?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libcli/cldap: fix memory/resource leak
[Samba/gbeck.git] / source3 / smbd / reply.c
blob3f9d5c5498fd94361f7c3e15dc64267251cd9394
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!posix_path && !stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 break;
132 }
133 /* Go back one level... */
134 /* We know this is safe as '/' cannot be part of a mb sequence. */
135 /* NOTE - if this assumption is invalid we are not in good shape... */
136 /* Decrement d first as d points to the *next* char to write into. */
137 for (d--; d > path; d--) {
138 if (*d == '/')
139 break;
140 }
141 s += 2; /* Else go past the .. */
142 /* We're still at the start of a name component, just the previous one. */
143 continue;
144
145 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
146 if (posix_path) {
147 /* Eat the '.' */
148 s++;
149 continue;
150 }
151 }
152
153 }
154
155 if (!(*s & 0x80)) {
156 if (!posix_path) {
157 if (*s <= 0x1f || *s == '|') {
158 return NT_STATUS_OBJECT_NAME_INVALID;
159 }
160 switch (*s) {
161 case '*':
162 case '?':
163 case '<':
164 case '>':
165 case '"':
166 *p_last_component_contains_wcard = True;
167 break;
168 default:
169 break;
170 }
171 }
172 *d++ = *s++;
173 } else {
174 size_t siz;
175 /* Get the size of the next MB character. */
176 next_codepoint(s,&siz);
177 switch(siz) {
178 case 5:
179 *d++ = *s++;
180 /*fall through*/
181 case 4:
182 *d++ = *s++;
183 /*fall through*/
184 case 3:
185 *d++ = *s++;
186 /*fall through*/
187 case 2:
188 *d++ = *s++;
189 /*fall through*/
190 case 1:
191 *d++ = *s++;
192 break;
193 default:
194 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
195 *d = '\0';
196 return NT_STATUS_INVALID_PARAMETER;
197 }
198 }
199 start_of_name_component = False;
200 }
201
202 *d = '\0';
203
204 return ret;
205 }
206
207 /****************************************************************************
208 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
209 No wildcards allowed.
210 ****************************************************************************/
211
212 NTSTATUS check_path_syntax(char *path)
213 {
214 bool ignore;
215 return check_path_syntax_internal(path, False, &ignore);
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 Wildcards allowed - p_contains_wcard returns true if the last component contained
221 a wildcard.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
225 {
226 return check_path_syntax_internal(path, False, p_contains_wcard);
227 }
228
229 /****************************************************************************
230 Check the path for a POSIX client.
231 We're assuming here that '/' is not the second byte in any multibyte char
232 set (a safe assumption).
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_posix(char *path)
236 {
237 bool ignore;
238 return check_path_syntax_internal(path, True, &ignore);
239 }
240
241 /****************************************************************************
242 Pull a string and check the path allowing a wilcard - provide for error return.
243 ****************************************************************************/
244
245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
246 const char *base_ptr,
247 uint16 smb_flags2,
248 char **pp_dest,
249 const char *src,
250 size_t src_len,
251 int flags,
252 NTSTATUS *err,
253 bool *contains_wcard)
254 {
255 size_t ret;
256
257 *pp_dest = NULL;
258
259 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
260 src_len, flags);
261
262 if (!*pp_dest) {
263 *err = NT_STATUS_INVALID_PARAMETER;
264 return ret;
265 }
266
267 *contains_wcard = False;
268
269 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
270 /*
271 * For a DFS path the function parse_dfs_path()
272 * will do the path processing, just make a copy.
273 */
274 *err = NT_STATUS_OK;
275 return ret;
276 }
277
278 if (lp_posix_pathnames()) {
279 *err = check_path_syntax_posix(*pp_dest);
280 } else {
281 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
282 }
283
284 return ret;
285 }
286
287 /****************************************************************************
288 Pull a string and check the path - provide for error return.
289 ****************************************************************************/
290
291 size_t srvstr_get_path(TALLOC_CTX *ctx,
292 const char *base_ptr,
293 uint16 smb_flags2,
294 char **pp_dest,
295 const char *src,
296 size_t src_len,
297 int flags,
298 NTSTATUS *err)
299 {
300 bool ignore;
301 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
302 src_len, flags, err, &ignore);
303 }
304
305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
306 char **pp_dest, const char *src, int flags,
307 NTSTATUS *err, bool *contains_wcard)
308 {
309 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
310 pp_dest, src, smbreq_bufrem(req, src),
311 flags, err, contains_wcard);
312 }
313
314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err)
317 {
318 bool ignore;
319 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
320 flags, err, &ignore);
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if (!(fsp) || !(conn)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if ((fsp)->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if ((fsp)->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 (fsp)->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 /****************************************************************************
395 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
396 ****************************************************************************/
397
398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
399 files_struct *fsp)
400 {
401 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
402 && (req->vuid == (fsp)->vuid)) {
403 return True;
404 }
405
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return False;
408 }
409
410 /****************************************************************************
411 Reply to a (netbios-level) special message.
412 ****************************************************************************/
413
414 void reply_special(char *inbuf)
415 {
416 int msg_type = CVAL(inbuf,0);
417 int msg_flags = CVAL(inbuf,1);
418 fstring name1,name2;
419 char name_type = 0;
420
421 /*
422 * We only really use 4 bytes of the outbuf, but for the smb_setlen
423 * calculation & friends (srv_send_smb uses that) we need the full smb
424 * header.
425 */
426 char outbuf[smb_size];
427
428 *name1 = *name2 = 0;
429
430 memset(outbuf, '\0', sizeof(outbuf));
431
432 smb_setlen(outbuf,0);
433
434 switch (msg_type) {
435 case 0x81: /* session request */
436
437 if (already_got_session) {
438 exit_server_cleanly("multiple session request not permitted");
439 }
440
441 SCVAL(outbuf,0,0x82);
442 SCVAL(outbuf,3,0);
443 if (name_len(inbuf+4) > 50 ||
444 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
445 DEBUG(0,("Invalid name length in session request\n"));
446 return;
447 }
448 name_extract(inbuf,4,name1);
449 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
450 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
451 name1,name2));
452
453 set_local_machine_name(name1, True);
454 set_remote_machine_name(name2, True);
455
456 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
457 get_local_machine_name(), get_remote_machine_name(),
458 name_type));
459
460 if (name_type == 'R') {
461 /* We are being asked for a pathworks session ---
462 no thanks! */
463 SCVAL(outbuf, 0,0x83);
464 break;
465 }
466
467 /* only add the client's machine name to the list
468 of possibly valid usernames if we are operating
469 in share mode security */
470 if (lp_security() == SEC_SHARE) {
471 add_session_user(get_remote_machine_name());
472 }
473
474 reload_services(True);
475 reopen_logs();
476
477 already_got_session = True;
478 break;
479
480 case 0x89: /* session keepalive request
481 (some old clients produce this?) */
482 SCVAL(outbuf,0,SMBkeepalive);
483 SCVAL(outbuf,3,0);
484 break;
485
486 case 0x82: /* positive session response */
487 case 0x83: /* negative session response */
488 case 0x84: /* retarget session response */
489 DEBUG(0,("Unexpected session response\n"));
490 break;
491
492 case SMBkeepalive: /* session keepalive */
493 default:
494 return;
495 }
496
497 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
498 msg_type, msg_flags));
499
500 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
501 return;
502 }
503
504 /****************************************************************************
505 Reply to a tcon.
506 conn POINTER CAN BE NULL HERE !
507 ****************************************************************************/
508
509 void reply_tcon(struct smb_request *req)
510 {
511 connection_struct *conn = req->conn;
512 const char *service;
513 char *service_buf = NULL;
514 char *password = NULL;
515 char *dev = NULL;
516 int pwlen=0;
517 NTSTATUS nt_status;
518 const char *p;
519 DATA_BLOB password_blob;
520 TALLOC_CTX *ctx = talloc_tos();
521
522 START_PROFILE(SMBtcon);
523
524 if (req->buflen < 4) {
525 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
526 END_PROFILE(SMBtcon);
527 return;
528 }
529
530 p = (const char *)req->buf + 1;
531 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
532 p += 1;
533 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
534 p += pwlen+1;
535 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
536 p += 1;
537
538 if (service_buf == NULL || password == NULL || dev == NULL) {
539 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
540 END_PROFILE(SMBtcon);
541 return;
542 }
543 p = strrchr_m(service_buf,'\\');
544 if (p) {
545 service = p+1;
546 } else {
547 service = service_buf;
548 }
549
550 password_blob = data_blob(password, pwlen+1);
551
552 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
553 req->conn = conn;
554
555 data_blob_clear_free(&password_blob);
556
557 if (!conn) {
558 reply_nterror(req, nt_status);
559 END_PROFILE(SMBtcon);
560 return;
561 }
562
563 reply_outbuf(req, 2, 0);
564 SSVAL(req->outbuf,smb_vwv0,max_recv);
565 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
566 SSVAL(req->outbuf,smb_tid,conn->cnum);
567
568 DEBUG(3,("tcon service=%s cnum=%d\n",
569 service, conn->cnum));
570
571 END_PROFILE(SMBtcon);
572 return;
573 }
574
575 /****************************************************************************
576 Reply to a tcon and X.
577 conn POINTER CAN BE NULL HERE !
578 ****************************************************************************/
579
580 void reply_tcon_and_X(struct smb_request *req)
581 {
582 connection_struct *conn = req->conn;
583 const char *service = NULL;
584 DATA_BLOB password;
585 TALLOC_CTX *ctx = talloc_tos();
586 /* what the cleint thinks the device is */
587 char *client_devicetype = NULL;
588 /* what the server tells the client the share represents */
589 const char *server_devicetype;
590 NTSTATUS nt_status;
591 int passlen;
592 char *path = NULL;
593 const char *p, *q;
594 uint16 tcon_flags;
595
596 START_PROFILE(SMBtconX);
597
598 if (req->wct < 4) {
599 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
600 END_PROFILE(SMBtconX);
601 return;
602 }
603
604 passlen = SVAL(req->vwv+3, 0);
605 tcon_flags = SVAL(req->vwv+2, 0);
606
607 /* we might have to close an old one */
608 if ((tcon_flags & 0x1) && conn) {
609 close_cnum(conn,req->vuid);
610 req->conn = NULL;
611 conn = NULL;
612 }
613
614 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
615 reply_doserror(req, ERRDOS, ERRbuftoosmall);
616 END_PROFILE(SMBtconX);
617 return;
618 }
619
620 if (global_encrypted_passwords_negotiated) {
621 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
622 if (lp_security() == SEC_SHARE) {
623 /*
624 * Security = share always has a pad byte
625 * after the password.
626 */
627 p = (const char *)req->buf + passlen + 1;
628 } else {
629 p = (const char *)req->buf + passlen;
630 }
631 } else {
632 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
633 /* Ensure correct termination */
634 password.data[passlen]=0;
635 p = (const char *)req->buf + passlen + 1;
636 }
637
638 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
639
640 if (path == NULL) {
641 data_blob_clear_free(&password);
642 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
643 END_PROFILE(SMBtconX);
644 return;
645 }
646
647 /*
648 * the service name can be either: \\server\share
649 * or share directly like on the DELL PowerVault 705
650 */
651 if (*path=='\\') {
652 q = strchr_m(path+2,'\\');
653 if (!q) {
654 data_blob_clear_free(&password);
655 reply_doserror(req, ERRDOS, ERRnosuchshare);
656 END_PROFILE(SMBtconX);
657 return;
658 }
659 service = q+1;
660 } else {
661 service = path;
662 }
663
664 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
665 &client_devicetype, p,
666 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
667
668 if (client_devicetype == NULL) {
669 data_blob_clear_free(&password);
670 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
671 END_PROFILE(SMBtconX);
672 return;
673 }
674
675 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
676
677 conn = make_connection(service, password, client_devicetype,
678 req->vuid, &nt_status);
679 req->conn =conn;
680
681 data_blob_clear_free(&password);
682
683 if (!conn) {
684 reply_nterror(req, nt_status);
685 END_PROFILE(SMBtconX);
686 return;
687 }
688
689 if ( IS_IPC(conn) )
690 server_devicetype = "IPC";
691 else if ( IS_PRINT(conn) )
692 server_devicetype = "LPT1:";
693 else
694 server_devicetype = "A:";
695
696 if (Protocol < PROTOCOL_NT1) {
697 reply_outbuf(req, 2, 0);
698 if (message_push_string(&req->outbuf, server_devicetype,
699 STR_TERMINATE|STR_ASCII) == -1) {
700 reply_nterror(req, NT_STATUS_NO_MEMORY);
701 END_PROFILE(SMBtconX);
702 return;
703 }
704 } else {
705 /* NT sets the fstype of IPC$ to the null string */
706 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
707
708 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
709 /* Return permissions. */
710 uint32 perm1 = 0;
711 uint32 perm2 = 0;
712
713 reply_outbuf(req, 7, 0);
714
715 if (IS_IPC(conn)) {
716 perm1 = FILE_ALL_ACCESS;
717 perm2 = FILE_ALL_ACCESS;
718 } else {
719 perm1 = CAN_WRITE(conn) ?
720 SHARE_ALL_ACCESS :
721 SHARE_READ_ONLY;
722 }
723
724 SIVAL(req->outbuf, smb_vwv3, perm1);
725 SIVAL(req->outbuf, smb_vwv5, perm2);
726 } else {
727 reply_outbuf(req, 3, 0);
728 }
729
730 if ((message_push_string(&req->outbuf, server_devicetype,
731 STR_TERMINATE|STR_ASCII) == -1)
732 || (message_push_string(&req->outbuf, fstype,
733 STR_TERMINATE) == -1)) {
734 reply_nterror(req, NT_STATUS_NO_MEMORY);
735 END_PROFILE(SMBtconX);
736 return;
737 }
738
739 /* what does setting this bit do? It is set by NT4 and
740 may affect the ability to autorun mounted cdroms */
741 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
742 (lp_csc_policy(SNUM(conn)) << 2));
743
744 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
745 DEBUG(2,("Serving %s as a Dfs root\n",
746 lp_servicename(SNUM(conn)) ));
747 SSVAL(req->outbuf, smb_vwv2,
748 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
749 }
750 }
751
752
753 DEBUG(3,("tconX service=%s \n",
754 service));
755
756 /* set the incoming and outgoing tid to the just created one */
757 SSVAL(req->inbuf,smb_tid,conn->cnum);
758 SSVAL(req->outbuf,smb_tid,conn->cnum);
759
760 END_PROFILE(SMBtconX);
761
762 chain_reply(req);
763 return;
764 }
765
766 /****************************************************************************
767 Reply to an unknown type.
768 ****************************************************************************/
769
770 void reply_unknown_new(struct smb_request *req, uint8 type)
771 {
772 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
773 smb_fn_name(type), type, type));
774 reply_doserror(req, ERRSRV, ERRunknownsmb);
775 return;
776 }
777
778 /****************************************************************************
779 Reply to an ioctl.
780 conn POINTER CAN BE NULL HERE !
781 ****************************************************************************/
782
783 void reply_ioctl(struct smb_request *req)
784 {
785 connection_struct *conn = req->conn;
786 uint16 device;
787 uint16 function;
788 uint32 ioctl_code;
789 int replysize;
790 char *p;
791
792 START_PROFILE(SMBioctl);
793
794 if (req->wct < 3) {
795 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
796 END_PROFILE(SMBioctl);
797 return;
798 }
799
800 device = SVAL(req->vwv+1, 0);
801 function = SVAL(req->vwv+2, 0);
802 ioctl_code = (device << 16) + function;
803
804 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
805
806 switch (ioctl_code) {
807 case IOCTL_QUERY_JOB_INFO:
808 replysize = 32;
809 break;
810 default:
811 reply_doserror(req, ERRSRV, ERRnosupport);
812 END_PROFILE(SMBioctl);
813 return;
814 }
815
816 reply_outbuf(req, 8, replysize+1);
817 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
818 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
819 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
820 p = smb_buf(req->outbuf);
821 memset(p, '\0', replysize+1); /* valgrind-safe. */
822 p += 1; /* Allow for alignment */
823
824 switch (ioctl_code) {
825 case IOCTL_QUERY_JOB_INFO:
826 {
827 files_struct *fsp = file_fsp(
828 req, SVAL(req->vwv+0, 0));
829 if (!fsp) {
830 reply_doserror(req, ERRDOS, ERRbadfid);
831 END_PROFILE(SMBioctl);
832 return;
833 }
834 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
835 srvstr_push((char *)req->outbuf, req->flags2, p+2,
836 global_myname(), 15,
837 STR_TERMINATE|STR_ASCII);
838 if (conn) {
839 srvstr_push((char *)req->outbuf, req->flags2,
840 p+18, lp_servicename(SNUM(conn)),
841 13, STR_TERMINATE|STR_ASCII);
842 } else {
843 memset(p+18, 0, 13);
844 }
845 break;
846 }
847 }
848
849 END_PROFILE(SMBioctl);
850 return;
851 }
852
853 /****************************************************************************
854 Strange checkpath NTSTATUS mapping.
855 ****************************************************************************/
856
857 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
858 {
859 /* Strange DOS error code semantics only for checkpath... */
860 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
861 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
862 /* We need to map to ERRbadpath */
863 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
864 }
865 }
866 return status;
867 }
868
869 /****************************************************************************
870 Reply to a checkpath.
871 ****************************************************************************/
872
873 void reply_checkpath(struct smb_request *req)
874 {
875 connection_struct *conn = req->conn;
876 char *name = NULL;
877 SMB_STRUCT_STAT sbuf;
878 NTSTATUS status;
879 TALLOC_CTX *ctx = talloc_tos();
880
881 START_PROFILE(SMBcheckpath);
882
883 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
884 STR_TERMINATE, &status);
885
886 if (!NT_STATUS_IS_OK(status)) {
887 status = map_checkpath_error(req->flags2, status);
888 reply_nterror(req, status);
889 END_PROFILE(SMBcheckpath);
890 return;
891 }
892
893 status = resolve_dfspath(ctx, conn,
894 req->flags2 & FLAGS2_DFS_PATHNAMES,
895 name,
896 &name);
897 if (!NT_STATUS_IS_OK(status)) {
898 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
899 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
900 ERRSRV, ERRbadpath);
901 END_PROFILE(SMBcheckpath);
902 return;
903 }
904 goto path_err;
905 }
906
907 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
908
909 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
910 if (!NT_STATUS_IS_OK(status)) {
911 goto path_err;
912 }
913
914 status = check_name(conn, name);
915 if (!NT_STATUS_IS_OK(status)) {
916 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
917 goto path_err;
918 }
919
920 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
921 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
922 status = map_nt_error_from_unix(errno);
923 goto path_err;
924 }
925
926 if (!S_ISDIR(sbuf.st_mode)) {
927 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
928 ERRDOS, ERRbadpath);
929 END_PROFILE(SMBcheckpath);
930 return;
931 }
932
933 reply_outbuf(req, 0, 0);
934
935 END_PROFILE(SMBcheckpath);
936 return;
937
938 path_err:
939
940 END_PROFILE(SMBcheckpath);
941
942 /* We special case this - as when a Windows machine
943 is parsing a path is steps through the components
944 one at a time - if a component fails it expects
945 ERRbadpath, not ERRbadfile.
946 */
947 status = map_checkpath_error(req->flags2, status);
948 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
949 /*
950 * Windows returns different error codes if
951 * the parent directory is valid but not the
952 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
953 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
954 * if the path is invalid.
955 */
956 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
957 ERRDOS, ERRbadpath);
958 return;
959 }
960
961 reply_nterror(req, status);
962 }
963
964 /****************************************************************************
965 Reply to a getatr.
966 ****************************************************************************/
967
968 void reply_getatr(struct smb_request *req)
969 {
970 connection_struct *conn = req->conn;
971 char *fname = NULL;
972 SMB_STRUCT_STAT sbuf;
973 int mode=0;
974 SMB_OFF_T size=0;
975 time_t mtime=0;
976 const char *p;
977 NTSTATUS status;
978 TALLOC_CTX *ctx = talloc_tos();
979
980 START_PROFILE(SMBgetatr);
981
982 p = (const char *)req->buf + 1;
983 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
984 if (!NT_STATUS_IS_OK(status)) {
985 reply_nterror(req, status);
986 END_PROFILE(SMBgetatr);
987 return;
988 }
989
990 status = resolve_dfspath(ctx, conn,
991 req->flags2 & FLAGS2_DFS_PATHNAMES,
992 fname,
993 &fname);
994 if (!NT_STATUS_IS_OK(status)) {
995 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
996 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
997 ERRSRV, ERRbadpath);
998 END_PROFILE(SMBgetatr);
999 return;
1000 }
1001 reply_nterror(req, status);
1002 END_PROFILE(SMBgetatr);
1003 return;
1004 }
1005
1006 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1007 under WfWg - weird! */
1008 if (*fname == '\0') {
1009 mode = aHIDDEN | aDIR;
1010 if (!CAN_WRITE(conn)) {
1011 mode |= aRONLY;
1012 }
1013 size = 0;
1014 mtime = 0;
1015 } else {
1016 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1017 if (!NT_STATUS_IS_OK(status)) {
1018 reply_nterror(req, status);
1019 END_PROFILE(SMBgetatr);
1020 return;
1021 }
1022 status = check_name(conn, fname);
1023 if (!NT_STATUS_IS_OK(status)) {
1024 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1025 reply_nterror(req, status);
1026 END_PROFILE(SMBgetatr);
1027 return;
1028 }
1029 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1030 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1031 reply_unixerror(req, ERRDOS,ERRbadfile);
1032 END_PROFILE(SMBgetatr);
1033 return;
1034 }
1035
1036 mode = dos_mode(conn,fname,&sbuf);
1037 size = sbuf.st_size;
1038 mtime = sbuf.st_mtime;
1039 if (mode & aDIR) {
1040 size = 0;
1041 }
1042 }
1043
1044 reply_outbuf(req, 10, 0);
1045
1046 SSVAL(req->outbuf,smb_vwv0,mode);
1047 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1048 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1049 } else {
1050 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1051 }
1052 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1053
1054 if (Protocol >= PROTOCOL_NT1) {
1055 SSVAL(req->outbuf, smb_flg2,
1056 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1057 }
1058
1059 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1060
1061 END_PROFILE(SMBgetatr);
1062 return;
1063 }
1064
1065 /****************************************************************************
1066 Reply to a setatr.
1067 ****************************************************************************/
1068
1069 void reply_setatr(struct smb_request *req)
1070 {
1071 struct smb_file_time ft;
1072 connection_struct *conn = req->conn;
1073 char *fname = NULL;
1074 int mode;
1075 time_t mtime;
1076 SMB_STRUCT_STAT sbuf;
1077 const char *p;
1078 NTSTATUS status;
1079 TALLOC_CTX *ctx = talloc_tos();
1080
1081 START_PROFILE(SMBsetatr);
1082
1083 ZERO_STRUCT(ft);
1084
1085 if (req->wct < 2) {
1086 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1087 return;
1088 }
1089
1090 p = (const char *)req->buf + 1;
1091 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1092 if (!NT_STATUS_IS_OK(status)) {
1093 reply_nterror(req, status);
1094 END_PROFILE(SMBsetatr);
1095 return;
1096 }
1097
1098 status = resolve_dfspath(ctx, conn,
1099 req->flags2 & FLAGS2_DFS_PATHNAMES,
1100 fname,
1101 &fname);
1102 if (!NT_STATUS_IS_OK(status)) {
1103 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1104 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1105 ERRSRV, ERRbadpath);
1106 END_PROFILE(SMBsetatr);
1107 return;
1108 }
1109 reply_nterror(req, status);
1110 END_PROFILE(SMBsetatr);
1111 return;
1112 }
1113
1114 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1115 if (!NT_STATUS_IS_OK(status)) {
1116 reply_nterror(req, status);
1117 END_PROFILE(SMBsetatr);
1118 return;
1119 }
1120
1121 status = check_name(conn, fname);
1122 if (!NT_STATUS_IS_OK(status)) {
1123 reply_nterror(req, status);
1124 END_PROFILE(SMBsetatr);
1125 return;
1126 }
1127
1128 if (fname[0] == '.' && fname[1] == '\0') {
1129 /*
1130 * Not sure here is the right place to catch this
1131 * condition. Might be moved to somewhere else later -- vl
1132 */
1133 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1134 END_PROFILE(SMBsetatr);
1135 return;
1136 }
1137
1138 mode = SVAL(req->vwv+0, 0);
1139 mtime = srv_make_unix_date3(req->vwv+1);
1140
1141 ft.mtime = convert_time_t_to_timespec(mtime);
1142 status = smb_set_file_time(conn, NULL, fname,
1143 &sbuf, &ft, true);
1144 if (!NT_STATUS_IS_OK(status)) {
1145 reply_unixerror(req, ERRDOS, ERRnoaccess);
1146 END_PROFILE(SMBsetatr);
1147 return;
1148 }
1149
1150 if (mode != FILE_ATTRIBUTE_NORMAL) {
1151 if (VALID_STAT_OF_DIR(sbuf))
1152 mode |= aDIR;
1153 else
1154 mode &= ~aDIR;
1155
1156 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1157 reply_unixerror(req, ERRDOS, ERRnoaccess);
1158 END_PROFILE(SMBsetatr);
1159 return;
1160 }
1161 }
1162
1163 reply_outbuf(req, 0, 0);
1164
1165 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1166
1167 END_PROFILE(SMBsetatr);
1168 return;
1169 }
1170
1171 /****************************************************************************
