SMBclose);
4855 return;
4856 }
4857
4858 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4859
4860 /*
4861 * We can only use check_fsp if we know it's not a directory.
4862 */
4863
4864 if (!check_fsp_open(conn, req, fsp)) {
4865 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4866 END_PROFILE(SMBclose);
4867 return;
4868 }
4869
4870 if(fsp->is_directory) {
4871 /*
4872 * Special case - close NT SMB directory handle.
4873 */
4874 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4875 status = close_file(req, fsp, NORMAL_CLOSE);
4876 } else {
4877 time_t t;
4878 /*
4879 * Close ordinary file.
4880 */
4881
4882 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4883 fsp->fh->fd, fsp->fnum,
4884 conn->num_files_open));
4885
4886 /*
4887 * Take care of any time sent in the close.
4888 */
4889
4890 t = srv_make_unix_date3(req->vwv+1);
4891 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4892
4893 /*
4894 * close_file() returns the unix errno if an error
4895 * was detected on close - normally this is due to
4896 * a disk full error. If not then it was probably an I/O error.
4897 */
4898
4899 status = close_file(req, fsp, NORMAL_CLOSE);
4900 }
4901
4902 if (!NT_STATUS_IS_OK(status)) {
4903 reply_nterror(req, status);
4904 END_PROFILE(SMBclose);
4905 return;
4906 }
4907
4908 reply_outbuf(req, 0, 0);
4909 END_PROFILE(SMBclose);
4910 return;
4911 }
4912
4913 /****************************************************************************
4914 Reply to a writeclose (Core+ protocol).
4915 ****************************************************************************/
4916
4917 void reply_writeclose(struct smb_request *req)
4918 {
4919 connection_struct *conn = req->conn;
4920 size_t numtowrite;
4921 ssize_t nwritten = -1;
4922 NTSTATUS close_status = NT_STATUS_OK;
4923 SMB_OFF_T startpos;
4924 const char *data;
4925 struct timespec mtime;
4926 files_struct *fsp;
4927 struct lock_struct lock;
4928
4929 START_PROFILE(SMBwriteclose);
4930
4931 if (req->wct < 6) {
4932 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4933 END_PROFILE(SMBwriteclose);
4934 return;
4935 }
4936
4937 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4938
4939 if (!check_fsp(conn, req, fsp)) {
4940 END_PROFILE(SMBwriteclose);
4941 return;
4942 }
4943 if (!CHECK_WRITE(fsp)) {
4944 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4945 END_PROFILE(SMBwriteclose);
4946 return;
4947 }
4948
4949 numtowrite = SVAL(req->vwv+1, 0);
4950 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4951 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4952 data = (const char *)req->buf + 1;
4953
4954 if (!fsp->print_file) {
4955 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4956 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4957 &lock);
4958
4959 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4960 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4961 END_PROFILE(SMBwriteclose);
4962 return;
4963 }
4964 }
4965
4966 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4967
4968 set_close_write_time(fsp, mtime);
4969
4970 /*
4971 * More insanity. W2K only closes the file if writelen > 0.
4972 * JRA.
4973 */
4974
4975 if (numtowrite) {
4976 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4977 "file %s\n", fsp_str_dbg(fsp)));
4978 close_status = close_file(req, fsp, NORMAL_CLOSE);
4979 }
4980
4981 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4982 fsp->fnum, (int)numtowrite, (int)nwritten,
4983 conn->num_files_open));
4984
4985 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4986 reply_nterror(req, NT_STATUS_DISK_FULL);
4987 goto strict_unlock;
4988 }
4989
4990 if(!NT_STATUS_IS_OK(close_status)) {
4991 reply_nterror(req, close_status);
4992 goto strict_unlock;
4993 }
4994
4995 reply_outbuf(req, 1, 0);
4996
4997 SSVAL(req->outbuf,smb_vwv0,nwritten);
4998
4999 strict_unlock:
5000 if (numtowrite && !fsp->print_file) {
5001 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5002 }
5003
5004 END_PROFILE(SMBwriteclose);
5005 return;
5006 }
5007
5008 #undef DBGC_CLASS
5009 #define DBGC_CLASS DBGC_LOCKING
5010
5011 /****************************************************************************
5012 Reply to a lock.
5013 ****************************************************************************/
5014
5015 void reply_lock(struct smb_request *req)
5016 {
5017 connection_struct *conn = req->conn;
5018 uint64_t count,offset;
5019 NTSTATUS status;
5020 files_struct *fsp;
5021 struct byte_range_lock *br_lck = NULL;
5022
5023 START_PROFILE(SMBlock);
5024
5025 if (req->wct < 5) {
5026 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5027 END_PROFILE(SMBlock);
5028 return;
5029 }
5030
5031 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5032
5033 if (!check_fsp(conn, req, fsp)) {
5034 END_PROFILE(SMBlock);
5035 return;
5036 }
5037
5038 count = (uint64_t)IVAL(req->vwv+1, 0);
5039 offset = (uint64_t)IVAL(req->vwv+3, 0);
5040
5041 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5042 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5043
5044 br_lck = do_lock(req->sconn->msg_ctx,
5045 fsp,
5046 (uint64_t)req->smbpid,
5047 count,
5048 offset,
5049 WRITE_LOCK,
5050 WINDOWS_LOCK,
5051 False, /* Non-blocking lock. */
5052 &status,
5053 NULL,
5054 NULL);
5055
5056 TALLOC_FREE(br_lck);
5057
5058 if (NT_STATUS_V(status)) {
5059 reply_nterror(req, status);
5060 END_PROFILE(SMBlock);
5061 return;
5062 }
5063
5064 reply_outbuf(req, 0, 0);
5065
5066 END_PROFILE(SMBlock);
5067 return;
5068 }
5069
5070 /****************************************************************************
5071 Reply to a unlock.
5072 ****************************************************************************/
5073
5074 void reply_unlock(struct smb_request *req)
5075 {
5076 connection_struct *conn = req->conn;
5077 uint64_t count,offset;
5078 NTSTATUS status;
5079 files_struct *fsp;
5080
5081 START_PROFILE(SMBunlock);
5082
5083 if (req->wct < 5) {
5084 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5085 END_PROFILE(SMBunlock);
5086 return;
5087 }
5088
5089 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5090
5091 if (!check_fsp(conn, req, fsp)) {
5092 END_PROFILE(SMBunlock);
5093 return;
5094 }
5095
5096 count = (uint64_t)IVAL(req->vwv+1, 0);
5097 offset = (uint64_t)IVAL(req->vwv+3, 0);
5098
5099 status = do_unlock(req->sconn->msg_ctx,
5100 fsp,
5101 (uint64_t)req->smbpid,
5102 count,
5103 offset,
5104 WINDOWS_LOCK);
5105
5106 if (NT_STATUS_V(status)) {
5107 reply_nterror(req, status);
5108 END_PROFILE(SMBunlock);
5109 return;
5110 }
5111
5112 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5113 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5114
5115 reply_outbuf(req, 0, 0);
5116
5117 END_PROFILE(SMBunlock);
5118 return;
5119 }
5120
5121 #undef DBGC_CLASS
5122 #define DBGC_CLASS DBGC_ALL
5123
5124 /****************************************************************************
5125 Reply to a tdis.
5126 conn POINTER CAN BE NULL HERE !
5127 ****************************************************************************/
5128
5129 void reply_tdis(struct smb_request *req)
5130 {
5131 connection_struct *conn = req->conn;
5132 START_PROFILE(SMBtdis);
5133
5134 if (!conn) {
5135 DEBUG(4,("Invalid connection in tdis\n"));
5136 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5137 END_PROFILE(SMBtdis);
5138 return;
5139 }
5140
5141 conn->used = False;
5142
5143 close_cnum(conn,req->vuid);
5144 req->conn = NULL;
5145
5146 reply_outbuf(req, 0, 0);
5147 END_PROFILE(SMBtdis);
5148 return;
5149 }
5150
5151 /****************************************************************************
5152 Reply to a echo.
5153 conn POINTER CAN BE NULL HERE !
5154 ****************************************************************************/
5155
5156 void reply_echo(struct smb_request *req)
5157 {
5158 connection_struct *conn = req->conn;
5159 struct smb_perfcount_data local_pcd;
5160 struct smb_perfcount_data *cur_pcd;
5161 int smb_reverb;
5162 int seq_num;
5163
5164 START_PROFILE(SMBecho);
5165
5166 smb_init_perfcount_data(&local_pcd);
5167
5168 if (req->wct < 1) {
5169 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5170 END_PROFILE(SMBecho);
5171 return;
5172 }
5173
5174 smb_reverb = SVAL(req->vwv+0, 0);
5175
5176 reply_outbuf(req, 1, req->buflen);
5177
5178 /* copy any incoming data back out */
5179 if (req->buflen > 0) {
5180 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5181 }
5182
5183 if (smb_reverb > 100) {
5184 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5185 smb_reverb = 100;
5186 }
5187
5188 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5189
5190 /* this makes sure we catch the request pcd */
5191 if (seq_num == smb_reverb) {
5192 cur_pcd = &req->pcd;
5193 } else {
5194 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5195 cur_pcd = &local_pcd;
5196 }
5197
5198 SSVAL(req->outbuf,smb_vwv0,seq_num);
5199
5200 show_msg((char *)req->outbuf);
5201 if (!srv_send_smb(req->sconn,
5202 (char *)req->outbuf,
5203 true, req->seqnum+1,
5204 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5205 cur_pcd))
5206 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5207 }
5208
5209 DEBUG(3,("echo %d times\n", smb_reverb));
5210
5211 TALLOC_FREE(req->outbuf);
5212
5213 END_PROFILE(SMBecho);
5214 return;
5215 }
5216
5217 /****************************************************************************
5218 Reply to a printopen.
5219 ****************************************************************************/
5220
5221 void reply_printopen(struct smb_request *req)
5222 {
5223 connection_struct *conn = req->conn;
5224 files_struct *fsp;
5225 NTSTATUS status;
5226
5227 START_PROFILE(SMBsplopen);
5228
5229 if (req->wct < 2) {
5230 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5231 END_PROFILE(SMBsplopen);
5232 return;
5233 }
5234
5235 if (!CAN_PRINT(conn)) {
5236 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5237 END_PROFILE(SMBsplopen);
5238 return;
5239 }
5240
5241 status = file_new(req, conn, &fsp);
5242 if(!NT_STATUS_IS_OK(status)) {
5243 reply_nterror(req, status);
5244 END_PROFILE(SMBsplopen);
5245 return;
5246 }
5247
5248 /* Open for exclusive use, write only. */
5249 status = print_spool_open(fsp, NULL, req->vuid);
5250
5251 if (!NT_STATUS_IS_OK(status)) {
5252 file_free(req, fsp);
5253 reply_nterror(req, status);
5254 END_PROFILE(SMBsplopen);
5255 return;
5256 }
5257
5258 reply_outbuf(req, 1, 0);
5259 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5260
5261 DEBUG(3,("openprint fd=%d fnum=%d\n",
5262 fsp->fh->fd, fsp->fnum));
5263
5264 END_PROFILE(SMBsplopen);
5265 return;
5266 }
5267
5268 /****************************************************************************
5269 Reply to a printclose.
5270 ****************************************************************************/
5271
5272 void reply_printclose(struct smb_request *req)
5273 {
5274 connection_struct *conn = req->conn;
5275 files_struct *fsp;
5276 NTSTATUS status;
5277
5278 START_PROFILE(SMBsplclose);
5279
5280 if (req->wct < 1) {
5281 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5282 END_PROFILE(SMBsplclose);
5283 return;
5284 }
5285
5286 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5287
5288 if (!check_fsp(conn, req, fsp)) {
5289 END_PROFILE(SMBsplclose);
5290 return;
5291 }
5292
5293 if (!CAN_PRINT(conn)) {
5294 reply_force_doserror(req, ERRSRV, ERRerror);
5295 END_PROFILE(SMBsplclose);
5296 return;
5297 }
5298
5299 DEBUG(3,("printclose fd=%d fnum=%d\n",
5300 fsp->fh->fd,fsp->fnum));
5301
5302 status = close_file(req, fsp, NORMAL_CLOSE);
5303
5304 if(!NT_STATUS_IS_OK(status)) {
5305 reply_nterror(req, status);
5306 END_PROFILE(SMBsplclose);
5307 return;
5308 }
5309
5310 reply_outbuf(req, 0, 0);
5311
5312 END_PROFILE(SMBsplclose);
5313 return;
5314 }
5315
5316 /****************************************************************************
