?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix msdfs after the change to smb_filename struct. We must *always*
[Samba/gbeck.git] / source3 / smbd / nttrans.c
bloba8716d36a3ed009c564a5a09f3f8bbd1fadfd476
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23
24 extern enum protocol_types Protocol;
25 extern const struct generic_mapping file_generic_mapping;
26
27 static char *nttrans_realloc(char **ptr, size_t size)
28 {
29 if (ptr==NULL) {
30 smb_panic("nttrans_realloc() called with NULL ptr");
31 }
32
33 *ptr = (char *)SMB_REALLOC(*ptr, size);
34 if(*ptr == NULL) {
35 return NULL;
36 }
37 memset(*ptr,'\0',size);
38 return *ptr;
39 }
40
41 /****************************************************************************
42 Send the required number of replies back.
43 We assume all fields other than the data fields are
44 set correctly for the type of call.
45 HACK ! Always assumes smb_setup field is zero.
46 ****************************************************************************/
47
48 void send_nt_replies(connection_struct *conn,
49 struct smb_request *req, NTSTATUS nt_error,
50 char *params, int paramsize,
51 char *pdata, int datasize)
52 {
53 int data_to_send = datasize;
54 int params_to_send = paramsize;
55 int useable_space;
56 char *pp = params;
57 char *pd = pdata;
58 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59 int alignment_offset = 3;
60 int data_alignment_offset = 0;
61 struct smbd_server_connection *sconn = smbd_server_conn;
62 int max_send = sconn->smb1.sessions.max_send;
63
64 /*
65 * If there genuinely are no parameters or data to send just send
66 * the empty packet.
67 */
68
69 if(params_to_send == 0 && data_to_send == 0) {
70 reply_outbuf(req, 18, 0);
71 show_msg((char *)req->outbuf);
72 return;
73 }
74
75 /*
76 * When sending params and data ensure that both are nicely aligned.
77 * Only do this alignment when there is also data to send - else
78 * can cause NT redirector problems.
79 */
80
81 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
82 data_alignment_offset = 4 - (params_to_send % 4);
83 }
84
85 /*
86 * Space is bufsize minus Netbios over TCP header minus SMB header.
87 * The alignment_offset is to align the param bytes on a four byte
88 * boundary (2 bytes for data len, one byte pad).
89 * NT needs this to work correctly.
90 */
91
92 useable_space = max_send - (smb_size
93 + 2 * 18 /* wct */
94 + alignment_offset
95 + data_alignment_offset);
96
97 if (useable_space < 0) {
98 char *msg = talloc_asprintf(
99 talloc_tos(),
100 "send_nt_replies failed sanity useable_space = %d!!!",
101 useable_space);
102 DEBUG(0, ("%s\n", msg));
103 exit_server_cleanly(msg);
104 }
105
106 while (params_to_send || data_to_send) {
107
108 /*
109 * Calculate whether we will totally or partially fill this packet.
110 */
111
112 total_sent_thistime = params_to_send + data_to_send;
113
114 /*
115 * We can never send more than useable_space.
116 */
117
118 total_sent_thistime = MIN(total_sent_thistime, useable_space);
119
120 reply_outbuf(req, 18,
121 total_sent_thistime + alignment_offset
122 + data_alignment_offset);
123
124 /*
125 * We might have had SMBnttranss in req->inbuf, fix that.
126 */
127 SCVAL(req->outbuf, smb_com, SMBnttrans);
128
129 /*
130 * Set total params and data to be sent.
131 */
132
133 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
134 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
135
136 /*
137 * Calculate how many parameters and data we can fit into
138 * this packet. Parameters get precedence.
139 */
140
141 params_sent_thistime = MIN(params_to_send,useable_space);
142 data_sent_thistime = useable_space - params_sent_thistime;
143 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
144
145 SIVAL(req->outbuf, smb_ntr_ParameterCount,
146 params_sent_thistime);
147
148 if(params_sent_thistime == 0) {
149 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
150 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
151 } else {
152 /*
153 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
154 * parameter bytes, however the first 4 bytes of outbuf are
155 * the Netbios over TCP header. Thus use smb_base() to subtract
156 * them from the calculation.
157 */
158
159 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
160 ((smb_buf(req->outbuf)+alignment_offset)
161 - smb_base(req->outbuf)));
162 /*
163 * Absolute displacement of param bytes sent in this packet.
164 */
165
166 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
167 pp - params);
168 }
169
170 /*
171 * Deal with the data portion.
172 */
173
174 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
175
176 if(data_sent_thistime == 0) {
177 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
178 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
179 } else {
180 /*
181 * The offset of the data bytes is the offset of the
182 * parameter bytes plus the number of parameters being sent this time.
183 */
184
185 SIVAL(req->outbuf, smb_ntr_DataOffset,
186 ((smb_buf(req->outbuf)+alignment_offset) -
187 smb_base(req->outbuf))
188 + params_sent_thistime + data_alignment_offset);
189 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
190 }
191
192 /*
193 * Copy the param bytes into the packet.
194 */
195
196 if(params_sent_thistime) {
197 if (alignment_offset != 0) {
198 memset(smb_buf(req->outbuf), 0,
199 alignment_offset);
200 }
201 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
202 params_sent_thistime);
203 }
204
205 /*
206 * Copy in the data bytes
207 */
208
209 if(data_sent_thistime) {
210 if (data_alignment_offset != 0) {
211 memset((smb_buf(req->outbuf)+alignment_offset+
212 params_sent_thistime), 0,
213 data_alignment_offset);
214 }
215 memcpy(smb_buf(req->outbuf)+alignment_offset
216 +params_sent_thistime+data_alignment_offset,
217 pd,data_sent_thistime);
218 }
219
220 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
221 params_sent_thistime, data_sent_thistime, useable_space));
222 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
223 params_to_send, data_to_send, paramsize, datasize));
224
225 if (NT_STATUS_V(nt_error)) {
226 error_packet_set((char *)req->outbuf,
227 0, 0, nt_error,
228 __LINE__,__FILE__);
229 }
230
231 /* Send the packet */
232 show_msg((char *)req->outbuf);
233 if (!srv_send_smb(smbd_server_fd(),
234 (char *)req->outbuf,
235 true, req->seqnum+1,
236 IS_CONN_ENCRYPTED(conn),
237 &req->pcd)) {
238 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
239 }
240
241 TALLOC_FREE(req->outbuf);
242
243 pp += params_sent_thistime;
244 pd += data_sent_thistime;
245
246 params_to_send -= params_sent_thistime;
247 data_to_send -= data_sent_thistime;
248
249 /*
250 * Sanity check
251 */
252
253 if(params_to_send < 0 || data_to_send < 0) {
254 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
255 params_to_send, data_to_send));
256 exit_server_cleanly("send_nt_replies: internal error");
257 }
258 }
259 }
260
261 /****************************************************************************
262 Is it an NTFS stream name ?
263 An NTFS file name is <path>.<extention>:<stream name>:<stream type>
264 $DATA can be used as both a stream name and a stream type. A missing stream
265 name or type implies $DATA.