1172 Reply to a dskattr.
1173 ****************************************************************************/
1174
1175 void reply_dskattr(struct smb_request *req)
1176 {
1177 connection_struct *conn = req->conn;
1178 uint64_t dfree,dsize,bsize;
1179 START_PROFILE(SMBdskattr);
1180
1181 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1182 reply_unixerror(req, ERRHRD, ERRgeneral);
1183 END_PROFILE(SMBdskattr);
1184 return;
1185 }
1186
1187 reply_outbuf(req, 5, 0);
1188
1189 if (Protocol <= PROTOCOL_LANMAN2) {
1190 double total_space, free_space;
1191 /* we need to scale this to a number that DOS6 can handle. We
1192 use floating point so we can handle large drives on systems
1193 that don't have 64 bit integers
1194
1195 we end up displaying a maximum of 2G to DOS systems
1196 */
1197 total_space = dsize * (double)bsize;
1198 free_space = dfree * (double)bsize;
1199
1200 dsize = (uint64_t)((total_space+63*512) / (64*512));
1201 dfree = (uint64_t)((free_space+63*512) / (64*512));
1202
1203 if (dsize > 0xFFFF) dsize = 0xFFFF;
1204 if (dfree > 0xFFFF) dfree = 0xFFFF;
1205
1206 SSVAL(req->outbuf,smb_vwv0,dsize);
1207 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1208 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1209 SSVAL(req->outbuf,smb_vwv3,dfree);
1210 } else {
1211 SSVAL(req->outbuf,smb_vwv0,dsize);
1212 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1213 SSVAL(req->outbuf,smb_vwv2,512);
1214 SSVAL(req->outbuf,smb_vwv3,dfree);
1215 }
1216
1217 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1218
1219 END_PROFILE(SMBdskattr);
1220 return;
1221 }
1222
1223 /****************************************************************************
1224 Reply to a search.
1225 Can be called from SMBsearch, SMBffirst or SMBfunique.
1226 ****************************************************************************/
1227
1228 void reply_search(struct smb_request *req)
1229 {
1230 connection_struct *conn = req->conn;
1231 const char *mask = NULL;
1232 char *directory = NULL;
1233 char *fname = NULL;
1234 SMB_OFF_T size;
1235 uint32 mode;
1236 time_t date;
1237 uint32 dirtype;
1238 unsigned int numentries = 0;
1239 unsigned int maxentries = 0;
1240 bool finished = False;
1241 const char *p;
1242 int status_len;
1243 char *path = NULL;
1244 char status[21];
1245 int dptr_num= -1;
1246 bool check_descend = False;
1247 bool expect_close = False;
1248 NTSTATUS nt_status;
1249 bool mask_contains_wcard = False;
1250 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1251 TALLOC_CTX *ctx = talloc_tos();
1252 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1253
1254 START_PROFILE(SMBsearch);
1255
1256 if (req->wct < 2) {
1257 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1258 END_PROFILE(SMBsearch);
1259 return;
1260 }
1261
1262 if (lp_posix_pathnames()) {
1263 reply_unknown_new(req, req->cmd);
1264 END_PROFILE(SMBsearch);
1265 return;
1266 }
1267
1268 /* If we were called as SMBffirst then we must expect close. */
1269 if(req->cmd == SMBffirst) {
1270 expect_close = True;
1271 }
1272
1273 reply_outbuf(req, 1, 3);
1274 maxentries = SVAL(req->vwv+0, 0);
1275 dirtype = SVAL(req->vwv+1, 0);
1276 p = (const char *)req->buf + 1;
1277 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1278 &nt_status, &mask_contains_wcard);
1279 if (!NT_STATUS_IS_OK(nt_status)) {
1280 reply_nterror(req, nt_status);
1281 END_PROFILE(SMBsearch);
1282 return;
1283 }
1284
1285 nt_status = resolve_dfspath_wcard(ctx, conn,
1286 req->flags2 & FLAGS2_DFS_PATHNAMES,
1287 path,
1288 &path,
1289 &mask_contains_wcard);
1290 if (!NT_STATUS_IS_OK(nt_status)) {
1291 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1292 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1293 ERRSRV, ERRbadpath);
1294 END_PROFILE(SMBsearch);
1295 return;
1296 }
1297 reply_nterror(req, nt_status);
1298 END_PROFILE(SMBsearch);
1299 return;
1300 }
1301
1302 p++;
1303 status_len = SVAL(p, 0);
1304 p += 2;
1305
1306 /* dirtype &= ~aDIR; */
1307
1308 if (status_len == 0) {
1309 SMB_STRUCT_STAT sbuf;
1310
1311 nt_status = unix_convert(ctx, conn, path, True,
1312 &directory, NULL, &sbuf);
1313 if (!NT_STATUS_IS_OK(nt_status)) {
1314 reply_nterror(req, nt_status);
1315 END_PROFILE(SMBsearch);
1316 return;
1317 }
1318
1319 nt_status = check_name(conn, directory);
1320 if (!NT_STATUS_IS_OK(nt_status)) {
1321 reply_nterror(req, nt_status);
1322 END_PROFILE(SMBsearch);
1323 return;
1324 }
1325
1326 p = strrchr_m(directory,'/');
1327 if ((p != NULL) && (*directory != '/')) {
1328 mask = p + 1;
1329 directory = talloc_strndup(ctx, directory,
1330 PTR_DIFF(p, directory));
1331 } else {
1332 mask = directory;
1333 directory = talloc_strdup(ctx,".");
1334 }
1335
1336 if (!directory) {
1337 reply_nterror(req, NT_STATUS_NO_MEMORY);
1338 END_PROFILE(SMBsearch);
1339 return;
1340 }
1341
1342 memset((char *)status,'\0',21);
1343 SCVAL(status,0,(dirtype & 0x1F));
1344
1345 nt_status = dptr_create(conn,
1346 directory,
1347 True,
1348 expect_close,
1349 req->smbpid,
1350 mask,
1351 mask_contains_wcard,
1352 dirtype,
1353 &conn->dirptr);
1354 if (!NT_STATUS_IS_OK(nt_status)) {
1355 reply_nterror(req, nt_status);
1356 END_PROFILE(SMBsearch);
1357 return;
1358 }
1359 dptr_num = dptr_dnum(conn->dirptr);
1360 } else {
1361 int status_dirtype;
1362
1363 memcpy(status,p,21);
1364 status_dirtype = CVAL(status,0) & 0x1F;
1365 if (status_dirtype != (dirtype & 0x1F)) {
1366 dirtype = status_dirtype;
1367 }
1368
1369 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1370 if (!conn->dirptr) {
1371 goto SearchEmpty;
1372 }
1373 string_set(&conn->dirpath,dptr_path(dptr_num));
1374 mask = dptr_wcard(dptr_num);
1375 if (!mask) {
1376 goto SearchEmpty;
1377 }
1378 /*
1379 * For a 'continue' search we have no string. So
1380 * check from the initial saved string.
1381 */
1382 mask_contains_wcard = ms_has_wild(mask);
1383 dirtype = dptr_attr(dptr_num);
1384 }
1385
1386 DEBUG(4,("dptr_num is %d\n",dptr_num));
1387
1388 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1389 dptr_init_search_op(conn->dirptr);
1390
1391 if ((dirtype&0x1F) == aVOLID) {
1392 char buf[DIR_STRUCT_SIZE];
1393 memcpy(buf,status,21);
1394 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1395 0,aVOLID,0,!allow_long_path_components)) {
1396 reply_nterror(req, NT_STATUS_NO_MEMORY);
1397 END_PROFILE(SMBsearch);
1398 return;
1399 }
1400 dptr_fill(buf+12,dptr_num);
1401 if (dptr_zero(buf+12) && (status_len==0)) {
1402 numentries = 1;
1403 } else {
1404 numentries = 0;
1405 }
1406 if (message_push_blob(&req->outbuf,
1407 data_blob_const(buf, sizeof(buf)))
1408 == -1) {
1409 reply_nterror(req, NT_STATUS_NO_MEMORY);
1410 END_PROFILE(SMBsearch);
1411 return;
1412 }
1413 } else {
1414 unsigned int i;
1415 maxentries = MIN(
1416 maxentries,
1417 ((BUFFER_SIZE -
1418 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1419 /DIR_STRUCT_SIZE));
1420
1421 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1422 conn->dirpath,lp_dontdescend(SNUM(conn))));
1423 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1424 check_descend = True;
1425 }
1426
1427 for (i=numentries;(i<maxentries) && !finished;i++) {
1428 finished = !get_dir_entry(ctx,
1429 conn,
1430 mask,
1431 dirtype,
1432 &fname,
1433 &size,
1434 &mode,
1435 &date,
1436 check_descend,
1437 ask_sharemode);
1438 if (!finished) {
1439 char buf[DIR_STRUCT_SIZE];
1440 memcpy(buf,status,21);
1441 if (!make_dir_struct(ctx,
1442 buf,
1443 mask,
1444 fname,
1445 size,
1446 mode,
1447 date,
1448 !allow_long_path_components)) {
1449 reply_nterror(req, NT_STATUS_NO_MEMORY);
1450 END_PROFILE(SMBsearch);
1451 return;
1452 }
1453 if (!dptr_fill(buf+12,dptr_num)) {
1454 break;
1455 }
1456 if (message_push_blob(&req->outbuf,
1457 data_blob_const(buf, sizeof(buf)))
1458 == -1) {
1459 reply_nterror(req, NT_STATUS_NO_MEMORY);
1460 END_PROFILE(SMBsearch);
1461 return;
1462 }
1463 numentries++;
1464 }
1465 }
1466 }
1467
1468 SearchEmpty:
1469
1470 /* If we were called as SMBffirst with smb_search_id == NULL
1471 and no entries were found then return error and close dirptr
1472 (X/Open spec) */
1473
1474 if (numentries == 0) {
1475 dptr_close(&dptr_num);
1476 } else if(expect_close && status_len == 0) {
1477 /* Close the dptr - we know it's gone */
1478 dptr_close(&dptr_num);
1479 }
1480
1481 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1482 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1483 dptr_close(&dptr_num);
1484 }
1485
1486 if ((numentries == 0) && !mask_contains_wcard) {
1487 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1488 END_PROFILE(SMBsearch);
1489 return;
1490 }
1491
1492 SSVAL(req->outbuf,smb_vwv0,numentries);
1493 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1494 SCVAL(smb_buf(req->outbuf),0,5);
1495 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1496
1497 /* The replies here are never long name. */
1498 SSVAL(req->outbuf, smb_flg2,
1499 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1500 if (!allow_long_path_components) {
1501 SSVAL(req->outbuf, smb_flg2,
1502 SVAL(req->outbuf, smb_flg2)
1503 & (~FLAGS2_LONG_PATH_COMPONENTS));
1504 }
1505
1506 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1507 SSVAL(req->outbuf, smb_flg2,
1508 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1509
1510 if (!directory) {
1511 directory = dptr_path(dptr_num);
1512 }
1513
1514 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1515 smb_fn_name(req->cmd),
1516 mask,
1517 directory ? directory : "./",
1518 dirtype,
1519 numentries,
1520 maxentries ));
1521
1522 END_PROFILE(SMBsearch);
1523 return;
1524 }
1525
1526 /****************************************************************************
1527 Reply to a fclose (stop directory search).
1528 ****************************************************************************/
1529
1530 void reply_fclose(struct smb_request *req)
1531 {
1532 int status_len;
1533 char status[21];
1534 int dptr_num= -2;
1535 const char *p;
1536 char *path = NULL;
1537 NTSTATUS err;
1538 bool path_contains_wcard = False;
1539 TALLOC_CTX *ctx = talloc_tos();
1540
1541 START_PROFILE(SMBfclose);
1542
1543 if (lp_posix_pathnames()) {
1544 reply_unknown_new(req, req->cmd);
1545 END_PROFILE(SMBfclose);
1546 return;
1547 }
1548
1549 p = (const char *)req->buf + 1;
1550 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1551 &err, &path_contains_wcard);
1552 if (!NT_STATUS_IS_OK(err)) {
1553 reply_nterror(req, err);
1554 END_PROFILE(SMBfclose);
1555 return;
1556 }
1557 p++;
1558 status_len = SVAL(p,0);
1559 p += 2;
1560
1561 if (status_len == 0) {
1562 reply_doserror(req, ERRSRV, ERRsrverror);
1563 END_PROFILE(SMBfclose);
1564 return;
1565 }
1566
1567 memcpy(status,p,21);
1568
1569 if(dptr_fetch(status+12,&dptr_num)) {
1570 /* Close the dptr - we know it's gone */
1571 dptr_close(&dptr_num);
1572 }
1573
1574 reply_outbuf(req, 1, 0);
1575 SSVAL(req->outbuf,smb_vwv0,0);
1576
1577 DEBUG(3,("search close\n"));
1578
1579 END_PROFILE(SMBfclose);
1580 return;
1581 }
1582
1583 /****************************************************************************
1584 Reply to an open.
1585 ****************************************************************************/
1586
1587 void reply_open(struct smb_request *req)
1588 {
1589 connection_struct *conn = req->conn;
1590 char *fname = NULL;
1591 uint32 fattr=0;
1592 SMB_OFF_T size = 0;
1593 time_t mtime=0;
1594 int info;
1595 SMB_STRUCT_STAT sbuf;
1596 files_struct *fsp;
1597 int oplock_request;
1598 int deny_mode;
1599 uint32 dos_attr;
1600 uint32 access_mask;
1601 uint32 share_mode;
1602 uint32 create_disposition;
1603 uint32 create_options = 0;
1604 NTSTATUS status;
1605 TALLOC_CTX *ctx = talloc_tos();
1606
1607 START_PROFILE(SMBopen);
1608
1609 SET_STAT_INVALID(sbuf);
1610
1611 if (req->wct < 2) {
1612 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1613 END_PROFILE(SMBopen);
1614 return;
1615 }
1616
1617 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1618 deny_mode = SVAL(req->vwv+0, 0);
1619 dos_attr = SVAL(req->vwv+1, 0);
1620
1621 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1622 STR_TERMINATE, &status);
1623 if (!NT_STATUS_IS_OK(status)) {
1624 reply_nterror(req, status);
1625 END_PROFILE(SMBopen);
1626 return;
1627 }
1628
1629 if (!map_open_params_to_ntcreate(
1630 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1631 &share_mode, &create_disposition, &create_options)) {
1632 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1633 END_PROFILE(SMBopen);
1634 return;
1635 }
1636
1637 status = SMB_VFS_CREATE_FILE(
1638 conn, /* conn */
1639 req, /* req */
1640 0, /* root_dir_fid */
1641 fname, /* fname */
1642 CFF_DOS_PATH, /* create_file_flags */
1643 access_mask, /* access_mask */
1644 share_mode, /* share_access */
1645 create_disposition, /* create_disposition*/
1646 create_options, /* create_options */
1647 dos_attr, /* file_attributes */
1648 oplock_request, /* oplock_request */
1649 0, /* allocation_size */
1650 NULL, /* sd */
1651 NULL, /* ea_list */
1652 &fsp, /* result */
1653 &info, /* pinfo */
1654 &sbuf); /* psbuf */
1655
1656 if (!NT_STATUS_IS_OK(status)) {
1657 if (open_was_deferred(req->mid)) {
1658 /* We have re-scheduled this call. */
1659 END_PROFILE(SMBopen);
1660 return;
1661 }
1662 reply_openerror(req, status);
1663 END_PROFILE(SMBopen);
1664 return;
1665 }
1666
1667 size = sbuf.st_size;
1668 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1669 mtime = sbuf.st_mtime;
1670
1671 if (fattr & aDIR) {
1672 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1673 close_file(req, fsp, ERROR_CLOSE);
1674 reply_doserror(req, ERRDOS,ERRnoaccess);
1675 END_PROFILE(SMBopen);
1676 return;
1677 }
1678
1679 reply_outbuf(req, 7, 0);
1680 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1681 SSVAL(req->outbuf,smb_vwv1,fattr);
1682 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1683 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1684 } else {
1685 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1686 }
1687 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1688 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1689
1690 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1691 SCVAL(req->outbuf,smb_flg,
1692 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1693 }
1694
1695 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1696 SCVAL(req->outbuf,smb_flg,
1697 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1698 }
1699 END_PROFILE(SMBopen);
1700 return;
1701 }
1702
1703 /****************************************************************************
1704 Reply to an open and X.
1705 ****************************************************************************/
1706
1707 void reply_open_and_X(struct smb_request *req)
1708 {
1709 connection_struct *conn = req->conn;
1710 char *fname = NULL;
1711 uint16 open_flags;
1712 int deny_mode;
1713 uint32 smb_attr;
1714 /* Breakout the oplock request bits so we can set the
1715 reply bits separately. */
1716 int ex_oplock_request;
1717 int core_oplock_request;
1718 int oplock_request;
1719 #if 0
1720 int smb_sattr = SVAL(req->vwv+4, 0);
1721 uint32 smb_time = make_unix_date3(req->vwv+6);
1722 #endif
1723 int smb_ofun;
1724 uint32 fattr=0;
1725 int mtime=0;
1726 SMB_STRUCT_STAT sbuf;
1727 int smb_action = 0;
1728 files_struct *fsp;
1729 NTSTATUS status;
1730 uint64_t allocation_size;
1731 ssize_t retval = -1;
1732 uint32 access_mask;
1733 uint32 share_mode;
1734 uint32 create_disposition;
1735 uint32 create_options = 0;
1736 TALLOC_CTX *ctx = talloc_tos();
1737
1738 START_PROFILE(SMBopenX);
1739
1740 if (req->wct < 15) {
1741 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1742 END_PROFILE(SMBopenX);
1743 return;
1744 }
1745
1746 SET_STAT_INVALID(sbuf);
1747
1748 open_flags = SVAL(req->vwv+2, 0);
1749 deny_mode = SVAL(req->vwv+3, 0);
1750 smb_attr = SVAL(req->vwv+5, 0);
1751 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1752 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1753 oplock_request = ex_oplock_request | core_oplock_request;
1754 smb_ofun = SVAL(req->vwv+8, 0);
1755 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1756
1757 /* If it's an IPC, pass off the pipe handler. */
1758 if (IS_IPC(conn)) {
1759 if (lp_nt_pipe_support()) {
1760 reply_open_pipe_and_X(conn, req);
1761 } else {
1762 reply_doserror(req, ERRSRV, ERRaccess);
1763 }
1764 END_PROFILE(SMBopenX);
1765 return;
1766 }
1767
1768 /* XXXX we need to handle passed times, sattr and flags */
1769 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1770 STR_TERMINATE, &status);
1771 if (!NT_STATUS_IS_OK(status)) {
1772 reply_nterror(req, status);
1773 END_PROFILE(SMBopenX);
1774 return;
1775 }
1776
1777 if (!map_open_params_to_ntcreate(
1778 fname, deny_mode, smb_ofun, &access_mask,
1779 &share_mode, &create_disposition, &create_options)) {
1780 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1781 END_PROFILE(SMBopenX);
1782 return;
1783 }
1784
1785 status = SMB_VFS_CREATE_FILE(
1786 conn, /* conn */
1787 req, /* req */
1788 0, /* root_dir_fid */
1789 fname, /* fname */
1790 CFF_DOS_PATH, /* create_file_flags */
1791 access_mask, /* access_mask */
1792 share_mode, /* share_access */
1793 create_disposition, /* create_disposition*/
1794 create_options, /* create_options */
1795 smb_attr, /* file_attributes */
1796 oplock_request, /* oplock_request */
1797 0, /* allocation_size */
1798 NULL, /* sd */
1799 NULL, /* ea_list */
1800 &fsp, /* result */
1801 &smb_action, /* pinfo */
1802 &sbuf); /* psbuf */
1803
1804 if (!NT_STATUS_IS_OK(status)) {
1805 END_PROFILE(SMBopenX);
1806 if (open_was_deferred(req->mid)) {
1807 /* We have re-scheduled this call. */
1808 return;
1809 }
1810 reply_openerror(req, status);
1811 return;
1812 }
1813
1814 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1815 if the file is truncated or created. */
1816 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1817 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1818 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1819 close_file(req, fsp, ERROR_CLOSE);
1820 reply_nterror(req, NT_STATUS_DISK_FULL);
1821 END_PROFILE(SMBopenX);
1822 return;
1823 }
1824 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1825 if (retval < 0) {
1826 close_file(req, fsp, ERROR_CLOSE);
1827 reply_nterror(req, NT_STATUS_DISK_FULL);
1828 END_PROFILE(SMBopenX);
1829 return;
1830 }
1831 sbuf.st_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
1832 }
1833
1834 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1835 mtime = sbuf.st_mtime;
1836 if (fattr & aDIR) {
1837 close_file(req, fsp, ERROR_CLOSE);
1838 reply_doserror(req, ERRDOS, ERRnoaccess);
1839 END_PROFILE(SMBopenX);
1840 return;
1841 }
1842
1843 /* If the caller set the extended oplock request bit
1844 and we granted one (by whatever means) - set the
1845 correct bit for extended oplock reply.
1846 */
1847
1848 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1849 smb_action |= EXTENDED_OPLOCK_GRANTED;
1850 }
1851
1852 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1853 smb_action |= EXTENDED_OPLOCK_GRANTED;
1854 }
1855
1856 /* If the caller set the core oplock request bit
1857 and we granted one (by whatever means) - set the
1858 correct bit for core oplock reply.
1859 */
1860
1861 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1862 reply_outbuf(req, 19, 0);
1863 } else {
1864 reply_outbuf(req, 15, 0);
1865 }
1866
1867 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1868 SCVAL(req->outbuf, smb_flg,
1869 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1870 }
1871
1872 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1873 SCVAL(req->outbuf, smb_flg,
1874 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1875 }
1876
1877 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1878 SSVAL(req->outbuf,smb_vwv3,fattr);
1879 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1880 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1881 } else {
1882 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1883 }
1884 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1885 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1886 SSVAL(req->outbuf,smb_vwv11,smb_action);
1887
1888 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1889 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1890 }
1891
1892 END_PROFILE(SMBopenX);
1893 chain_reply(req);
1894 return;
1895 }
1896
1897 /****************************************************************************
1898 Reply to a SMBulogoffX.
1899 ****************************************************************************/
1900
1901 void reply_ulogoffX(struct smb_request *req)
1902 {
1903 user_struct *vuser;
1904
1905 START_PROFILE(SMBulogoffX);
1906
1907 vuser = get_valid_user_struct(req->vuid);
1908
1909 if(vuser == NULL) {
1910 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1911 req->vuid));
1912 }
1913
1914 /* in user level security we are supposed to close any files
1915 open by this user */
1916 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1917 file_close_user(req->vuid);
1918 }
1919
1920 invalidate_vuid(req->vuid);
1921
1922 reply_outbuf(req, 2, 0);
1923
1924 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1925
1926 END_PROFILE(SMBulogoffX);
1927 chain_reply(req);
1928 }
1929
1930 /****************************************************************************
1931 Reply to a mknew or a create.
1932 ****************************************************************************/
1933
1934 void reply_mknew(struct smb_request *req)
1935 {
1936 connection_struct *conn = req->conn;
1937 char *fname = NULL;
1938 uint32 fattr = 0;
1939 struct smb_file_time ft;
1940 files_struct *fsp;
1941 int oplock_request = 0;
1942 SMB_STRUCT_STAT sbuf;
1943 NTSTATUS status;
1944 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1945 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1946 uint32 create_disposition;
1947 uint32 create_options = 0;
1948 TALLOC_CTX *ctx = talloc_tos();
1949
1950 START_PROFILE(SMBcreate);
1951 ZERO_STRUCT(ft);
1952 SET_STAT_INVALID(sbuf);
1953
1954 if (req->wct < 3) {
1955 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1956 END_PROFILE(SMBcreate);
1957 return;
1958 }
1959
1960 fattr = SVAL(req->vwv+0, 0);
1961 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1962
1963 /* mtime. */
1964 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
1965
1966 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
1967 STR_TERMINATE, &status);
1968 if (!NT_STATUS_IS_OK(status)) {
1969 reply_nterror(req, status);
1970 END_PROFILE(SMBcreate);
1971 return;
1972 }
1973
1974 if (fattr & aVOLID) {
1975 DEBUG(0,("Attempt to create file (%s) with volid set - "
1976 "please report this\n", fname));
1977 }
1978
1979 if(req->cmd == SMBmknew) {
1980 /* We should fail if file exists. */
1981 create_disposition = FILE_CREATE;
1982 } else {
1983 /* Create if file doesn't exist, truncate if it does. */
1984 create_disposition = FILE_OVERWRITE_IF;
1985 }
1986
1987 status = SMB_VFS_CREATE_FILE(
1988 conn, /* conn */
1989 req, /* req */
1990 0, /* root_dir_fid */
1991 fname, /* fname */
1992 CFF_DOS_PATH, /* create_file_flags */
1993 access_mask, /* access_mask */
1994 share_mode, /* share_access */
1995 create_disposition, /* create_disposition*/
1996 create_options, /* create_options */
1997 fattr, /* file_attributes */
1998 oplock_request, /* oplock_request */
1999 0, /* allocation_size */
2000 NULL, /* sd */
2001 NULL, /* ea_list */
2002 &fsp, /* result */
2003 NULL, /* pinfo */
2004 &sbuf); /* psbuf */
2005
2006 if (!NT_STATUS_IS_OK(status)) {
2007 END_PROFILE(SMBcreate);
2008 if (open_was_deferred(req->mid)) {
2009 /* We have re-scheduled this call. */
2010 return;
2011 }
2012 reply_openerror(req, status);
2013 return;
2014 }
2015
2016 ft.atime = get_atimespec(&sbuf); /* atime. */
2017 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
2018 if (!NT_STATUS_IS_OK(status)) {
2019 END_PROFILE(SMBcreate);
2020 reply_openerror(req, status);
2021 return;
2022 }
2023
2024 reply_outbuf(req, 1, 0);
2025 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2026
2027 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2028 SCVAL(req->outbuf,smb_flg,
2029 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2030 }
2031
2032 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2033 SCVAL(req->outbuf,smb_flg,
2034 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2035 }
2036
2037 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2038 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2039 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2040
2041 END_PROFILE(SMBcreate);
2042 return;
2043 }
2044
2045 /****************************************************************************