5317 Reply to a printqueue.
5318 ****************************************************************************/
5319
5320 void reply_printqueue(struct smb_request *req)
5321 {
5322 connection_struct *conn = req->conn;
5323 int max_count;
5324 int start_index;
5325
5326 START_PROFILE(SMBsplretq);
5327
5328 if (req->wct < 2) {
5329 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5330 END_PROFILE(SMBsplretq);
5331 return;
5332 }
5333
5334 max_count = SVAL(req->vwv+0, 0);
5335 start_index = SVAL(req->vwv+1, 0);
5336
5337 /* we used to allow the client to get the cnum wrong, but that
5338 is really quite gross and only worked when there was only
5339 one printer - I think we should now only accept it if they
5340 get it right (tridge) */
5341 if (!CAN_PRINT(conn)) {
5342 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5343 END_PROFILE(SMBsplretq);
5344 return;
5345 }
5346
5347 reply_outbuf(req, 2, 3);
5348 SSVAL(req->outbuf,smb_vwv0,0);
5349 SSVAL(req->outbuf,smb_vwv1,0);
5350 SCVAL(smb_buf(req->outbuf),0,1);
5351 SSVAL(smb_buf(req->outbuf),1,0);
5352
5353 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5354 start_index, max_count));
5355
5356 {
5357 TALLOC_CTX *mem_ctx = talloc_tos();
5358 NTSTATUS status;
5359 WERROR werr;
5360 const char *sharename = lp_servicename(SNUM(conn));
5361 struct rpc_pipe_client *cli = NULL;
5362 struct dcerpc_binding_handle *b = NULL;
5363 struct policy_handle handle;
5364 struct spoolss_DevmodeContainer devmode_ctr;
5365 union spoolss_JobInfo *info;
5366 uint32_t count;
5367 uint32_t num_to_get;
5368 uint32_t first;
5369 uint32_t i;
5370
5371 ZERO_STRUCT(handle);
5372
5373 status = rpc_pipe_open_interface(conn,
5374 &ndr_table_spoolss.syntax_id,
5375 conn->session_info,
5376 conn->sconn->remote_address,
5377 conn->sconn->msg_ctx,
5378 &cli);
5379 if (!NT_STATUS_IS_OK(status)) {
5380 DEBUG(0, ("reply_printqueue: "
5381 "could not connect to spoolss: %s\n",
5382 nt_errstr(status)));
5383 reply_nterror(req, status);
5384 goto out;
5385 }
5386 b = cli->binding_handle;
5387
5388 ZERO_STRUCT(devmode_ctr);
5389
5390 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5391 sharename,
5392 NULL, devmode_ctr,
5393 SEC_FLAG_MAXIMUM_ALLOWED,
5394 &handle,
5395 &werr);
5396 if (!NT_STATUS_IS_OK(status)) {
5397 reply_nterror(req, status);
5398 goto out;
5399 }
5400 if (!W_ERROR_IS_OK(werr)) {
5401 reply_nterror(req, werror_to_ntstatus(werr));
5402 goto out;
5403 }
5404
5405 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5406 &handle,
5407 0, /* firstjob */
5408 0xff, /* numjobs */
5409 2, /* level */
5410 0, /* offered */
5411 &count,
5412 &info);
5413 if (!W_ERROR_IS_OK(werr)) {
5414 reply_nterror(req, werror_to_ntstatus(werr));
5415 goto out;
5416 }
5417
5418 if (max_count > 0) {
5419 first = start_index;
5420 } else {
5421 first = start_index + max_count + 1;
5422 }
5423
5424 if (first >= count) {
5425 num_to_get = first;
5426 } else {
5427 num_to_get = first + MIN(ABS(max_count), count - first);
5428 }
5429
5430 for (i = first; i < num_to_get; i++) {
5431 char blob[28];
5432 char *p = blob;
5433 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5434 int qstatus;
5435 uint16_t qrapjobid = pjobid_to_rap(sharename,
5436 info[i].info2.job_id);
5437
5438 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5439 qstatus = 2;
5440 } else {
5441 qstatus = 3;
5442 }
5443
5444 srv_put_dos_date2(p, 0, qtime);
5445 SCVAL(p, 4, qstatus);
5446 SSVAL(p, 5, qrapjobid);
5447 SIVAL(p, 7, info[i].info2.size);
5448 SCVAL(p, 11, 0);
5449 srvstr_push(blob, req->flags2, p+12,
5450 info[i].info2.notify_name, 16, STR_ASCII);
5451
5452 if (message_push_blob(
5453 &req->outbuf,
5454 data_blob_const(
5455 blob, sizeof(blob))) == -1) {
5456 reply_nterror(req, NT_STATUS_NO_MEMORY);
5457 goto out;
5458 }
5459 }
5460
5461 if (count > 0) {
5462 SSVAL(req->outbuf,smb_vwv0,count);
5463 SSVAL(req->outbuf,smb_vwv1,
5464 (max_count>0?first+count:first-1));
5465 SCVAL(smb_buf(req->outbuf),0,1);
5466 SSVAL(smb_buf(req->outbuf),1,28*count);
5467 }
5468
5469
5470 DEBUG(3, ("%u entries returned in queue\n",
5471 (unsigned)count));
5472
5473 out:
5474 if (b && is_valid_policy_hnd(&handle)) {
5475 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5476 }
5477
5478 }
5479
5480 END_PROFILE(SMBsplretq);
5481 return;
5482 }
5483
5484 /****************************************************************************
5485 Reply to a printwrite.
5486 ****************************************************************************/
5487
5488 void reply_printwrite(struct smb_request *req)
5489 {
5490 connection_struct *conn = req->conn;
5491 int numtowrite;
5492 const char *data;
5493 files_struct *fsp;
5494
5495 START_PROFILE(SMBsplwr);
5496
5497 if (req->wct < 1) {
5498 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5499 END_PROFILE(SMBsplwr);
5500 return;
5501 }
5502
5503 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5504
5505 if (!check_fsp(conn, req, fsp)) {
5506 END_PROFILE(SMBsplwr);
5507 return;
5508 }
5509
5510 if (!fsp->print_file) {
5511 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5512 END_PROFILE(SMBsplwr);
5513 return;
5514 }
5515
5516 if (!CHECK_WRITE(fsp)) {
5517 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5518 END_PROFILE(SMBsplwr);
5519 return;
5520 }
5521
5522 numtowrite = SVAL(req->buf, 1);
5523
5524 if (req->buflen < numtowrite + 3) {
5525 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5526 END_PROFILE(SMBsplwr);
5527 return;
5528 }
5529
5530 data = (const char *)req->buf + 3;
5531
5532 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5533 reply_nterror(req, map_nt_error_from_unix(errno));
5534 END_PROFILE(SMBsplwr);
5535 return;
5536 }
5537
5538 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5539
5540 END_PROFILE(SMBsplwr);
5541 return;
5542 }
5543
5544 /****************************************************************************
5545 Reply to a mkdir.
5546 ****************************************************************************/
5547
5548 void reply_mkdir(struct smb_request *req)
5549 {
5550 connection_struct *conn = req->conn;
5551 struct smb_filename *smb_dname = NULL;
5552 char *directory = NULL;
5553 NTSTATUS status;
5554 TALLOC_CTX *ctx = talloc_tos();
5555
5556 START_PROFILE(SMBmkdir);
5557
5558 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5559 STR_TERMINATE, &status);
5560 if (!NT_STATUS_IS_OK(status)) {
5561 reply_nterror(req, status);
5562 goto out;
5563 }
5564
5565 status = filename_convert(ctx, conn,
5566 req->flags2 & FLAGS2_DFS_PATHNAMES,
5567 directory,
5568 0,
5569 NULL,
5570 &smb_dname);
5571 if (!NT_STATUS_IS_OK(status)) {
5572 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5573 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5574 ERRSRV, ERRbadpath);
5575 goto out;
5576 }
5577 reply_nterror(req, status);
5578 goto out;
5579 }
5580
5581 status = create_directory(conn, req, smb_dname);
5582
5583 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5584
5585 if (!NT_STATUS_IS_OK(status)) {
5586
5587 if (!use_nt_status()
5588 && NT_STATUS_EQUAL(status,
5589 NT_STATUS_OBJECT_NAME_COLLISION)) {
5590 /*
5591 * Yes, in the DOS error code case we get a
5592 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5593 * samba4 torture test.
5594 */
5595 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5596 }
5597
5598 reply_nterror(req, status);
5599 goto out;
5600 }
5601
5602 reply_outbuf(req, 0, 0);
5603
5604 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5605 out:
5606 TALLOC_FREE(smb_dname);
5607 END_PROFILE(SMBmkdir);
5608 return;
5609 }
5610
5611 /****************************************************************************
5612 Reply to a rmdir.
5613 ****************************************************************************/
5614
5615 void reply_rmdir(struct smb_request *req)
5616 {
5617 connection_struct *conn = req->conn;
5618 struct smb_filename *smb_dname = NULL;
5619 char *directory = NULL;
5620 NTSTATUS status;
5621 TALLOC_CTX *ctx = talloc_tos();
5622 files_struct *fsp = NULL;
5623 int info = 0;
5624 struct smbd_server_connection *sconn = req->sconn;
5625
5626 START_PROFILE(SMBrmdir);
5627
5628 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5629 STR_TERMINATE, &status);
5630 if (!NT_STATUS_IS_OK(status)) {
5631 reply_nterror(req, status);
5632 goto out;
5633 }
5634
5635 status = filename_convert(ctx, conn,
5636 req->flags2 & FLAGS2_DFS_PATHNAMES,
5637 directory,
5638 0,
5639 NULL,
5640 &smb_dname);
5641 if (!NT_STATUS_IS_OK(status)) {
5642 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5643 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5644 ERRSRV, ERRbadpath);
5645 goto out;
5646 }
5647 reply_nterror(req, status);
5648 goto out;
5649 }
5650
5651 if (is_ntfs_stream_smb_fname(smb_dname)) {
5652 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5653 goto out;
5654 }
5655
5656 status = SMB_VFS_CREATE_FILE(
5657 conn, /* conn */
5658 req, /* req */
5659 0, /* root_dir_fid */
5660 smb_dname, /* fname */
5661 DELETE_ACCESS, /* access_mask */
5662 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5663 FILE_SHARE_DELETE),
5664 FILE_OPEN, /* create_disposition*/
5665 FILE_DIRECTORY_FILE, /* create_options */
5666 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5667 0, /* oplock_request */
5668 0, /* allocation_size */
5669 0, /* private_flags */
5670 NULL, /* sd */
5671 NULL, /* ea_list */
5672 &fsp, /* result */
5673 &info); /* pinfo */
5674
5675 if (!NT_STATUS_IS_OK(status)) {
5676 if (open_was_deferred(req->sconn, req->mid)) {
5677 /* We have re-scheduled this call. */
5678 goto out;
5679 }
5680 reply_nterror(req, status);
5681 goto out;
5682 }
5683
5684 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5685 if (!NT_STATUS_IS_OK(status)) {
5686 close_file(req, fsp, ERROR_CLOSE);
5687 reply_nterror(req, status);
5688 goto out;
5689 }
5690
5691 if (!set_delete_on_close(fsp, true, conn->session_info->unix_token)) {
5692 close_file(req, fsp, ERROR_CLOSE);
5693 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5694 goto out;
5695 }
5696
5697 status = close_file(req, fsp, NORMAL_CLOSE);
5698 if (!NT_STATUS_IS_OK(status)) {
5699 reply_nterror(req, status);
5700 } else {
5701 reply_outbuf(req, 0, 0);
5702 }
5703
5704 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5705
5706 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5707 out:
5708 TALLOC_FREE(smb_dname);
5709 END_PROFILE(SMBrmdir);
5710 return;