266
267 Both Windows stream names and POSIX files can contain the ':' character.
268 This function first checks for the existence of a colon in the last component
269 of the given name. If the name contains a colon we differentiate between a
270 stream and POSIX file by checking if the latter exists through a POSIX stat.
271
272 Function assumes we've already chdir() to the "root" directory of fname.
273 ****************************************************************************/
274
275 bool is_ntfs_stream_name(const char *fname)
276 {
277 const char *lastcomp;
278 SMB_STRUCT_STAT sbuf;
279
280 /* If all pathnames are treated as POSIX we ignore streams. */
281 if (lp_posix_pathnames()) {
282 return false;
283 }
284
285 /* Find the last component of the name. */
286 if ((lastcomp = strrchr_m(fname, '/')) != NULL)
287 ++lastcomp;
288 else
289 lastcomp = fname;
290
291 /* If there is no colon in the last component, it's not a stream. */
292 if (strchr_m(lastcomp, ':') == NULL)
293 return false;
294
295 /*
296 * If file already exists on disk, it's not a stream. The stat must
297 * bypass the vfs layer so streams modules don't intefere.
298 */
299 if (sys_stat(fname, &sbuf) == 0) {
300 DEBUG(5, ("is_ntfs_stream_name: file %s contains a ':' but is "
301 "not a stream\n", fname));
302 return false;
303 }
304
305 return true;
306 }
307
308 /****************************************************************************
309 Reply to an NT create and X call on a pipe
310 ****************************************************************************/
311
312 static void nt_open_pipe(char *fname, connection_struct *conn,
313 struct smb_request *req, int *ppnum)
314 {
315 files_struct *fsp;
316 NTSTATUS status;
317
318 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
319
320 /* Strip \\ off the name. */
321 fname++;
322
323 status = open_np_file(req, fname, &fsp);
324 if (!NT_STATUS_IS_OK(status)) {
325 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
326 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
327 ERRDOS, ERRbadpipe);
328 return;
329 }
330 reply_nterror(req, status);
331 return;
332 }
333
334 *ppnum = fsp->fnum;
335 return;
336 }
337
338 /****************************************************************************
339 Reply to an NT create and X call for pipes.
340 ****************************************************************************/
341
342 static void do_ntcreate_pipe_open(connection_struct *conn,
343 struct smb_request *req)
344 {
345 char *fname = NULL;
346 int pnum = -1;
347 char *p = NULL;
348 uint32 flags = IVAL(req->vwv+3, 1);
349 TALLOC_CTX *ctx = talloc_tos();
350
351 srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
352
353 if (!fname) {
354 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
355 ERRDOS, ERRbadpipe);
356 return;
357 }
358 nt_open_pipe(fname, conn, req, &pnum);
359
360 if (req->outbuf) {
361 /* error reply */
362 return;
363 }
364
365 /*
366 * Deal with pipe return.
367 */
368
369 if (flags & EXTENDED_RESPONSE_REQUIRED) {
370 /* This is very strange. We
371 * return 50 words, but only set
372 * the wcnt to 42 ? It's definately
373 * what happens on the wire....
374 */
375 reply_outbuf(req, 50, 0);
376 SCVAL(req->outbuf,smb_wct,42);
377 } else {
378 reply_outbuf(req, 34, 0);
379 }
380
381 p = (char *)req->outbuf + smb_vwv2;
382 p++;
383 SSVAL(p,0,pnum);
384 p += 2;
385 SIVAL(p,0,FILE_WAS_OPENED);
386 p += 4;
387 p += 32;
388 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
389 p += 20;
390 /* File type. */
391 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
392 /* Device state. */
393 SSVAL(p,2, 0x5FF); /* ? */
394 p += 4;
395
396 if (flags & EXTENDED_RESPONSE_REQUIRED) {
397 p += 25;
398 SIVAL(p,0,FILE_GENERIC_ALL);
399 /*
400 * For pipes W2K3 seems to return
401 * 0x12019B next.
402 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
403 */
404 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
405 }
406
407 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
408
409 chain_reply(req);
410 }
411
412 /****************************************************************************
413 Reply to an NT create and X call.
414 ****************************************************************************/
415
416 void reply_ntcreate_and_X(struct smb_request *req)
417 {
418 connection_struct *conn = req->conn;
419 struct smb_filename *smb_fname = NULL;
420 char *fname = NULL;
421 uint32 flags;
422 uint32 access_mask;
423 uint32 file_attributes;
424 uint32 share_access;
425 uint32 create_disposition;
426 uint32 create_options;
427 uint16 root_dir_fid;
428 uint64_t allocation_size;
429 /* Breakout the oplock request bits so we can set the
430 reply bits separately. */
431 uint32 fattr=0;
432 SMB_OFF_T file_len = 0;
433 int info = 0;
434 files_struct *fsp = NULL;
435 char *p = NULL;
436 struct timespec c_timespec;
437 struct timespec a_timespec;
438 struct timespec m_timespec;
439 NTSTATUS status;
440 int oplock_request;
441 uint8_t oplock_granted = NO_OPLOCK_RETURN;
442 TALLOC_CTX *ctx = talloc_tos();
443
444 START_PROFILE(SMBntcreateX);
445
446 if (req->wct < 24) {
447 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
448 return;
449 }
450
451 flags = IVAL(req->vwv+3, 1);
452 access_mask = IVAL(req->vwv+7, 1);
453 file_attributes = IVAL(req->vwv+13, 1);
454 share_access = IVAL(req->vwv+15, 1);
455 create_disposition = IVAL(req->vwv+17, 1);
456 create_options = IVAL(req->vwv+19, 1);
457 root_dir_fid = (uint16)IVAL(req->vwv+5, 1);
458
459 allocation_size = (uint64_t)IVAL(req->vwv+9, 1);
460 #ifdef LARGE_SMB_OFF_T
461 allocation_size |= (((uint64_t)IVAL(req->vwv+11, 1)) << 32);
462 #endif
463
464 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
465 STR_TERMINATE, &status);
466
467 if (!NT_STATUS_IS_OK(status)) {
468 reply_nterror(req, status);
469 goto out;
470 }
471
472 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
473 "file_attributes = 0x%x, share_access = 0x%x, "
474 "create_disposition = 0x%x create_options = 0x%x "
475 "root_dir_fid = 0x%x, fname = %s\n",
476 (unsigned int)flags,
477 (unsigned int)access_mask,
478 (unsigned int)file_attributes,
479 (unsigned int)share_access,
480 (unsigned int)create_disposition,
481 (unsigned int)create_options,
482 (unsigned int)root_dir_fid,
483 fname));
484
485 /*
486 * we need to remove ignored bits when they come directly from the client
487 * because we reuse some of them for internal stuff
488 */
489 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
490
491 /*
492 * If it's an IPC, use the pipe handler.