2046 Reply to a create temporary file.
2047 ****************************************************************************/
2048
2049 void reply_ctemp(struct smb_request *req)
2050 {
2051 connection_struct *conn = req->conn;
2052 char *fname = NULL;
2053 uint32 fattr;
2054 files_struct *fsp;
2055 int oplock_request;
2056 int tmpfd;
2057 SMB_STRUCT_STAT sbuf;
2058 char *s;
2059 NTSTATUS status;
2060 TALLOC_CTX *ctx = talloc_tos();
2061
2062 START_PROFILE(SMBctemp);
2063
2064 if (req->wct < 3) {
2065 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2066 END_PROFILE(SMBctemp);
2067 return;
2068 }
2069
2070 fattr = SVAL(req->vwv+0, 0);
2071 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2072
2073 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2074 STR_TERMINATE, &status);
2075 if (!NT_STATUS_IS_OK(status)) {
2076 reply_nterror(req, status);
2077 END_PROFILE(SMBctemp);
2078 return;
2079 }
2080 if (*fname) {
2081 fname = talloc_asprintf(ctx,
2082 "%s/TMXXXXXX",
2083 fname);
2084 } else {
2085 fname = talloc_strdup(ctx, "TMXXXXXX");
2086 }
2087
2088 if (!fname) {
2089 reply_nterror(req, NT_STATUS_NO_MEMORY);
2090 END_PROFILE(SMBctemp);
2091 return;
2092 }
2093
2094 status = resolve_dfspath(ctx, conn,
2095 req->flags2 & FLAGS2_DFS_PATHNAMES,
2096 fname,
2097 &fname);
2098 if (!NT_STATUS_IS_OK(status)) {
2099 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2100 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2101 ERRSRV, ERRbadpath);
2102 END_PROFILE(SMBctemp);
2103 return;
2104 }
2105 reply_nterror(req, status);
2106 END_PROFILE(SMBctemp);
2107 return;
2108 }
2109
2110 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2111 if (!NT_STATUS_IS_OK(status)) {
2112 reply_nterror(req, status);
2113 END_PROFILE(SMBctemp);
2114 return;
2115 }
2116
2117 status = check_name(conn, fname);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 reply_nterror(req, status);
2120 END_PROFILE(SMBctemp);
2121 return;
2122 }
2123
2124 tmpfd = smb_mkstemp(fname);
2125 if (tmpfd == -1) {
2126 reply_unixerror(req, ERRDOS, ERRnoaccess);
2127 END_PROFILE(SMBctemp);
2128 return;
2129 }
2130
2131 SET_STAT_INVALID(sbuf);
2132 SMB_VFS_STAT(conn,fname,&sbuf);
2133
2134 /* We should fail if file does not exist. */
2135 status = SMB_VFS_CREATE_FILE(
2136 conn, /* conn */
2137 req, /* req */
2138 0, /* root_dir_fid */
2139 fname, /* fname */
2140 0, /* create_file_flags */
2141 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2142 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2143 FILE_OPEN, /* create_disposition*/
2144 0, /* create_options */
2145 fattr, /* file_attributes */
2146 oplock_request, /* oplock_request */
2147 0, /* allocation_size */
2148 NULL, /* sd */
2149 NULL, /* ea_list */
2150 &fsp, /* result */
2151 NULL, /* pinfo */
2152 &sbuf); /* psbuf */
2153
2154 /* close fd from smb_mkstemp() */
2155 close(tmpfd);
2156
2157 if (!NT_STATUS_IS_OK(status)) {
2158 if (open_was_deferred(req->mid)) {
2159 /* We have re-scheduled this call. */
2160 END_PROFILE(SMBctemp);
2161 return;
2162 }
2163 reply_openerror(req, status);
2164 END_PROFILE(SMBctemp);
2165 return;
2166 }
2167
2168 reply_outbuf(req, 1, 0);
2169 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2170
2171 /* the returned filename is relative to the directory */
2172 s = strrchr_m(fsp->fsp_name, '/');
2173 if (!s) {
2174 s = fsp->fsp_name;
2175 } else {
2176 s++;
2177 }
2178
2179 #if 0
2180 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2181 thing in the byte section. JRA */
2182 SSVALS(p, 0, -1); /* what is this? not in spec */
2183 #endif
2184 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2185 == -1) {
2186 reply_nterror(req, NT_STATUS_NO_MEMORY);
2187 END_PROFILE(SMBctemp);
2188 return;
2189 }
2190
2191 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2192 SCVAL(req->outbuf, smb_flg,
2193 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2194 }
2195
2196 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2197 SCVAL(req->outbuf, smb_flg,
2198 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2199 }
2200
2201 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2202 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2203 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2204
2205 END_PROFILE(SMBctemp);
2206 return;
2207 }
2208
2209 /*******************************************************************
2210 Check if a user is allowed to rename a file.
2211 ********************************************************************/
2212
2213 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2214 uint16 dirtype, SMB_STRUCT_STAT *pst)
2215 {
2216 uint32 fmode;
2217
2218 if (!CAN_WRITE(conn)) {
2219 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2220 }
2221
2222 fmode = dos_mode(conn, fsp->fsp_name, pst);
2223 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2224 return NT_STATUS_NO_SUCH_FILE;
2225 }
2226
2227 if (S_ISDIR(pst->st_mode)) {
2228 if (fsp->posix_open) {
2229 return NT_STATUS_OK;
2230 }
2231
2232 /* If no pathnames are open below this
2233 directory, allow the rename. */
2234
2235 if (file_find_subpath(fsp)) {
2236 return NT_STATUS_ACCESS_DENIED;
2237 }
2238 return NT_STATUS_OK;
2239 }
2240
2241 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2242 return NT_STATUS_OK;
2243 }
2244
2245 return NT_STATUS_ACCESS_DENIED;
2246 }
2247
2248 /*******************************************************************
2249 * unlink a file with all relevant access checks
2250 *******************************************************************/
2251
2252 static NTSTATUS do_unlink(connection_struct *conn,
2253 struct smb_request *req,
2254 const char *fname,
2255 uint32 dirtype)
2256 {
2257 SMB_STRUCT_STAT sbuf;
2258 uint32 fattr;
2259 files_struct *fsp;
2260 uint32 dirtype_orig = dirtype;
2261 NTSTATUS status;
2262
2263 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2264
2265 if (!CAN_WRITE(conn)) {
2266 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2267 }
2268
2269 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2270 return map_nt_error_from_unix(errno);
2271 }
2272
2273 fattr = dos_mode(conn,fname,&sbuf);
2274
2275 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2276 dirtype = aDIR|aARCH|aRONLY;
2277 }
2278
2279 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2280 if (!dirtype) {
2281 return NT_STATUS_NO_SUCH_FILE;
2282 }
2283
2284 if (!dir_check_ftype(conn, fattr, dirtype)) {
2285 if (fattr & aDIR) {
2286 return NT_STATUS_FILE_IS_A_DIRECTORY;
2287 }
2288 return NT_STATUS_NO_SUCH_FILE;
2289 }
2290
2291 if (dirtype_orig & 0x8000) {
2292 /* These will never be set for POSIX. */
2293 return NT_STATUS_NO_SUCH_FILE;
2294 }
2295
2296 #if 0
2297 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2298 return NT_STATUS_FILE_IS_A_DIRECTORY;
2299 }
2300
2301 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2302 return NT_STATUS_NO_SUCH_FILE;
2303 }
2304
2305 if (dirtype & 0xFF00) {
2306 /* These will never be set for POSIX. */
2307 return NT_STATUS_NO_SUCH_FILE;
2308 }
2309
2310 dirtype &= 0xFF;
2311 if (!dirtype) {
2312 return NT_STATUS_NO_SUCH_FILE;
2313 }
2314
2315 /* Can't delete a directory. */
2316 if (fattr & aDIR) {
2317 return NT_STATUS_FILE_IS_A_DIRECTORY;
2318 }
2319 #endif
2320
2321 #if 0 /* JRATEST */
2322 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2323 return NT_STATUS_OBJECT_NAME_INVALID;
2324 #endif /* JRATEST */
2325
2326 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2327
2328 On a Windows share, a file with read-only dosmode can be opened with
2329 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2330 fails with NT_STATUS_CANNOT_DELETE error.
2331
2332 This semantic causes a problem that a user can not
2333 rename a file with read-only dosmode on a Samba share
2334 from a Windows command prompt (i.e. cmd.exe, but can rename
2335 from Windows Explorer).
2336 */
2337
2338 if (!lp_delete_readonly(SNUM(conn))) {
2339 if (fattr & aRONLY) {
2340 return NT_STATUS_CANNOT_DELETE;
2341 }
2342 }
2343
2344 /* On open checks the open itself will check the share mode, so
2345 don't do it here as we'll get it wrong. */
2346
2347 status = SMB_VFS_CREATE_FILE
2348 (conn, /* conn */
2349 req, /* req */
2350 0, /* root_dir_fid */
2351 fname, /* fname */
2352 0, /* create_file_flags */
2353 DELETE_ACCESS, /* access_mask */
2354 FILE_SHARE_NONE, /* share_access */
2355 FILE_OPEN, /* create_disposition*/
2356 FILE_NON_DIRECTORY_FILE, /* create_options */
2357 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2358 0, /* oplock_request */
2359 0, /* allocation_size */
2360 NULL, /* sd */
2361 NULL, /* ea_list */
2362 &fsp, /* result */
2363 NULL, /* pinfo */
2364 &sbuf); /* psbuf */
2365
2366 if (!NT_STATUS_IS_OK(status)) {
2367 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2368 nt_errstr(status)));
2369 return status;
2370 }
2371
2372 /* The set is across all open files on this dev/inode pair. */
2373 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2374 close_file(req, fsp, NORMAL_CLOSE);
2375 return NT_STATUS_ACCESS_DENIED;
2376 }
2377
2378 return close_file(req, fsp, NORMAL_CLOSE);
2379 }
2380
2381 /****************************************************************************
2382 The guts of the unlink command, split out so it may be called by the NT SMB
2383 code.
2384 ****************************************************************************/
2385
2386 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2387 uint32 dirtype, const char *name_in, bool has_wild)
2388 {
2389 const char *directory = NULL;
2390 char *mask = NULL;
2391 char *name = NULL;
2392 char *p = NULL;
2393 int count=0;
2394 NTSTATUS status = NT_STATUS_OK;
2395 SMB_STRUCT_STAT sbuf, st;
2396 TALLOC_CTX *ctx = talloc_tos();
2397
2398 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2399 if (!NT_STATUS_IS_OK(status)) {
2400 return status;
2401 }
2402
2403 p = strrchr_m(name,'/');
2404 if (!p) {
2405 directory = talloc_strdup(ctx, ".");
2406 if (!directory) {
2407 return NT_STATUS_NO_MEMORY;
2408 }
2409 mask = name;
2410 } else {
2411 *p = 0;
2412 directory = name;
2413 mask = p+1;
2414 }
2415
2416 /*
2417 * We should only check the mangled cache
2418 * here if unix_convert failed. This means
2419 * that the path in 'mask' doesn't exist
2420 * on the file system and so we need to look
2421 * for a possible mangle. This patch from
2422 * Tine Smukavec <valentin.smukavec@hermes.si>.
2423 */
2424
2425 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2426 char *new_mask = NULL;
2427 mangle_lookup_name_from_8_3(ctx,
2428 mask,
2429 &new_mask,
2430 conn->params );
2431 if (new_mask) {
2432 mask = new_mask;
2433 }
2434 }
2435
2436 if (!has_wild) {
2437 directory = talloc_asprintf(ctx,
2438 "%s/%s",
2439 directory,
2440 mask);
2441 if (!directory) {
2442 return NT_STATUS_NO_MEMORY;
2443 }
2444 if (dirtype == 0) {
2445 dirtype = FILE_ATTRIBUTE_NORMAL;
2446 }
2447
2448 status = check_name(conn, directory);
2449 if (!NT_STATUS_IS_OK(status)) {
2450 return status;
2451 }
2452
2453 status = do_unlink(conn, req, directory, dirtype);
2454 if (!NT_STATUS_IS_OK(status)) {
2455 return status;
2456 }
2457
2458 count++;
2459 } else {
2460 struct smb_Dir *dir_hnd = NULL;
2461 long offset = 0;
2462 const char *dname;
2463
2464 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2465 return NT_STATUS_OBJECT_NAME_INVALID;
2466 }
2467
2468 if (strequal(mask,"????????.???")) {
2469 mask[0] = '*';
2470 mask[1] = '\0';
2471 }
2472
2473 status = check_name(conn, directory);
2474 if (!NT_STATUS_IS_OK(status)) {
2475 return status;
2476 }
2477
2478 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2479 dirtype);
2480 if (dir_hnd == NULL) {
2481 return map_nt_error_from_unix(errno);
2482 }
2483
2484 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2485 the pattern matches against the long name, otherwise the short name
2486 We don't implement this yet XXXX
2487 */
2488
2489 status = NT_STATUS_NO_SUCH_FILE;
2490
2491 while ((dname = ReadDirName(dir_hnd, &offset, &st))) {
2492 char *fname = NULL;
2493
2494 if (!is_visible_file(conn, directory, dname, &st,
2495 true))
2496 {
2497 continue;
2498 }
2499
2500 /* Quick check for "." and ".." */
2501 if (ISDOT(dname) || ISDOTDOT(dname)) {
2502 continue;
2503 }
2504
2505 if(!mask_match(dname, mask, conn->case_sensitive)) {
2506 continue;
2507 }
2508
2509 fname = talloc_asprintf(ctx, "%s/%s",
2510 directory,
2511 dname);
2512 if (!fname) {
2513 return NT_STATUS_NO_MEMORY;
2514 }
2515
2516 status = check_name(conn, fname);
2517 if (!NT_STATUS_IS_OK(status)) {
2518 TALLOC_FREE(dir_hnd);
2519 return status;
2520 }
2521
2522 status = do_unlink(conn, req, fname, dirtype);
2523 if (!NT_STATUS_IS_OK(status)) {
2524 TALLOC_FREE(fname);
2525 continue;
2526 }
2527
2528 count++;
2529 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2530 fname));
2531
2532 TALLOC_FREE(fname);
2533 }
2534 TALLOC_FREE(dir_hnd);
2535 }
2536
2537 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2538 status = map_nt_error_from_unix(errno);
2539 }
2540
2541 return status;
2542 }
2543
2544 /****************************************************************************
2545 Reply to a unlink
2546 ****************************************************************************/
2547
2548 void reply_unlink(struct smb_request *req)
2549 {
2550 connection_struct *conn = req->conn;
2551 char *name = NULL;
2552 uint32 dirtype;
2553 NTSTATUS status;
2554 bool path_contains_wcard = False;
2555 TALLOC_CTX *ctx = talloc_tos();
2556
2557 START_PROFILE(SMBunlink);
2558
2559 if (req->wct < 1) {
2560 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2561 END_PROFILE(SMBunlink);
2562 return;
2563 }
2564
2565 dirtype = SVAL(req->vwv+0, 0);
2566
2567 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2568 STR_TERMINATE, &status,
2569 &path_contains_wcard);
2570 if (!NT_STATUS_IS_OK(status)) {
2571 reply_nterror(req, status);
2572 END_PROFILE(SMBunlink);
2573 return;
2574 }
2575
2576 status = resolve_dfspath_wcard(ctx, conn,
2577 req->flags2 & FLAGS2_DFS_PATHNAMES,
2578 name,
2579 &name,
2580 &path_contains_wcard);
2581 if (!NT_STATUS_IS_OK(status)) {
2582 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2583 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2584 ERRSRV, ERRbadpath);
2585 END_PROFILE(SMBunlink);
2586 return;
2587 }
2588 reply_nterror(req, status);
2589 END_PROFILE(SMBunlink);
2590 return;
2591 }
2592
2593 DEBUG(3,("reply_unlink : %s\n",name));
2594
2595 status = unlink_internals(conn, req, dirtype, name,
2596 path_contains_wcard);
2597 if (!NT_STATUS_IS_OK(status)) {
2598 if (open_was_deferred(req->mid)) {
2599 /* We have re-scheduled this call. */
2600 END_PROFILE(SMBunlink);
2601 return;
2602 }
2603 reply_nterror(req, status);
2604 END_PROFILE(SMBunlink);
2605 return;
2606 }
2607
2608 reply_outbuf(req, 0, 0);
2609 END_PROFILE(SMBunlink);
2610
2611 return;
2612 }
2613
2614 /****************************************************************************
2615 Fail for readbraw.
2616 ****************************************************************************/
2617
2618 static void fail_readraw(void)
2619 {
2620 const char *errstr = talloc_asprintf(talloc_tos(),
2621 "FAIL ! reply_readbraw: socket write fail (%s)",
2622 strerror(errno));
2623 if (!errstr) {
2624 errstr = "";
2625 }
2626 exit_server_cleanly(errstr);
2627 }
2628
2629 /****************************************************************************
2630 Fake (read/write) sendfile. Returns -1 on read or write fail.
2631 ****************************************************************************/
2632
2633 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2634 size_t nread)
2635 {
2636 size_t bufsize;
2637 size_t tosend = nread;
2638 char *buf;
2639
2640 if (nread == 0) {
2641 return 0;
2642 }
2643
2644 bufsize = MIN(nread, 65536);
2645
2646 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2647 return -1;
2648 }
2649
2650 while (tosend > 0) {
2651 ssize_t ret;
2652 size_t cur_read;
2653
2654 if (tosend > bufsize) {
2655 cur_read = bufsize;
2656 } else {
2657 cur_read = tosend;
2658 }
2659 ret = read_file(fsp,buf,startpos,cur_read);
2660 if (ret == -1) {
2661 SAFE_FREE(buf);
2662 return -1;
2663 }
2664
2665 /* If we had a short read, fill with zeros. */
2666 if (ret < cur_read) {
2667 memset(buf, '\0', cur_read - ret);
2668 }
2669
2670 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2671 SAFE_FREE(buf);
2672 return -1;
2673 }
2674 tosend -= cur_read;
2675 startpos += cur_read;
2676 }
2677
2678 SAFE_FREE(buf);
2679 return (ssize_t)nread;
2680 }
2681
2682 #if defined(WITH_SENDFILE)
2683 /****************************************************************************
2684 Deal with the case of sendfile reading less bytes from the file than
2685 requested. Fill with zeros (all we can do).
2686 ****************************************************************************/
2687
2688 static void sendfile_short_send(files_struct *fsp,
2689 ssize_t nread,
2690 size_t headersize,
2691 size_t smb_maxcnt)
2692 {
2693 if (nread < headersize) {
2694 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2695 "header for file %s (%s). Terminating\n",
2696 fsp->fsp_name, strerror(errno) ));
2697 exit_server_cleanly("sendfile_short_send failed");
2698 }
2699
2700 nread -= headersize;
2701
2702 if (nread < smb_maxcnt) {
2703 char *buf = SMB_CALLOC_ARRAY(char, 1024);
2704 if (!buf) {
2705 exit_server_cleanly("sendfile_short_send: "
2706 "malloc failed");
2707 }
2708
2709 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2710 "with zeros !\n", fsp->fsp_name));
2711
2712 while (nread < smb_maxcnt) {
2713 /*
2714 * We asked for the real file size and told sendfile
2715 * to not go beyond the end of the file. But it can
2716 * happen that in between our fstat call and the
2717 * sendfile call the file was truncated. This is very
2718 * bad because we have already announced the larger
2719 * number of bytes to the client.
2720 *
2721 * The best we can do now is to send 0-bytes, just as
2722 * a read from a hole in a sparse file would do.
2723 *
2724 * This should happen rarely enough that I don't care
2725 * about efficiency here :-)
2726 */
2727 size_t to_write;
2728
2729 to_write = MIN(sizeof(buf), smb_maxcnt - nread);
2730 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2731 exit_server_cleanly("sendfile_short_send: "
2732 "write_data failed");
2733 }
2734 nread += to_write;
2735 }
2736 SAFE_FREE(buf);
2737 }
2738 }
2739 #endif /* defined WITH_SENDFILE */
2740
2741 /****************************************************************************
2742 Return a readbraw error (4 bytes of zero).
2743 ****************************************************************************/
2744
2745 static void reply_readbraw_error(void)
2746 {
2747 char header[4];
2748 SIVAL(header,0,0);
2749 if (write_data(smbd_server_fd(),header,4) != 4) {
2750 fail_readraw();
2751 }
2752 }
2753
2754 /****************************************************************************
2755 Use sendfile in readbraw.
2756 ****************************************************************************/
2757
2758 static void send_file_readbraw(connection_struct *conn,
2759 struct smb_request *req,
2760 files_struct *fsp,
2761 SMB_OFF_T startpos,
2762 size_t nread,
2763 ssize_t mincount)
2764 {
2765 char *outbuf = NULL;
2766 ssize_t ret=0;
2767
2768 #if defined(WITH_SENDFILE)
2769 /*
2770 * We can only use sendfile on a non-chained packet
2771 * but we can use on a non-oplocked file. tridge proved this
2772 * on a train in Germany :-). JRA.
2773 * reply_readbraw has already checked the length.
2774 */
2775
2776 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2777 (fsp->wcp == NULL) &&
2778 lp_use_sendfile(SNUM(conn), smbd_server_conn->signing_state) ) {
2779 ssize_t sendfile_read = -1;
2780 char header[4];
2781 DATA_BLOB header_blob;
2782
2783 _smb_setlen(header,nread);
2784 header_blob = data_blob_const(header, 4);
2785
2786 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2787 &header_blob, startpos, nread)) == -1) {
2788 /* Returning ENOSYS means no data at all was sent.
2789 * Do this as a normal read. */
2790 if (errno == ENOSYS) {
2791 goto normal_readbraw;
2792 }
2793
2794 /*
2795 * Special hack for broken Linux with no working sendfile. If we
2796 * return EINTR we sent the header but not the rest of the data.
2797 * Fake this up by doing read/write calls.
2798 */
2799 if (errno == EINTR) {
2800 /* Ensure we don't do this again. */
2801 set_use_sendfile(SNUM(conn), False);
2802 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2803
2804 if (fake_sendfile(fsp, startpos, nread) == -1) {
2805 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2806 fsp->fsp_name, strerror(errno) ));
2807 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2808 }
2809 return;
2810 }
2811
2812 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2813 fsp->fsp_name, strerror(errno) ));
2814 exit_server_cleanly("send_file_readbraw sendfile failed");
2815 } else if (sendfile_read == 0) {
2816 /*
2817 * Some sendfile implementations return 0 to indicate
2818 * that there was a short read, but nothing was
2819 * actually written to the socket. In this case,
2820 * fallback to the normal read path so the header gets
2821 * the correct byte count.
2822 */
2823 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2824 "bytes falling back to the normal read: "
2825 "%s\n", fsp->fsp_name));
2826 goto normal_readbraw;
2827 }
2828
2829 /* Deal with possible short send. */
2830 if (sendfile_read != 4+nread) {
2831 sendfile_short_send(fsp, sendfile_read, 4, nread);
2832 }
2833 return;
2834 }
2835
2836 normal_readbraw:
2837 #endif
2838
2839 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2840 if (!outbuf) {
2841 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2842 (unsigned)(nread+4)));
2843 reply_readbraw_error();
2844 return;
2845 }
2846
2847 if (nread > 0) {
2848 ret = read_file(fsp,outbuf+4,startpos,nread);
2849 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2850 if (ret < mincount)
2851 ret = 0;
2852 #else
2853 if (ret < nread)
2854 ret = 0;
2855 #endif
2856 }
2857
2858 _smb_setlen(outbuf,ret);
2859 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2860 fail_readraw();
2861
2862 TALLOC_FREE(outbuf);
2863 }
2864
2865 /****************************************************************************
2866 Reply to a readbraw (core+ protocol).
2867 ****************************************************************************/
2868
2869 void reply_readbraw(struct smb_request *req)
2870 {
2871 connection_struct *conn = req->conn;
2872 ssize_t maxcount,mincount;
2873 size_t nread = 0;
2874 SMB_OFF_T startpos;
2875 files_struct *fsp;
2876 struct lock_struct lock;
2877 SMB_STRUCT_STAT st;
2878 SMB_OFF_T size = 0;
2879
2880 START_PROFILE(SMBreadbraw);
2881
2882 if (srv_is_signing_active(smbd_server_conn) ||
2883 is_encrypted_packet(req->inbuf)) {
2884 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2885 "raw reads/writes are disallowed.");
2886 }
2887
2888 if (req->wct < 8) {
2889 reply_readbraw_error();
2890 END_PROFILE(SMBreadbraw);
2891 return;
2892 }
2893
2894 /*
2895 * Special check if an oplock break has been issued
2896 * and the readraw request croses on the wire, we must
2897 * return a zero length response here.
2898 */
2899
2900 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
2901
2902 /*
2903 * We have to do a check_fsp by hand here, as
2904 * we must always return 4 zero bytes on error,
2905 * not a NTSTATUS.
2906 */
2907
2908 if (!fsp || !conn || conn != fsp->conn ||
2909 req->vuid != fsp->vuid ||
2910 fsp->is_directory || fsp->fh->fd == -1) {
2911 /*
2912 * fsp could be NULL here so use the value from the packet. JRA.
2913 */
2914 DEBUG(3,("reply_readbraw: fnum %d not valid "
2915 "- cache prime?\n",
2916 (int)SVAL(req->vwv+0, 0)));
2917 reply_readbraw_error();
2918 END_PROFILE(SMBreadbraw);
2919 return;
2920 }
2921
2922 /* Do a "by hand" version of CHECK_READ. */
2923 if (!(fsp->can_read ||
2924 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2925 (fsp->access_mask & FILE_EXECUTE)))) {
2926 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2927 (int)SVAL(req->vwv+0, 0)));
2928 reply_readbraw_error();
2929 END_PROFILE(SMBreadbraw);
2930 return;
2931 }
2932
2933 flush_write_cache(fsp, READRAW_FLUSH);
2934
2935 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
2936 if(req->wct == 10) {
2937 /*
2938 * This is a large offset (64 bit) read.