5711 }
5712
5713 /*******************************************************************
5714 Resolve wildcards in a filename rename.
5715 ********************************************************************/
5716
5717 static bool resolve_wildcards(TALLOC_CTX *ctx,
5718 const char *name1,
5719 const char *name2,
5720 char **pp_newname)
5721 {
5722 char *name2_copy = NULL;
5723 char *root1 = NULL;
5724 char *root2 = NULL;
5725 char *ext1 = NULL;
5726 char *ext2 = NULL;
5727 char *p,*p2, *pname1, *pname2;
5728
5729 name2_copy = talloc_strdup(ctx, name2);
5730 if (!name2_copy) {
5731 return False;
5732 }
5733
5734 pname1 = strrchr_m(name1,'/');
5735 pname2 = strrchr_m(name2_copy,'/');
5736
5737 if (!pname1 || !pname2) {
5738 return False;
5739 }
5740
5741 /* Truncate the copy of name2 at the last '/' */
5742 *pname2 = '\0';
5743
5744 /* Now go past the '/' */
5745 pname1++;
5746 pname2++;
5747
5748 root1 = talloc_strdup(ctx, pname1);
5749 root2 = talloc_strdup(ctx, pname2);
5750
5751 if (!root1 || !root2) {
5752 return False;
5753 }
5754
5755 p = strrchr_m(root1,'.');
5756 if (p) {
5757 *p = 0;
5758 ext1 = talloc_strdup(ctx, p+1);
5759 } else {
5760 ext1 = talloc_strdup(ctx, "");
5761 }
5762 p = strrchr_m(root2,'.');
5763 if (p) {
5764 *p = 0;
5765 ext2 = talloc_strdup(ctx, p+1);
5766 } else {
5767 ext2 = talloc_strdup(ctx, "");
5768 }
5769
5770 if (!ext1 || !ext2) {
5771 return False;
5772 }
5773
5774 p = root1;
5775 p2 = root2;
5776 while (*p2) {
5777 if (*p2 == '?') {
5778 /* Hmmm. Should this be mb-aware ? */
5779 *p2 = *p;
5780 p2++;
5781 } else if (*p2 == '*') {
5782 *p2 = '\0';
5783 root2 = talloc_asprintf(ctx, "%s%s",
5784 root2,
5785 p);
5786 if (!root2) {
5787 return False;
5788 }
5789 break;
5790 } else {
5791 p2++;
5792 }
5793 if (*p) {
5794 p++;
5795 }
5796 }
5797
5798 p = ext1;
5799 p2 = ext2;
5800 while (*p2) {
5801 if (*p2 == '?') {
5802 /* Hmmm. Should this be mb-aware ? */
5803 *p2 = *p;
5804 p2++;
5805 } else if (*p2 == '*') {
5806 *p2 = '\0';
5807 ext2 = talloc_asprintf(ctx, "%s%s",
5808 ext2,
5809 p);
5810 if (!ext2) {
5811 return False;
5812 }
5813 break;
5814 } else {
5815 p2++;
5816 }
5817 if (*p) {
5818 p++;
5819 }
5820 }
5821
5822 if (*ext2) {
5823 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5824 name2_copy,
5825 root2,
5826 ext2);
5827 } else {
5828 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5829 name2_copy,
5830 root2);
5831 }
5832
5833 if (!*pp_newname) {
5834 return False;
5835 }
5836
5837 return True;
5838 }
5839
5840 /****************************************************************************
5841 Ensure open files have their names updated. Updated to notify other smbd's
5842 asynchronously.
5843 ****************************************************************************/
5844
5845 static void rename_open_files(connection_struct *conn,
5846 struct share_mode_lock *lck,
5847 uint32_t orig_name_hash,
5848 const struct smb_filename *smb_fname_dst)
5849 {
5850 files_struct *fsp;
5851 bool did_rename = False;
5852 NTSTATUS status;
5853 uint32_t new_name_hash = 0;
5854
5855 for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5856 fsp = file_find_di_next(fsp)) {
5857 /* fsp_name is a relative path under the fsp. To change this for other
5858 sharepaths we need to manipulate relative paths. */
5859 /* TODO - create the absolute path and manipulate the newname
5860 relative to the sharepath. */
5861 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5862 continue;
5863 }
5864 if (fsp->name_hash != orig_name_hash) {
5865 continue;
5866 }
5867 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5868 "(file_id %s) from %s -> %s\n", fsp->fnum,
5869 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5870 smb_fname_str_dbg(smb_fname_dst)));
5871
5872 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5873 if (NT_STATUS_IS_OK(status)) {
5874 did_rename = True;
5875 new_name_hash = fsp->name_hash;
5876 }
5877 }
5878
5879 if (!did_rename) {
5880 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5881 "for %s\n", file_id_string_tos(&lck->id),
5882 smb_fname_str_dbg(smb_fname_dst)));
5883 }
5884
5885 /* Send messages to all smbd's (not ourself) that the name has changed. */
5886 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5887 orig_name_hash, new_name_hash,
5888 smb_fname_dst);
5889
5890 }
5891
5892 /****************************************************************************
5893 We need to check if the source path is a parent directory of the destination
5894 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5895 refuse the rename with a sharing violation. Under UNIX the above call can
5896 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5897 probably need to check that the client is a Windows one before disallowing
5898 this as a UNIX client (one with UNIX extensions) can know the source is a
5899 symlink and make this decision intelligently. Found by an excellent bug
5900 report from <AndyLiebman@aol.com>.
5901 ****************************************************************************/
5902
5903 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5904 const struct smb_filename *smb_fname_dst)
5905 {
5906 const char *psrc = smb_fname_src->base_name;
5907 const char *pdst = smb_fname_dst->base_name;
5908 size_t slen;
5909
5910 if (psrc[0] == '.' && psrc[1] == '/') {
5911 psrc += 2;
5912 }
5913 if (pdst[0] == '.' && pdst[1] == '/') {
5914 pdst += 2;
5915 }
5916 if ((slen = strlen(psrc)) > strlen(pdst)) {
5917 return False;
5918 }
5919 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5920 }
5921
5922 /*
5923 * Do the notify calls from a rename
5924 */
5925
5926 static void notify_rename(connection_struct *conn, bool is_dir,
5927 const struct smb_filename *smb_fname_src,
5928 const struct smb_filename *smb_fname_dst)
5929 {
5930 char *parent_dir_src = NULL;
5931 char *parent_dir_dst = NULL;
5932 uint32 mask;
5933
5934 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5935 : FILE_NOTIFY_CHANGE_FILE_NAME;
5936
5937 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5938 &parent_dir_src, NULL) ||
5939 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5940 &parent_dir_dst, NULL)) {
5941 goto out;
5942 }
5943
5944 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5945 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5946 smb_fname_src->base_name);
5947 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5948 smb_fname_dst->base_name);
5949 }
5950 else {
5951 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5952 smb_fname_src->base_name);
5953 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5954 smb_fname_dst->base_name);
5955 }
5956
5957 /* this is a strange one. w2k3 gives an additional event for
5958 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5959 files, but not directories */
5960 if (!is_dir) {
5961 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5962 FILE_NOTIFY_CHANGE_ATTRIBUTES
5963 |FILE_NOTIFY_CHANGE_CREATION,
5964 smb_fname_dst->base_name);
5965 }
5966 out:
5967 TALLOC_FREE(parent_dir_src);
5968 TALLOC_FREE(parent_dir_dst);
5969 }
5970
5971 /****************************************************************************
5972 Returns an error if the parent directory for a filename is open in an
5973 incompatible way.
5974 ****************************************************************************/
5975
5976 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5977 const struct smb_filename *smb_fname_dst_in)
5978 {
5979 char *parent_dir = NULL;
5980 struct smb_filename smb_fname_parent;
5981 struct file_id id;
5982 files_struct *fsp = NULL;
5983 int ret;
5984
5985 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5986 &parent_dir, NULL)) {
5987 return NT_STATUS_NO_MEMORY;
5988 }
5989 ZERO_STRUCT(smb_fname_parent);
5990 smb_fname_parent.base_name = parent_dir;
5991
5992 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
5993 if (ret == -1) {
5994 return map_nt_error_from_unix(errno);
5995 }
5996
5997 /*
5998 * We're only checking on this smbd here, mostly good
5999 * enough.. and will pass tests.
6000 */
6001
6002 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6003 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6004 fsp = file_find_di_next(fsp)) {
6005 if (fsp->access_mask & DELETE_ACCESS) {
6006 return NT_STATUS_SHARING_VIOLATION;
6007 }
6008 }
6009 return NT_STATUS_OK;
6010 }
6011
6012 /****************************************************************************
6013 Rename an open file - given an fsp.
6014 ****************************************************************************/
6015
6016 NTSTATUS rename_internals_fsp(connection_struct *conn,
6017 files_struct *fsp,
6018 const struct smb_filename *smb_fname_dst_in,
6019 uint32 attrs,
6020 bool replace_if_exists)
6021 {
6022 TALLOC_CTX *ctx = talloc_tos();
6023 struct smb_filename *smb_fname_dst = NULL;
6024 NTSTATUS status = NT_STATUS_OK;
6025 struct share_mode_lock *lck = NULL;
6026 bool dst_exists, old_is_stream, new_is_stream;
6027
6028 status = check_name(conn, smb_fname_dst_in->base_name);
6029 if (!NT_STATUS_IS_OK(status)) {
6030 return status;
6031 }
6032
6033 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6034 if (!NT_STATUS_IS_OK(status)) {
6035 return status;
6036 }
6037
6038 /* Make a copy of the dst smb_fname structs */
6039
6040 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6041 if (!NT_STATUS_IS_OK(status)) {
6042 goto out;
6043 }
6044
6045 /*
6046 * Check for special case with case preserving and not
6047 * case sensitive. If the old last component differs from the original
6048 * last component only by case, then we should allow
6049 * the rename (user is trying to change the case of the
6050 * filename).
6051 */
6052 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6053 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6054 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6055 char *last_slash;
6056 char *fname_dst_lcomp_base_mod = NULL;
6057 struct smb_filename *smb_fname_orig_lcomp = NULL;
6058
6059 /*
6060 * Get the last component of the destination name.
6061 */
6062 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6063 if (last_slash) {
6064 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6065 } else {
6066 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6067 }
6068 if (!fname_dst_lcomp_base_mod) {
6069 status = NT_STATUS_NO_MEMORY;
6070 goto out;
6071 }
6072
6073 /*
6074 * Create an smb_filename struct using the original last
6075 * component of the destination.
6076 */
6077 status = create_synthetic_smb_fname_split(ctx,
6078 smb_fname_dst->original_lcomp, NULL,
6079 &smb_fname_orig_lcomp);
6080 if (!NT_STATUS_IS_OK(status)) {
6081 TALLOC_FREE(fname_dst_lcomp_base_mod);
6082 goto out;
6083 }
6084
6085 /* If the base names only differ by case, use original. */
6086 if(!strcsequal(fname_dst_lcomp_base_mod,
6087 smb_fname_orig_lcomp->base_name)) {
6088 char *tmp;
6089 /*
6090 * Replace the modified last component with the
6091 * original.