493 */
494
495 if (IS_IPC(conn)) {
496 if (lp_nt_pipe_support()) {
497 do_ntcreate_pipe_open(conn, req);
498 goto out;
499 }
500 reply_doserror(req, ERRDOS, ERRnoaccess);
501 goto out;
502 }
503
504 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
505 if (oplock_request) {
506 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
507 ? BATCH_OPLOCK : 0;
508 }
509
510 status = resolve_dfspath(ctx,
511 conn,
512 req->flags2 & FLAGS2_DFS_PATHNAMES,
513 fname,
514 &fname);
515
516 if (!NT_STATUS_IS_OK(status)) {
517 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
518 reply_botherror(req,
519 NT_STATUS_PATH_NOT_COVERED,
520 ERRSRV, ERRbadpath);
521 goto out;
522 }
523 reply_nterror(req, status);
524 goto out;
525 }
526
527 status = unix_convert(ctx, conn, fname, &smb_fname, 0);
528 if (!NT_STATUS_IS_OK(status)) {
529 reply_nterror(req, status);
530 goto out;
531 }
532
533 status = SMB_VFS_CREATE_FILE(
534 conn, /* conn */
535 req, /* req */
536 root_dir_fid, /* root_dir_fid */
537 smb_fname, /* fname */
538 access_mask, /* access_mask */
539 share_access, /* share_access */
540 create_disposition, /* create_disposition*/
541 create_options, /* create_options */
542 file_attributes, /* file_attributes */
543 oplock_request, /* oplock_request */
544 allocation_size, /* allocation_size */
545 NULL, /* sd */
546 NULL, /* ea_list */
547 &fsp, /* result */
548 &info); /* pinfo */
549
550 if (!NT_STATUS_IS_OK(status)) {
551 if (open_was_deferred(req->mid)) {
552 /* We have re-scheduled this call, no error. */
553 goto out;
554 }
555 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
556 reply_botherror(req, status, ERRDOS, ERRfilexists);
557 }
558 else {
559 reply_nterror(req, status);
560 }
561 goto out;
562 }
563
564 /*
565 * If the caller set the extended oplock request bit
566 * and we granted one (by whatever means) - set the
567 * correct bit for extended oplock reply.
568 */
569
570 if (oplock_request &&
571 (lp_fake_oplocks(SNUM(conn))
572 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
573
574 /*
575 * Exclusive oplock granted
576 */
577
578 if (flags & REQUEST_BATCH_OPLOCK) {
579 oplock_granted = BATCH_OPLOCK_RETURN;
580 } else {
581 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
582 }
583 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
584 oplock_granted = LEVEL_II_OPLOCK_RETURN;
585 } else {
586 oplock_granted = NO_OPLOCK_RETURN;
587 }
588
589 file_len = smb_fname->st.st_ex_size;
590 fattr = dos_mode(conn,fsp->fsp_name,&smb_fname->st);
591 if (fattr == 0) {
592 fattr = FILE_ATTRIBUTE_NORMAL;
593 }
594
595 if (flags & EXTENDED_RESPONSE_REQUIRED) {
596 /* This is very strange. We
597 * return 50 words, but only set
598 * the wcnt to 42 ? It's definately
599 * what happens on the wire....
600 */
601 reply_outbuf(req, 50, 0);
602 SCVAL(req->outbuf,smb_wct,42);
603 } else {
604 reply_outbuf(req, 34, 0);
605 }
606
607 p = (char *)req->outbuf + smb_vwv2;
608
609 SCVAL(p, 0, oplock_granted);
610
611 p++;
612 SSVAL(p,0,fsp->fnum);
613 p += 2;
614 if ((create_disposition == FILE_SUPERSEDE)
615 && (info == FILE_WAS_OVERWRITTEN)) {
616 SIVAL(p,0,FILE_WAS_SUPERSEDED);
617 } else {
618 SIVAL(p,0,info);
619 }
620 p += 4;
621
622 /* Create time. */
623 c_timespec = smb_fname->st.st_ex_btime;
624 a_timespec = smb_fname->st.st_ex_atime;
625 m_timespec = smb_fname->st.st_ex_mtime;
626
627 if (lp_dos_filetime_resolution(SNUM(conn))) {
628 dos_filetime_timespec(&c_timespec);
629 dos_filetime_timespec(&a_timespec);
630 dos_filetime_timespec(&m_timespec);
631 }
632
633 put_long_date_timespec(p, c_timespec); /* create time. */
634 p += 8;
635 put_long_date_timespec(p, a_timespec); /* access time */
636 p += 8;
637 put_long_date_timespec(p, m_timespec); /* write time */
638 p += 8;
639 put_long_date_timespec(p, m_timespec); /* change time */
640 p += 8;
641 SIVAL(p,0,fattr); /* File Attributes. */
642 p += 4;
643 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&smb_fname->st));
644 p += 8;
645 SOFF_T(p,0,file_len);
646 p += 8;
647 if (flags & EXTENDED_RESPONSE_REQUIRED) {
648 SSVAL(p,2,0x7);
649 }
650 p += 4;
651 SCVAL(p,0,fsp->is_directory ? 1 : 0);
652
653 if (flags & EXTENDED_RESPONSE_REQUIRED) {
654 uint32 perms = 0;
655 p += 25;
656 if (fsp->is_directory ||
657 can_write_to_file(conn, fsp->fsp_name, &smb_fname->st)) {
658 perms = FILE_GENERIC_ALL;
659 } else {
660 perms = FILE_GENERIC_READ|FILE_EXECUTE;
661 }
662 SIVAL(p,0,perms);
663 }
664
665 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
666 fsp->fnum, fsp->fsp_name));
667
668 chain_reply(req);
669 out:
670 TALLOC_FREE(smb_fname);
671 END_PROFILE(SMBntcreateX);
672 return;
673 }
674
675 /****************************************************************************
676 Reply to a NT_TRANSACT_CREATE call to open a pipe.
677 ****************************************************************************/
678
679 static void do_nt_transact_create_pipe(connection_struct *conn,
680 struct smb_request *req,
681 uint16 **ppsetup, uint32 setup_count,
682 char **ppparams, uint32 parameter_count,
683 char **ppdata, uint32 data_count)
684 {
685 char *fname = NULL;
686 char *params = *ppparams;
687 int pnum = -1;
688 char *p = NULL;
689 NTSTATUS status;
690 size_t param_len;
691 uint32 flags;
692 TALLOC_CTX *ctx = talloc_tos();
693
694 /*
695 * Ensure minimum number of parameters sent.