2939 */
2940 #ifdef LARGE_SMB_OFF_T
2941
2942 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
2943
2944 #else /* !LARGE_SMB_OFF_T */
2945
2946 /*
2947 * Ensure we haven't been sent a >32 bit offset.
2948 */
2949
2950 if(IVAL(req->vwv+8, 0) != 0) {
2951 DEBUG(0,("reply_readbraw: large offset "
2952 "(%x << 32) used and we don't support "
2953 "64 bit offsets.\n",
2954 (unsigned int)IVAL(req->vwv+8, 0) ));
2955 reply_readbraw_error();
2956 END_PROFILE(SMBreadbraw);
2957 return;
2958 }
2959
2960 #endif /* LARGE_SMB_OFF_T */
2961
2962 if(startpos < 0) {
2963 DEBUG(0,("reply_readbraw: negative 64 bit "
2964 "readraw offset (%.0f) !\n",
2965 (double)startpos ));
2966 reply_readbraw_error();
2967 END_PROFILE(SMBreadbraw);
2968 return;
2969 }
2970 }
2971
2972 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
2973 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
2974
2975 /* ensure we don't overrun the packet size */
2976 maxcount = MIN(65535,maxcount);
2977
2978 init_strict_lock_struct(fsp, (uint32)req->smbpid,
2979 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
2980 &lock);
2981
2982 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
2983 reply_readbraw_error();
2984 END_PROFILE(SMBreadbraw);
2985 return;
2986 }
2987
2988 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2989 size = st.st_size;
2990 }
2991
2992 if (startpos >= size) {
2993 nread = 0;
2994 } else {
2995 nread = MIN(maxcount,(size - startpos));
2996 }
2997
2998 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2999 if (nread < mincount)
3000 nread = 0;
3001 #endif
3002
3003 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3004 "min=%lu nread=%lu\n",
3005 fsp->fnum, (double)startpos,
3006 (unsigned long)maxcount,
3007 (unsigned long)mincount,
3008 (unsigned long)nread ) );
3009
3010 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3011
3012 DEBUG(5,("reply_readbraw finished\n"));
3013
3014 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3015
3016 END_PROFILE(SMBreadbraw);
3017 return;
3018 }
3019
3020 #undef DBGC_CLASS
3021 #define DBGC_CLASS DBGC_LOCKING
3022
3023 /****************************************************************************
3024 Reply to a lockread (core+ protocol).
3025 ****************************************************************************/
3026
3027 void reply_lockread(struct smb_request *req)
3028 {
3029 connection_struct *conn = req->conn;
3030 ssize_t nread = -1;
3031 char *data;
3032 SMB_OFF_T startpos;
3033 size_t numtoread;
3034 NTSTATUS status;
3035 files_struct *fsp;
3036 struct byte_range_lock *br_lck = NULL;
3037 char *p = NULL;
3038
3039 START_PROFILE(SMBlockread);
3040
3041 if (req->wct < 5) {
3042 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3043 END_PROFILE(SMBlockread);
3044 return;
3045 }
3046
3047 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3048
3049 if (!check_fsp(conn, req, fsp)) {
3050 END_PROFILE(SMBlockread);
3051 return;
3052 }
3053
3054 if (!CHECK_READ(fsp,req)) {
3055 reply_doserror(req, ERRDOS, ERRbadaccess);
3056 END_PROFILE(SMBlockread);
3057 return;
3058 }
3059
3060 numtoread = SVAL(req->vwv+1, 0);
3061 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3062
3063 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3064
3065 reply_outbuf(req, 5, numtoread + 3);
3066
3067 data = smb_buf(req->outbuf) + 3;
3068
3069 /*
3070 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3071 * protocol request that predates the read/write lock concept.
3072 * Thus instead of asking for a read lock here we need to ask
3073 * for a write lock. JRA.
3074 * Note that the requested lock size is unaffected by max_recv.
3075 */
3076
3077 br_lck = do_lock(smbd_messaging_context(),
3078 fsp,
3079 req->smbpid,
3080 (uint64_t)numtoread,
3081 (uint64_t)startpos,
3082 WRITE_LOCK,
3083 WINDOWS_LOCK,
3084 False, /* Non-blocking lock. */
3085 &status,
3086 NULL,
3087 NULL);
3088 TALLOC_FREE(br_lck);
3089
3090 if (NT_STATUS_V(status)) {
3091 reply_nterror(req, status);
3092 END_PROFILE(SMBlockread);
3093 return;
3094 }
3095
3096 /*
3097 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3098 */
3099
3100 if (numtoread > max_recv) {
3101 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3102 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3103 (unsigned int)numtoread, (unsigned int)max_recv ));
3104 numtoread = MIN(numtoread,max_recv);
3105 }
3106 nread = read_file(fsp,data,startpos,numtoread);
3107
3108 if (nread < 0) {
3109 reply_unixerror(req, ERRDOS, ERRnoaccess);
3110 END_PROFILE(SMBlockread);
3111 return;
3112 }
3113
3114 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3115
3116 SSVAL(req->outbuf,smb_vwv0,nread);
3117 SSVAL(req->outbuf,smb_vwv5,nread+3);
3118 p = smb_buf(req->outbuf);
3119 SCVAL(p,0,0); /* pad byte. */
3120 SSVAL(p,1,nread);
3121
3122 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3123 fsp->fnum, (int)numtoread, (int)nread));
3124
3125 END_PROFILE(SMBlockread);
3126 return;
3127 }
3128
3129 #undef DBGC_CLASS
3130 #define DBGC_CLASS DBGC_ALL
3131
3132 /****************************************************************************
3133 Reply to a read.
3134 ****************************************************************************/
3135
3136 void reply_read(struct smb_request *req)
3137 {
3138 connection_struct *conn = req->conn;
3139 size_t numtoread;
3140 ssize_t nread = 0;
3141 char *data;
3142 SMB_OFF_T startpos;
3143 int outsize = 0;
3144 files_struct *fsp;
3145 struct lock_struct lock;
3146
3147 START_PROFILE(SMBread);
3148
3149 if (req->wct < 3) {
3150 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3151 END_PROFILE(SMBread);
3152 return;
3153 }
3154
3155 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3156
3157 if (!check_fsp(conn, req, fsp)) {
3158 END_PROFILE(SMBread);
3159 return;
3160 }
3161
3162 if (!CHECK_READ(fsp,req)) {
3163 reply_doserror(req, ERRDOS, ERRbadaccess);
3164 END_PROFILE(SMBread);
3165 return;
3166 }
3167
3168 numtoread = SVAL(req->vwv+1, 0);
3169 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3170
3171 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3172
3173 /*
3174 * The requested read size cannot be greater than max_recv. JRA.
3175 */
3176 if (numtoread > max_recv) {
3177 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3178 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3179 (unsigned int)numtoread, (unsigned int)max_recv ));
3180 numtoread = MIN(numtoread,max_recv);
3181 }
3182
3183 reply_outbuf(req, 5, numtoread+3);
3184
3185 data = smb_buf(req->outbuf) + 3;
3186
3187 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3188 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3189 &lock);
3190
3191 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3192 reply_doserror(req, ERRDOS,ERRlock);
3193 END_PROFILE(SMBread);
3194 return;
3195 }
3196
3197 if (numtoread > 0)
3198 nread = read_file(fsp,data,startpos,numtoread);
3199
3200 if (nread < 0) {
3201 reply_unixerror(req, ERRDOS,ERRnoaccess);
3202 goto strict_unlock;
3203 }
3204
3205 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3206
3207 SSVAL(req->outbuf,smb_vwv0,nread);
3208 SSVAL(req->outbuf,smb_vwv5,nread+3);
3209 SCVAL(smb_buf(req->outbuf),0,1);
3210 SSVAL(smb_buf(req->outbuf),1,nread);
3211
3212 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3213 fsp->fnum, (int)numtoread, (int)nread ) );
3214
3215 strict_unlock:
3216 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3217
3218 END_PROFILE(SMBread);
3219 return;
3220 }
3221
3222 /****************************************************************************
3223 Setup readX header.
3224 ****************************************************************************/
3225
3226 static int setup_readX_header(struct smb_request *req, char *outbuf,
3227 size_t smb_maxcnt)
3228 {
3229 int outsize;
3230 char *data;
3231
3232 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3233 data = smb_buf(outbuf);
3234
3235 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3236
3237 SCVAL(outbuf,smb_vwv0,0xFF);
3238 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3239 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3240 SSVAL(outbuf,smb_vwv6,
3241 req_wct_ofs(req)
3242 + 1 /* the wct field */
3243 + 12 * sizeof(uint16_t) /* vwv */
3244 + 2); /* the buflen field */
3245 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3246 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3247 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3248 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3249 return outsize;
3250 }
3251
3252 /****************************************************************************
3253 Reply to a read and X - possibly using sendfile.
3254 ****************************************************************************/
3255
3256 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3257 files_struct *fsp, SMB_OFF_T startpos,
3258 size_t smb_maxcnt)
3259 {
3260 SMB_STRUCT_STAT sbuf;
3261 ssize_t nread = -1;
3262
3263 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3264 reply_unixerror(req, ERRDOS, ERRnoaccess);
3265 return;
3266 }
3267
3268 if (startpos > sbuf.st_size) {
3269 smb_maxcnt = 0;
3270 } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3271 smb_maxcnt = (sbuf.st_size - startpos);
3272 }
3273
3274 if (smb_maxcnt == 0) {
3275 goto normal_read;
3276 }
3277
3278 #if defined(WITH_SENDFILE)
3279 /*
3280 * We can only use sendfile on a non-chained packet
3281 * but we can use on a non-oplocked file. tridge proved this
3282 * on a train in Germany :-). JRA.
3283 */
3284
3285 if (!req_is_in_chain(req) &&
3286 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3287 (fsp->wcp == NULL) &&
3288 lp_use_sendfile(SNUM(conn), smbd_server_conn->signing_state) ) {
3289 uint8 headerbuf[smb_size + 12 * 2];
3290 DATA_BLOB header;
3291
3292 /*
3293 * Set up the packet header before send. We
3294 * assume here the sendfile will work (get the
3295 * correct amount of data).
3296 */
3297
3298 header = data_blob_const(headerbuf, sizeof(headerbuf));
3299
3300 construct_reply_common_req(req, (char *)headerbuf);
3301 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3302
3303 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3304 /* Returning ENOSYS means no data at all was sent.
3305 Do this as a normal read. */
3306 if (errno == ENOSYS) {
3307 goto normal_read;
3308 }
3309
3310 /*
3311 * Special hack for broken Linux with no working sendfile. If we
3312 * return EINTR we sent the header but not the rest of the data.
3313 * Fake this up by doing read/write calls.
3314 */
3315
3316 if (errno == EINTR) {
3317 /* Ensure we don't do this again. */
3318 set_use_sendfile(SNUM(conn), False);
3319 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3320 nread = fake_sendfile(fsp, startpos,
3321 smb_maxcnt);
3322 if (nread == -1) {
3323 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3324 fsp->fsp_name, strerror(errno) ));
3325 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3326 }
3327 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3328 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3329 /* No outbuf here means successful sendfile. */
3330 TALLOC_FREE(req->outbuf);
3331 return;
3332 }
3333
3334 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3335 fsp->fsp_name, strerror(errno) ));
3336 exit_server_cleanly("send_file_readX sendfile failed");
3337 } else if (nread == 0) {
3338 /*
3339 * Some sendfile implementations return 0 to indicate
3340 * that there was a short read, but nothing was
3341 * actually written to the socket. In this case,
3342 * fallback to the normal read path so the header gets
3343 * the correct byte count.
3344 */
3345 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3346 "falling back to the normal read: %s\n",
3347 fsp->fsp_name));
3348 goto normal_read;
3349 }
3350
3351 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3352 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3353
3354 /* Deal with possible short send. */
3355 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3356 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3357 }
3358
3359 /* No outbuf here means successful sendfile. */
3360 TALLOC_FREE(req->outbuf);
3361 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3362 SMB_PERFCOUNT_END(&req->pcd);
3363 return;
3364 }
3365 #endif
3366
3367 normal_read:
3368
3369 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3370 uint8 headerbuf[smb_size + 2*12];
3371
3372 construct_reply_common_req(req, (char *)headerbuf);
3373 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3374
3375 /* Send out the header. */
3376 if (write_data(smbd_server_fd(), (char *)headerbuf,
3377 sizeof(headerbuf)) != sizeof(headerbuf)) {
3378 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3379 fsp->fsp_name, strerror(errno) ));
3380 exit_server_cleanly("send_file_readX sendfile failed");
3381 }
3382 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3383 if (nread == -1) {
3384 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3385 fsp->fsp_name, strerror(errno) ));
3386 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3387 }
3388 TALLOC_FREE(req->outbuf);
3389 return;
3390 }
3391
3392 reply_outbuf(req, 12, smb_maxcnt);
3393
3394 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3395 if (nread < 0) {
3396 reply_unixerror(req, ERRDOS, ERRnoaccess);
3397 return;
3398 }
3399
3400 setup_readX_header(req, (char *)req->outbuf, nread);
3401
3402 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3403 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3404
3405 chain_reply(req);
3406 }
3407
3408 /****************************************************************************
3409 Reply to a read and X.
3410 ****************************************************************************/
3411
3412 void reply_read_and_X(struct smb_request *req)
3413 {
3414 connection_struct *conn = req->conn;
3415 files_struct *fsp;
3416 SMB_OFF_T startpos;
3417 size_t smb_maxcnt;
3418 struct lock_struct lock;
3419 bool big_readX = False;
3420 #if 0
3421 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3422 #endif
3423
3424 START_PROFILE(SMBreadX);
3425
3426 if ((req->wct != 10) && (req->wct != 12)) {
3427 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3428 return;
3429 }
3430
3431 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3432 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3433 smb_maxcnt = SVAL(req->vwv+5, 0);
3434
3435 /* If it's an IPC, pass off the pipe handler. */
3436 if (IS_IPC(conn)) {
3437 reply_pipe_read_and_X(req);
3438 END_PROFILE(SMBreadX);
3439 return;
3440 }
3441
3442 if (!check_fsp(conn, req, fsp)) {
3443 END_PROFILE(SMBreadX);
3444 return;
3445 }
3446
3447 if (!CHECK_READ(fsp,req)) {
3448 reply_doserror(req, ERRDOS,ERRbadaccess);
3449 END_PROFILE(SMBreadX);
3450 return;
3451 }
3452
3453 if (global_client_caps & CAP_LARGE_READX) {
3454 size_t upper_size = SVAL(req->vwv+7, 0);
3455 smb_maxcnt |= (upper_size<<16);
3456 if (upper_size > 1) {
3457 /* Can't do this on a chained packet. */
3458 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3459 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3460 END_PROFILE(SMBreadX);
3461 return;
3462 }
3463 /* We currently don't do this on signed or sealed data. */
3464 if (srv_is_signing_active(smbd_server_conn) ||
3465 is_encrypted_packet(req->inbuf)) {
3466 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3467 END_PROFILE(SMBreadX);
3468 return;
3469 }
3470 /* Is there room in the reply for this data ? */
3471 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3472 reply_nterror(req,
3473 NT_STATUS_INVALID_PARAMETER);
3474 END_PROFILE(SMBreadX);
3475 return;
3476 }
3477 big_readX = True;
3478 }
3479 }
3480
3481 if (req->wct == 12) {
3482 #ifdef LARGE_SMB_OFF_T
3483 /*
3484 * This is a large offset (64 bit) read.
3485 */
3486 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3487
3488 #else /* !LARGE_SMB_OFF_T */
3489
3490 /*
3491 * Ensure we haven't been sent a >32 bit offset.
3492 */
3493
3494 if(IVAL(req->vwv+10, 0) != 0) {
3495 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3496 "used and we don't support 64 bit offsets.\n",
3497 (unsigned int)IVAL(req->vwv+10, 0) ));
3498 END_PROFILE(SMBreadX);
3499 reply_doserror(req, ERRDOS, ERRbadaccess);
3500 return;
3501 }
3502
3503 #endif /* LARGE_SMB_OFF_T */
3504
3505 }
3506
3507 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3508 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3509 &lock);
3510
3511 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3512 END_PROFILE(SMBreadX);
3513 reply_doserror(req, ERRDOS, ERRlock);
3514 return;
3515 }
3516
3517 if (!big_readX &&
3518 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3519 goto strict_unlock;
3520 }
3521
3522 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3523
3524 strict_unlock:
3525 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3526
3527 END_PROFILE(SMBreadX);
3528 return;
3529 }
3530
3531 /****************************************************************************
3532 Error replies to writebraw must have smb_wct == 1. Fix this up.
3533 ****************************************************************************/
3534
3535 void error_to_writebrawerr(struct smb_request *req)
3536 {
3537 uint8 *old_outbuf = req->outbuf;
3538
3539 reply_outbuf(req, 1, 0);
3540
3541 memcpy(req->outbuf, old_outbuf, smb_size);
3542 TALLOC_FREE(old_outbuf);
3543 }
3544
3545 /****************************************************************************
3546 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3547 ****************************************************************************/
3548
3549 void reply_writebraw(struct smb_request *req)
3550 {
3551 connection_struct *conn = req->conn;
3552 char *buf = NULL;
3553 ssize_t nwritten=0;
3554 ssize_t total_written=0;
3555 size_t numtowrite=0;
3556 size_t tcount;
3557 SMB_OFF_T startpos;
3558 char *data=NULL;
3559 bool write_through;
3560 files_struct *fsp;
3561 struct lock_struct lock;
3562 NTSTATUS status;
3563
3564 START_PROFILE(SMBwritebraw);
3565
3566 /*
3567 * If we ever reply with an error, it must have the SMB command
3568 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3569 * we're finished.
3570 */
3571 SCVAL(req->inbuf,smb_com,SMBwritec);
3572
3573 if (srv_is_signing_active(smbd_server_conn)) {
3574 END_PROFILE(SMBwritebraw);
3575 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3576 "raw reads/writes are disallowed.");
3577 }
3578
3579 if (req->wct < 12) {
3580 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3581 error_to_writebrawerr(req);
3582 END_PROFILE(SMBwritebraw);
3583 return;
3584 }
3585
3586 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3587 if (!check_fsp(conn, req, fsp)) {
3588 error_to_writebrawerr(req);
3589 END_PROFILE(SMBwritebraw);
3590 return;
3591 }
3592
3593 if (!CHECK_WRITE(fsp)) {
3594 reply_doserror(req, ERRDOS, ERRbadaccess);
3595 error_to_writebrawerr(req);
3596 END_PROFILE(SMBwritebraw);
3597 return;
3598 }
3599
3600 tcount = IVAL(req->vwv+1, 0);
3601 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3602 write_through = BITSETW(req->vwv+7,0);
3603
3604 /* We have to deal with slightly different formats depending
3605 on whether we are using the core+ or lanman1.0 protocol */
3606
3607 if(Protocol <= PROTOCOL_COREPLUS) {
3608 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3609 data = smb_buf(req->inbuf);
3610 } else {
3611 numtowrite = SVAL(req->vwv+10, 0);
3612 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3613 }
3614
3615 /* Ensure we don't write bytes past the end of this packet. */
3616 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3617 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3618 error_to_writebrawerr(req);
3619 END_PROFILE(SMBwritebraw);
3620 return;
3621 }
3622
3623 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3624 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3625 &lock);
3626
3627 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3628 reply_doserror(req, ERRDOS, ERRlock);
3629 error_to_writebrawerr(req);
3630 END_PROFILE(SMBwritebraw);
3631 return;
3632 }
3633
3634 if (numtowrite>0) {
3635 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3636 }
3637
3638 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3639 "wrote=%d sync=%d\n",
3640 fsp->fnum, (double)startpos, (int)numtowrite,
3641 (int)nwritten, (int)write_through));
3642
3643 if (nwritten < (ssize_t)numtowrite) {
3644 reply_unixerror(req, ERRHRD, ERRdiskfull);
3645 error_to_writebrawerr(req);
3646 goto strict_unlock;
3647 }
3648
3649 total_written = nwritten;
3650
3651 /* Allocate a buffer of 64k + length. */
3652 buf = TALLOC_ARRAY(NULL, char, 65540);
3653 if (!buf) {
3654 reply_doserror(req, ERRDOS, ERRnomem);
3655 error_to_writebrawerr(req);
3656 goto strict_unlock;
3657 }
3658
3659 /* Return a SMBwritebraw message to the redirector to tell
3660 * it to send more bytes */
3661
3662 memcpy(buf, req->inbuf, smb_size);
3663 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3664 SCVAL(buf,smb_com,SMBwritebraw);
3665 SSVALS(buf,smb_vwv0,0xFFFF);
3666 show_msg(buf);
3667 if (!srv_send_smb(smbd_server_fd(),
3668 buf,
3669 false, 0, /* no signing */
3670 IS_CONN_ENCRYPTED(conn),
3671 &req->pcd)) {
3672 exit_server_cleanly("reply_writebraw: srv_send_smb "
3673 "failed.");
3674 }
3675
3676 /* Now read the raw data into the buffer and write it */
3677 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3678 &numtowrite);
3679 if (!NT_STATUS_IS_OK(status)) {
3680 exit_server_cleanly("secondary writebraw failed");
3681 }
3682
3683 /* Set up outbuf to return the correct size */
3684 reply_outbuf(req, 1, 0);
3685
3686 if (numtowrite != 0) {
3687
3688 if (numtowrite > 0xFFFF) {
3689 DEBUG(0,("reply_writebraw: Oversize secondary write "
3690 "raw requested (%u). Terminating\n",
3691 (unsigned int)numtowrite ));
3692 exit_server_cleanly("secondary writebraw failed");
3693 }
3694
3695 if (tcount > nwritten+numtowrite) {
3696 DEBUG(3,("reply_writebraw: Client overestimated the "
3697 "write %d %d %d\n",
3698 (int)tcount,(int)nwritten,(int)numtowrite));
3699 }
3700
3701 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3702
3703 if (!NT_STATUS_IS_OK(status)) {
3704 DEBUG(0,("reply_writebraw: Oversize secondary write "
3705 "raw read failed (%s). Terminating\n",
3706 nt_errstr(status)));
3707 exit_server_cleanly("secondary writebraw failed");
3708 }
3709
3710 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3711 if (nwritten == -1) {
3712 TALLOC_FREE(buf);
3713 reply_unixerror(req, ERRHRD, ERRdiskfull);
3714 error_to_writebrawerr(req);
3715 goto strict_unlock;
3716 }
3717
3718 if (nwritten < (ssize_t)numtowrite) {
3719 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3720 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3721 }
3722
3723 if (nwritten > 0) {
3724 total_written += nwritten;
3725 }
3726 }
3727
3728 TALLOC_FREE(buf);
3729 SSVAL(req->outbuf,smb_vwv0,total_written);
3730
3731 status = sync_file(conn, fsp, write_through);
3732 if (!NT_STATUS_IS_OK(status)) {
3733 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3734 fsp->fsp_name, nt_errstr(status) ));
3735 reply_nterror(req, status);
3736 error_to_writebrawerr(req);
3737 goto strict_unlock;
3738 }
3739
3740 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3741 "wrote=%d\n",
3742 fsp->fnum, (double)startpos, (int)numtowrite,
3743 (int)total_written));
3744
3745 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3746
3747 /* We won't return a status if write through is not selected - this
3748 * follows what WfWg does */
3749 END_PROFILE(SMBwritebraw);
3750
3751 if (!write_through && total_written==tcount) {
3752
3753 #if RABBIT_PELLET_FIX
3754 /*
3755 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3756 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3757 * JRA.