6092 */
6093 if (last_slash) {
6094 *last_slash = '\0'; /* Truncate at the '/' */
6095 tmp = talloc_asprintf(smb_fname_dst,
6096 "%s/%s",
6097 smb_fname_dst->base_name,
6098 smb_fname_orig_lcomp->base_name);
6099 } else {
6100 tmp = talloc_asprintf(smb_fname_dst,
6101 "%s",
6102 smb_fname_orig_lcomp->base_name);
6103 }
6104 if (tmp == NULL) {
6105 status = NT_STATUS_NO_MEMORY;
6106 TALLOC_FREE(fname_dst_lcomp_base_mod);
6107 TALLOC_FREE(smb_fname_orig_lcomp);
6108 goto out;
6109 }
6110 TALLOC_FREE(smb_fname_dst->base_name);
6111 smb_fname_dst->base_name = tmp;
6112 }
6113
6114 /* If the stream_names only differ by case, use original. */
6115 if(!strcsequal(smb_fname_dst->stream_name,
6116 smb_fname_orig_lcomp->stream_name)) {
6117 char *tmp = NULL;
6118 /* Use the original stream. */
6119 tmp = talloc_strdup(smb_fname_dst,
6120 smb_fname_orig_lcomp->stream_name);
6121 if (tmp == NULL) {
6122 status = NT_STATUS_NO_MEMORY;
6123 TALLOC_FREE(fname_dst_lcomp_base_mod);
6124 TALLOC_FREE(smb_fname_orig_lcomp);
6125 goto out;
6126 }
6127 TALLOC_FREE(smb_fname_dst->stream_name);
6128 smb_fname_dst->stream_name = tmp;
6129 }
6130 TALLOC_FREE(fname_dst_lcomp_base_mod);
6131 TALLOC_FREE(smb_fname_orig_lcomp);
6132 }
6133
6134 /*
6135 * If the src and dest names are identical - including case,
6136 * don't do the rename, just return success.
6137 */
6138
6139 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6140 strcsequal(fsp->fsp_name->stream_name,
6141 smb_fname_dst->stream_name)) {
6142 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6143 "- returning success\n",
6144 smb_fname_str_dbg(smb_fname_dst)));
6145 status = NT_STATUS_OK;
6146 goto out;
6147 }
6148
6149 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6150 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6151
6152 /* Return the correct error code if both names aren't streams. */
6153 if (!old_is_stream && new_is_stream) {
6154 status = NT_STATUS_OBJECT_NAME_INVALID;
6155 goto out;
6156 }
6157
6158 if (old_is_stream && !new_is_stream) {
6159 status = NT_STATUS_INVALID_PARAMETER;
6160 goto out;
6161 }
6162
6163 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6164
6165 if(!replace_if_exists && dst_exists) {
6166 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6167 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6168 smb_fname_str_dbg(smb_fname_dst)));
6169 status = NT_STATUS_OBJECT_NAME_COLLISION;
6170 goto out;
6171 }
6172
6173 if (dst_exists) {
6174 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6175 &smb_fname_dst->st);
6176 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6177 fileid);
6178 /* The file can be open when renaming a stream */
6179 if (dst_fsp && !new_is_stream) {
6180 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6181 status = NT_STATUS_ACCESS_DENIED;
6182 goto out;
6183 }
6184 }
6185
6186 /* Ensure we have a valid stat struct for the source. */
6187 status = vfs_stat_fsp(fsp);
6188 if (!NT_STATUS_IS_OK(status)) {
6189 goto out;
6190 }
6191
6192 status = can_rename(conn, fsp, attrs);
6193
6194 if (!NT_STATUS_IS_OK(status)) {
6195 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6196 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6197 smb_fname_str_dbg(smb_fname_dst)));
6198 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6199 status = NT_STATUS_ACCESS_DENIED;
6200 goto out;
6201 }
6202
6203 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6204 status = NT_STATUS_ACCESS_DENIED;
6205 }
6206
6207 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6208 NULL);
6209
6210 /*
6211 * We have the file open ourselves, so not being able to get the
6212 * corresponding share mode lock is a fatal error.
6213 */
6214
6215 SMB_ASSERT(lck != NULL);
6216
6217 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6218 uint32 create_options = fsp->fh->private_options;
6219
6220 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6221 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6222 smb_fname_str_dbg(smb_fname_dst)));
6223
6224 if (!lp_posix_pathnames() &&
6225 (lp_map_archive(SNUM(conn)) ||
6226 lp_store_dos_attributes(SNUM(conn)))) {
6227 /* We must set the archive bit on the newly
6228 renamed file. */
6229 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6230 uint32_t old_dosmode = dos_mode(conn,
6231 smb_fname_dst);
6232 file_set_dosmode(conn,
6233 smb_fname_dst,
6234 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6235 NULL,
6236 true);
6237 }
6238 }
6239
6240 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6241 smb_fname_dst);
6242
6243 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6244
6245 /*
6246 * A rename acts as a new file create w.r.t. allowing an initial delete
6247 * on close, probably because in Windows there is a new handle to the
6248 * new file. If initial delete on close was requested but not
6249 * originally set, we need to set it here. This is probably not 100% correct,
6250 * but will work for the CIFSFS client which in non-posix mode
6251 * depends on these semantics. JRA.
6252 */
6253
6254 if (create_options & FILE_DELETE_ON_CLOSE) {
6255 status = can_set_delete_on_close(fsp, 0);
6256
6257 if (NT_STATUS_IS_OK(status)) {
6258 /* Note that here we set the *inital* delete on close flag,
6259 * not the regular one. The magic gets handled in close. */
6260 fsp->initial_delete_on_close = True;
6261 }
6262 }
6263 TALLOC_FREE(lck);
6264 status = NT_STATUS_OK;
6265 goto out;
6266 }
6267
6268 TALLOC_FREE(lck);
6269
6270 if (errno == ENOTDIR || errno == EISDIR) {
6271 status = NT_STATUS_OBJECT_NAME_COLLISION;
6272 } else {
6273 status = map_nt_error_from_unix(errno);
6274 }
6275
6276 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6277 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6278 smb_fname_str_dbg(smb_fname_dst)));
6279
6280 out:
6281 TALLOC_FREE(smb_fname_dst);
6282
6283 return status;
6284 }
6285
6286 /****************************************************************************
6287 The guts of the rename command, split out so it may be called by the NT SMB
6288 code.
6289 ****************************************************************************/
6290
6291 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6292 connection_struct *conn,
6293 struct smb_request *req,
6294 struct smb_filename *smb_fname_src,
6295 struct smb_filename *smb_fname_dst,
6296 uint32 attrs,
6297 bool replace_if_exists,
6298 bool src_has_wild,
6299 bool dest_has_wild,
6300 uint32_t access_mask)
6301 {
6302 char *fname_src_dir = NULL;
6303 char *fname_src_mask = NULL;
6304 int count=0;
6305 NTSTATUS status = NT_STATUS_OK;
6306 struct smb_Dir *dir_hnd = NULL;
6307 const char *dname = NULL;
6308 char *talloced = NULL;
6309 long offset = 0;
6310 int create_options = 0;
6311 bool posix_pathnames = lp_posix_pathnames();
6312
6313 /*
6314 * Split the old name into directory and last component
6315 * strings. Note that unix_convert may have stripped off a
6316 * leading ./ from both name and newname if the rename is
6317 * at the root of the share. We need to make sure either both
6318 * name and newname contain a / character or neither of them do
6319 * as this is checked in resolve_wildcards().
6320 */
6321
6322 /* Split up the directory from the filename/mask. */
6323 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6324 &fname_src_dir, &fname_src_mask);
6325 if (!NT_STATUS_IS_OK(status)) {
6326 status = NT_STATUS_NO_MEMORY;
6327 goto out;
6328 }
6329
6330 /*
6331 * We should only check the mangled cache
6332 * here if unix_convert failed. This means
6333 * that the path in 'mask' doesn't exist
6334 * on the file system and so we need to look
6335 * for a possible mangle. This patch from
6336 * Tine Smukavec <valentin.smukavec@hermes.si>.
6337 */
6338
6339 if (!VALID_STAT(smb_fname_src->st) &&
6340 mangle_is_mangled(fname_src_mask, conn->params)) {
6341 char *new_mask = NULL;
6342 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6343 conn->params);
6344 if (new_mask) {
6345 TALLOC_FREE(fname_src_mask);
6346 fname_src_mask = new_mask;
6347 }
6348 }
6349
6350 if (!src_has_wild) {
6351 files_struct *fsp;
6352
6353 /*
6354 * Only one file needs to be renamed. Append the mask back
6355 * onto the directory.
6356 */
6357 TALLOC_FREE(smb_fname_src->base_name);
6358 if (ISDOT(fname_src_dir)) {
6359 /* Ensure we use canonical names on open. */
6360 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6361 "%s",
6362 fname_src_mask);
6363 } else {
6364 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6365 "%s/%s",
6366 fname_src_dir,
6367 fname_src_mask);
6368 }
6369 if (!smb_fname_src->base_name) {
6370 status = NT_STATUS_NO_MEMORY;
6371 goto out;
6372 }
6373
6374 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6375 "case_preserve = %d, short case preserve = %d, "
6376 "directory = %s, newname = %s, "
6377 "last_component_dest = %s\n",
6378 conn->case_sensitive, conn->case_preserve,
6379 conn->short_case_preserve,
6380 smb_fname_str_dbg(smb_fname_src),
6381 smb_fname_str_dbg(smb_fname_dst),
6382 smb_fname_dst->original_lcomp));
6383
6384 /* The dest name still may have wildcards. */
6385 if (dest_has_wild) {
6386 char *fname_dst_mod = NULL;
6387 if (!resolve_wildcards(smb_fname_dst,
6388 smb_fname_src->base_name,
6389 smb_fname_dst->base_name,
6390 &fname_dst_mod)) {
6391 DEBUG(6, ("rename_internals: resolve_wildcards "
6392 "%s %s failed\n",
6393 smb_fname_src->base_name,
6394 smb_fname_dst->base_name));
6395 status = NT_STATUS_NO_MEMORY;
6396 goto out;
6397 }
6398 TALLOC_FREE(smb_fname_dst->base_name);
6399 smb_fname_dst->base_name = fname_dst_mod;
6400 }
6401
6402 ZERO_STRUCT(smb_fname_src->st);
6403 if (posix_pathnames) {
6404 SMB_VFS_LSTAT(conn, smb_fname_src);
6405 } else {
6406 SMB_VFS_STAT(conn, smb_fname_src);
6407 }
6408
6409 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6410 create_options |= FILE_DIRECTORY_FILE;
6411 }
6412
6413 status = SMB_VFS_CREATE_FILE(
6414 conn, /* conn */
6415 req, /* req */
6416 0, /* root_dir_fid */
6417 smb_fname_src, /* fname */
6418 access_mask, /* access_mask */
6419 (FILE_SHARE_READ | /* share_access */
6420 FILE_SHARE_WRITE),
6421 FILE_OPEN, /* create_disposition*/
6422 create_options, /* create_options */
6423 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6424 0, /* oplock_request */
6425 0, /* allocation_size */
6426 0, /* private_flags */
6427 NULL, /* sd */
6428 NULL, /* ea_list */
6429 &fsp, /* result */
6430 NULL); /* pinfo */
6431
6432 if (!NT_STATUS_IS_OK(status)) {
6433 DEBUG(3, ("Could not open rename source %s: %s\n",
6434 smb_fname_str_dbg(smb_fname_src),
6435 nt_errstr(status)));
6436 goto out;
6437 }
6438
6439 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6440 attrs, replace_if_exists);
6441
6442 close_file(req, fsp, NORMAL_CLOSE);
6443
6444 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6445 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6446 smb_fname_str_dbg(smb_fname_dst)));
6447
6448 goto out;
6449 }
6450
6451 /*
6452 * Wildcards - process each file that matches.