696 */
697
698 if(parameter_count < 54) {
699 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
700 reply_doserror(req, ERRDOS, ERRnoaccess);
701 return;
702 }
703
704 flags = IVAL(params,0);
705
706 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
707 parameter_count-53, STR_TERMINATE,
708 &status);
709 if (!NT_STATUS_IS_OK(status)) {
710 reply_nterror(req, status);
711 return;
712 }
713
714 nt_open_pipe(fname, conn, req, &pnum);
715
716 if (req->outbuf) {
717 /* Error return */
718 return;
719 }
720
721 /* Realloc the size of parameters and data we will return */
722 if (flags & EXTENDED_RESPONSE_REQUIRED) {
723 /* Extended response is 32 more byyes. */
724 param_len = 101;
725 } else {
726 param_len = 69;
727 }
728 params = nttrans_realloc(ppparams, param_len);
729 if(params == NULL) {
730 reply_doserror(req, ERRDOS, ERRnomem);
731 return;
732 }
733
734 p = params;
735 SCVAL(p,0,NO_OPLOCK_RETURN);
736
737 p += 2;
738 SSVAL(p,0,pnum);
739 p += 2;
740 SIVAL(p,0,FILE_WAS_OPENED);
741 p += 8;
742
743 p += 32;
744 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
745 p += 20;
746 /* File type. */
747 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
748 /* Device state. */
749 SSVAL(p,2, 0x5FF); /* ? */
750 p += 4;
751
752 if (flags & EXTENDED_RESPONSE_REQUIRED) {
753 p += 25;
754 SIVAL(p,0,FILE_GENERIC_ALL);
755 /*
756 * For pipes W2K3 seems to return
757 * 0x12019B next.
758 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
759 */
760 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
761 }
762
763 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
764
765 /* Send the required number of replies */
766 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
767
768 return;
769 }
770
771 /****************************************************************************
772 Internal fn to set security descriptors.
773 ****************************************************************************/
774
775 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
776 uint32 security_info_sent)
777 {
778 SEC_DESC *psd = NULL;
779 NTSTATUS status;
780
781 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
782 return NT_STATUS_OK;
783 }
784
785 status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
786
787 if (!NT_STATUS_IS_OK(status)) {
788 return status;
789 }
790
791 if (psd->owner_sid == NULL) {
792 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
793 }
794 if (psd->group_sid == NULL) {
795 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
796 }
797
798 /* Convert all the generic bits. */
799 security_acl_map_generic(psd->dacl, &file_generic_mapping);
800 security_acl_map_generic(psd->sacl, &file_generic_mapping);
801
802 if (DEBUGLEVEL >= 10) {
803 DEBUG(10,("set_sd for file %s\n", fsp->fsp_name ));
804 NDR_PRINT_DEBUG(security_descriptor, psd);
805 }
806
807 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
808
809 TALLOC_FREE(psd);
810
811 return status;
812 }
813
814 /****************************************************************************
815 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
816 ****************************************************************************/
817
818 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
819 {
820 struct ea_list *ea_list_head = NULL;
821 size_t offset = 0;
822
823 if (data_size < 4) {
824 return NULL;
825 }
826
827 while (offset + 4 <= data_size) {
828 size_t next_offset = IVAL(pdata,offset);
829 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
830
831 if (!eal) {
832 return NULL;
833 }
834
835 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
836 if (next_offset == 0) {
837 break;
838 }
839 offset += next_offset;
840 }
841
842 return ea_list_head;
843 }
844
845 /****************************************************************************
846 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
847 ****************************************************************************/
848
849 static void call_nt_transact_create(connection_struct *conn,
850 struct smb_request *req,
851 uint16 **ppsetup, uint32 setup_count,
852 char **ppparams, uint32 parameter_count,
853 char **ppdata, uint32 data_count,
854 uint32 max_data_count)
855 {
856 struct smb_filename *smb_fname = NULL;
857 char *fname = NULL;
858 char *params = *ppparams;
859 char *data = *ppdata;
860 /* Breakout the oplock request bits so we can set the reply bits separately. */
861 uint32 fattr=0;
862 SMB_OFF_T file_len = 0;
863 int info = 0;
864 files_struct *fsp = NULL;
865 char *p = NULL;
866 uint32 flags;
867 uint32 access_mask;
868 uint32 file_attributes;
869 uint32 share_access;
870 uint32 create_disposition;
871 uint32 create_options;
872 uint32 sd_len;
873 struct security_descriptor *sd = NULL;
874 uint32 ea_len;
875 uint16 root_dir_fid;
876 struct timespec c_timespec;
877 struct timespec a_timespec;
878 struct timespec m_timespec;
879 struct ea_list *ea_list = NULL;
880 NTSTATUS status;
881 size_t param_len;
882 uint64_t allocation_size;
883 int oplock_request;
884 uint8_t oplock_granted;
885 TALLOC_CTX *ctx = talloc_tos();
886
887 DEBUG(5,("call_nt_transact_create\n"));
888
889 /*
890 * If it's an IPC, use the pipe handler.
891 */
892
893 if (IS_IPC(conn)) {
894 if (lp_nt_pipe_support()) {
895 do_nt_transact_create_pipe(
896 conn, req,
897 ppsetup, setup_count,
898 ppparams, parameter_count,
899 ppdata, data_count);
900 goto out;
901 }
902 reply_doserror(req, ERRDOS, ERRnoaccess);
903 goto out;
904 }
905
906 /*
907 * Ensure minimum number of parameters sent.