3758 */
3759 if (!send_keepalive(smbd_server_fd())) {
3760 exit_server_cleanly("reply_writebraw: send of "
3761 "keepalive failed");
3762 }
3763 #endif
3764 TALLOC_FREE(req->outbuf);
3765 }
3766 return;
3767
3768 strict_unlock:
3769 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3770
3771 END_PROFILE(SMBwritebraw);
3772 return;
3773 }
3774
3775 #undef DBGC_CLASS
3776 #define DBGC_CLASS DBGC_LOCKING
3777
3778 /****************************************************************************
3779 Reply to a writeunlock (core+).
3780 ****************************************************************************/
3781
3782 void reply_writeunlock(struct smb_request *req)
3783 {
3784 connection_struct *conn = req->conn;
3785 ssize_t nwritten = -1;
3786 size_t numtowrite;
3787 SMB_OFF_T startpos;
3788 const char *data;
3789 NTSTATUS status = NT_STATUS_OK;
3790 files_struct *fsp;
3791 struct lock_struct lock;
3792
3793 START_PROFILE(SMBwriteunlock);
3794
3795 if (req->wct < 5) {
3796 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3797 END_PROFILE(SMBwriteunlock);
3798 return;
3799 }
3800
3801 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3802
3803 if (!check_fsp(conn, req, fsp)) {
3804 END_PROFILE(SMBwriteunlock);
3805 return;
3806 }
3807
3808 if (!CHECK_WRITE(fsp)) {
3809 reply_doserror(req, ERRDOS,ERRbadaccess);
3810 END_PROFILE(SMBwriteunlock);
3811 return;
3812 }
3813
3814 numtowrite = SVAL(req->vwv+1, 0);
3815 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3816 data = (const char *)req->buf + 3;
3817
3818 if (numtowrite) {
3819 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3820 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3821 &lock);
3822
3823 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3824 reply_doserror(req, ERRDOS, ERRlock);
3825 END_PROFILE(SMBwriteunlock);
3826 return;
3827 }
3828 }
3829
3830 /* The special X/Open SMB protocol handling of
3831 zero length writes is *NOT* done for
3832 this call */
3833 if(numtowrite == 0) {
3834 nwritten = 0;
3835 } else {
3836 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3837 }
3838
3839 status = sync_file(conn, fsp, False /* write through */);
3840 if (!NT_STATUS_IS_OK(status)) {
3841 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3842 fsp->fsp_name, nt_errstr(status) ));
3843 reply_nterror(req, status);
3844 goto strict_unlock;
3845 }
3846
3847 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3848 reply_unixerror(req, ERRHRD, ERRdiskfull);
3849 goto strict_unlock;
3850 }
3851
3852 if (numtowrite) {
3853 status = do_unlock(smbd_messaging_context(),
3854 fsp,
3855 req->smbpid,
3856 (uint64_t)numtowrite,
3857 (uint64_t)startpos,
3858 WINDOWS_LOCK);
3859
3860 if (NT_STATUS_V(status)) {
3861 reply_nterror(req, status);
3862 goto strict_unlock;
3863 }
3864 }
3865
3866 reply_outbuf(req, 1, 0);
3867
3868 SSVAL(req->outbuf,smb_vwv0,nwritten);
3869
3870 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3871 fsp->fnum, (int)numtowrite, (int)nwritten));
3872
3873 strict_unlock:
3874 if (numtowrite) {
3875 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3876 }
3877
3878 END_PROFILE(SMBwriteunlock);
3879 return;
3880 }
3881
3882 #undef DBGC_CLASS
3883 #define DBGC_CLASS DBGC_ALL
3884
3885 /****************************************************************************
3886 Reply to a write.
3887 ****************************************************************************/
3888
3889 void reply_write(struct smb_request *req)
3890 {
3891 connection_struct *conn = req->conn;
3892 size_t numtowrite;
3893 ssize_t nwritten = -1;
3894 SMB_OFF_T startpos;
3895 const char *data;
3896 files_struct *fsp;
3897 struct lock_struct lock;
3898 NTSTATUS status;
3899
3900 START_PROFILE(SMBwrite);
3901
3902 if (req->wct < 5) {
3903 END_PROFILE(SMBwrite);
3904 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3905 return;
3906 }
3907
3908 /* If it's an IPC, pass off the pipe handler. */
3909 if (IS_IPC(conn)) {
3910 reply_pipe_write(req);
3911 END_PROFILE(SMBwrite);
3912 return;
3913 }
3914
3915 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3916
3917 if (!check_fsp(conn, req, fsp)) {
3918 END_PROFILE(SMBwrite);
3919 return;
3920 }
3921
3922 if (!CHECK_WRITE(fsp)) {
3923 reply_doserror(req, ERRDOS, ERRbadaccess);
3924 END_PROFILE(SMBwrite);
3925 return;
3926 }
3927
3928 numtowrite = SVAL(req->vwv+1, 0);
3929 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3930 data = (const char *)req->buf + 3;
3931
3932 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3933 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3934 &lock);
3935
3936 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3937 reply_doserror(req, ERRDOS, ERRlock);
3938 END_PROFILE(SMBwrite);
3939 return;
3940 }
3941
3942 /*
3943 * X/Open SMB protocol says that if smb_vwv1 is
3944 * zero then the file size should be extended or
3945 * truncated to the size given in smb_vwv[2-3].
3946 */
3947
3948 if(numtowrite == 0) {
3949 /*
3950 * This is actually an allocate call, and set EOF. JRA.
3951 */
3952 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3953 if (nwritten < 0) {
3954 reply_nterror(req, NT_STATUS_DISK_FULL);
3955 goto strict_unlock;
3956 }
3957 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3958 if (nwritten < 0) {
3959 reply_nterror(req, NT_STATUS_DISK_FULL);
3960 goto strict_unlock;
3961 }
3962 trigger_write_time_update_immediate(fsp);
3963 } else {
3964 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3965 }
3966
3967 status = sync_file(conn, fsp, False);
3968 if (!NT_STATUS_IS_OK(status)) {
3969 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3970 fsp->fsp_name, nt_errstr(status) ));
3971 reply_nterror(req, status);
3972 goto strict_unlock;
3973 }
3974
3975 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3976 reply_unixerror(req, ERRHRD, ERRdiskfull);
3977 goto strict_unlock;
3978 }
3979
3980 reply_outbuf(req, 1, 0);
3981
3982 SSVAL(req->outbuf,smb_vwv0,nwritten);
3983
3984 if (nwritten < (ssize_t)numtowrite) {
3985 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3986 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3987 }
3988
3989 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3990
3991 strict_unlock:
3992 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3993
3994 END_PROFILE(SMBwrite);
3995 return;
3996 }
3997
3998 /****************************************************************************
3999 Ensure a buffer is a valid writeX for recvfile purposes.
4000 ****************************************************************************/
4001
4002 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4003 (2*14) + /* word count (including bcc) */ \
4004 1 /* pad byte */)
4005
4006 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4007 {
4008 size_t numtowrite;
4009 connection_struct *conn = NULL;
4010 unsigned int doff = 0;
4011 size_t len = smb_len_large(inbuf);
4012
4013 if (is_encrypted_packet(inbuf)) {
4014 /* Can't do this on encrypted
4015 * connections. */
4016 return false;
4017 }
4018
4019 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4020 return false;
4021 }
4022
4023 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4024 CVAL(inbuf,smb_wct) != 14) {
4025 DEBUG(10,("is_valid_writeX_buffer: chained or "
4026 "invalid word length.\n"));
4027 return false;
4028 }
4029
4030 conn = conn_find(SVAL(inbuf, smb_tid));
4031 if (conn == NULL) {
4032 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4033 return false;
4034 }
4035 if (IS_IPC(conn)) {
4036 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4037 return false;
4038 }
4039 if (IS_PRINT(conn)) {
4040 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4041 return false;
4042 }
4043 doff = SVAL(inbuf,smb_vwv11);
4044
4045 numtowrite = SVAL(inbuf,smb_vwv10);
4046
4047 if (len > doff && len - doff > 0xFFFF) {
4048 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4049 }
4050
4051 if (numtowrite == 0) {
4052 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4053 return false;
4054 }
4055
4056 /* Ensure the sizes match up. */
4057 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4058 /* no pad byte...old smbclient :-( */
4059 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4060 (unsigned int)doff,
4061 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4062 return false;
4063 }
4064
4065 if (len - doff != numtowrite) {
4066 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4067 "len = %u, doff = %u, numtowrite = %u\n",
4068 (unsigned int)len,
4069 (unsigned int)doff,
4070 (unsigned int)numtowrite ));
4071 return false;
4072 }
4073
4074 DEBUG(10,("is_valid_writeX_buffer: true "
4075 "len = %u, doff = %u, numtowrite = %u\n",
4076 (unsigned int)len,
4077 (unsigned int)doff,
4078 (unsigned int)numtowrite ));
4079
4080 return true;
4081 }
4082
4083 /****************************************************************************
4084 Reply to a write and X.
4085 ****************************************************************************/
4086
4087 void reply_write_and_X(struct smb_request *req)
4088 {
4089 connection_struct *conn = req->conn;
4090 files_struct *fsp;
4091 struct lock_struct lock;
4092 SMB_OFF_T startpos;
4093 size_t numtowrite;
4094 bool write_through;
4095 ssize_t nwritten;
4096 unsigned int smb_doff;
4097 unsigned int smblen;
4098 char *data;
4099 NTSTATUS status;
4100
4101 START_PROFILE(SMBwriteX);
4102
4103 if ((req->wct != 12) && (req->wct != 14)) {
4104 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4105 END_PROFILE(SMBwriteX);
4106 return;
4107 }
4108
4109 numtowrite = SVAL(req->vwv+10, 0);
4110 smb_doff = SVAL(req->vwv+11, 0);
4111 smblen = smb_len(req->inbuf);
4112
4113 if (req->unread_bytes > 0xFFFF ||
4114 (smblen > smb_doff &&
4115 smblen - smb_doff > 0xFFFF)) {
4116 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4117 }
4118
4119 if (req->unread_bytes) {
4120 /* Can't do a recvfile write on IPC$ */
4121 if (IS_IPC(conn)) {
4122 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4123 END_PROFILE(SMBwriteX);
4124 return;
4125 }
4126 if (numtowrite != req->unread_bytes) {
4127 reply_doserror(req, ERRDOS, ERRbadmem);
4128 END_PROFILE(SMBwriteX);
4129 return;
4130 }
4131 } else {
4132 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4133 smb_doff + numtowrite > smblen) {
4134 reply_doserror(req, ERRDOS, ERRbadmem);
4135 END_PROFILE(SMBwriteX);
4136 return;
4137 }
4138 }
4139
4140 /* If it's an IPC, pass off the pipe handler. */
4141 if (IS_IPC(conn)) {
4142 if (req->unread_bytes) {
4143 reply_doserror(req, ERRDOS, ERRbadmem);
4144 END_PROFILE(SMBwriteX);
4145 return;
4146 }
4147 reply_pipe_write_and_X(req);
4148 END_PROFILE(SMBwriteX);
4149 return;
4150 }
4151
4152 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4153 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4154 write_through = BITSETW(req->vwv+7,0);
4155
4156 if (!check_fsp(conn, req, fsp)) {
4157 END_PROFILE(SMBwriteX);
4158 return;
4159 }
4160
4161 if (!CHECK_WRITE(fsp)) {
4162 reply_doserror(req, ERRDOS, ERRbadaccess);
4163 END_PROFILE(SMBwriteX);
4164 return;
4165 }
4166
4167 data = smb_base(req->inbuf) + smb_doff;
4168
4169 if(req->wct == 14) {
4170 #ifdef LARGE_SMB_OFF_T
4171 /*
4172 * This is a large offset (64 bit) write.
4173 */
4174 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4175
4176 #else /* !LARGE_SMB_OFF_T */
4177
4178 /*
4179 * Ensure we haven't been sent a >32 bit offset.
4180 */
4181
4182 if(IVAL(req->vwv+12, 0) != 0) {
4183 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4184 "used and we don't support 64 bit offsets.\n",
4185 (unsigned int)IVAL(req->vwv+12, 0) ));
4186 reply_doserror(req, ERRDOS, ERRbadaccess);
4187 END_PROFILE(SMBwriteX);
4188 return;
4189 }
4190
4191 #endif /* LARGE_SMB_OFF_T */
4192 }
4193
4194 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4195 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4196 &lock);
4197
4198 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4199 reply_doserror(req, ERRDOS, ERRlock);
4200 END_PROFILE(SMBwriteX);
4201 return;
4202 }
4203
4204 /* X/Open SMB protocol says that, unlike SMBwrite
4205 if the length is zero then NO truncation is
4206 done, just a write of zero. To truncate a file,
4207 use SMBwrite. */
4208
4209 if(numtowrite == 0) {
4210 nwritten = 0;
4211 } else {
4212
4213 if ((req->unread_bytes == 0) &&
4214 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4215 numtowrite)) {
4216 goto strict_unlock;
4217 }
4218
4219 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4220 }
4221
4222 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4223 reply_unixerror(req, ERRHRD, ERRdiskfull);
4224 goto strict_unlock;
4225 }
4226
4227 reply_outbuf(req, 6, 0);
4228 SSVAL(req->outbuf,smb_vwv2,nwritten);
4229 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4230
4231 if (nwritten < (ssize_t)numtowrite) {
4232 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4233 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4234 }
4235
4236 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4237 fsp->fnum, (int)numtowrite, (int)nwritten));
4238
4239 status = sync_file(conn, fsp, write_through);
4240 if (!NT_STATUS_IS_OK(status)) {
4241 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4242 fsp->fsp_name, nt_errstr(status) ));
4243 reply_nterror(req, status);
4244 goto strict_unlock;
4245 }
4246
4247 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4248
4249 END_PROFILE(SMBwriteX);
4250 chain_reply(req);
4251 return;
4252
4253 strict_unlock:
4254 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4255
4256 END_PROFILE(SMBwriteX);
4257 return;
4258 }
4259
4260 /****************************************************************************
4261 Reply to a lseek.
4262 ****************************************************************************/
4263
4264 void reply_lseek(struct smb_request *req)
4265 {
4266 connection_struct *conn = req->conn;
4267 SMB_OFF_T startpos;
4268 SMB_OFF_T res= -1;
4269 int mode,umode;
4270 files_struct *fsp;
4271
4272 START_PROFILE(SMBlseek);
4273
4274 if (req->wct < 4) {
4275 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4276 END_PROFILE(SMBlseek);
4277 return;
4278 }
4279
4280 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4281
4282 if (!check_fsp(conn, req, fsp)) {
4283 return;
4284 }
4285
4286 flush_write_cache(fsp, SEEK_FLUSH);
4287
4288 mode = SVAL(req->vwv+1, 0) & 3;
4289 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4290 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4291
4292 switch (mode) {
4293 case 0:
4294 umode = SEEK_SET;
4295 res = startpos;
4296 break;
4297 case 1:
4298 umode = SEEK_CUR;
4299 res = fsp->fh->pos + startpos;
4300 break;
4301 case 2:
4302 umode = SEEK_END;
4303 break;
4304 default:
4305 umode = SEEK_SET;
4306 res = startpos;
4307 break;
4308 }
4309
4310 if (umode == SEEK_END) {
4311 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4312 if(errno == EINVAL) {
4313 SMB_OFF_T current_pos = startpos;
4314 SMB_STRUCT_STAT sbuf;
4315
4316 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4317 reply_unixerror(req, ERRDOS,
4318 ERRnoaccess);
4319 END_PROFILE(SMBlseek);
4320 return;
4321 }
4322
4323 current_pos += sbuf.st_size;
4324 if(current_pos < 0)
4325 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4326 }
4327 }
4328
4329 if(res == -1) {
4330 reply_unixerror(req, ERRDOS, ERRnoaccess);
4331 END_PROFILE(SMBlseek);
4332 return;
4333 }
4334 }
4335
4336 fsp->fh->pos = res;
4337
4338 reply_outbuf(req, 2, 0);
4339 SIVAL(req->outbuf,smb_vwv0,res);
4340
4341 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4342 fsp->fnum, (double)startpos, (double)res, mode));
4343
4344 END_PROFILE(SMBlseek);
4345 return;
4346 }
4347
4348 /****************************************************************************
4349 Reply to a flush.
4350 ****************************************************************************/
4351
4352 void reply_flush(struct smb_request *req)
4353 {
4354 connection_struct *conn = req->conn;
4355 uint16 fnum;
4356 files_struct *fsp;
4357
4358 START_PROFILE(SMBflush);
4359
4360 if (req->wct < 1) {
4361 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4362 return;
4363 }
4364
4365 fnum = SVAL(req->vwv+0, 0);
4366 fsp = file_fsp(req, fnum);
4367
4368 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4369 return;
4370 }
4371
4372 if (!fsp) {
4373 file_sync_all(conn);
4374 } else {
4375 NTSTATUS status = sync_file(conn, fsp, True);
4376 if (!NT_STATUS_IS_OK(status)) {
4377 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4378 fsp->fsp_name, nt_errstr(status) ));
4379 reply_nterror(req, status);
4380 END_PROFILE(SMBflush);
4381 return;
4382 }
4383 }
4384
4385 reply_outbuf(req, 0, 0);
4386
4387 DEBUG(3,("flush\n"));
4388 END_PROFILE(SMBflush);
4389 return;
4390 }
4391
4392 /****************************************************************************
4393 Reply to a exit.
4394 conn POINTER CAN BE NULL HERE !
4395 ****************************************************************************/
4396
4397 void reply_exit(struct smb_request *req)
4398 {
4399 START_PROFILE(SMBexit);
4400
4401 file_close_pid(req->smbpid, req->vuid);
4402
4403 reply_outbuf(req, 0, 0);
4404
4405 DEBUG(3,("exit\n"));
4406
4407 END_PROFILE(SMBexit);
4408 return;
4409 }
4410
4411 /****************************************************************************
4412 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4413 ****************************************************************************/
4414
4415 void reply_close(struct smb_request *req)
4416 {
4417 connection_struct *conn = req->conn;
4418 NTSTATUS status = NT_STATUS_OK;
4419 files_struct *fsp = NULL;
4420 START_PROFILE(SMBclose);
4421
4422 if (req->wct < 3) {
4423 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4424 END_PROFILE(SMBclose);
4425 return;
4426 }
4427
4428 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4429
4430 /*
4431 * We can only use check_fsp if we know it's not a directory.
4432 */
4433
4434 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4435 reply_doserror(req, ERRDOS, ERRbadfid);
4436 END_PROFILE(SMBclose);
4437 return;
4438 }
4439
4440 if(fsp->is_directory) {
4441 /*
4442 * Special case - close NT SMB directory handle.
4443 */
4444 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4445 status = close_file(req, fsp, NORMAL_CLOSE);
4446 } else {
4447 time_t t;
4448 /*
4449 * Close ordinary file.
4450 */
4451
4452 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4453 fsp->fh->fd, fsp->fnum,
4454 conn->num_files_open));
4455
4456 /*
4457 * Take care of any time sent in the close.
4458 */
4459
4460 t = srv_make_unix_date3(req->vwv+1);
4461 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4462
4463 /*
4464 * close_file() returns the unix errno if an error
4465 * was detected on close - normally this is due to
4466 * a disk full error. If not then it was probably an I/O error.
4467 */
4468
4469 status = close_file(req, fsp, NORMAL_CLOSE);
4470 }
4471
4472 if (!NT_STATUS_IS_OK(status)) {
4473 reply_nterror(req, status);
4474 END_PROFILE(SMBclose);
4475 return;
4476 }
4477
4478 reply_outbuf(req, 0, 0);
4479 END_PROFILE(SMBclose);
4480 return;
4481 }
4482
4483 /****************************************************************************
4484 Reply to a writeclose (Core+ protocol).
4485 ****************************************************************************/
4486
4487 void reply_writeclose(struct smb_request *req)
4488 {
4489 connection_struct *conn = req->conn;
4490 size_t numtowrite;
4491 ssize_t nwritten = -1;
4492 NTSTATUS close_status = NT_STATUS_OK;
4493 SMB_OFF_T startpos;
4494 const char *data;
4495 struct timespec mtime;
4496 files_struct *fsp;
4497 struct lock_struct lock;
4498
4499 START_PROFILE(SMBwriteclose);
4500
4501 if (req->wct < 6) {
4502 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4503 END_PROFILE(SMBwriteclose);
4504 return;
4505 }
4506
4507 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4508
4509 if (!check_fsp(conn, req, fsp)) {
4510 END_PROFILE(SMBwriteclose);
4511 return;
4512 }
4513 if (!CHECK_WRITE(fsp)) {
4514 reply_doserror(req, ERRDOS,ERRbadaccess);
4515 END_PROFILE(SMBwriteclose);
4516 return;
4517 }
4518
4519 numtowrite = SVAL(req->vwv+1, 0);
4520 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4521 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4522 data = (const char *)req->buf + 1;
4523
4524 if (numtowrite) {
4525 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4526 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4527 &lock);
4528
4529 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4530 reply_doserror(req, ERRDOS,ERRlock);
4531 END_PROFILE(SMBwriteclose);
4532 return;
4533 }
4534 }
4535
4536 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4537
4538 set_close_write_time(fsp, mtime);
4539
4540 /*
4541 * More insanity. W2K only closes the file if writelen > 0.
4542 * JRA.
4543 */
4544
4545 if (numtowrite) {
4546 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4547 fsp->fsp_name ));
4548 close_status = close_file(req, fsp, NORMAL_CLOSE);
4549 }
4550
4551 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4552 fsp->fnum, (int)numtowrite, (int)nwritten,
4553 conn->num_files_open));
4554
4555 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4556 reply_doserror(req, ERRHRD, ERRdiskfull);
4557 goto strict_unlock;
4558 }
4559
4560 if(!NT_STATUS_IS_OK(close_status)) {
4561 reply_nterror(req, close_status);
4562 goto strict_unlock;
4563 }
4564
4565 reply_outbuf(req, 1, 0);
4566
4567 SSVAL(req->outbuf,smb_vwv0,nwritten);
4568
4569 strict_unlock:
4570 if (numtowrite) {
4571 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4572 }
4573
4574 END_PROFILE(SMBwriteclose);
4575 return;
4576 }
4577
4578 #undef DBGC_CLASS
4579 #define DBGC_CLASS DBGC_LOCKING
4580
4581 /****************************************************************************
4582 Reply to a lock.
4583 ****************************************************************************/
4584
4585 void reply_lock(struct smb_request *req)
4586 {
4587 connection_struct *conn = req->conn;
4588 uint64_t count,offset;
4589 NTSTATUS status;
4590 files_struct *fsp;
4591 struct byte_range_lock *br_lck = NULL;
4592
4593 START_PROFILE(SMBlock);
4594
4595 if (req->wct < 5) {
4596 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4597 END_PROFILE(SMBlock);
4598 return;
4599 }
4600
4601 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4602
4603 if (!check_fsp(conn, req, fsp)) {
4604 END_PROFILE(SMBlock);
4605 return;
4606 }
4607
4608 count = (uint64_t)IVAL(req->vwv+1, 0);
4609 offset = (uint64_t)IVAL(req->vwv+3, 0);
4610
4611 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4612 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4613
4614 br_lck = do_lock(smbd_messaging_context(),
4615 fsp,
4616 req->smbpid,
4617 count,
4618 offset,
4619 WRITE_LOCK,
4620 WINDOWS_LOCK,
4621 False, /* Non-blocking lock. */
4622 &status,
4623 NULL,
4624 NULL);
4625
4626 TALLOC_FREE(br_lck);
4627
4628 if (NT_STATUS_V(status)) {
4629 reply_nterror(req, status);
4630 END_PROFILE(SMBlock);
4631 return;
4632 }
4633
4634 reply_outbuf(req, 0, 0);
4635
4636 END_PROFILE(SMBlock);
4637 return;
4638 }
4639
4640 /****************************************************************************
4641 Reply to a unlock.
4642 ****************************************************************************/
4643
4644 void reply_unlock(struct smb_request *req)
4645 {
4646 connection_struct *conn = req->conn;
4647 uint64_t count,offset;
4648 NTSTATUS status;
4649 files_struct *fsp;
4650
4651 START_PROFILE(SMBunlock);
4652
4653 if (req->wct < 5) {
4654 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4655 END_PROFILE(SMBunlock);
4656 return;
4657 }
4658
4659 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4660
4661 if (!check_fsp(conn, req, fsp)) {
4662 END_PROFILE(SMBunlock);
4663 return;
4664 }
4665
4666 count = (uint64_t)IVAL(req->vwv+1, 0);
4667 offset = (uint64_t)IVAL(req->vwv+3, 0);
4668
4669 status = do_unlock(smbd_messaging_context(),
4670 fsp,
4671 req->smbpid,
4672 count,
4673 offset,
4674 WINDOWS_LOCK);
4675
4676 if (NT_STATUS_V(status)) {
4677 reply_nterror(req, status);
4678 END_PROFILE(SMBunlock);
4679 return;
4680 }
4681
4682 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4683 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4684
4685 reply_outbuf(req, 0, 0);
4686
4687 END_PROFILE(SMBunlock);
4688 return;
4689 }
4690
4691 #undef DBGC_CLASS
4692 #define DBGC_CLASS DBGC_ALL
4693
4694 /****************************************************************************
4695 Reply to a tdis.
4696 conn POINTER CAN BE NULL HERE !
4697 ****************************************************************************/
4698
4699 void reply_tdis(struct smb_request *req)
4700 {
4701 connection_struct *conn = req->conn;
4702 START_PROFILE(SMBtdis);
4703
4704 if (!conn) {
4705 DEBUG(4,("Invalid connection in tdis\n"));
4706 reply_doserror(req, ERRSRV, ERRinvnid);
4707 END_PROFILE(SMBtdis);
4708 return;
4709 }
4710
4711 conn->used = False;
4712
4713 close_cnum(conn,req->vuid);
4714 req->conn = NULL;
4715
4716 reply_outbuf(req, 0, 0);
4717 END_PROFILE(SMBtdis);
4718 return;
4719 }
4720
4721 /****************************************************************************
4722 Reply to a echo.
4723 conn POINTER CAN BE NULL HERE !