6453 */
6454 if (strequal(fname_src_mask, "????????.???")) {
6455 TALLOC_FREE(fname_src_mask);
6456 fname_src_mask = talloc_strdup(ctx, "*");
6457 if (!fname_src_mask) {
6458 status = NT_STATUS_NO_MEMORY;
6459 goto out;
6460 }
6461 }
6462
6463 status = check_name(conn, fname_src_dir);
6464 if (!NT_STATUS_IS_OK(status)) {
6465 goto out;
6466 }
6467
6468 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6469 attrs);
6470 if (dir_hnd == NULL) {
6471 status = map_nt_error_from_unix(errno);
6472 goto out;
6473 }
6474
6475 status = NT_STATUS_NO_SUCH_FILE;
6476 /*
6477 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6478 * - gentest fix. JRA
6479 */
6480
6481 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6482 &talloced))) {
6483 files_struct *fsp = NULL;
6484 char *destname = NULL;
6485 bool sysdir_entry = False;
6486
6487 /* Quick check for "." and ".." */
6488 if (ISDOT(dname) || ISDOTDOT(dname)) {
6489 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6490 sysdir_entry = True;
6491 } else {
6492 TALLOC_FREE(talloced);
6493 continue;
6494 }
6495 }
6496
6497 if (!is_visible_file(conn, fname_src_dir, dname,
6498 &smb_fname_src->st, false)) {
6499 TALLOC_FREE(talloced);
6500 continue;
6501 }
6502
6503 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6504 TALLOC_FREE(talloced);
6505 continue;
6506 }
6507
6508 if (sysdir_entry) {
6509 status = NT_STATUS_OBJECT_NAME_INVALID;
6510 break;
6511 }
6512
6513 TALLOC_FREE(smb_fname_src->base_name);
6514 if (ISDOT(fname_src_dir)) {
6515 /* Ensure we use canonical names on open. */
6516 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6517 "%s",
6518 dname);
6519 } else {
6520 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6521 "%s/%s",
6522 fname_src_dir,
6523 dname);
6524 }
6525 if (!smb_fname_src->base_name) {
6526 status = NT_STATUS_NO_MEMORY;
6527 goto out;
6528 }
6529
6530 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6531 smb_fname_dst->base_name,
6532 &destname)) {
6533 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6534 smb_fname_src->base_name, destname));
6535 TALLOC_FREE(talloced);
6536 continue;
6537 }
6538 if (!destname) {
6539 status = NT_STATUS_NO_MEMORY;
6540 goto out;
6541 }
6542
6543 TALLOC_FREE(smb_fname_dst->base_name);
6544 smb_fname_dst->base_name = destname;
6545
6546 ZERO_STRUCT(smb_fname_src->st);
6547 if (posix_pathnames) {
6548 SMB_VFS_LSTAT(conn, smb_fname_src);
6549 } else {
6550 SMB_VFS_STAT(conn, smb_fname_src);
6551 }
6552
6553 create_options = 0;
6554
6555 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6556 create_options |= FILE_DIRECTORY_FILE;
6557 }
6558
6559 status = SMB_VFS_CREATE_FILE(
6560 conn, /* conn */
6561 req, /* req */
6562 0, /* root_dir_fid */
6563 smb_fname_src, /* fname */
6564 access_mask, /* access_mask */
6565 (FILE_SHARE_READ | /* share_access */
6566 FILE_SHARE_WRITE),
6567 FILE_OPEN, /* create_disposition*/
6568 create_options, /* create_options */
6569 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6570 0, /* oplock_request */
6571 0, /* allocation_size */
6572 0, /* private_flags */
6573 NULL, /* sd */
6574 NULL, /* ea_list */
6575 &fsp, /* result */
6576 NULL); /* pinfo */
6577
6578 if (!NT_STATUS_IS_OK(status)) {
6579 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6580 "returned %s rename %s -> %s\n",
6581 nt_errstr(status),
6582 smb_fname_str_dbg(smb_fname_src),
6583 smb_fname_str_dbg(smb_fname_dst)));
6584 break;
6585 }
6586
6587 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6588 dname);
6589 if (!smb_fname_dst->original_lcomp) {
6590 status = NT_STATUS_NO_MEMORY;
6591 goto out;
6592 }
6593
6594 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6595 attrs, replace_if_exists);
6596
6597 close_file(req, fsp, NORMAL_CLOSE);
6598
6599 if (!NT_STATUS_IS_OK(status)) {
6600 DEBUG(3, ("rename_internals_fsp returned %s for "
6601 "rename %s -> %s\n", nt_errstr(status),
6602 smb_fname_str_dbg(smb_fname_src),
6603 smb_fname_str_dbg(smb_fname_dst)));
6604 break;
6605 }
6606
6607 count++;
6608
6609 DEBUG(3,("rename_internals: doing rename on %s -> "
6610 "%s\n", smb_fname_str_dbg(smb_fname_src),
6611 smb_fname_str_dbg(smb_fname_src)));
6612 TALLOC_FREE(talloced);
6613 }
6614 TALLOC_FREE(dir_hnd);
6615
6616 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6617 status = map_nt_error_from_unix(errno);
6618 }
6619
6620 out:
6621 TALLOC_FREE(talloced);
6622 TALLOC_FREE(fname_src_dir);
6623 TALLOC_FREE(fname_src_mask);
6624 return status;
6625 }
6626
6627 /****************************************************************************
6628 Reply to a mv.
6629 ****************************************************************************/
6630
6631 void reply_mv(struct smb_request *req)
6632 {
6633 connection_struct *conn = req->conn;
6634 char *name = NULL;
6635 char *newname = NULL;
6636 const char *p;
6637 uint32 attrs;
6638 NTSTATUS status;
6639 bool src_has_wcard = False;
6640 bool dest_has_wcard = False;
6641 TALLOC_CTX *ctx = talloc_tos();
6642 struct smb_filename *smb_fname_src = NULL;
6643 struct smb_filename *smb_fname_dst = NULL;
6644 bool stream_rename = false;
6645
6646 START_PROFILE(SMBmv);
6647
6648 if (req->wct < 1) {
6649 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6650 goto out;
6651 }
6652
6653 attrs = SVAL(req->vwv+0, 0);
6654
6655 p = (const char *)req->buf + 1;
6656 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6657 &status, &src_has_wcard);
6658 if (!NT_STATUS_IS_OK(status)) {
6659 reply_nterror(req, status);
6660 goto out;
6661 }
6662 p++;
6663 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6664 &status, &dest_has_wcard);
6665 if (!NT_STATUS_IS_OK(status)) {
6666 reply_nterror(req, status);
6667 goto out;
6668 }
6669
6670 if (!lp_posix_pathnames()) {
6671 /* The newname must begin with a ':' if the
6672 name contains a ':'. */
6673 if (strchr_m(name, ':')) {
6674 if (newname[0] != ':') {
6675 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6676 goto out;
6677 }
6678 stream_rename = true;
6679 }
6680 }
6681
6682 status = filename_convert(ctx,
6683 conn,
6684 req->flags2 & FLAGS2_DFS_PATHNAMES,
6685 name,
6686 UCF_COND_ALLOW_WCARD_LCOMP,
6687 &src_has_wcard,
6688 &smb_fname_src);
6689
6690 if (!NT_STATUS_IS_OK(status)) {
6691 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6692 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6693 ERRSRV, ERRbadpath);
6694 goto out;
6695 }
6696 reply_nterror(req, status);
6697 goto out;
6698 }
6699
6700 status = filename_convert(ctx,
6701 conn,
6702 req->flags2 & FLAGS2_DFS_PATHNAMES,
6703 newname,
6704 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6705 &dest_has_wcard,
6706 &smb_fname_dst);
6707
6708 if (!NT_STATUS_IS_OK(status)) {
6709 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6710 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6711 ERRSRV, ERRbadpath);
6712 goto out;
6713 }
6714 reply_nterror(req, status);
6715 goto out;
6716 }
6717
6718 if (stream_rename) {
6719 /* smb_fname_dst->base_name must be the same as
6720 smb_fname_src->base_name. */
6721 TALLOC_FREE(smb_fname_dst->base_name);
6722 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6723 smb_fname_src->base_name);
6724 if (!smb_fname_dst->base_name) {
6725 reply_nterror(req, NT_STATUS_NO_MEMORY);
6726 goto out;
6727 }
6728 }
6729
6730 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6731 smb_fname_str_dbg(smb_fname_dst)));
6732
6733 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6734 attrs, False, src_has_wcard, dest_has_wcard,
6735 DELETE_ACCESS);
6736 if (!NT_STATUS_IS_OK(status)) {
6737 if (open_was_deferred(req->sconn, req->mid)) {
6738 /* We have re-scheduled this call. */
6739 goto out;
6740 }
6741 reply_nterror(req, status);
6742 goto out;
6743 }
6744
6745 reply_outbuf(req, 0, 0);
6746 out:
6747 TALLOC_FREE(smb_fname_src);
6748 TALLOC_FREE(smb_fname_dst);
6749 END_PROFILE(SMBmv);
6750 return;
6751 }
6752
6753 /*******************************************************************
6754 Copy a file as part of a reply_copy.
6755 ******************************************************************/
6756
6757 /*
6758 * TODO: check error codes on all callers
6759 */
6760
6761 NTSTATUS copy_file(TALLOC_CTX *ctx,
6762 connection_struct *conn,
6763 struct smb_filename *smb_fname_src,
6764 struct smb_filename *smb_fname_dst,
6765 int ofun,
6766 int count,
6767 bool target_is_directory)
6768 {
6769 struct smb_filename *smb_fname_dst_tmp = NULL;
6770 SMB_OFF_T ret=-1;
6771 files_struct *fsp1,*fsp2;
6772 uint32 dosattrs;
6773 uint32 new_create_disposition;
6774 NTSTATUS status;
6775
6776
6777 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6778 if (!NT_STATUS_IS_OK(status)) {
6779 return status;
6780 }
6781
6782 /*
6783 * If the target is a directory, extract the last component from the
6784 * src filename and append it to the dst filename
6785 */
6786 if (target_is_directory) {
6787 const char *p;
6788
6789 /* dest/target can't be a stream if it's a directory. */
6790 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6791
6792 p = strrchr_m(smb_fname_src->base_name,'/');
6793 if (p) {
6794 p++;
6795 } else {
6796 p = smb_fname_src->base_name;
6797 }
6798 smb_fname_dst_tmp->base_name =
6799 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6800 p);
6801 if (!smb_fname_dst_tmp->base_name) {
6802 status = NT_STATUS_NO_MEMORY;
6803 goto out;
6804 }
6805 }
6806
6807 status = vfs_file_exist(conn, smb_fname_src);
6808 if (!NT_STATUS_IS_OK(status)) {
6809 goto out;
6810 }
6811
6812 if (!target_is_directory && count) {
6813 new_create_disposition = FILE_OPEN;
6814 } else {
6815 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6816 0, ofun,
6817 NULL, NULL,
6818 &new_create_disposition,
6819 NULL,
6820 NULL)) {
6821 status = NT_STATUS_INVALID_PARAMETER;
6822 goto out;
6823 }
6824 }
6825
6826 /* Open the src file for reading. */
6827 status = SMB_VFS_CREATE_FILE(
6828 conn, /* conn */
6829 NULL, /* req */
6830 0, /* root_dir_fid */
6831 smb_fname_src, /* fname */
6832 FILE_GENERIC_READ, /* access_mask */
6833 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6834 FILE_OPEN, /* create_disposition*/
6835 0, /* create_options */
6836 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6837 INTERNAL_OPEN_ONLY, /* oplock_request */
6838 0, /* allocation_size */
6839 0, /* private_flags */
6840 NULL, /* sd */
6841 NULL, /* ea_list */
6842 &fsp1, /* result */
6843 NULL); /* psbuf */
6844
6845 if (!NT_STATUS_IS_OK(status)) {
6846 goto out;
6847 }
6848
6849 dosattrs = dos_mode(conn, smb_fname_src);
6850
6851 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6852 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6853 }
6854
6855 /* Open the dst file for writing. */
6856 status = SMB_VFS_CREATE_FILE(
6857 conn, /* conn */
6858 NULL, /* req */
6859 0, /* root_dir_fid */
6860 smb_fname_dst, /* fname */
6861 FILE_GENERIC_WRITE, /* access_mask */
6862 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6863 new_create_disposition, /* create_disposition*/
6864 0, /* create_options */
6865 dosattrs, /* file_attributes */
6866 INTERNAL_OPEN_ONLY, /* oplock_request */
6867 0, /* allocation_size */
6868 0, /* private_flags */
6869 NULL, /* sd */
6870 NULL, /* ea_list */
6871 &fsp2, /* result */
6872 NULL); /* psbuf */
6873
6874 if (!NT_STATUS_IS_OK(status)) {
6875 close_file(NULL, fsp1, ERROR_CLOSE);
6876 goto out;
6877 }
6878
6879 if (ofun & OPENX_FILE_EXISTS_OPEN) {
6880 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6881 if (ret == -1) {
6882 DEBUG(0, ("error - vfs lseek returned error %s\n",
6883 strerror(errno)));
6884 status = map_nt_error_from_unix(errno);
6885 close_file(NULL, fsp1, ERROR_CLOSE);
6886 close_file(NULL, fsp2, ERROR_CLOSE);
6887 goto out;
6888 }
6889 }
6890
6891 /* Do the actual copy. */
6892 if (smb_fname_src->st.st_ex_size) {
6893 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6894 } else {
6895 ret = 0;
6896 }
6897
6898 close_file(NULL, fsp1, NORMAL_CLOSE);
6899
6900 /* Ensure the modtime is set correctly on the destination file. */
6901 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6902
6903 /*
6904 * As we are opening fsp1 read-only we only expect
6905 * an error on close on fsp2 if we are out of space.