908 */
909
910 if(parameter_count < 54) {
911 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
912 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
913 goto out;
914 }
915
916 flags = IVAL(params,0);
917 access_mask = IVAL(params,8);
918 file_attributes = IVAL(params,20);
919 share_access = IVAL(params,24);
920 create_disposition = IVAL(params,28);
921 create_options = IVAL(params,32);
922 sd_len = IVAL(params,36);
923 ea_len = IVAL(params,40);
924 root_dir_fid = (uint16)IVAL(params,4);
925 allocation_size = (uint64_t)IVAL(params,12);
926 #ifdef LARGE_SMB_OFF_T
927 allocation_size |= (((uint64_t)IVAL(params,16)) << 32);
928 #endif
929
930 /*
931 * we need to remove ignored bits when they come directly from the client
932 * because we reuse some of them for internal stuff
933 */
934 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
935
936 /* Ensure the data_len is correct for the sd and ea values given. */
937 if ((ea_len + sd_len > data_count)
938 || (ea_len > data_count) || (sd_len > data_count)
939 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
940 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
941 "%u, data_count = %u\n", (unsigned int)ea_len,
942 (unsigned int)sd_len, (unsigned int)data_count));
943 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
944 goto out;
945 }
946
947 if (sd_len) {
948 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
949 sd_len));
950
951 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
952 &sd);
953 if (!NT_STATUS_IS_OK(status)) {
954 DEBUG(10, ("call_nt_transact_create: "
955 "unmarshall_sec_desc failed: %s\n",
956 nt_errstr(status)));
957 reply_nterror(req, status);
958 goto out;
959 }
960 }
961
962 if (ea_len) {
963 if (!lp_ea_support(SNUM(conn))) {
964 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
965 "EA's not supported.\n",
966 (unsigned int)ea_len));
967 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
968 goto out;
969 }
970
971 if (ea_len < 10) {
972 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
973 "too small (should be more than 10)\n",
974 (unsigned int)ea_len ));
975 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
976 goto out;
977 }
978
979 /* We have already checked that ea_len <= data_count here. */
980 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
981 ea_len);
982 if (ea_list == NULL) {
983 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
984 goto out;
985 }
986 }
987
988 srvstr_get_path(ctx, params, req->flags2, &fname,
989 params+53, parameter_count-53,
990 STR_TERMINATE, &status);
991 if (!NT_STATUS_IS_OK(status)) {
992 reply_nterror(req, status);
993 goto out;
994 }
995
996 status = resolve_dfspath(ctx,
997 conn,
998 req->flags2 & FLAGS2_DFS_PATHNAMES,
999 fname,
1000 &fname);
1001
1002 if (!NT_STATUS_IS_OK(status)) {
1003 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1004 reply_botherror(req,
1005 NT_STATUS_PATH_NOT_COVERED,
1006 ERRSRV, ERRbadpath);
1007 goto out;
1008 }
1009 reply_nterror(req, status);
1010 goto out;
1011 }
1012
1013 status = unix_convert(ctx, conn, fname, &smb_fname, 0);
1014 if (!NT_STATUS_IS_OK(status)) {
1015 reply_nterror(req, status);
1016 goto out;
1017 }
1018
1019 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1020 if (oplock_request) {
1021 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
1022 ? BATCH_OPLOCK : 0;
1023 }
1024
1025 status = SMB_VFS_CREATE_FILE(
1026 conn, /* conn */
1027 req, /* req */
1028 root_dir_fid, /* root_dir_fid */
1029 smb_fname, /* fname */
1030 access_mask, /* access_mask */
1031 share_access, /* share_access */
1032 create_disposition, /* create_disposition*/
1033 create_options, /* create_options */
1034 file_attributes, /* file_attributes */
1035 oplock_request, /* oplock_request */
1036 allocation_size, /* allocation_size */
1037 sd, /* sd */
1038 ea_list, /* ea_list */
1039 &fsp, /* result */
1040 &info); /* pinfo */
1041
1042 if(!NT_STATUS_IS_OK(status)) {
1043 if (open_was_deferred(req->mid)) {
1044 /* We have re-scheduled this call, no error. */
1045 return;
1046 }
1047 reply_openerror(req, status);
1048 goto out;
1049 }
1050
1051 /*
1052 * If the caller set the extended oplock request bit
1053 * and we granted one (by whatever means) - set the
1054 * correct bit for extended oplock reply.
1055 */
1056
1057 if (oplock_request &&
1058 (lp_fake_oplocks(SNUM(conn))
1059 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1060
1061 /*
1062 * Exclusive oplock granted
1063 */
1064
1065 if (flags & REQUEST_BATCH_OPLOCK) {
1066 oplock_granted = BATCH_OPLOCK_RETURN;
1067 } else {
1068 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1069 }
1070 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1071 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1072 } else {
1073 oplock_granted = NO_OPLOCK_RETURN;
1074 }
1075
1076 file_len = smb_fname->st.st_ex_size;
1077 fattr = dos_mode(conn, fsp->fsp_name, &smb_fname->st);
1078 if (fattr == 0) {
1079 fattr = FILE_ATTRIBUTE_NORMAL;
1080 }
1081
1082 /* Realloc the size of parameters and data we will return */
1083 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1084 /* Extended response is 32 more byyes. */
1085 param_len = 101;
1086 } else {
1087 param_len = 69;
1088 }
1089 params = nttrans_realloc(ppparams, param_len);
1090 if(params == NULL) {
1091 reply_doserror(req, ERRDOS, ERRnomem);
1092 goto out;
1093 }
1094
1095 p = params;
1096 SCVAL(p, 0, oplock_granted);
1097
1098 p += 2;
1099 SSVAL(p,0,fsp->fnum);
1100 p += 2;
1101 if ((create_disposition == FILE_SUPERSEDE)
1102 && (info == FILE_WAS_OVERWRITTEN)) {
1103 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1104 } else {
1105 SIVAL(p,0,info);
1106 }
1107 p += 8;
1108
1109 /* Create time. */
1110 c_timespec = smb_fname->st.st_ex_btime;
1111 a_timespec = smb_fname->st.st_ex_atime;
1112 m_timespec = smb_fname->st.st_ex_mtime;
1113
1114 if (lp_dos_filetime_resolution(SNUM(conn))) {
1115 dos_filetime_timespec(&c_timespec);
1116 dos_filetime_timespec(&a_timespec);
1117 dos_filetime_timespec(&m_timespec);
1118 }
1119
1120 put_long_date_timespec(p, c_timespec); /* create time. */
1121 p += 8;
1122 put_long_date_timespec(p, a_timespec); /* access time */
1123 p += 8;
1124 put_long_date_timespec(p, m_timespec); /* write time */
1125 p += 8;
1126 put_long_date_timespec(p, m_timespec); /* change time */
1127 p += 8;
1128 SIVAL(p,0,fattr); /* File Attributes. */
1129 p += 4;
1130 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st));
1131 p += 8;
1132 SOFF_T(p,0,file_len);
1133 p += 8;
1134 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1135 SSVAL(p,2,0x7);
1136 }
1137 p += 4;
1138 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1139
1140 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1141 uint32 perms = 0;
1142 p += 25;
1143 if (fsp->is_directory ||
1144 can_write_to_file(conn, fsp->fsp_name, &smb_fname->st)) {
1145 perms = FILE_GENERIC_ALL;
1146 } else {
1147 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1148 }
1149 SIVAL(p,0,perms);
1150 }
1151
1152 DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1153
1154 /* Send the required number of replies */
1155 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1156 out:
1157 TALLOC_FREE(smb_fname);
1158 return;
1159 }
1160
1161 /****************************************************************************