4724 ****************************************************************************/
4725
4726 void reply_echo(struct smb_request *req)
4727 {
4728 connection_struct *conn = req->conn;
4729 struct smb_perfcount_data local_pcd;
4730 struct smb_perfcount_data *cur_pcd;
4731 int smb_reverb;
4732 int seq_num;
4733
4734 START_PROFILE(SMBecho);
4735
4736 smb_init_perfcount_data(&local_pcd);
4737
4738 if (req->wct < 1) {
4739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4740 END_PROFILE(SMBecho);
4741 return;
4742 }
4743
4744 smb_reverb = SVAL(req->vwv+0, 0);
4745
4746 reply_outbuf(req, 1, req->buflen);
4747
4748 /* copy any incoming data back out */
4749 if (req->buflen > 0) {
4750 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4751 }
4752
4753 if (smb_reverb > 100) {
4754 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4755 smb_reverb = 100;
4756 }
4757
4758 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4759
4760 /* this makes sure we catch the request pcd */
4761 if (seq_num == smb_reverb) {
4762 cur_pcd = &req->pcd;
4763 } else {
4764 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4765 cur_pcd = &local_pcd;
4766 }
4767
4768 SSVAL(req->outbuf,smb_vwv0,seq_num);
4769
4770 show_msg((char *)req->outbuf);
4771 if (!srv_send_smb(smbd_server_fd(),
4772 (char *)req->outbuf,
4773 true, req->seqnum+1,
4774 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4775 cur_pcd))
4776 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4777 }
4778
4779 DEBUG(3,("echo %d times\n", smb_reverb));
4780
4781 TALLOC_FREE(req->outbuf);
4782
4783 END_PROFILE(SMBecho);
4784 return;
4785 }
4786
4787 /****************************************************************************
4788 Reply to a printopen.
4789 ****************************************************************************/
4790
4791 void reply_printopen(struct smb_request *req)
4792 {
4793 connection_struct *conn = req->conn;
4794 files_struct *fsp;
4795 SMB_STRUCT_STAT sbuf;
4796 NTSTATUS status;
4797
4798 START_PROFILE(SMBsplopen);
4799
4800 if (req->wct < 2) {
4801 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4802 END_PROFILE(SMBsplopen);
4803 return;
4804 }
4805
4806 if (!CAN_PRINT(conn)) {
4807 reply_doserror(req, ERRDOS, ERRnoaccess);
4808 END_PROFILE(SMBsplopen);
4809 return;
4810 }
4811
4812 status = file_new(req, conn, &fsp);
4813 if(!NT_STATUS_IS_OK(status)) {
4814 reply_nterror(req, status);
4815 END_PROFILE(SMBsplopen);
4816 return;
4817 }
4818
4819 /* Open for exclusive use, write only. */
4820 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4821
4822 if (!NT_STATUS_IS_OK(status)) {
4823 reply_nterror(req, status);
4824 END_PROFILE(SMBsplopen);
4825 return;
4826 }
4827
4828 reply_outbuf(req, 1, 0);
4829 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4830
4831 DEBUG(3,("openprint fd=%d fnum=%d\n",
4832 fsp->fh->fd, fsp->fnum));
4833
4834 END_PROFILE(SMBsplopen);
4835 return;
4836 }
4837
4838 /****************************************************************************
4839 Reply to a printclose.
4840 ****************************************************************************/
4841
4842 void reply_printclose(struct smb_request *req)
4843 {
4844 connection_struct *conn = req->conn;
4845 files_struct *fsp;
4846 NTSTATUS status;
4847
4848 START_PROFILE(SMBsplclose);
4849
4850 if (req->wct < 1) {
4851 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4852 END_PROFILE(SMBsplclose);
4853 return;
4854 }
4855
4856 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4857
4858 if (!check_fsp(conn, req, fsp)) {
4859 END_PROFILE(SMBsplclose);
4860 return;
4861 }
4862
4863 if (!CAN_PRINT(conn)) {
4864 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4865 END_PROFILE(SMBsplclose);
4866 return;
4867 }
4868
4869 DEBUG(3,("printclose fd=%d fnum=%d\n",
4870 fsp->fh->fd,fsp->fnum));
4871
4872 status = close_file(req, fsp, NORMAL_CLOSE);
4873
4874 if(!NT_STATUS_IS_OK(status)) {
4875 reply_nterror(req, status);
4876 END_PROFILE(SMBsplclose);
4877 return;
4878 }
4879
4880 reply_outbuf(req, 0, 0);
4881
4882 END_PROFILE(SMBsplclose);
4883 return;
4884 }
4885
4886 /****************************************************************************
4887 Reply to a printqueue.
4888 ****************************************************************************/
4889
4890 void reply_printqueue(struct smb_request *req)
4891 {
4892 connection_struct *conn = req->conn;
4893 int max_count;
4894 int start_index;
4895
4896 START_PROFILE(SMBsplretq);
4897
4898 if (req->wct < 2) {
4899 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4900 END_PROFILE(SMBsplretq);
4901 return;
4902 }
4903
4904 max_count = SVAL(req->vwv+0, 0);
4905 start_index = SVAL(req->vwv+1, 0);
4906
4907 /* we used to allow the client to get the cnum wrong, but that
4908 is really quite gross and only worked when there was only
4909 one printer - I think we should now only accept it if they
4910 get it right (tridge) */
4911 if (!CAN_PRINT(conn)) {
4912 reply_doserror(req, ERRDOS, ERRnoaccess);
4913 END_PROFILE(SMBsplretq);
4914 return;
4915 }
4916
4917 reply_outbuf(req, 2, 3);
4918 SSVAL(req->outbuf,smb_vwv0,0);
4919 SSVAL(req->outbuf,smb_vwv1,0);
4920 SCVAL(smb_buf(req->outbuf),0,1);
4921 SSVAL(smb_buf(req->outbuf),1,0);
4922
4923 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4924 start_index, max_count));
4925
4926 {
4927 print_queue_struct *queue = NULL;
4928 print_status_struct status;
4929 int count = print_queue_status(SNUM(conn), &queue, &status);
4930 int num_to_get = ABS(max_count);
4931 int first = (max_count>0?start_index:start_index+max_count+1);
4932 int i;
4933
4934 if (first >= count)
4935 num_to_get = 0;
4936 else
4937 num_to_get = MIN(num_to_get,count-first);
4938
4939
4940 for (i=first;i<first+num_to_get;i++) {
4941 char blob[28];
4942 char *p = blob;
4943
4944 srv_put_dos_date2(p,0,queue[i].time);
4945 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4946 SSVAL(p,5, queue[i].job);
4947 SIVAL(p,7,queue[i].size);
4948 SCVAL(p,11,0);
4949 srvstr_push(blob, req->flags2, p+12,
4950 queue[i].fs_user, 16, STR_ASCII);
4951
4952 if (message_push_blob(
4953 &req->outbuf,
4954 data_blob_const(
4955 blob, sizeof(blob))) == -1) {
4956 reply_nterror(req, NT_STATUS_NO_MEMORY);
4957 END_PROFILE(SMBsplretq);
4958 return;
4959 }
4960 }
4961
4962 if (count > 0) {
4963 SSVAL(req->outbuf,smb_vwv0,count);
4964 SSVAL(req->outbuf,smb_vwv1,
4965 (max_count>0?first+count:first-1));
4966 SCVAL(smb_buf(req->outbuf),0,1);
4967 SSVAL(smb_buf(req->outbuf),1,28*count);
4968 }
4969
4970 SAFE_FREE(queue);
4971
4972 DEBUG(3,("%d entries returned in queue\n",count));
4973 }
4974
4975 END_PROFILE(SMBsplretq);
4976 return;
4977 }
4978
4979 /****************************************************************************
4980 Reply to a printwrite.
4981 ****************************************************************************/
4982
4983 void reply_printwrite(struct smb_request *req)
4984 {
4985 connection_struct *conn = req->conn;
4986 int numtowrite;
4987 const char *data;
4988 files_struct *fsp;
4989
4990 START_PROFILE(SMBsplwr);
4991
4992 if (req->wct < 1) {
4993 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4994 END_PROFILE(SMBsplwr);
4995 return;
4996 }
4997
4998 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4999
5000 if (!check_fsp(conn, req, fsp)) {
5001 END_PROFILE(SMBsplwr);
5002 return;
5003 }
5004
5005 if (!CAN_PRINT(conn)) {
5006 reply_doserror(req, ERRDOS, ERRnoaccess);
5007 END_PROFILE(SMBsplwr);
5008 return;
5009 }
5010
5011 if (!CHECK_WRITE(fsp)) {
5012 reply_doserror(req, ERRDOS, ERRbadaccess);
5013 END_PROFILE(SMBsplwr);
5014 return;
5015 }
5016
5017 numtowrite = SVAL(req->buf, 1);
5018
5019 if (req->buflen < numtowrite + 3) {
5020 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5021 END_PROFILE(SMBsplwr);
5022 return;
5023 }
5024
5025 data = (const char *)req->buf + 3;
5026
5027 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5028 reply_unixerror(req, ERRHRD, ERRdiskfull);
5029 END_PROFILE(SMBsplwr);
5030 return;
5031 }
5032
5033 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5034
5035 END_PROFILE(SMBsplwr);
5036 return;
5037 }
5038
5039 /****************************************************************************
5040 Reply to a mkdir.
5041 ****************************************************************************/
5042
5043 void reply_mkdir(struct smb_request *req)
5044 {
5045 connection_struct *conn = req->conn;
5046 char *directory = NULL;
5047 NTSTATUS status;
5048 SMB_STRUCT_STAT sbuf;
5049 TALLOC_CTX *ctx = talloc_tos();
5050
5051 START_PROFILE(SMBmkdir);
5052
5053 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5054 STR_TERMINATE, &status);
5055 if (!NT_STATUS_IS_OK(status)) {
5056 reply_nterror(req, status);
5057 END_PROFILE(SMBmkdir);
5058 return;
5059 }
5060
5061 status = resolve_dfspath(ctx, conn,
5062 req->flags2 & FLAGS2_DFS_PATHNAMES,
5063 directory,
5064 &directory);
5065 if (!NT_STATUS_IS_OK(status)) {
5066 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5067 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5068 ERRSRV, ERRbadpath);
5069 END_PROFILE(SMBmkdir);
5070 return;
5071 }
5072 reply_nterror(req, status);
5073 END_PROFILE(SMBmkdir);
5074 return;
5075 }
5076
5077 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
5078 if (!NT_STATUS_IS_OK(status)) {
5079 reply_nterror(req, status);
5080 END_PROFILE(SMBmkdir);
5081 return;
5082 }
5083
5084 status = check_name(conn, directory);
5085 if (!NT_STATUS_IS_OK(status)) {
5086 reply_nterror(req, status);
5087 END_PROFILE(SMBmkdir);
5088 return;
5089 }
5090
5091 status = create_directory(conn, req, directory);
5092
5093 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5094
5095 if (!NT_STATUS_IS_OK(status)) {
5096
5097 if (!use_nt_status()
5098 && NT_STATUS_EQUAL(status,
5099 NT_STATUS_OBJECT_NAME_COLLISION)) {
5100 /*
5101 * Yes, in the DOS error code case we get a
5102 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5103 * samba4 torture test.
5104 */
5105 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5106 }
5107
5108 reply_nterror(req, status);
5109 END_PROFILE(SMBmkdir);
5110 return;
5111 }
5112
5113 reply_outbuf(req, 0, 0);
5114
5115 DEBUG( 3, ( "mkdir %s\n", directory ) );
5116
5117 END_PROFILE(SMBmkdir);
5118 return;
5119 }
5120
5121 /****************************************************************************
5122 Static function used by reply_rmdir to delete an entire directory
5123 tree recursively. Return True on ok, False on fail.
5124 ****************************************************************************/
5125
5126 static bool recursive_rmdir(TALLOC_CTX *ctx,
5127 connection_struct *conn,
5128 char *directory)
5129 {
5130 const char *dname = NULL;
5131 bool ret = True;
5132 long offset = 0;
5133 SMB_STRUCT_STAT st;
5134 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5135 NULL, 0);
5136
5137 if(dir_hnd == NULL)
5138 return False;
5139
5140 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5141 char *fullname = NULL;
5142
5143 if (ISDOT(dname) || ISDOTDOT(dname)) {
5144 continue;
5145 }
5146
5147 if (!is_visible_file(conn, directory, dname, &st, False)) {
5148 continue;
5149 }
5150
5151 /* Construct the full name. */
5152 fullname = talloc_asprintf(ctx,
5153 "%s/%s",
5154 directory,
5155 dname);
5156 if (!fullname) {
5157 errno = ENOMEM;
5158 ret = False;
5159 break;
5160 }
5161
5162 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5163 ret = False;
5164 break;
5165 }
5166
5167 if(st.st_mode & S_IFDIR) {
5168 if(!recursive_rmdir(ctx, conn, fullname)) {
5169 ret = False;
5170 break;
5171 }
5172 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5173 ret = False;
5174 break;
5175 }
5176 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5177 ret = False;
5178 break;
5179 }
5180 TALLOC_FREE(fullname);
5181 }
5182 TALLOC_FREE(dir_hnd);
5183 return ret;
5184 }
5185
5186 /****************************************************************************
5187 The internals of the rmdir code - called elsewhere.
5188 ****************************************************************************/
5189
5190 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5191 connection_struct *conn,
5192 const char *directory)
5193 {
5194 int ret;
5195 SMB_STRUCT_STAT st;
5196
5197 /* Might be a symlink. */
5198 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5199 return map_nt_error_from_unix(errno);
5200 }
5201
5202 if (S_ISLNK(st.st_mode)) {
5203 /* Is what it points to a directory ? */
5204 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5205 return map_nt_error_from_unix(errno);
5206 }
5207 if (!(S_ISDIR(st.st_mode))) {
5208 return NT_STATUS_NOT_A_DIRECTORY;
5209 }
5210 ret = SMB_VFS_UNLINK(conn,directory);
5211 } else {
5212 ret = SMB_VFS_RMDIR(conn,directory);
5213 }
5214 if (ret == 0) {
5215 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5216 FILE_NOTIFY_CHANGE_DIR_NAME,
5217 directory);
5218 return NT_STATUS_OK;
5219 }
5220
5221 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5222 /*
5223 * Check to see if the only thing in this directory are
5224 * vetoed files/directories. If so then delete them and
5225 * retry. If we fail to delete any of them (and we *don't*
5226 * do a recursive delete) then fail the rmdir.
5227 */
5228 const char *dname;
5229 long dirpos = 0;
5230 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5231 directory, NULL, 0);
5232
5233 if(dir_hnd == NULL) {
5234 errno = ENOTEMPTY;
5235 goto err;
5236 }
5237
5238 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5239 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5240 continue;
5241 if (!is_visible_file(conn, directory, dname, &st, False))
5242 continue;
5243 if(!IS_VETO_PATH(conn, dname)) {
5244 TALLOC_FREE(dir_hnd);
5245 errno = ENOTEMPTY;
5246 goto err;
5247 }
5248 }
5249
5250 /* We only have veto files/directories.
5251 * Are we allowed to delete them ? */
5252
5253 if(!lp_recursive_veto_delete(SNUM(conn))) {
5254 TALLOC_FREE(dir_hnd);
5255 errno = ENOTEMPTY;
5256 goto err;
5257 }
5258
5259 /* Do a recursive delete. */
5260 RewindDir(dir_hnd,&dirpos);
5261 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5262 char *fullname = NULL;
5263
5264 if (ISDOT(dname) || ISDOTDOT(dname)) {
5265 continue;
5266 }
5267 if (!is_visible_file(conn, directory, dname, &st, False)) {
5268 continue;
5269 }
5270
5271 fullname = talloc_asprintf(ctx,
5272 "%s/%s",
5273 directory,
5274 dname);
5275
5276 if(!fullname) {
5277 errno = ENOMEM;
5278 break;
5279 }
5280
5281 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5282 break;
5283 }
5284 if(st.st_mode & S_IFDIR) {
5285 if(!recursive_rmdir(ctx, conn, fullname)) {
5286 break;
5287 }
5288 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5289 break;
5290 }
5291 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5292 break;
5293 }
5294 TALLOC_FREE(fullname);
5295 }
5296 TALLOC_FREE(dir_hnd);
5297 /* Retry the rmdir */
5298 ret = SMB_VFS_RMDIR(conn,directory);
5299 }
5300
5301 err:
5302
5303 if (ret != 0) {
5304 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5305 "%s\n", directory,strerror(errno)));
5306 return map_nt_error_from_unix(errno);
5307 }
5308
5309 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5310 FILE_NOTIFY_CHANGE_DIR_NAME,
5311 directory);
5312
5313 return NT_STATUS_OK;
5314 }
5315
5316 /****************************************************************************
5317 Reply to a rmdir.
5318 ****************************************************************************/
5319
5320 void reply_rmdir(struct smb_request *req)
5321 {
5322 connection_struct *conn = req->conn;
5323 char *directory = NULL;
5324 SMB_STRUCT_STAT sbuf;
5325 NTSTATUS status;
5326 TALLOC_CTX *ctx = talloc_tos();
5327
5328 START_PROFILE(SMBrmdir);
5329
5330 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5331 STR_TERMINATE, &status);
5332 if (!NT_STATUS_IS_OK(status)) {
5333 reply_nterror(req, status);
5334 END_PROFILE(SMBrmdir);
5335 return;
5336 }
5337
5338 status = resolve_dfspath(ctx, conn,
5339 req->flags2 & FLAGS2_DFS_PATHNAMES,
5340 directory,
5341 &directory);
5342 if (!NT_STATUS_IS_OK(status)) {
5343 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5344 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5345 ERRSRV, ERRbadpath);
5346 END_PROFILE(SMBrmdir);
5347 return;
5348 }
5349 reply_nterror(req, status);
5350 END_PROFILE(SMBrmdir);
5351 return;
5352 }
5353
5354 status = unix_convert(ctx, conn, directory, False, &directory,
5355 NULL, &sbuf);
5356 if (!NT_STATUS_IS_OK(status)) {
5357 reply_nterror(req, status);
5358 END_PROFILE(SMBrmdir);
5359 return;
5360 }
5361
5362 status = check_name(conn, directory);
5363 if (!NT_STATUS_IS_OK(status)) {
5364 reply_nterror(req, status);
5365 END_PROFILE(SMBrmdir);
5366 return;
5367 }
5368
5369 dptr_closepath(directory, req->smbpid);
5370 status = rmdir_internals(ctx, conn, directory);
5371 if (!NT_STATUS_IS_OK(status)) {
5372 reply_nterror(req, status);
5373 END_PROFILE(SMBrmdir);
5374 return;
5375 }
5376
5377 reply_outbuf(req, 0, 0);
5378
5379 DEBUG( 3, ( "rmdir %s\n", directory ) );
5380
5381 END_PROFILE(SMBrmdir);
5382 return;
5383 }
5384
5385 /*******************************************************************
5386 Resolve wildcards in a filename rename.
5387 ********************************************************************/
5388
5389 static bool resolve_wildcards(TALLOC_CTX *ctx,
5390 const char *name1,
5391 const char *name2,
5392 char **pp_newname)
5393 {
5394 char *name2_copy = NULL;
5395 char *root1 = NULL;
5396 char *root2 = NULL;
5397 char *ext1 = NULL;
5398 char *ext2 = NULL;
5399 char *p,*p2, *pname1, *pname2;
5400
5401 name2_copy = talloc_strdup(ctx, name2);
5402 if (!name2_copy) {
5403 return False;
5404 }
5405
5406 pname1 = strrchr_m(name1,'/');
5407 pname2 = strrchr_m(name2_copy,'/');
5408
5409 if (!pname1 || !pname2) {
5410 return False;
5411 }
5412
5413 /* Truncate the copy of name2 at the last '/' */
5414 *pname2 = '\0';
5415
5416 /* Now go past the '/' */
5417 pname1++;
5418 pname2++;
5419
5420 root1 = talloc_strdup(ctx, pname1);
5421 root2 = talloc_strdup(ctx, pname2);
5422
5423 if (!root1 || !root2) {
5424 return False;
5425 }
5426
5427 p = strrchr_m(root1,'.');
5428 if (p) {
5429 *p = 0;
5430 ext1 = talloc_strdup(ctx, p+1);
5431 } else {
5432 ext1 = talloc_strdup(ctx, "");
5433 }
5434 p = strrchr_m(root2,'.');
5435 if (p) {
5436 *p = 0;
5437 ext2 = talloc_strdup(ctx, p+1);
5438 } else {
5439 ext2 = talloc_strdup(ctx, "");
5440 }
5441
5442 if (!ext1 || !ext2) {
5443 return False;
5444 }
5445
5446 p = root1;
5447 p2 = root2;
5448 while (*p2) {
5449 if (*p2 == '?') {
5450 /* Hmmm. Should this be mb-aware ? */
5451 *p2 = *p;
5452 p2++;
5453 } else if (*p2 == '*') {
5454 *p2 = '\0';
5455 root2 = talloc_asprintf(ctx, "%s%s",
5456 root2,
5457 p);
5458 if (!root2) {
5459 return False;
5460 }
5461 break;
5462 } else {
5463 p2++;
5464 }
5465 if (*p) {
5466 p++;
5467 }
5468 }
5469
5470 p = ext1;
5471 p2 = ext2;
5472 while (*p2) {
5473 if (*p2 == '?') {
5474 /* Hmmm. Should this be mb-aware ? */
5475 *p2 = *p;
5476 p2++;
5477 } else if (*p2 == '*') {
5478 *p2 = '\0';
5479 ext2 = talloc_asprintf(ctx, "%s%s",
5480 ext2,
5481 p);
5482 if (!ext2) {
5483 return False;
5484 }
5485 break;
5486 } else {
5487 p2++;
5488 }
5489 if (*p) {
5490 p++;
5491 }
5492 }
5493
5494 if (*ext2) {
5495 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5496 name2_copy,
5497 root2,
5498 ext2);
5499 } else {
5500 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5501 name2_copy,
5502 root2);
5503 }
5504
5505 if (!*pp_newname) {
5506 return False;
5507 }
5508
5509 return True;
5510 }
5511
5512 /****************************************************************************
5513 Ensure open files have their names updated. Updated to notify other smbd's
5514 asynchronously.
5515 ****************************************************************************/
5516
5517 static void rename_open_files(connection_struct *conn,
5518 struct share_mode_lock *lck,
5519 const char *newname)
5520 {
5521 files_struct *fsp;
5522 bool did_rename = False;
5523
5524 for(fsp = file_find_di_first(lck->id); fsp;
5525 fsp = file_find_di_next(fsp)) {
5526 /* fsp_name is a relative path under the fsp. To change this for other
5527 sharepaths we need to manipulate relative paths. */
5528 /* TODO - create the absolute path and manipulate the newname
5529 relative to the sharepath. */
5530 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5531 continue;
5532 }
5533 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5534 fsp->fnum, file_id_string_tos(&fsp->file_id),
5535 fsp->fsp_name, newname ));
5536 string_set(&fsp->fsp_name, newname);
5537 did_rename = True;
5538 }
5539
5540 if (!did_rename) {
5541 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5542 file_id_string_tos(&lck->id), newname ));
5543 }
5544
5545 /* Send messages to all smbd's (not ourself) that the name has changed. */
5546 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5547 newname);
5548 }
5549
5550 /****************************************************************************
5551 We need to check if the source path is a parent directory of the destination
5552 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5553 refuse the rename with a sharing violation. Under UNIX the above call can
5554 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5555 probably need to check that the client is a Windows one before disallowing
5556 this as a UNIX client (one with UNIX extensions) can know the source is a
5557 symlink and make this decision intelligently. Found by an excellent bug
5558 report from <AndyLiebman@aol.com>.
5559 ****************************************************************************/
5560
5561 static bool rename_path_prefix_equal(const char *src, const char *dest)
5562 {
5563 const char *psrc = src;
5564 const char *pdst = dest;
5565 size_t slen;
5566
5567 if (psrc[0] == '.' && psrc[1] == '/') {
5568 psrc += 2;
5569 }
5570 if (pdst[0] == '.' && pdst[1] == '/') {
5571 pdst += 2;
5572 }
5573 if ((slen = strlen(psrc)) > strlen(pdst)) {
5574 return False;
5575 }
5576 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5577 }
5578
5579 /*
5580 * Do the notify calls from a rename
5581 */
5582
5583 static void notify_rename(connection_struct *conn, bool is_dir,
5584 const char *oldpath, const char *newpath)
5585 {
5586 char *olddir, *newdir;
5587 const char *oldname, *newname;
5588 uint32 mask;
5589
5590 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5591 : FILE_NOTIFY_CHANGE_FILE_NAME;
5592
5593 if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
5594 || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
5595 TALLOC_FREE(olddir);
5596 return;
5597 }
5598
5599 if (strcmp(olddir, newdir) == 0) {
5600 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5601 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5602 }
5603 else {
5604 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5605 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5606 }
5607 TALLOC_FREE(olddir);
5608 TALLOC_FREE(newdir);
5609
5610 /* this is a strange one. w2k3 gives an additional event for
5611 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5612 files, but not directories */
5613 if (!is_dir) {
5614 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5615 FILE_NOTIFY_CHANGE_ATTRIBUTES
5616 |FILE_NOTIFY_CHANGE_CREATION,
5617 newpath);
5618 }
5619 }
5620
5621 /****************************************************************************
5622 Rename an open file - given an fsp.
5623 ****************************************************************************/
5624
5625 NTSTATUS rename_internals_fsp(connection_struct *conn,
5626 files_struct *fsp,
5627 char *newname,
5628 const char *newname_last_component,
5629 uint32 attrs,
5630 bool replace_if_exists)
5631 {
5632 TALLOC_CTX *ctx = talloc_tos();
5633 SMB_STRUCT_STAT sbuf, sbuf1;
5634 NTSTATUS status = NT_STATUS_OK;
5635 struct share_mode_lock *lck = NULL;
5636 bool dst_exists, old_is_stream, new_is_stream;
5637
5638 ZERO_STRUCT(sbuf);
5639
5640 status = check_name(conn, newname);
5641 if (!NT_STATUS_IS_OK(status)) {
5642 return status;
5643 }
5644
5645 /* Ensure newname contains a '/' */
5646 if(strrchr_m(newname,'/') == 0) {
5647 newname = talloc_asprintf(ctx,
5648 "./%s",
5649 newname);
5650 if (!newname) {
5651 return NT_STATUS_NO_MEMORY;
5652 }
5653 }
5654
5655 /*
5656 * Check for special case with case preserving and not
5657 * case sensitive. If the old last component differs from the original
5658 * last component only by case, then we should allow
5659 * the rename (user is trying to change the case of the
5660 * filename).
5661 */
5662
5663 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5664 strequal(newname, fsp->fsp_name)) {
5665 char *p;
5666 char *newname_modified_last_component = NULL;
5667
5668 /*
5669 * Get the last component of the modified name.
5670 * Note that we guarantee that newname contains a '/'
5671 * character above.
5672 */
5673 p = strrchr_m(newname,'/');
5674 newname_modified_last_component = talloc_strdup(ctx,
5675 p+1);
5676 if (!newname_modified_last_component) {
5677 return NT_STATUS_NO_MEMORY;
5678 }
5679
5680 if(strcsequal(newname_modified_last_component,
5681 newname_last_component) == False) {
5682 /*
5683 * Replace the modified last component with
5684 * the original.
5685 */
5686 *p = '\0'; /* Truncate at the '/' */
5687 newname = talloc_asprintf(ctx,
5688 "%s/%s",
5689 newname,
5690 newname_last_component);
5691 }
5692 }
5693
5694 /*
5695 * If the src and dest names are identical - including case,
5696 * don't do the rename, just return success.