6906 * Thus we don't look at the error return from the
6907 * close of fsp1.
6908 */
6909 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6910
6911 if (!NT_STATUS_IS_OK(status)) {
6912 goto out;
6913 }
6914
6915 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6916 status = NT_STATUS_DISK_FULL;
6917 goto out;
6918 }
6919
6920 status = NT_STATUS_OK;
6921
6922 out:
6923 TALLOC_FREE(smb_fname_dst_tmp);
6924 return status;
6925 }
6926
6927 /****************************************************************************
6928 Reply to a file copy.
6929 ****************************************************************************/
6930
6931 void reply_copy(struct smb_request *req)
6932 {
6933 connection_struct *conn = req->conn;
6934 struct smb_filename *smb_fname_src = NULL;
6935 struct smb_filename *smb_fname_dst = NULL;
6936 char *fname_src = NULL;
6937 char *fname_dst = NULL;
6938 char *fname_src_mask = NULL;
6939 char *fname_src_dir = NULL;
6940 const char *p;
6941 int count=0;
6942 int error = ERRnoaccess;
6943 int tid2;
6944 int ofun;
6945 int flags;
6946 bool target_is_directory=False;
6947 bool source_has_wild = False;
6948 bool dest_has_wild = False;
6949 NTSTATUS status;
6950 TALLOC_CTX *ctx = talloc_tos();
6951
6952 START_PROFILE(SMBcopy);
6953
6954 if (req->wct < 3) {
6955 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6956 goto out;
6957 }
6958
6959 tid2 = SVAL(req->vwv+0, 0);
6960 ofun = SVAL(req->vwv+1, 0);
6961 flags = SVAL(req->vwv+2, 0);
6962
6963 p = (const char *)req->buf;
6964 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6965 &status, &source_has_wild);
6966 if (!NT_STATUS_IS_OK(status)) {
6967 reply_nterror(req, status);
6968 goto out;
6969 }
6970 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6971 &status, &dest_has_wild);
6972 if (!NT_STATUS_IS_OK(status)) {
6973 reply_nterror(req, status);
6974 goto out;
6975 }
6976
6977 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6978
6979 if (tid2 != conn->cnum) {
6980 /* can't currently handle inter share copies XXXX */
6981 DEBUG(3,("Rejecting inter-share copy\n"));
6982 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6983 goto out;
6984 }
6985
6986 status = filename_convert(ctx, conn,
6987 req->flags2 & FLAGS2_DFS_PATHNAMES,
6988 fname_src,
6989 UCF_COND_ALLOW_WCARD_LCOMP,
6990 &source_has_wild,
6991 &smb_fname_src);
6992 if (!NT_STATUS_IS_OK(status)) {
6993 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6994 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6995 ERRSRV, ERRbadpath);
6996 goto out;
6997 }
6998 reply_nterror(req, status);
6999 goto out;
7000 }
7001
7002 status = filename_convert(ctx, conn,
7003 req->flags2 & FLAGS2_DFS_PATHNAMES,
7004 fname_dst,
7005 UCF_COND_ALLOW_WCARD_LCOMP,
7006 &dest_has_wild,
7007 &smb_fname_dst);
7008 if (!NT_STATUS_IS_OK(status)) {
7009 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7010 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7011 ERRSRV, ERRbadpath);
7012 goto out;
7013 }
7014 reply_nterror(req, status);
7015 goto out;
7016 }
7017
7018 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7019
7020 if ((flags&1) && target_is_directory) {
7021 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7022 goto out;
7023 }
7024
7025 if ((flags&2) && !target_is_directory) {
7026 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7027 goto out;
7028 }
7029
7030 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7031 /* wants a tree copy! XXXX */
7032 DEBUG(3,("Rejecting tree copy\n"));
7033 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7034 goto out;
7035 }
7036
7037 /* Split up the directory from the filename/mask. */
7038 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7039 &fname_src_dir, &fname_src_mask);
7040 if (!NT_STATUS_IS_OK(status)) {
7041 reply_nterror(req, NT_STATUS_NO_MEMORY);
7042 goto out;
7043 }
7044
7045 /*
7046 * We should only check the mangled cache
7047 * here if unix_convert failed. This means
7048 * that the path in 'mask' doesn't exist
7049 * on the file system and so we need to look
7050 * for a possible mangle. This patch from
7051 * Tine Smukavec <valentin.smukavec@hermes.si>.
7052 */
7053 if (!VALID_STAT(smb_fname_src->st) &&
7054 mangle_is_mangled(fname_src_mask, conn->params)) {
7055 char *new_mask = NULL;
7056 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7057 &new_mask, conn->params);
7058
7059 /* Use demangled name if one was successfully found. */
7060 if (new_mask) {
7061 TALLOC_FREE(fname_src_mask);
7062 fname_src_mask = new_mask;
7063 }
7064 }
7065
7066 if (!source_has_wild) {
7067
7068 /*
7069 * Only one file needs to be copied. Append the mask back onto
7070 * the directory.
7071 */
7072 TALLOC_FREE(smb_fname_src->base_name);
7073 if (ISDOT(fname_src_dir)) {
7074 /* Ensure we use canonical names on open. */
7075 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7076 "%s",
7077 fname_src_mask);
7078 } else {
7079 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7080 "%s/%s",
7081 fname_src_dir,
7082 fname_src_mask);
7083 }
7084 if (!smb_fname_src->base_name) {
7085 reply_nterror(req, NT_STATUS_NO_MEMORY);
7086 goto out;
7087 }
7088
7089 if (dest_has_wild) {
7090 char *fname_dst_mod = NULL;
7091 if (!resolve_wildcards(smb_fname_dst,
7092 smb_fname_src->base_name,
7093 smb_fname_dst->base_name,
7094 &fname_dst_mod)) {
7095 reply_nterror(req, NT_STATUS_NO_MEMORY);
7096 goto out;
7097 }
7098 TALLOC_FREE(smb_fname_dst->base_name);
7099 smb_fname_dst->base_name = fname_dst_mod;
7100 }
7101
7102 status = check_name(conn, smb_fname_src->base_name);
7103 if (!NT_STATUS_IS_OK(status)) {
7104 reply_nterror(req, status);
7105 goto out;
7106 }
7107
7108 status = check_name(conn, smb_fname_dst->base_name);
7109 if (!NT_STATUS_IS_OK(status)) {
7110 reply_nterror(req, status);
7111 goto out;
7112 }
7113
7114 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7115 ofun, count, target_is_directory);
7116
7117 if(!NT_STATUS_IS_OK(status)) {
7118 reply_nterror(req, status);
7119 goto out;
7120 } else {
7121 count++;
7122 }
7123 } else {
7124 struct smb_Dir *dir_hnd = NULL;
7125 const char *dname = NULL;
7126 char *talloced = NULL;
7127 long offset = 0;
7128
7129 /*
7130 * There is a wildcard that requires us to actually read the
7131 * src dir and copy each file matching the mask to the dst.
7132 * Right now streams won't be copied, but this could
7133 * presumably be added with a nested loop for reach dir entry.
7134 */
7135 SMB_ASSERT(!smb_fname_src->stream_name);
7136 SMB_ASSERT(!smb_fname_dst->stream_name);
7137
7138 smb_fname_src->stream_name = NULL;
7139 smb_fname_dst->stream_name = NULL;
7140
7141 if (strequal(fname_src_mask,"????????.???")) {
7142 TALLOC_FREE(fname_src_mask);
7143 fname_src_mask = talloc_strdup(ctx, "*");
7144 if (!fname_src_mask) {
7145 reply_nterror(req, NT_STATUS_NO_MEMORY);
7146 goto out;
7147 }
7148 }
7149
7150 status = check_name(conn, fname_src_dir);
7151 if (!NT_STATUS_IS_OK(status)) {
7152 reply_nterror(req, status);
7153 goto out;
7154 }
7155
7156 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7157 if (dir_hnd == NULL) {
7158 status = map_nt_error_from_unix(errno);
7159 reply_nterror(req, status);
7160 goto out;
7161 }
7162
7163 error = ERRbadfile;
7164
7165 /* Iterate over the src dir copying each entry to the dst. */
7166 while ((dname = ReadDirName(dir_hnd, &offset,
7167 &smb_fname_src->st, &talloced))) {
7168 char *destname = NULL;
7169
7170 if (ISDOT(dname) || ISDOTDOT(dname)) {
7171 TALLOC_FREE(talloced);
7172 continue;
7173 }
7174
7175 if (!is_visible_file(conn, fname_src_dir, dname,
7176 &smb_fname_src->st, false)) {
7177 TALLOC_FREE(talloced);
7178 continue;
7179 }
7180
7181 if(!mask_match(dname, fname_src_mask,
7182 conn->case_sensitive)) {
7183 TALLOC_FREE(talloced);
7184 continue;
7185 }
7186
7187 error = ERRnoaccess;
7188
7189 /* Get the src smb_fname struct setup. */
7190 TALLOC_FREE(smb_fname_src->base_name);
7191 if (ISDOT(fname_src_dir)) {
7192 /* Ensure we use canonical names on open. */
7193 smb_fname_src->base_name =
7194 talloc_asprintf(smb_fname_src, "%s",
7195 dname);
7196 } else {
7197 smb_fname_src->base_name =
7198 talloc_asprintf(smb_fname_src, "%s/%s",
7199 fname_src_dir, dname);
7200 }
7201
7202 if (!smb_fname_src->base_name) {
7203 TALLOC_FREE(dir_hnd);
7204 TALLOC_FREE(talloced);
7205 reply_nterror(req, NT_STATUS_NO_MEMORY);
7206 goto out;
7207 }
7208
7209 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7210 smb_fname_dst->base_name,
7211 &destname)) {
7212 TALLOC_FREE(talloced);
7213 continue;
7214 }
7215 if (!destname) {
7216 TALLOC_FREE(dir_hnd);
7217 TALLOC_FREE(talloced);
7218 reply_nterror(req, NT_STATUS_NO_MEMORY);
7219 goto out;
7220 }
7221
7222 TALLOC_FREE(smb_fname_dst->base_name);
7223 smb_fname_dst->base_name = destname;
7224
7225 status = check_name(conn, smb_fname_src->base_name);
7226 if (!NT_STATUS_IS_OK(status)) {
7227 TALLOC_FREE(dir_hnd);
7228 TALLOC_FREE(talloced);
7229 reply_nterror(req, status);
7230 goto out;
7231 }
7232
7233 status = check_name(conn, smb_fname_dst->base_name);
7234 if (!NT_STATUS_IS_OK(status)) {
7235 TALLOC_FREE(dir_hnd);
7236 TALLOC_FREE(talloced);
7237 reply_nterror(req, status);
7238 goto out;
7239 }
7240
7241 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7242 smb_fname_src->base_name,
7243 smb_fname_dst->base_name));
7244
7245 status = copy_file(ctx, conn, smb_fname_src,
7246 smb_fname_dst, ofun, count,
7247 target_is_directory);
7248 if (NT_STATUS_IS_OK(status)) {
7249 count++;
7250 }
7251
7252 TALLOC_FREE(talloced);
7253 }
7254 TALLOC_FREE(dir_hnd);
7255 }
7256
7257 if (count == 0) {
7258 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7259 goto out;
7260 }
7261
7262 reply_outbuf(req, 1, 0);
7263 SSVAL(req->outbuf,smb_vwv0,count);
7264 out:
7265 TALLOC_FREE(smb_fname_src);
7266 TALLOC_FREE(smb_fname_dst);
7267 TALLOC_FREE(fname_src);
7268 TALLOC_FREE(fname_dst);
7269 TALLOC_FREE(fname_src_mask);
7270 TALLOC_FREE(fname_src_dir);
7271
7272 END_PROFILE(SMBcopy);
7273 return;
7274 }
7275
7276 #undef DBGC_CLASS
7277 #define DBGC_CLASS DBGC_LOCKING
7278
7279 /****************************************************************************