1162 Reply to a NT CANCEL request.
1163 conn POINTER CAN BE NULL HERE !
1164 ****************************************************************************/
1165
1166 void reply_ntcancel(struct smb_request *req)
1167 {
1168 /*
1169 * Go through and cancel any pending change notifies.
1170 */
1171
1172 START_PROFILE(SMBntcancel);
1173 srv_cancel_sign_response(smbd_server_conn);
1174 remove_pending_change_notify_requests_by_mid(req->mid);
1175 remove_pending_lock_requests_by_mid(req->mid);
1176
1177 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1178
1179 END_PROFILE(SMBntcancel);
1180 return;
1181 }
1182
1183 /****************************************************************************
1184 Copy a file.
1185 ****************************************************************************/
1186
1187 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1188 connection_struct *conn,
1189 struct smb_request *req,
1190 const char *oldname_in,
1191 const char *newname_in,
1192 uint32 attrs)
1193 {
1194 struct smb_filename *smb_fname_src = NULL;
1195 struct smb_filename *smb_fname_dst = NULL;
1196 char *oldname = NULL;
1197 char *newname = NULL;
1198 files_struct *fsp1,*fsp2;
1199 uint32 fattr;
1200 int info;
1201 SMB_OFF_T ret=-1;
1202 NTSTATUS status = NT_STATUS_OK;
1203 char *parent;
1204
1205 if (!CAN_WRITE(conn)) {
1206 status = NT_STATUS_MEDIA_WRITE_PROTECTED;
1207 goto out;
1208 }
1209
1210 status = unix_convert(ctx, conn, oldname_in, &smb_fname_src, 0);
1211 if (!NT_STATUS_IS_OK(status)) {
1212 goto out;
1213 }
1214
1215 status = check_name(conn, smb_fname_src->base_name);
1216 if (!NT_STATUS_IS_OK(status)) {
1217 goto out;
1218 }
1219
1220 /* Source must already exist. */
1221 if (!VALID_STAT(smb_fname_src->st)) {
1222 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1223 goto out;
1224 }
1225
1226 status = get_full_smb_filename(ctx, smb_fname_src, &oldname);
1227 if (!NT_STATUS_IS_OK(status)) {
1228 goto out;
1229 }
1230
1231 /* Ensure attributes match. */
1232 fattr = dos_mode(conn, oldname, &smb_fname_src->st);
1233 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1234 status = NT_STATUS_NO_SUCH_FILE;
1235 goto out;
1236 }
1237
1238 status = unix_convert(ctx, conn, newname_in, &smb_fname_dst, 0);
1239 if (!NT_STATUS_IS_OK(status)) {
1240 goto out;
1241 }
1242
1243 status = check_name(conn, smb_fname_dst->base_name);
1244 if (!NT_STATUS_IS_OK(status)) {
1245 goto out;
1246 }
1247
1248 /* Disallow if dst file already exists. */
1249 if (VALID_STAT(smb_fname_dst->st)) {
1250 status = NT_STATUS_OBJECT_NAME_COLLISION;
1251 goto out;
1252 }
1253
1254 /* No links from a directory. */
1255 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
1256 status = NT_STATUS_FILE_IS_A_DIRECTORY;
1257 goto out;
1258 }
1259
1260 /* Ensure this is within the share. */
1261 status = check_reduced_name(conn, smb_fname_src->base_name);
1262 if (!NT_STATUS_IS_OK(status)) {
1263 goto out;
1264 }
1265
1266 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1267 smb_fname_str_dbg(smb_fname_src),
1268 smb_fname_str_dbg(smb_fname_dst)));
1269
1270 status = SMB_VFS_CREATE_FILE(
1271 conn, /* conn */
1272 req, /* req */
1273 0, /* root_dir_fid */
1274 smb_fname_src, /* fname */
1275 FILE_READ_DATA, /* access_mask */
1276 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1277 FILE_SHARE_DELETE),
1278 FILE_OPEN, /* create_disposition*/
1279 0, /* create_options */
1280 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
1281 NO_OPLOCK, /* oplock_request */
1282 0, /* allocation_size */
1283 NULL, /* sd */
1284 NULL, /* ea_list */
1285 &fsp1, /* result */
1286 &info); /* pinfo */
1287
1288 if (!NT_STATUS_IS_OK(status)) {
1289 goto out;
1290 }
1291
1292 status = SMB_VFS_CREATE_FILE(
1293 conn, /* conn */
1294 req, /* req */
1295 0, /* root_dir_fid */
1296 smb_fname_dst, /* fname */
1297 FILE_WRITE_DATA, /* access_mask */
1298 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1299 FILE_SHARE_DELETE),
1300 FILE_CREATE, /* create_disposition*/
1301 0, /* create_options */
1302 fattr, /* file_attributes */
1303 NO_OPLOCK, /* oplock_request */
1304 0, /* allocation_size */
1305 NULL, /* sd */
1306 NULL, /* ea_list */
1307 &fsp2, /* result */
1308 &info); /* pinfo */
1309
1310 if (!NT_STATUS_IS_OK(status)) {
1311 close_file(NULL, fsp1, ERROR_CLOSE);
1312 goto out;
1313 }
1314
1315 if (smb_fname_src->st.st_ex_size) {
1316 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
1317 }
1318
1319 /*
1320 * As we are opening fsp1 read-only we only expect
1321 * an error on close on fsp2 if we are out of space.
1322 * Thus we don't look at the error return from the
1323 * close of fsp1.