5697 */
5698
5699 if (strcsequal(fsp->fsp_name, newname)) {
5700 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5701 newname));
5702 return NT_STATUS_OK;
5703 }
5704
5705 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5706 new_is_stream = is_ntfs_stream_name(newname);
5707
5708 /* Return the correct error code if both names aren't streams. */
5709 if (!old_is_stream && new_is_stream) {
5710 return NT_STATUS_OBJECT_NAME_INVALID;
5711 }
5712
5713 if (old_is_stream && !new_is_stream) {
5714 return NT_STATUS_INVALID_PARAMETER;
5715 }
5716
5717 /*
5718 * Have vfs_object_exist also fill sbuf1
5719 */
5720 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5721
5722 if(!replace_if_exists && dst_exists) {
5723 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5724 fsp->fsp_name,newname));
5725 return NT_STATUS_OBJECT_NAME_COLLISION;
5726 }
5727
5728 if (dst_exists) {
5729 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5730 files_struct *dst_fsp = file_find_di_first(fileid);
5731 /* The file can be open when renaming a stream */
5732 if (dst_fsp && !new_is_stream) {
5733 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5734 return NT_STATUS_ACCESS_DENIED;
5735 }
5736 }
5737
5738 /* Ensure we have a valid stat struct for the source. */
5739 if (fsp->fh->fd != -1) {
5740 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5741 return map_nt_error_from_unix(errno);
5742 }
5743 } else {
5744 int ret = -1;
5745 if (fsp->posix_open) {
5746 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5747 } else {
5748 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5749 }
5750 if (ret == -1) {
5751 return map_nt_error_from_unix(errno);
5752 }
5753 }
5754
5755 status = can_rename(conn, fsp, attrs, &sbuf);
5756
5757 if (!NT_STATUS_IS_OK(status)) {
5758 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5759 nt_errstr(status), fsp->fsp_name,newname));
5760 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5761 status = NT_STATUS_ACCESS_DENIED;
5762 return status;
5763 }
5764
5765 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5766 return NT_STATUS_ACCESS_DENIED;
5767 }
5768
5769 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5770 NULL);
5771
5772 /*
5773 * We have the file open ourselves, so not being able to get the
5774 * corresponding share mode lock is a fatal error.
5775 */
5776
5777 SMB_ASSERT(lck != NULL);
5778
5779 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5780 uint32 create_options = fsp->fh->private_options;
5781
5782 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5783 fsp->fsp_name,newname));
5784
5785 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5786
5787 rename_open_files(conn, lck, newname);
5788
5789 /*
5790 * A rename acts as a new file create w.r.t. allowing an initial delete
5791 * on close, probably because in Windows there is a new handle to the
5792 * new file. If initial delete on close was requested but not
5793 * originally set, we need to set it here. This is probably not 100% correct,
5794 * but will work for the CIFSFS client which in non-posix mode
5795 * depends on these semantics. JRA.
5796 */
5797
5798 if (create_options & FILE_DELETE_ON_CLOSE) {
5799 status = can_set_delete_on_close(fsp, True, 0);
5800
5801 if (NT_STATUS_IS_OK(status)) {
5802 /* Note that here we set the *inital* delete on close flag,
5803 * not the regular one. The magic gets handled in close. */
5804 fsp->initial_delete_on_close = True;
5805 }
5806 }
5807 TALLOC_FREE(lck);
5808 return NT_STATUS_OK;
5809 }
5810
5811 TALLOC_FREE(lck);
5812
5813 if (errno == ENOTDIR || errno == EISDIR) {
5814 status = NT_STATUS_OBJECT_NAME_COLLISION;
5815 } else {
5816 status = map_nt_error_from_unix(errno);
5817 }
5818
5819 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5820 nt_errstr(status), fsp->fsp_name,newname));
5821
5822 return status;
5823 }
5824
5825 /****************************************************************************
5826 The guts of the rename command, split out so it may be called by the NT SMB
5827 code.
5828 ****************************************************************************/
5829
5830 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5831 connection_struct *conn,
5832 struct smb_request *req,
5833 const char *name_in,
5834 const char *newname_in,
5835 uint32 attrs,
5836 bool replace_if_exists,
5837 bool src_has_wild,
5838 bool dest_has_wild,
5839 uint32_t access_mask)
5840 {
5841 char *directory = NULL;
5842 char *mask = NULL;
5843 char *last_component_src = NULL;
5844 char *last_component_dest = NULL;
5845 char *name = NULL;
5846 char *newname = NULL;
5847 char *p;
5848 int count=0;
5849 NTSTATUS status = NT_STATUS_OK;
5850 SMB_STRUCT_STAT sbuf1, sbuf2;
5851 struct smb_Dir *dir_hnd = NULL;
5852 const char *dname;
5853 long offset = 0;
5854 int create_options = 0;
5855 bool posix_pathnames = lp_posix_pathnames();
5856
5857 ZERO_STRUCT(sbuf1);
5858 ZERO_STRUCT(sbuf2);
5859
5860 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5861 &last_component_src, &sbuf1);
5862 if (!NT_STATUS_IS_OK(status)) {
5863 return status;
5864 }
5865
5866 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5867 &last_component_dest, &sbuf2);
5868 if (!NT_STATUS_IS_OK(status)) {
5869 return status;
5870 }
5871
5872 /*
5873 * Split the old name into directory and last component
5874 * strings. Note that unix_convert may have stripped off a
5875 * leading ./ from both name and newname if the rename is
5876 * at the root of the share. We need to make sure either both
5877 * name and newname contain a / character or neither of them do
5878 * as this is checked in resolve_wildcards().
5879 */
5880
5881 p = strrchr_m(name,'/');
5882 if (!p) {
5883 directory = talloc_strdup(ctx, ".");
5884 if (!directory) {
5885 return NT_STATUS_NO_MEMORY;
5886 }
5887 mask = name;
5888 } else {
5889 *p = 0;
5890 directory = talloc_strdup(ctx, name);
5891 if (!directory) {
5892 return NT_STATUS_NO_MEMORY;
5893 }
5894 mask = p+1;
5895 *p = '/'; /* Replace needed for exceptional test below. */
5896 }
5897
5898 /*
5899 * We should only check the mangled cache
5900 * here if unix_convert failed. This means
5901 * that the path in 'mask' doesn't exist
5902 * on the file system and so we need to look
5903 * for a possible mangle. This patch from
5904 * Tine Smukavec <valentin.smukavec@hermes.si>.
5905 */
5906
5907 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5908 char *new_mask = NULL;
5909 mangle_lookup_name_from_8_3(ctx,
5910 mask,
5911 &new_mask,
5912 conn->params );
5913 if (new_mask) {
5914 mask = new_mask;
5915 }
5916 }
5917
5918 if (!src_has_wild) {
5919 files_struct *fsp;
5920
5921 /*
5922 * No wildcards - just process the one file.
5923 */
5924 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5925
5926 /* Add a terminating '/' to the directory name. */
5927 directory = talloc_asprintf_append(directory,
5928 "/%s",
5929 mask);
5930 if (!directory) {
5931 return NT_STATUS_NO_MEMORY;
5932 }
5933
5934 /* Ensure newname contains a '/' also */
5935 if(strrchr_m(newname,'/') == 0) {
5936 newname = talloc_asprintf(ctx,
5937 "./%s",
5938 newname);
5939 if (!newname) {
5940 return NT_STATUS_NO_MEMORY;
5941 }
5942 }
5943
5944 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5945 "case_preserve = %d, short case preserve = %d, "
5946 "directory = %s, newname = %s, "
5947 "last_component_dest = %s, is_8_3 = %d\n",
5948 conn->case_sensitive, conn->case_preserve,
5949 conn->short_case_preserve, directory,
5950 newname, last_component_dest, is_short_name));
5951
5952 /* The dest name still may have wildcards. */
5953 if (dest_has_wild) {
5954 char *mod_newname = NULL;
5955 if (!resolve_wildcards(ctx,
5956 directory,newname,&mod_newname)) {
5957 DEBUG(6, ("rename_internals: resolve_wildcards "
5958 "%s %s failed\n",
5959 directory,
5960 newname));
5961 return NT_STATUS_NO_MEMORY;
5962 }
5963 newname = mod_newname;
5964 }
5965
5966 ZERO_STRUCT(sbuf1);
5967 if (posix_pathnames) {
5968 SMB_VFS_LSTAT(conn, directory, &sbuf1);
5969 } else {
5970 SMB_VFS_STAT(conn, directory, &sbuf1);
5971 }
5972
5973 if (S_ISDIR(sbuf1.st_mode)) {
5974 create_options |= FILE_DIRECTORY_FILE;
5975 }
5976
5977 status = SMB_VFS_CREATE_FILE(
5978 conn, /* conn */
5979 req, /* req */
5980 0, /* root_dir_fid */
5981 directory, /* fname */
5982 0, /* create_file_flags */
5983 access_mask, /* access_mask */
5984 (FILE_SHARE_READ | /* share_access */
5985 FILE_SHARE_WRITE),
5986 FILE_OPEN, /* create_disposition*/
5987 create_options, /* create_options */
5988 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
5989 0, /* oplock_request */
5990 0, /* allocation_size */
5991 NULL, /* sd */
5992 NULL, /* ea_list */
5993 &fsp, /* result */
5994 NULL, /* pinfo */
5995 &sbuf1); /* psbuf */
5996
5997 if (!NT_STATUS_IS_OK(status)) {
5998 DEBUG(3, ("Could not open rename source %s: %s\n",
5999 directory, nt_errstr(status)));
6000 return status;
6001 }
6002
6003 status = rename_internals_fsp(conn, fsp, newname,
6004 last_component_dest,
6005 attrs, replace_if_exists);
6006
6007 close_file(req, fsp, NORMAL_CLOSE);
6008
6009 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6010 nt_errstr(status), directory,newname));
6011
6012 return status;
6013 }
6014
6015 /*
6016 * Wildcards - process each file that matches.
6017 */
6018 if (strequal(mask,"????????.???")) {
6019 mask[0] = '*';
6020 mask[1] = '\0';
6021 }
6022
6023 status = check_name(conn, directory);
6024 if (!NT_STATUS_IS_OK(status)) {
6025 return status;
6026 }
6027
6028 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
6029 if (dir_hnd == NULL) {
6030 return map_nt_error_from_unix(errno);
6031 }
6032
6033 status = NT_STATUS_NO_SUCH_FILE;
6034 /*
6035 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6036 * - gentest fix. JRA
6037 */
6038
6039 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6040 files_struct *fsp = NULL;
6041 char *fname = NULL;
6042 char *destname = NULL;
6043 bool sysdir_entry = False;
6044
6045 /* Quick check for "." and ".." */
6046 if (ISDOT(dname) || ISDOTDOT(dname)) {
6047 if (attrs & aDIR) {
6048 sysdir_entry = True;
6049 } else {
6050 continue;
6051 }
6052 }
6053
6054 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6055 continue;
6056 }
6057
6058 if(!mask_match(dname, mask, conn->case_sensitive)) {
6059 continue;
6060 }
6061
6062 if (sysdir_entry) {
6063 status = NT_STATUS_OBJECT_NAME_INVALID;
6064 break;
6065 }
6066
6067 fname = talloc_asprintf(ctx,
6068 "%s/%s",
6069 directory,
6070 dname);
6071 if (!fname) {
6072 return NT_STATUS_NO_MEMORY;
6073 }
6074
6075 if (!resolve_wildcards(ctx,
6076 fname,newname,&destname)) {
6077 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6078 fname, destname));
6079 TALLOC_FREE(fname);
6080 continue;
6081 }
6082 if (!destname) {
6083 return NT_STATUS_NO_MEMORY;
6084 }
6085
6086 ZERO_STRUCT(sbuf1);
6087 if (posix_pathnames) {
6088 SMB_VFS_LSTAT(conn, fname, &sbuf1);
6089 } else {
6090 SMB_VFS_STAT(conn, fname, &sbuf1);
6091 }
6092
6093 create_options = 0;
6094
6095 if (S_ISDIR(sbuf1.st_mode)) {
6096 create_options |= FILE_DIRECTORY_FILE;
6097 }
6098
6099 status = SMB_VFS_CREATE_FILE(
6100 conn, /* conn */
6101 req, /* req */
6102 0, /* root_dir_fid */
6103 fname, /* fname */
6104 0, /* create_file_flags */
6105 access_mask, /* access_mask */
6106 (FILE_SHARE_READ | /* share_access */
6107 FILE_SHARE_WRITE),
6108 FILE_OPEN, /* create_disposition*/
6109 create_options, /* create_options */
6110 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6111 0, /* oplock_request */
6112 0, /* allocation_size */
6113 NULL, /* sd */
6114 NULL, /* ea_list */
6115 &fsp, /* result */
6116 NULL, /* pinfo */
6117 &sbuf1); /* psbuf */
6118
6119 if (!NT_STATUS_IS_OK(status)) {
6120 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6121 "returned %s rename %s -> %s\n",
6122 nt_errstr(status), directory, newname));
6123 break;
6124 }
6125
6126 status = rename_internals_fsp(conn, fsp, destname, dname,
6127 attrs, replace_if_exists);
6128
6129 close_file(req, fsp, NORMAL_CLOSE);
6130
6131 if (!NT_STATUS_IS_OK(status)) {
6132 DEBUG(3, ("rename_internals_fsp returned %s for "
6133 "rename %s -> %s\n", nt_errstr(status),
6134 directory, newname));
6135 break;
6136 }
6137
6138 count++;
6139
6140 DEBUG(3,("rename_internals: doing rename on %s -> "
6141 "%s\n",fname,destname));
6142
6143 TALLOC_FREE(fname);
6144 TALLOC_FREE(destname);
6145 }
6146 TALLOC_FREE(dir_hnd);
6147
6148 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6149 status = map_nt_error_from_unix(errno);
6150 }
6151
6152 return status;
6153 }
6154
6155 /****************************************************************************
6156 Reply to a mv.
6157 ****************************************************************************/
6158
6159 void reply_mv(struct smb_request *req)
6160 {
6161 connection_struct *conn = req->conn;
6162 char *name = NULL;
6163 char *newname = NULL;
6164 const char *p;
6165 uint32 attrs;
6166 NTSTATUS status;
6167 bool src_has_wcard = False;
6168 bool dest_has_wcard = False;
6169 TALLOC_CTX *ctx = talloc_tos();
6170
6171 START_PROFILE(SMBmv);
6172
6173 if (req->wct < 1) {
6174 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6175 END_PROFILE(SMBmv);
6176 return;
6177 }
6178
6179 attrs = SVAL(req->vwv+0, 0);
6180
6181 p = (const char *)req->buf + 1;
6182 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6183 &status, &src_has_wcard);
6184 if (!NT_STATUS_IS_OK(status)) {
6185 reply_nterror(req, status);
6186 END_PROFILE(SMBmv);
6187 return;
6188 }
6189 p++;
6190 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6191 &status, &dest_has_wcard);
6192 if (!NT_STATUS_IS_OK(status)) {
6193 reply_nterror(req, status);
6194 END_PROFILE(SMBmv);
6195 return;
6196 }
6197
6198 status = resolve_dfspath_wcard(ctx, conn,
6199 req->flags2 & FLAGS2_DFS_PATHNAMES,
6200 name,
6201 &name,
6202 &src_has_wcard);
6203 if (!NT_STATUS_IS_OK(status)) {
6204 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6205 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6206 ERRSRV, ERRbadpath);
6207 END_PROFILE(SMBmv);
6208 return;
6209 }
6210 reply_nterror(req, status);
6211 END_PROFILE(SMBmv);
6212 return;
6213 }
6214
6215 status = resolve_dfspath_wcard(ctx, conn,
6216 req->flags2 & FLAGS2_DFS_PATHNAMES,
6217 newname,
6218 &newname,
6219 &dest_has_wcard);
6220 if (!NT_STATUS_IS_OK(status)) {
6221 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6222 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6223 ERRSRV, ERRbadpath);
6224 END_PROFILE(SMBmv);
6225 return;
6226 }
6227 reply_nterror(req, status);
6228 END_PROFILE(SMBmv);
6229 return;
6230 }
6231
6232 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6233
6234 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6235 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6236 if (!NT_STATUS_IS_OK(status)) {
6237 if (open_was_deferred(req->mid)) {
6238 /* We have re-scheduled this call. */
6239 END_PROFILE(SMBmv);
6240 return;
6241 }
6242 reply_nterror(req, status);
6243 END_PROFILE(SMBmv);
6244 return;
6245 }
6246
6247 reply_outbuf(req, 0, 0);
6248
6249 END_PROFILE(SMBmv);
6250 return;
6251 }
6252
6253 /*******************************************************************
6254 Copy a file as part of a reply_copy.
6255 ******************************************************************/
6256
6257 /*
6258 * TODO: check error codes on all callers
6259 */
6260
6261 NTSTATUS copy_file(TALLOC_CTX *ctx,
6262 connection_struct *conn,
6263 const char *src,
6264 const char *dest1,
6265 int ofun,
6266 int count,
6267 bool target_is_directory)
6268 {
6269 SMB_STRUCT_STAT src_sbuf, sbuf2;
6270 SMB_OFF_T ret=-1;
6271 files_struct *fsp1,*fsp2;
6272 char *dest = NULL;
6273 uint32 dosattrs;
6274 uint32 new_create_disposition;
6275 NTSTATUS status;
6276
6277 dest = talloc_strdup(ctx, dest1);
6278 if (!dest) {
6279 return NT_STATUS_NO_MEMORY;
6280 }
6281 if (target_is_directory) {
6282 const char *p = strrchr_m(src,'/');
6283 if (p) {
6284 p++;
6285 } else {
6286 p = src;
6287 }
6288 dest = talloc_asprintf_append(dest,
6289 "/%s",
6290 p);
6291 if (!dest) {
6292 return NT_STATUS_NO_MEMORY;
6293 }
6294 }
6295
6296 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6297 TALLOC_FREE(dest);
6298 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6299 }
6300
6301 if (!target_is_directory && count) {
6302 new_create_disposition = FILE_OPEN;
6303 } else {
6304 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6305 NULL, NULL, &new_create_disposition, NULL)) {
6306 TALLOC_FREE(dest);
6307 return NT_STATUS_INVALID_PARAMETER;
6308 }
6309 }
6310
6311 status = SMB_VFS_CREATE_FILE(
6312 conn, /* conn */
6313 NULL, /* req */
6314 0, /* root_dir_fid */
6315 src, /* fname */
6316 0, /* create_file_flags */
6317 FILE_GENERIC_READ, /* access_mask */
6318 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6319 FILE_OPEN, /* create_disposition*/
6320 0, /* create_options */
6321 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6322 INTERNAL_OPEN_ONLY, /* oplock_request */
6323 0, /* allocation_size */
6324 NULL, /* sd */
6325 NULL, /* ea_list */
6326 &fsp1, /* result */
6327 NULL, /* pinfo */
6328 &src_sbuf); /* psbuf */
6329
6330 if (!NT_STATUS_IS_OK(status)) {
6331 TALLOC_FREE(dest);
6332 return status;
6333 }
6334
6335 dosattrs = dos_mode(conn, src, &src_sbuf);
6336 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6337 ZERO_STRUCTP(&sbuf2);
6338 }
6339
6340 status = SMB_VFS_CREATE_FILE(
6341 conn, /* conn */
6342 NULL, /* req */
6343 0, /* root_dir_fid */
6344 dest, /* fname */
6345 0, /* create_file_flags */
6346 FILE_GENERIC_WRITE, /* access_mask */
6347 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6348 new_create_disposition, /* create_disposition*/
6349 0, /* create_options */
6350 dosattrs, /* file_attributes */
6351 INTERNAL_OPEN_ONLY, /* oplock_request */
6352 0, /* allocation_size */
6353 NULL, /* sd */
6354 NULL, /* ea_list */
6355 &fsp2, /* result */
6356 NULL, /* pinfo */
6357 &sbuf2); /* psbuf */
6358
6359 TALLOC_FREE(dest);
6360
6361 if (!NT_STATUS_IS_OK(status)) {
6362 close_file(NULL, fsp1, ERROR_CLOSE);
6363 return status;
6364 }
6365
6366 if ((ofun&3) == 1) {
6367 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6368 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6369 /*
6370 * Stop the copy from occurring.
6371 */
6372 ret = -1;
6373 src_sbuf.st_size = 0;
6374 }
6375 }
6376
6377 if (src_sbuf.st_size) {
6378 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6379 }
6380
6381 close_file(NULL, fsp1, NORMAL_CLOSE);
6382
6383 /* Ensure the modtime is set correctly on the destination file. */
6384 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6385
6386 /*
6387 * As we are opening fsp1 read-only we only expect
6388 * an error on close on fsp2 if we are out of space.
6389 * Thus we don't look at the error return from the
6390 * close of fsp1.
6391 */
6392 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6393
6394 if (!NT_STATUS_IS_OK(status)) {
6395 return status;
6396 }
6397
6398 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6399 return NT_STATUS_DISK_FULL;
6400 }
6401
6402 return NT_STATUS_OK;
6403 }
6404
6405 /****************************************************************************
6406 Reply to a file copy.
6407 ****************************************************************************/
6408
6409 void reply_copy(struct smb_request *req)
6410 {
6411 connection_struct *conn = req->conn;
6412 char *name = NULL;
6413 char *newname = NULL;
6414 char *directory = NULL;
6415 const char *mask = NULL;
6416 const char mask_star[] = "*";
6417 const char *p;
6418 int count=0;
6419 int error = ERRnoaccess;
6420 int err = 0;
6421 int tid2;
6422 int ofun;
6423 int flags;
6424 bool target_is_directory=False;
6425 bool source_has_wild = False;
6426 bool dest_has_wild = False;
6427 SMB_STRUCT_STAT sbuf1, sbuf2;
6428 NTSTATUS status;
6429 TALLOC_CTX *ctx = talloc_tos();
6430
6431 START_PROFILE(SMBcopy);
6432
6433 if (req->wct < 3) {
6434 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6435 END_PROFILE(SMBcopy);
6436 return;
6437 }
6438
6439 tid2 = SVAL(req->vwv+0, 0);
6440 ofun = SVAL(req->vwv+1, 0);
6441 flags = SVAL(req->vwv+2, 0);
6442
6443 p = (const char *)req->buf;
6444 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6445 &status, &source_has_wild);
6446 if (!NT_STATUS_IS_OK(status)) {
6447 reply_nterror(req, status);
6448 END_PROFILE(SMBcopy);
6449 return;
6450 }
6451 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6452 &status, &dest_has_wild);
6453 if (!NT_STATUS_IS_OK(status)) {
6454 reply_nterror(req, status);
6455 END_PROFILE(SMBcopy);
6456 return;
6457 }
6458
6459 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6460
6461 if (tid2 != conn->cnum) {
6462 /* can't currently handle inter share copies XXXX */
6463 DEBUG(3,("Rejecting inter-share copy\n"));
6464 reply_doserror(req, ERRSRV, ERRinvdevice);
6465 END_PROFILE(SMBcopy);
6466 return;
6467 }
6468
6469 status = resolve_dfspath_wcard(ctx, conn,
6470 req->flags2 & FLAGS2_DFS_PATHNAMES,
6471 name,
6472 &name,
6473 &source_has_wild);
6474 if (!NT_STATUS_IS_OK(status)) {
6475 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6476 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6477 ERRSRV, ERRbadpath);
6478 END_PROFILE(SMBcopy);
6479 return;
6480 }
6481 reply_nterror(req, status);
6482 END_PROFILE(SMBcopy);
6483 return;
6484 }
6485
6486 status = resolve_dfspath_wcard(ctx, conn,
6487 req->flags2 & FLAGS2_DFS_PATHNAMES,
6488 newname,
6489 &newname,
6490 &dest_has_wild);
6491 if (!NT_STATUS_IS_OK(status)) {
6492 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6493 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6494 ERRSRV, ERRbadpath);
6495 END_PROFILE(SMBcopy);
6496 return;
6497 }
6498 reply_nterror(req, status);
6499 END_PROFILE(SMBcopy);
6500 return;
6501 }
6502
6503 status = unix_convert(ctx, conn, name, source_has_wild,
6504 &name, NULL, &sbuf1);
6505 if (!NT_STATUS_IS_OK(status)) {
6506 reply_nterror(req, status);
6507 END_PROFILE(SMBcopy);
6508 return;
6509 }
6510
6511 status = unix_convert(ctx, conn, newname, dest_has_wild,
6512 &newname, NULL, &sbuf2);
6513 if (!NT_STATUS_IS_OK(status)) {
6514 reply_nterror(req, status);
6515 END_PROFILE(SMBcopy);
6516 return;
6517 }
6518
6519 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6520
6521 if ((flags&1) && target_is_directory) {
6522 reply_doserror(req, ERRDOS, ERRbadfile);
6523 END_PROFILE(SMBcopy);
6524 return;
6525 }
6526
6527 if ((flags&2) && !target_is_directory) {
6528 reply_doserror(req, ERRDOS, ERRbadpath);
6529 END_PROFILE(SMBcopy);
6530 return;
6531 }
6532
6533 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6534 /* wants a tree copy! XXXX */
6535 DEBUG(3,("Rejecting tree copy\n"));
6536 reply_doserror(req, ERRSRV, ERRerror);
6537 END_PROFILE(SMBcopy);
6538 return;
6539 }
6540
6541 p = strrchr_m(name,'/');
6542 if (p != NULL) {
6543 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6544 mask = p+1;
6545 } else {
6546 directory = talloc_strdup(ctx, "./");
6547 mask = name;
6548 }
6549
6550 if (!directory) {
6551 reply_nterror(req, NT_STATUS_NO_MEMORY);
6552 END_PROFILE(SMBcopy);
6553 return;
6554 }
6555
6556 /*
6557 * We should only check the mangled cache
6558 * here if unix_convert failed. This means
6559 * that the path in 'mask' doesn't exist
6560 * on the file system and so we need to look
6561 * for a possible mangle. This patch from
6562 * Tine Smukavec <valentin.smukavec@hermes.si>.