7280 Get a lock pid, dealing with large count requests.
7281 ****************************************************************************/
7282
7283 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7284 bool large_file_format)
7285 {
7286 if(!large_file_format)
7287 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7288 else
7289 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7290 }
7291
7292 /****************************************************************************
7293 Get a lock count, dealing with large count requests.
7294 ****************************************************************************/
7295
7296 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7297 bool large_file_format)
7298 {
7299 uint64_t count = 0;
7300
7301 if(!large_file_format) {
7302 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7303 } else {
7304
7305 #if defined(HAVE_LONGLONG)
7306 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7307 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7308 #else /* HAVE_LONGLONG */
7309
7310 /*
7311 * NT4.x seems to be broken in that it sends large file (64 bit)
7312 * lockingX calls even if the CAP_LARGE_FILES was *not*
7313 * negotiated. For boxes without large unsigned ints truncate the
7314 * lock count by dropping the top 32 bits.
7315 */
7316
7317 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7318 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7319 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7320 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7321 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7322 }
7323
7324 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7325 #endif /* HAVE_LONGLONG */
7326 }
7327
7328 return count;
7329 }
7330
7331 #if !defined(HAVE_LONGLONG)
7332 /****************************************************************************
7333 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7334 ****************************************************************************/
7335
7336 static uint32 map_lock_offset(uint32 high, uint32 low)
7337 {
7338 unsigned int i;
7339 uint32 mask = 0;
7340 uint32 highcopy = high;
7341
7342 /*
7343 * Try and find out how many significant bits there are in high.
7344 */
7345
7346 for(i = 0; highcopy; i++)
7347 highcopy >>= 1;
7348
7349 /*
7350 * We use 31 bits not 32 here as POSIX
7351 * lock offsets may not be negative.
7352 */
7353
7354 mask = (~0) << (31 - i);
7355
7356 if(low & mask)
7357 return 0; /* Fail. */
7358
7359 high <<= (31 - i);
7360
7361 return (high|low);
7362 }
7363 #endif /* !defined(HAVE_LONGLONG) */
7364
7365 /****************************************************************************
7366 Get a lock offset, dealing with large offset requests.
7367 ****************************************************************************/
7368
7369 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7370 bool large_file_format, bool *err)
7371 {
7372 uint64_t offset = 0;
7373
7374 *err = False;
7375
7376 if(!large_file_format) {
7377 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7378 } else {
7379
7380 #if defined(HAVE_LONGLONG)
7381 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7382 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7383 #else /* HAVE_LONGLONG */
7384
7385 /*
7386 * NT4.x seems to be broken in that it sends large file (64 bit)
7387 * lockingX calls even if the CAP_LARGE_FILES was *not*
7388 * negotiated. For boxes without large unsigned ints mangle the
7389 * lock offset by mapping the top 32 bits onto the lower 32.
7390 */
7391
7392 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7393 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7394 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7395 uint32 new_low = 0;
7396
7397 if((new_low = map_lock_offset(high, low)) == 0) {
7398 *err = True;
7399 return (uint64_t)-1;
7400 }
7401
7402 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7403 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7404 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7405 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7406 }
7407
7408 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7409 #endif /* HAVE_LONGLONG */
7410 }
7411
7412 return offset;
7413 }
7414
7415 NTSTATUS smbd_do_locking(struct smb_request *req,
7416 files_struct *fsp,
7417 uint8_t type,
7418 int32_t timeout,
7419 uint16_t num_ulocks,
7420 struct smbd_lock_element *ulocks,
7421 uint16_t num_locks,
7422 struct smbd_lock_element *locks,
7423 bool *async)
7424 {
7425 connection_struct *conn = req->conn;
7426 int i;
7427 NTSTATUS status = NT_STATUS_OK;
7428
7429 *async = false;
7430
7431 /* Data now points at the beginning of the list
7432 of smb_unlkrng structs */
7433 for(i = 0; i < (int)num_ulocks; i++) {
7434 struct smbd_lock_element *e = &ulocks[i];
7435
7436 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7437 "pid %u, file %s\n",
7438 (double)e->offset,
7439 (double)e->count,
7440 (unsigned int)e->smblctx,
7441 fsp_str_dbg(fsp)));
7442
7443 if (e->brltype != UNLOCK_LOCK) {
7444 /* this can only happen with SMB2 */
7445 return NT_STATUS_INVALID_PARAMETER;
7446 }
7447
7448 status = do_unlock(req->sconn->msg_ctx,
7449 fsp,
7450 e->smblctx,
7451 e->count,
7452 e->offset,
7453 WINDOWS_LOCK);
7454
7455 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7456 nt_errstr(status)));
7457
7458 if (!NT_STATUS_IS_OK(status)) {
7459 return status;
7460 }
7461 }
7462
7463 /* Setup the timeout in seconds. */
7464
7465 if (!lp_blocking_locks(SNUM(conn))) {
7466 timeout = 0;
7467 }
7468
7469 /* Data now points at the beginning of the list
7470 of smb_lkrng structs */
7471
7472 for(i = 0; i < (int)num_locks; i++) {
7473 struct smbd_lock_element *e = &locks[i];
7474
7475 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7476 "%llu, file %s timeout = %d\n",
7477 (double)e->offset,
7478 (double)e->count,
7479 (unsigned long long)e->smblctx,
7480 fsp_str_dbg(fsp),
7481 (int)timeout));
7482
7483 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7484 struct blocking_lock_record *blr = NULL;
7485
7486 if (num_locks > 1) {
7487 /*
7488 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7489 * if the lock vector contains one entry. When given mutliple cancel
7490 * requests in a single PDU we expect the server to return an
7491 * error. Windows servers seem to accept the request but only
7492 * cancel the first lock.
7493 * JRA - Do what Windows does (tm) :-).
7494 */
7495
7496 #if 0
7497 /* MS-CIFS (2.2.4.32.1) behavior. */
7498 return NT_STATUS_DOS(ERRDOS,
7499 ERRcancelviolation);
7500 #else
7501 /* Windows behavior. */
7502 if (i != 0) {
7503 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7504 "cancel request\n"));
7505 continue;
7506 }
7507 #endif
7508 }
7509
7510 if (lp_blocking_locks(SNUM(conn))) {
7511
7512 /* Schedule a message to ourselves to
7513 remove the blocking lock record and
7514 return the right error. */
7515
7516 blr = blocking_lock_cancel_smb1(fsp,
7517 e->smblctx,
7518 e->offset,
7519 e->count,
7520 WINDOWS_LOCK,
7521 type,
7522 NT_STATUS_FILE_LOCK_CONFLICT);
7523 if (blr == NULL) {
7524 return NT_STATUS_DOS(
7525 ERRDOS,
7526 ERRcancelviolation);
7527 }
7528 }
7529 /* Remove a matching pending lock. */
7530 status = do_lock_cancel(fsp,
7531 e->smblctx,
7532 e->count,
7533 e->offset,
7534 WINDOWS_LOCK,
7535 blr);
7536 } else {
7537 bool blocking_lock = timeout ? true : false;
7538 bool defer_lock = false;
7539 struct byte_range_lock *br_lck;
7540 uint64_t block_smblctx;
7541
7542 br_lck = do_lock(req->sconn->msg_ctx,
7543 fsp,
7544 e->smblctx,
7545 e->count,
7546 e->offset,
7547 e->brltype,
7548 WINDOWS_LOCK,
7549 blocking_lock,
7550 &status,
7551 &block_smblctx,
7552 NULL);
7553
7554 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7555 /* Windows internal resolution for blocking locks seems
7556 to be about 200ms... Don't wait for less than that. JRA. */
7557 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7558 timeout = lp_lock_spin_time();
7559 }
7560 defer_lock = true;
7561 }
7562
7563 /* If a lock sent with timeout of zero would fail, and
7564 * this lock has been requested multiple times,
7565 * according to brl_lock_failed() we convert this
7566 * request to a blocking lock with a timeout of between
7567 * 150 - 300 milliseconds.
7568 *
7569 * If lp_lock_spin_time() has been set to 0, we skip
7570 * this blocking retry and fail immediately.
7571 *
7572 * Replacement for do_lock_spin(). JRA. */
7573
7574 if (!req->sconn->using_smb2 &&
7575 br_lck && lp_blocking_locks(SNUM(conn)) &&
7576 lp_lock_spin_time() && !blocking_lock &&
7577 NT_STATUS_EQUAL((status),
7578 NT_STATUS_FILE_LOCK_CONFLICT))
7579 {
7580 defer_lock = true;
7581 timeout = lp_lock_spin_time();
7582 }
7583
7584 if (br_lck && defer_lock) {
7585 /*
7586 * A blocking lock was requested. Package up
7587 * this smb into a queued request and push it
7588 * onto the blocking lock queue.
7589 */
7590 if(push_blocking_lock_request(br_lck,
7591 req,
7592 fsp,
7593 timeout,
7594 i,
7595 e->smblctx,
7596 e->brltype,
7597 WINDOWS_LOCK,
7598 e->offset,
7599 e->count,
7600 block_smblctx)) {
7601 TALLOC_FREE(br_lck);
7602 *async = true;
7603 return NT_STATUS_OK;
7604 }
7605 }
7606
7607 TALLOC_FREE(br_lck);
7608 }
7609
7610 if (!NT_STATUS_IS_OK(status)) {
7611 break;
7612 }
7613 }
7614
7615 /* If any of the above locks failed, then we must unlock
7616 all of the previous locks (X/Open spec). */
7617
7618 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7619
7620 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7621 i = -1; /* we want to skip the for loop */
7622 }
7623
7624 /*
7625 * Ensure we don't do a remove on the lock that just failed,
7626 * as under POSIX rules, if we have a lock already there, we
7627 * will delete it (and we shouldn't) .....