1324 */
1325 close_file(NULL, fsp1, NORMAL_CLOSE);
1326
1327 /* Ensure the modtime is set correctly on the destination file. */
1328 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
1329
1330 status = close_file(NULL, fsp2, NORMAL_CLOSE);
1331
1332 status = get_full_smb_filename(ctx, smb_fname_dst, &newname);
1333 if (!NT_STATUS_IS_OK(status)) {
1334 goto out;
1335 }
1336
1337 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1338 creates the file. This isn't the correct thing to do in the copy
1339 case. JRA */
1340 if (!parent_dirname(talloc_tos(), newname, &parent, NULL)) {
1341 status = NT_STATUS_NO_MEMORY;
1342 goto out;
1343 }
1344 file_set_dosmode(conn, newname, fattr, &smb_fname_dst->st, parent,
1345 false);
1346 TALLOC_FREE(parent);
1347
1348 if (ret < (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
1349 status = NT_STATUS_DISK_FULL;
1350 goto out;
1351 }
1352 out:
1353 if (!NT_STATUS_IS_OK(status)) {
1354 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1355 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
1356 smb_fname_str_dbg(smb_fname_dst)));
1357 }
1358
1359 TALLOC_FREE(smb_fname_src);
1360 TALLOC_FREE(smb_fname_dst);
1361 TALLOC_FREE(oldname);
1362 TALLOC_FREE(newname);
1363
1364 return status;
1365 }
1366
1367 /****************************************************************************
1368 Reply to a NT rename request.
1369 ****************************************************************************/
1370
1371 void reply_ntrename(struct smb_request *req)
1372 {
1373 connection_struct *conn = req->conn;
1374 char *oldname = NULL;
1375 char *newname = NULL;
1376 const char *p;
1377 NTSTATUS status;
1378 bool src_has_wcard = False;
1379 bool dest_has_wcard = False;
1380 uint32 attrs;
1381 uint16 rename_type;
1382 TALLOC_CTX *ctx = talloc_tos();
1383
1384 START_PROFILE(SMBntrename);
1385
1386 if (req->wct < 4) {
1387 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1388 END_PROFILE(SMBntrename);
1389 return;
1390 }
1391
1392 attrs = SVAL(req->vwv+0, 0);
1393 rename_type = SVAL(req->vwv+1, 0);
1394
1395 p = (const char *)req->buf + 1;
1396 p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE,
1397 &status, &src_has_wcard);
1398 if (!NT_STATUS_IS_OK(status)) {
1399 reply_nterror(req, status);
1400 END_PROFILE(SMBntrename);
1401 return;
1402 }
1403
1404 if (ms_has_wild(oldname)) {
1405 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1406 END_PROFILE(SMBntrename);
1407 return;
1408 }
1409
1410 p++;
1411 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
1412 &status, &dest_has_wcard);
1413 if (!NT_STATUS_IS_OK(status)) {
1414 reply_nterror(req, status);
1415 END_PROFILE(SMBntrename);
1416 return;
1417 }
1418
1419 status = resolve_dfspath(ctx, conn,
1420 req->flags2 & FLAGS2_DFS_PATHNAMES,
1421 oldname,
1422 &oldname);
1423 if (!NT_STATUS_IS_OK(status)) {
1424 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1425 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1426 ERRSRV, ERRbadpath);
1427 END_PROFILE(SMBntrename);
1428 return;
1429 }
1430 reply_nterror(req, status);
1431 END_PROFILE(SMBntrename);
1432 return;
1433 }
1434
1435 status = resolve_dfspath(ctx, conn,
1436 req->flags2 & FLAGS2_DFS_PATHNAMES,
1437 newname,
1438 &newname);
1439 if (!NT_STATUS_IS_OK(status)) {
1440 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1441 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1442 ERRSRV, ERRbadpath);
1443 END_PROFILE(SMBntrename);
1444 return;
1445 }
1446 reply_nterror(req, status);
1447 END_PROFILE(SMBntrename);
1448 return;
1449 }
1450
1451 /* The new name must begin with a ':' if the old name is a stream. */
1452 if (is_ntfs_stream_name(oldname) && (newname[0] != ':')) {
1453 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1454 END_PROFILE(SMBntrename);
1455 return;
1456 }
1457
1458 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1459
1460 switch(rename_type) {
1461 case RENAME_FLAG_RENAME:
1462 status = rename_internals(ctx, conn, req, oldname,
1463 newname, attrs, False, src_has_wcard,
1464 dest_has_wcard, DELETE_ACCESS);
1465 break;
1466 case RENAME_FLAG_HARD_LINK:
1467 if (src_has_wcard || dest_has_wcard) {
1468 /* No wildcards. */
1469 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1470 } else {
1471 status = hardlink_internals(ctx,
1472 conn,
1473 oldname,
1474 newname);
1475 }
1476 break;
1477 case RENAME_FLAG_COPY:
1478 if (src_has_wcard || dest_has_wcard) {
1479 /* No wildcards. */
1480 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1481 } else {
1482 status = copy_internals(ctx, conn, req, oldname,
1483 newname, attrs);
1484 }
1485 break;
1486 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1487 status = NT_STATUS_INVALID_PARAMETER;
1488 break;
1489 default:
1490 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1491 break;
1492 }
1493
1494 if (!NT_STATUS_IS_OK(status)) {
1495 if (open_was_deferred(req->mid)) {
1496 /* We have re-scheduled this call. */
1497 END_PROFILE(SMBntrename);
1498 return;
1499 }
1500
1501 reply_nterror(req, status);
1502 END_PROFILE(SMBntrename);
1503 return;
1504 }
1505
1506 reply_outbuf(req, 0, 0);
1507
1508 END_PROFILE(SMBntrename);
1509 return;
1510 }
1511
1512 /****************************************************************************
1513 Reply to a notify change - queue the request and
1514 don't allow a directory to be opened.