6563 */
6564
6565 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6566 char *new_mask = NULL;
6567 mangle_lookup_name_from_8_3(ctx,
6568 mask,
6569 &new_mask,
6570 conn->params );
6571 if (new_mask) {
6572 mask = new_mask;
6573 }
6574 }
6575
6576 if (!source_has_wild) {
6577 directory = talloc_asprintf_append(directory,
6578 "/%s",
6579 mask);
6580 if (dest_has_wild) {
6581 char *mod_newname = NULL;
6582 if (!resolve_wildcards(ctx,
6583 directory,newname,&mod_newname)) {
6584 reply_nterror(req, NT_STATUS_NO_MEMORY);
6585 END_PROFILE(SMBcopy);
6586 return;
6587 }
6588 newname = mod_newname;
6589 }
6590
6591 status = check_name(conn, directory);
6592 if (!NT_STATUS_IS_OK(status)) {
6593 reply_nterror(req, status);
6594 END_PROFILE(SMBcopy);
6595 return;
6596 }
6597
6598 status = check_name(conn, newname);
6599 if (!NT_STATUS_IS_OK(status)) {
6600 reply_nterror(req, status);
6601 END_PROFILE(SMBcopy);
6602 return;
6603 }
6604
6605 status = copy_file(ctx,conn,directory,newname,ofun,
6606 count,target_is_directory);
6607
6608 if(!NT_STATUS_IS_OK(status)) {
6609 reply_nterror(req, status);
6610 END_PROFILE(SMBcopy);
6611 return;
6612 } else {
6613 count++;
6614 }
6615 } else {
6616 struct smb_Dir *dir_hnd = NULL;
6617 const char *dname = NULL;
6618 long offset = 0;
6619
6620 if (strequal(mask,"????????.???")) {
6621 mask = mask_star;
6622 }
6623
6624 status = check_name(conn, directory);
6625 if (!NT_STATUS_IS_OK(status)) {
6626 reply_nterror(req, status);
6627 END_PROFILE(SMBcopy);
6628 return;
6629 }
6630
6631 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6632 if (dir_hnd == NULL) {
6633 status = map_nt_error_from_unix(errno);
6634 reply_nterror(req, status);
6635 END_PROFILE(SMBcopy);
6636 return;
6637 }
6638
6639 error = ERRbadfile;
6640
6641 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6642 char *destname = NULL;
6643 char *fname = NULL;
6644
6645 if (ISDOT(dname) || ISDOTDOT(dname)) {
6646 continue;
6647 }
6648
6649 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6650 continue;
6651 }
6652
6653 if(!mask_match(dname, mask, conn->case_sensitive)) {
6654 continue;
6655 }
6656
6657 error = ERRnoaccess;
6658 fname = talloc_asprintf(ctx,
6659 "%s/%s",
6660 directory,
6661 dname);
6662 if (!fname) {
6663 TALLOC_FREE(dir_hnd);
6664 reply_nterror(req, NT_STATUS_NO_MEMORY);
6665 END_PROFILE(SMBcopy);
6666 return;
6667 }
6668
6669 if (!resolve_wildcards(ctx,
6670 fname,newname,&destname)) {
6671 continue;
6672 }
6673 if (!destname) {
6674 TALLOC_FREE(dir_hnd);
6675 reply_nterror(req, NT_STATUS_NO_MEMORY);
6676 END_PROFILE(SMBcopy);
6677 return;
6678 }
6679
6680 status = check_name(conn, fname);
6681 if (!NT_STATUS_IS_OK(status)) {
6682 TALLOC_FREE(dir_hnd);
6683 reply_nterror(req, status);
6684 END_PROFILE(SMBcopy);
6685 return;
6686 }
6687
6688 status = check_name(conn, destname);
6689 if (!NT_STATUS_IS_OK(status)) {
6690 TALLOC_FREE(dir_hnd);
6691 reply_nterror(req, status);
6692 END_PROFILE(SMBcopy);
6693 return;
6694 }
6695
6696 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6697
6698 status = copy_file(ctx,conn,fname,destname,ofun,
6699 count,target_is_directory);
6700 if (NT_STATUS_IS_OK(status)) {
6701 count++;
6702 }
6703 TALLOC_FREE(fname);
6704 TALLOC_FREE(destname);
6705 }
6706 TALLOC_FREE(dir_hnd);
6707 }
6708
6709 if (count == 0) {
6710 if(err) {
6711 /* Error on close... */
6712 errno = err;
6713 reply_unixerror(req, ERRHRD, ERRgeneral);
6714 END_PROFILE(SMBcopy);
6715 return;
6716 }
6717
6718 reply_doserror(req, ERRDOS, error);
6719 END_PROFILE(SMBcopy);
6720 return;
6721 }
6722
6723 reply_outbuf(req, 1, 0);
6724 SSVAL(req->outbuf,smb_vwv0,count);
6725
6726 END_PROFILE(SMBcopy);
6727 return;
6728 }
6729
6730 #undef DBGC_CLASS
6731 #define DBGC_CLASS DBGC_LOCKING
6732
6733 /****************************************************************************
6734 Get a lock pid, dealing with large count requests.
6735 ****************************************************************************/
6736
6737 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6738 bool large_file_format)
6739 {
6740 if(!large_file_format)
6741 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6742 else
6743 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6744 }
6745
6746 /****************************************************************************
6747 Get a lock count, dealing with large count requests.
6748 ****************************************************************************/
6749
6750 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6751 bool large_file_format)
6752 {
6753 uint64_t count = 0;
6754
6755 if(!large_file_format) {
6756 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6757 } else {
6758
6759 #if defined(HAVE_LONGLONG)
6760 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6761 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6762 #else /* HAVE_LONGLONG */
6763
6764 /*
6765 * NT4.x seems to be broken in that it sends large file (64 bit)
6766 * lockingX calls even if the CAP_LARGE_FILES was *not*
6767 * negotiated. For boxes without large unsigned ints truncate the
6768 * lock count by dropping the top 32 bits.
6769 */
6770
6771 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6772 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6773 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6774 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6775 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6776 }
6777
6778 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6779 #endif /* HAVE_LONGLONG */
6780 }
6781
6782 return count;
6783 }
6784
6785 #if !defined(HAVE_LONGLONG)
6786 /****************************************************************************
6787 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6788 ****************************************************************************/
6789
6790 static uint32 map_lock_offset(uint32 high, uint32 low)
6791 {
6792 unsigned int i;
6793 uint32 mask = 0;
6794 uint32 highcopy = high;
6795
6796 /*
6797 * Try and find out how many significant bits there are in high.
6798 */
6799
6800 for(i = 0; highcopy; i++)
6801 highcopy >>= 1;
6802
6803 /*
6804 * We use 31 bits not 32 here as POSIX
6805 * lock offsets may not be negative.
6806 */
6807
6808 mask = (~0) << (31 - i);
6809
6810 if(low & mask)
6811 return 0; /* Fail. */
6812
6813 high <<= (31 - i);
6814
6815 return (high|low);
6816 }
6817 #endif /* !defined(HAVE_LONGLONG) */
6818
6819 /****************************************************************************
6820 Get a lock offset, dealing with large offset requests.
6821 ****************************************************************************/
6822
6823 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6824 bool large_file_format, bool *err)
6825 {
6826 uint64_t offset = 0;
6827
6828 *err = False;
6829
6830 if(!large_file_format) {
6831 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6832 } else {
6833
6834 #if defined(HAVE_LONGLONG)
6835 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6836 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6837 #else /* HAVE_LONGLONG */
6838
6839 /*
6840 * NT4.x seems to be broken in that it sends large file (64 bit)
6841 * lockingX calls even if the CAP_LARGE_FILES was *not*
6842 * negotiated. For boxes without large unsigned ints mangle the
6843 * lock offset by mapping the top 32 bits onto the lower 32.
6844 */
6845
6846 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6847 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6848 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6849 uint32 new_low = 0;
6850
6851 if((new_low = map_lock_offset(high, low)) == 0) {
6852 *err = True;
6853 return (uint64_t)-1;
6854 }
6855
6856 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6857 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6858 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6859 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6860 }
6861
6862 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6863 #endif /* HAVE_LONGLONG */
6864 }
6865
6866 return offset;
6867 }
6868
6869 /****************************************************************************
6870 Reply to a lockingX request.
6871 ****************************************************************************/
6872
6873 void reply_lockingX(struct smb_request *req)
6874 {
6875 connection_struct *conn = req->conn;
6876 files_struct *fsp;
6877 unsigned char locktype;
6878 unsigned char oplocklevel;
6879 uint16 num_ulocks;
6880 uint16 num_locks;
6881 uint64_t count = 0, offset = 0;
6882 uint32 lock_pid;
6883 int32 lock_timeout;
6884 int i;
6885 const uint8_t *data;
6886 bool large_file_format;
6887 bool err;
6888 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6889
6890 START_PROFILE(SMBlockingX);
6891
6892 if (req->wct < 8) {
6893 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6894 END_PROFILE(SMBlockingX);
6895 return;
6896 }
6897
6898 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
6899 locktype = CVAL(req->vwv+3, 0);
6900 oplocklevel = CVAL(req->vwv+3, 1);
6901 num_ulocks = SVAL(req->vwv+6, 0);
6902 num_locks = SVAL(req->vwv+7, 0);
6903 lock_timeout = IVAL(req->vwv+4, 0);
6904 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6905
6906 if (!check_fsp(conn, req, fsp)) {
6907 END_PROFILE(SMBlockingX);
6908 return;
6909 }
6910
6911 data = req->buf;
6912
6913 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6914 /* we don't support these - and CANCEL_LOCK makes w2k
6915 and XP reboot so I don't really want to be
6916 compatible! (tridge) */
6917 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6918 END_PROFILE(SMBlockingX);
6919 return;
6920 }
6921
6922 /* Check if this is an oplock break on a file
6923 we have granted an oplock on.
6924 */
6925 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6926 /* Client can insist on breaking to none. */
6927 bool break_to_none = (oplocklevel == 0);
6928 bool result;
6929
6930 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6931 "for fnum = %d\n", (unsigned int)oplocklevel,
6932 fsp->fnum ));
6933
6934 /*
6935 * Make sure we have granted an exclusive or batch oplock on
6936 * this file.
6937 */
6938
6939 if (fsp->oplock_type == 0) {
6940
6941 /* The Samba4 nbench simulator doesn't understand
6942 the difference between break to level2 and break
6943 to none from level2 - it sends oplock break
6944 replies in both cases. Don't keep logging an error
6945 message here - just ignore it. JRA. */
6946
6947 DEBUG(5,("reply_lockingX: Error : oplock break from "
6948 "client for fnum = %d (oplock=%d) and no "
6949 "oplock granted on this file (%s).\n",
6950 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6951
6952 /* if this is a pure oplock break request then don't
6953 * send a reply */
6954 if (num_locks == 0 && num_ulocks == 0) {
6955 END_PROFILE(SMBlockingX);
6956 return;
6957 } else {
6958 END_PROFILE(SMBlockingX);
6959 reply_doserror(req, ERRDOS, ERRlock);
6960 return;
6961 }
6962 }
6963
6964 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6965 (break_to_none)) {
6966 result = remove_oplock(fsp);
6967 } else {
6968 result = downgrade_oplock(fsp);
6969 }
6970
6971 if (!result) {
6972 DEBUG(0, ("reply_lockingX: error in removing "
6973 "oplock on file %s\n", fsp->fsp_name));
6974 /* Hmmm. Is this panic justified? */
6975 smb_panic("internal tdb error");
6976 }
6977
6978 reply_to_oplock_break_requests(fsp);
6979
6980 /* if this is a pure oplock break request then don't send a
6981 * reply */
6982 if (num_locks == 0 && num_ulocks == 0) {
6983 /* Sanity check - ensure a pure oplock break is not a
6984 chained request. */
6985 if(CVAL(req->vwv+0, 0) != 0xff)
6986 DEBUG(0,("reply_lockingX: Error : pure oplock "
6987 "break is a chained %d request !\n",
6988 (unsigned int)CVAL(req->vwv+0, 0)));
6989 END_PROFILE(SMBlockingX);
6990 return;
6991 }
6992 }
6993
6994 if (req->buflen <
6995 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6996 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6997 END_PROFILE(SMBlockingX);
6998 return;
6999 }
7000
7001 /* Data now points at the beginning of the list
7002 of smb_unlkrng structs */
7003 for(i = 0; i < (int)num_ulocks; i++) {
7004 lock_pid = get_lock_pid( data, i, large_file_format);
7005 count = get_lock_count( data, i, large_file_format);
7006 offset = get_lock_offset( data, i, large_file_format, &err);
7007
7008 /*
7009 * There is no error code marked "stupid client bug".... :-).
7010 */
7011 if(err) {
7012 END_PROFILE(SMBlockingX);
7013 reply_doserror(req, ERRDOS, ERRnoaccess);
7014 return;
7015 }
7016
7017 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
7018 "pid %u, file %s\n", (double)offset, (double)count,
7019 (unsigned int)lock_pid, fsp->fsp_name ));
7020
7021 status = do_unlock(smbd_messaging_context(),
7022 fsp,
7023 lock_pid,
7024 count,
7025 offset,
7026 WINDOWS_LOCK);
7027
7028 DEBUG(10, ("reply_lockingX: unlock returned %s\n",
7029 nt_errstr(status)));
7030
7031 if (NT_STATUS_V(status)) {
7032 END_PROFILE(SMBlockingX);
7033 reply_nterror(req, status);
7034 return;
7035 }
7036 }
7037
7038 /* Setup the timeout in seconds. */
7039
7040 if (!lp_blocking_locks(SNUM(conn))) {
7041 lock_timeout = 0;
7042 }
7043
7044 /* Now do any requested locks */
7045 data += ((large_file_format ? 20 : 10)*num_ulocks);
7046
7047 /* Data now points at the beginning of the list
7048 of smb_lkrng structs */
7049
7050 for(i = 0; i < (int)num_locks; i++) {
7051 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
7052 READ_LOCK:WRITE_LOCK);
7053 lock_pid = get_lock_pid( data, i, large_file_format);
7054 count = get_lock_count( data, i, large_file_format);
7055 offset = get_lock_offset( data, i, large_file_format, &err);
7056
7057 /*
7058 * There is no error code marked "stupid client bug".... :-).
7059 */
7060 if(err) {
7061 END_PROFILE(SMBlockingX);
7062 reply_doserror(req, ERRDOS, ERRnoaccess);
7063 return;
7064 }
7065
7066 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
7067 "%u, file %s timeout = %d\n", (double)offset,
7068 (double)count, (unsigned int)lock_pid,
7069 fsp->fsp_name, (int)lock_timeout ));
7070
7071 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7072 struct blocking_lock_record *blr = NULL;
7073
7074 if (lp_blocking_locks(SNUM(conn))) {
7075
7076 /* Schedule a message to ourselves to
7077 remove the blocking lock record and
7078 return the right error. */
7079
7080 blr = blocking_lock_cancel(fsp,
7081 lock_pid,
7082 offset,
7083 count,
7084 WINDOWS_LOCK,
7085 locktype,
7086 NT_STATUS_FILE_LOCK_CONFLICT);
7087 if (blr == NULL) {
7088 END_PROFILE(SMBlockingX);
7089 reply_nterror(
7090 req,
7091 NT_STATUS_DOS(
7092 ERRDOS,
7093 ERRcancelviolation));
7094 return;
7095 }
7096 }
7097 /* Remove a matching pending lock. */
7098 status = do_lock_cancel(fsp,
7099 lock_pid,
7100 count,
7101 offset,
7102 WINDOWS_LOCK,
7103 blr);
7104 } else {
7105 bool blocking_lock = lock_timeout ? True : False;
7106 bool defer_lock = False;
7107 struct byte_range_lock *br_lck;
7108 uint32 block_smbpid;
7109
7110 br_lck = do_lock(smbd_messaging_context(),
7111 fsp,
7112 lock_pid,
7113 count,
7114 offset,
7115 lock_type,
7116 WINDOWS_LOCK,
7117 blocking_lock,
7118 &status,
7119 &block_smbpid,
7120 NULL);
7121
7122 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7123 /* Windows internal resolution for blocking locks seems
7124 to be about 200ms... Don't wait for less than that. JRA. */
7125 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
7126 lock_timeout = lp_lock_spin_time();
7127 }
7128 defer_lock = True;
7129 }
7130
7131 /* This heuristic seems to match W2K3 very well. If a
7132 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7133 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7134 far as I can tell. Replacement for do_lock_spin(). JRA. */
7135
7136 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7137 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7138 defer_lock = True;
7139 lock_timeout = lp_lock_spin_time();
7140 }
7141
7142 if (br_lck && defer_lock) {
7143 /*
7144 * A blocking lock was requested. Package up
7145 * this smb into a queued request and push it
7146 * onto the blocking lock queue.
7147 */
7148 if(push_blocking_lock_request(br_lck,
7149 req,
7150 fsp,
7151 lock_timeout,
7152 i,
7153 lock_pid,
7154 lock_type,
7155 WINDOWS_LOCK,
7156 offset,
7157 count,
7158 block_smbpid)) {
7159 TALLOC_FREE(br_lck);
7160 END_PROFILE(SMBlockingX);
7161 return;
7162 }
7163 }
7164
7165 TALLOC_FREE(br_lck);
7166 }
7167
7168 if (NT_STATUS_V(status)) {
7169 END_PROFILE(SMBlockingX);
7170 reply_nterror(req, status);
7171 return;
7172 }
7173 }
7174
7175 /* If any of the above locks failed, then we must unlock
7176 all of the previous locks (X/Open spec). */
7177
7178 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7179 (i != num_locks) &&
7180 (num_locks != 0)) {
7181 /*
7182 * Ensure we don't do a remove on the lock that just failed,
7183 * as under POSIX rules, if we have a lock already there, we
7184 * will delete it (and we shouldn't) .....
7185 */
7186 for(i--; i >= 0; i--) {
7187 lock_pid = get_lock_pid( data, i, large_file_format);
7188 count = get_lock_count( data, i, large_file_format);
7189 offset = get_lock_offset( data, i, large_file_format,
7190 &err);
7191
7192 /*
7193 * There is no error code marked "stupid client
7194 * bug".... :-).
7195 */
7196 if(err) {
7197 END_PROFILE(SMBlockingX);
7198 reply_doserror(req, ERRDOS, ERRnoaccess);
7199 return;
7200 }
7201
7202 do_unlock(smbd_messaging_context(),
7203 fsp,
7204 lock_pid,
7205 count,
7206 offset,
7207 WINDOWS_LOCK);
7208 }
7209 END_PROFILE(SMBlockingX);
7210 reply_nterror(req, status);
7211 return;
7212 }
7213
7214 reply_outbuf(req, 2, 0);
7215
7216 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7217 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7218
7219 END_PROFILE(SMBlockingX);
7220 chain_reply(req);
7221 }
7222
7223 #undef DBGC_CLASS
7224 #define DBGC_CLASS DBGC_ALL
7225
7226 /****************************************************************************
7227 Reply to a SMBreadbmpx (read block multiplex) request.
7228 Always reply with an error, if someone has a platform really needs this,
7229 please contact vl@samba.org
7230 ****************************************************************************/
7231
7232 void reply_readbmpx(struct smb_request *req)
7233 {
7234 START_PROFILE(SMBreadBmpx);
7235 reply_doserror(req, ERRSRV, ERRuseSTD);
7236 END_PROFILE(SMBreadBmpx);
7237 return;
7238 }
7239
7240 /****************************************************************************
7241 Reply to a SMBreadbs (read block multiplex secondary) request.
7242 Always reply with an error, if someone has a platform really needs this,
7243 please contact vl@samba.org
7244 ****************************************************************************/
7245
7246 void reply_readbs(struct smb_request *req)
7247 {
7248 START_PROFILE(SMBreadBs);
7249 reply_doserror(req, ERRSRV, ERRuseSTD);
7250 END_PROFILE(SMBreadBs);
7251 return;
7252 }
7253
7254 /****************************************************************************
7255 Reply to a SMBsetattrE.
7256 ****************************************************************************/
7257
7258 void reply_setattrE(struct smb_request *req)
7259 {
7260 connection_struct *conn = req->conn;
7261 struct smb_file_time ft;
7262 files_struct *fsp;
7263 SMB_STRUCT_STAT sbuf;
7264 NTSTATUS status;
7265
7266 START_PROFILE(SMBsetattrE);
7267 ZERO_STRUCT(ft);
7268
7269 if (req->wct < 7) {
7270 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7271 END_PROFILE(SMBsetattrE);
7272 return;
7273 }
7274
7275 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7276
7277 if(!fsp || (fsp->conn != conn)) {
7278 reply_doserror(req, ERRDOS, ERRbadfid);
7279 END_PROFILE(SMBsetattrE);
7280 return;
7281 }
7282
7283
7284 /*
7285 * Convert the DOS times into unix times.
7286 */
7287
7288 ft.atime = convert_time_t_to_timespec(
7289 srv_make_unix_date2(req->vwv+3));
7290 ft.mtime = convert_time_t_to_timespec(
7291 srv_make_unix_date2(req->vwv+5));
7292 ft.create_time = convert_time_t_to_timespec(
7293 srv_make_unix_date2(req->vwv+1));
7294
7295 reply_outbuf(req, 0, 0);
7296
7297 /*
7298 * Patch from Ray Frush <frush@engr.colostate.edu>
7299 * Sometimes times are sent as zero - ignore them.
7300 */
7301
7302 /* Ensure we have a valid stat struct for the source. */
7303 if (fsp->fh->fd != -1) {
7304 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7305 status = map_nt_error_from_unix(errno);
7306 reply_nterror(req, status);
7307 END_PROFILE(SMBsetattrE);
7308 return;
7309 }
7310 } else {
7311 int ret = -1;
7312
7313 if (fsp->posix_open) {
7314 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7315 } else {
7316 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7317 }
7318 if (ret == -1) {
7319 status = map_nt_error_from_unix(errno);
7320 reply_nterror(req, status);
7321 END_PROFILE(SMBsetattrE);
7322 return;
7323 }
7324 }
7325
7326 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7327 &sbuf, &ft, true);
7328 if (!NT_STATUS_IS_OK(status)) {
7329 reply_doserror(req, ERRDOS, ERRnoaccess);
7330 END_PROFILE(SMBsetattrE);
7331 return;
7332 }
7333
7334 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7335 " createtime=%u\n",
7336 fsp->fnum,
7337 (unsigned int)ft.atime.tv_sec,
7338 (unsigned int)ft.mtime.tv_sec,
7339 (unsigned int)ft.create_time.tv_sec
7340 ));
7341
7342 END_PROFILE(SMBsetattrE);
7343 return;
7344 }
7345
7346
7347 /* Back from the dead for OS/2..... JRA. */
7348
7349 /****************************************************************************
7350 Reply to a SMBwritebmpx (write block multiplex primary) request.
7351 Always reply with an error, if someone has a platform really needs this,
7352 please contact vl@samba.org
7353 ****************************************************************************/
7354
7355 void reply_writebmpx(struct smb_request *req)
7356 {
7357 START_PROFILE(SMBwriteBmpx);
7358 reply_doserror(req, ERRSRV, ERRuseSTD);
7359 END_PROFILE(SMBwriteBmpx);
7360 return;
7361 }
7362
7363 /****************************************************************************
7364 Reply to a SMBwritebs (write block multiplex secondary) request.
7365 Always reply with an error, if someone has a platform really needs this,
7366 please contact vl@samba.org
7367 ****************************************************************************/
7368
7369 void reply_writebs(struct smb_request *req)
7370 {
7371 START_PROFILE(SMBwriteBs);
7372 reply_doserror(req, ERRSRV, ERRuseSTD);
7373 END_PROFILE(SMBwriteBs);
7374 return;
7375 }
7376
7377 /****************************************************************************
7378 Reply to a SMBgetattrE.
7379 ****************************************************************************/
7380
7381 void reply_getattrE(struct smb_request *req)
7382 {
7383 connection_struct *conn = req->conn;
7384 SMB_STRUCT_STAT sbuf;
7385 int mode;
7386 files_struct *fsp;
7387 struct timespec create_ts;
7388
7389 START_PROFILE(SMBgetattrE);
7390
7391 if (req->wct < 1) {
7392 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7393 END_PROFILE(SMBgetattrE);
7394 return;
7395 }
7396
7397 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7398
7399 if(!fsp || (fsp->conn != conn)) {
7400 reply_doserror(req, ERRDOS, ERRbadfid);
7401 END_PROFILE(SMBgetattrE);
7402 return;
7403 }
7404
7405 /* Do an fstat on this file */
7406 if(fsp_stat(fsp, &sbuf)) {
7407 reply_unixerror(req, ERRDOS, ERRnoaccess);
7408 END_PROFILE(SMBgetattrE);
7409 return;
7410 }
7411
7412 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7413
7414 /*
7415 * Convert the times into dos times. Set create
7416 * date to be last modify date as UNIX doesn't save
7417 * this.
7418 */
7419
7420 reply_outbuf(req, 11, 0);
7421
7422 create_ts = get_create_timespec(&sbuf,
7423 lp_fake_dir_create_times(SNUM(conn)));
7424 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7425 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7426 /* Should we check pending modtime here ? JRA */
7427 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7428
7429 if (mode & aDIR) {
7430 SIVAL(req->outbuf, smb_vwv6, 0);
7431 SIVAL(req->outbuf, smb_vwv8, 0);
7432 } else {
7433 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7434 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7435 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7436 }
7437 SSVAL(req->outbuf,smb_vwv10, mode);
7438
7439 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7440
7441 END_PROFILE(SMBgetattrE);
7442 return;
7443 }
WIP