7628 */
7629 for(i--; i >= 0; i--) {
7630 struct smbd_lock_element *e = &locks[i];
7631
7632 do_unlock(req->sconn->msg_ctx,
7633 fsp,
7634 e->smblctx,
7635 e->count,
7636 e->offset,
7637 WINDOWS_LOCK);
7638 }
7639 return status;
7640 }
7641
7642 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7643 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7644
7645 return NT_STATUS_OK;
7646 }
7647
7648 /****************************************************************************
7649 Reply to a lockingX request.
7650 ****************************************************************************/
7651
7652 void reply_lockingX(struct smb_request *req)
7653 {
7654 connection_struct *conn = req->conn;
7655 files_struct *fsp;
7656 unsigned char locktype;
7657 unsigned char oplocklevel;
7658 uint16 num_ulocks;
7659 uint16 num_locks;
7660 int32 lock_timeout;
7661 int i;
7662 const uint8_t *data;
7663 bool large_file_format;
7664 bool err;
7665 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7666 struct smbd_lock_element *ulocks;
7667 struct smbd_lock_element *locks;
7668 bool async = false;
7669
7670 START_PROFILE(SMBlockingX);
7671
7672 if (req->wct < 8) {
7673 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7674 END_PROFILE(SMBlockingX);
7675 return;
7676 }
7677
7678 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7679 locktype = CVAL(req->vwv+3, 0);
7680 oplocklevel = CVAL(req->vwv+3, 1);
7681 num_ulocks = SVAL(req->vwv+6, 0);
7682 num_locks = SVAL(req->vwv+7, 0);
7683 lock_timeout = IVAL(req->vwv+4, 0);
7684 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7685
7686 if (!check_fsp(conn, req, fsp)) {
7687 END_PROFILE(SMBlockingX);
7688 return;
7689 }
7690
7691 data = req->buf;
7692
7693 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7694 /* we don't support these - and CANCEL_LOCK makes w2k
7695 and XP reboot so I don't really want to be
7696 compatible! (tridge) */
7697 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7698 END_PROFILE(SMBlockingX);
7699 return;
7700 }
7701
7702 /* Check if this is an oplock break on a file
7703 we have granted an oplock on.
7704 */
7705 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7706 /* Client can insist on breaking to none. */
7707 bool break_to_none = (oplocklevel == 0);
7708 bool result;
7709
7710 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7711 "for fnum = %d\n", (unsigned int)oplocklevel,
7712 fsp->fnum ));
7713
7714 /*
7715 * Make sure we have granted an exclusive or batch oplock on
7716 * this file.
7717 */
7718
7719 if (fsp->oplock_type == 0) {
7720
7721 /* The Samba4 nbench simulator doesn't understand
7722 the difference between break to level2 and break
7723 to none from level2 - it sends oplock break
7724 replies in both cases. Don't keep logging an error
7725 message here - just ignore it. JRA. */
7726
7727 DEBUG(5,("reply_lockingX: Error : oplock break from "
7728 "client for fnum = %d (oplock=%d) and no "
7729 "oplock granted on this file (%s).\n",
7730 fsp->fnum, fsp->oplock_type,
7731 fsp_str_dbg(fsp)));
7732
7733 /* if this is a pure oplock break request then don't
7734 * send a reply */
7735 if (num_locks == 0 && num_ulocks == 0) {
7736 END_PROFILE(SMBlockingX);
7737 return;
7738 } else {
7739 END_PROFILE(SMBlockingX);
7740 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7741 return;
7742 }
7743 }
7744
7745 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7746 (break_to_none)) {
7747 result = remove_oplock(fsp);
7748 } else {
7749 result = downgrade_oplock(fsp);
7750 }
7751
7752 if (!result) {
7753 DEBUG(0, ("reply_lockingX: error in removing "
7754 "oplock on file %s\n", fsp_str_dbg(fsp)));
7755 /* Hmmm. Is this panic justified? */
7756 smb_panic("internal tdb error");
7757 }
7758
7759 reply_to_oplock_break_requests(fsp);
7760
7761 /* if this is a pure oplock break request then don't send a
7762 * reply */
7763 if (num_locks == 0 && num_ulocks == 0) {
7764 /* Sanity check - ensure a pure oplock break is not a
7765 chained request. */
7766 if(CVAL(req->vwv+0, 0) != 0xff)
7767 DEBUG(0,("reply_lockingX: Error : pure oplock "
7768 "break is a chained %d request !\n",
7769 (unsigned int)CVAL(req->vwv+0, 0)));
7770 END_PROFILE(SMBlockingX);
7771 return;
7772 }
7773 }
7774
7775 if (req->buflen <
7776 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7777 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7778 END_PROFILE(SMBlockingX);
7779 return;
7780 }
7781
7782 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7783 if (ulocks == NULL) {
7784 reply_nterror(req, NT_STATUS_NO_MEMORY);
7785 END_PROFILE(SMBlockingX);
7786 return;
7787 }
7788
7789 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7790 if (locks == NULL) {
7791 reply_nterror(req, NT_STATUS_NO_MEMORY);
7792 END_PROFILE(SMBlockingX);
7793 return;
7794 }
7795
7796 /* Data now points at the beginning of the list
7797 of smb_unlkrng structs */
7798 for(i = 0; i < (int)num_ulocks; i++) {
7799 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7800 ulocks[i].count = get_lock_count(data, i, large_file_format);
7801 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7802 ulocks[i].brltype = UNLOCK_LOCK;
7803
7804 /*
7805 * There is no error code marked "stupid client bug".... :-).
7806 */
7807 if(err) {
7808 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7809 END_PROFILE(SMBlockingX);
7810 return;
7811 }
7812 }
7813
7814 /* Now do any requested locks */
7815 data += ((large_file_format ? 20 : 10)*num_ulocks);
7816
7817 /* Data now points at the beginning of the list
7818 of smb_lkrng structs */
7819
7820 for(i = 0; i < (int)num_locks; i++) {
7821 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7822 locks[i].count = get_lock_count(data, i, large_file_format);
7823 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7824
7825 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7826 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7827 locks[i].brltype = PENDING_READ_LOCK;
7828 } else {
7829 locks[i].brltype = READ_LOCK;
7830 }
7831 } else {
7832 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7833 locks[i].brltype = PENDING_WRITE_LOCK;
7834 } else {
7835 locks[i].brltype = WRITE_LOCK;
7836 }
7837 }
7838
7839 /*
7840 * There is no error code marked "stupid client bug".... :-).
7841 */
7842 if(err) {
7843 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7844 END_PROFILE(SMBlockingX);
7845 return;
7846 }
7847 }
7848
7849 status = smbd_do_locking(req, fsp,
7850 locktype, lock_timeout,
7851 num_ulocks, ulocks,
7852 num_locks, locks,
7853 &async);
7854 if (!NT_STATUS_IS_OK(status)) {
7855 END_PROFILE(SMBlockingX);
7856 reply_nterror(req, status);
7857 return;
7858 }
7859 if (async) {
7860 END_PROFILE(SMBlockingX);
7861 return;
7862 }
7863
7864 reply_outbuf(req, 2, 0);
7865
7866 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7867 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7868
7869 END_PROFILE(SMBlockingX);
7870 chain_reply(req);
7871 }
7872
7873 #undef DBGC_CLASS
7874 #define DBGC_CLASS DBGC_ALL
7875
7876 /****************************************************************************
7877 Reply to a SMBreadbmpx (read block multiplex) request.
7878 Always reply with an error, if someone has a platform really needs this,
7879 please contact vl@samba.org
7880 ****************************************************************************/
7881
7882 void reply_readbmpx(struct smb_request *req)
7883 {
7884 START_PROFILE(SMBreadBmpx);
7885 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7886 END_PROFILE(SMBreadBmpx);
7887 return;
7888 }
7889
7890 /****************************************************************************
7891 Reply to a SMBreadbs (read block multiplex secondary) request.
7892 Always reply with an error, if someone has a platform really needs this,
7893 please contact vl@samba.org
7894 ****************************************************************************/
7895
7896 void reply_readbs(struct smb_request *req)
7897 {
7898 START_PROFILE(SMBreadBs);
7899 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7900 END_PROFILE(SMBreadBs);
7901 return;
7902 }
7903
7904 /****************************************************************************
7905 Reply to a SMBsetattrE.
7906 ****************************************************************************/
7907
7908 void reply_setattrE(struct smb_request *req)
7909 {
7910 connection_struct *conn = req->conn;
7911 struct smb_file_time ft;
7912 files_struct *fsp;
7913 NTSTATUS status;
7914
7915 START_PROFILE(SMBsetattrE);
7916 ZERO_STRUCT(ft);
7917
7918 if (req->wct < 7) {
7919 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7920 goto out;
7921 }
7922
7923 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7924
7925 if(!fsp || (fsp->conn != conn)) {
7926 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7927 goto out;
7928 }
7929
7930 /*
7931 * Convert the DOS times into unix times.
7932 */
7933
7934 ft.atime = convert_time_t_to_timespec(
7935 srv_make_unix_date2(req->vwv+3));
7936 ft.mtime = convert_time_t_to_timespec(
7937 srv_make_unix_date2(req->vwv+5));
7938 ft.create_time = convert_time_t_to_timespec(
7939 srv_make_unix_date2(req->vwv+1));
7940
7941 reply_outbuf(req, 0, 0);
7942
7943 /*
7944 * Patch from Ray Frush <frush@engr.colostate.edu>
7945 * Sometimes times are sent as zero - ignore them.
7946 */
7947
7948 /* Ensure we have a valid stat struct for the source. */
7949 status = vfs_stat_fsp(fsp);
7950 if (!NT_STATUS_IS_OK(status)) {
7951 reply_nterror(req, status);
7952 goto out;
7953 }
7954
7955 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7956 if (!NT_STATUS_IS_OK(status)) {
7957 reply_nterror(req, status);
7958 goto out;
7959 }
7960
7961 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7962 " createtime=%u\n",
7963 fsp->fnum,
7964 (unsigned int)ft.atime.tv_sec,
7965 (unsigned int)ft.mtime.tv_sec,
7966 (unsigned int)ft.create_time.tv_sec
7967 ));
7968 out:
7969 END_PROFILE(SMBsetattrE);
7970 return;
7971 }
7972
7973
7974 /* Back from the dead for OS/2..... JRA. */
7975
7976 /****************************************************************************
7977 Reply to a SMBwritebmpx (write block multiplex primary) request.
7978 Always reply with an error, if someone has a platform really needs this,
7979 please contact vl@samba.org
7980 ****************************************************************************/
7981
7982 void reply_writebmpx(struct smb_request *req)
7983 {
7984 START_PROFILE(SMBwriteBmpx);
7985 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7986 END_PROFILE(SMBwriteBmpx);
7987 return;
7988 }
7989
7990 /****************************************************************************
7991 Reply to a SMBwritebs (write block multiplex secondary) request.
7992 Always reply with an error, if someone has a platform really needs this,
7993 please contact vl@samba.org
7994 ****************************************************************************/
7995
7996 void reply_writebs(struct smb_request *req)
7997 {
7998 START_PROFILE(SMBwriteBs);
7999 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8000 END_PROFILE(SMBwriteBs);
8001 return;
8002 }
8003
8004 /****************************************************************************
8005 Reply to a SMBgetattrE.
8006 ****************************************************************************/
8007
8008 void reply_getattrE(struct smb_request *req)
8009 {
8010 connection_struct *conn = req->conn;
8011 int mode;
8012 files_struct *fsp;
8013 struct timespec create_ts;
8014
8015 START_PROFILE(SMBgetattrE);
8016
8017 if (req->wct < 1) {
8018 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8019 END_PROFILE(SMBgetattrE);
8020 return;
8021 }
8022
8023 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8024
8025 if(!fsp || (fsp->conn != conn)) {
8026 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8027 END_PROFILE(SMBgetattrE);
8028 return;
8029 }
8030
8031 /* Do an fstat on this file */
8032 if(fsp_stat(fsp)) {
8033 reply_nterror(req, map_nt_error_from_unix(errno));
8034 END_PROFILE(SMBgetattrE);
8035 return;
8036 }
8037
8038 mode = dos_mode(conn, fsp->fsp_name);
8039
8040 /*
8041 * Convert the times into dos times. Set create
8042 * date to be last modify date as UNIX doesn't save
8043 * this.
8044 */
8045
8046 reply_outbuf(req, 11, 0);
8047
8048 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8049 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8050 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8051 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8052 /* Should we check pending modtime here ? JRA */
8053 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8054 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8055
8056 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8057 SIVAL(req->outbuf, smb_vwv6, 0);
8058 SIVAL(req->outbuf, smb_vwv8, 0);
8059 } else {
8060 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8061 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8062 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8063 }
8064 SSVAL(req->outbuf,smb_vwv10, mode);
8065
8066 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8067
8068 END_PROFILE(SMBgetattrE);
8069 return;
8070 }
WIP