1515 ****************************************************************************/
1516
1517 static void call_nt_transact_notify_change(connection_struct *conn,
1518 struct smb_request *req,
1519 uint16 **ppsetup,
1520 uint32 setup_count,
1521 char **ppparams,
1522 uint32 parameter_count,
1523 char **ppdata, uint32 data_count,
1524 uint32 max_data_count,
1525 uint32 max_param_count)
1526 {
1527 uint16 *setup = *ppsetup;
1528 files_struct *fsp;
1529 uint32 filter;
1530 NTSTATUS status;
1531 bool recursive;
1532
1533 if(setup_count < 6) {
1534 reply_doserror(req, ERRDOS, ERRbadfunc);
1535 return;
1536 }
1537
1538 fsp = file_fsp(req, SVAL(setup,4));
1539 filter = IVAL(setup, 0);
1540 recursive = (SVAL(setup, 6) != 0) ? True : False;
1541
1542 DEBUG(3,("call_nt_transact_notify_change\n"));
1543
1544 if(!fsp) {
1545 reply_doserror(req, ERRDOS, ERRbadfid);
1546 return;
1547 }
1548
1549 {
1550 char *filter_string;
1551
1552 if (!(filter_string = notify_filter_string(NULL, filter))) {
1553 reply_nterror(req,NT_STATUS_NO_MEMORY);
1554 return;
1555 }
1556
1557 DEBUG(3,("call_nt_transact_notify_change: notify change "
1558 "called on %s, filter = %s, recursive = %d\n",
1559 fsp->fsp_name, filter_string, recursive));
1560
1561 TALLOC_FREE(filter_string);
1562 }
1563
1564 if((!fsp->is_directory) || (conn != fsp->conn)) {
1565 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1566 return;
1567 }
1568
1569 if (fsp->notify == NULL) {
1570
1571 status = change_notify_create(fsp, filter, recursive);
1572
1573 if (!NT_STATUS_IS_OK(status)) {
1574 DEBUG(10, ("change_notify_create returned %s\n",
1575 nt_errstr(status)));
1576 reply_nterror(req, status);
1577 return;
1578 }
1579 }
1580
1581 if (fsp->notify->num_changes != 0) {
1582
1583 /*
1584 * We've got changes pending, respond immediately
1585 */
1586
1587 /*
1588 * TODO: write a torture test to check the filtering behaviour
1589 * here.
1590 */
1591
1592 change_notify_reply(fsp->conn, req, max_param_count,
1593 fsp->notify);
1594
1595 /*
1596 * change_notify_reply() above has independently sent its
1597 * results
1598 */
1599 return;
1600 }
1601
1602 /*
1603 * No changes pending, queue the request
1604 */
1605
1606 status = change_notify_add_request(req,
1607 max_param_count,
1608 filter,
1609 recursive, fsp);
1610 if (!NT_STATUS_IS_OK(status)) {
1611 reply_nterror(req, status);
1612 }
1613 return;
1614 }
1615
1616 /****************************************************************************
1617 Reply to an NT transact rename command.
1618 ****************************************************************************/
1619
1620 static void call_nt_transact_rename(connection_struct *conn,
1621 struct smb_request *req,
1622 uint16 **ppsetup, uint32 setup_count,
1623 char **ppparams, uint32 parameter_count,
1624 char **ppdata, uint32 data_count,
1625 uint32 max_data_count)
1626 {
1627 char *params = *ppparams;
1628 char *new_name = NULL;
1629 files_struct *fsp = NULL;
1630 bool dest_has_wcard = False;
1631 NTSTATUS status;
1632 TALLOC_CTX *ctx = talloc_tos();
1633
1634 if(parameter_count < 5) {
1635 reply_doserror(req, ERRDOS, ERRbadfunc);
1636 return;
1637 }
1638
1639 fsp = file_fsp(req, SVAL(params, 0));
1640 if (!check_fsp(conn, req, fsp)) {
1641 return;
1642 }
1643 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1644 parameter_count - 4,
1645 STR_TERMINATE, &status, &dest_has_wcard);
1646 if (!NT_STATUS_IS_OK(status)) {
1647 reply_nterror(req, status);
1648 return;
1649 }
1650
1651 /*
1652 * W2K3 ignores this request as the RAW-RENAME test
1653 * demonstrates, so we do.
1654 */
1655 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1656
1657 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1658 fsp->fsp_name, new_name));
1659
1660 return;
1661 }
1662
1663 /******************************************************************************
1664 Fake up a completely empty SD.
1665 *******************************************************************************/
1666
1667 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1668 {
1669 size_t sd_size;
1670
1671 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1672 if(!*ppsd) {
1673 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1674 return NT_STATUS_NO_MEMORY;
1675 }
1676
1677 return NT_STATUS_OK;
1678 }
1679
1680 /****************************************************************************
1681 Reply to query a security descriptor.
1682 ****************************************************************************/
1683
1684 static void call_nt_transact_query_security_desc(connection_struct *conn,
1685 struct smb_request *req,
1686 uint16 **ppsetup,
1687 uint32 setup_count,
1688 char **ppparams,
1689 uint32 parameter_count,
1690 char **ppdata,
1691 uint32 data_count,
1692 uint32 max_data_count)
1693 {
1694 char *params = *ppparams;
1695 char *data = *ppdata;
1696 SEC_DESC *psd = NULL;
1697 size_t sd_size;
1698 uint32 security_info_wanted;
1699 files_struct *fsp = NULL;
1700 NTSTATUS status;
1701 DATA_BLOB blob;
1702
1703 if(parameter_count < 8) {
1704 reply_doserror(req, ERRDOS, ERRbadfunc);
1705 return;
1706 }
1707
1708 fsp = file_fsp(req, SVAL(params,0));
1709 if(!fsp) {
1710 reply_doserror(req, ERRDOS, ERRbadfid);
1711 return;
1712 }
1713
1714 security_info_wanted = IVAL(params,4);
1715
1716 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1717 (unsigned int)security_info_wanted ));
1718
1719 params = nttrans_realloc(ppparams, 4);
1720 if(params == NULL) {
1721 reply_doserror(req, ERRDOS, ERRnomem);
1722 return;
1723 }
1724
1725 /*
1726 * Get the permissions to return.
1727 */
1728
1729 if (!lp_nt_acl_support(SNUM(conn))) {
1730 status = get_null_nt_acl(talloc_tos(), &psd);
1731 } else {
1732 status = SMB_VFS_FGET_NT_ACL(
1733 fsp, security_info_wanted, &psd);
1734 }
1735 if (!NT_STATUS_IS_OK(status)) {
1736 reply_nterror(req, status);
1737 return;
1738 }
1739
1740 /* If the SACL/DACL is NULL, but was requested, we mark that it is
1741 * present in the reply to match Windows behavior */
1742 if (psd->sacl == NULL &&
1743 security_info_wanted & SACL_SECURITY_INFORMATION)
1744 psd->type |= SEC_DESC_SACL_PRESENT;
1745 if (psd->dacl == NULL &&
1746 security_info_wanted & DACL_SECURITY_INFORMATION)
1747 psd->type |= SEC_DESC_DACL_PRESENT;
1748
1749 sd_size = ndr_size_security_descriptor(psd, NULL, 0);
1750
1751 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1752
1753 if (DEBUGLEVEL >= 10) {
1754 DEBUG(10,("call_nt_transact_query_security_desc for file %s\n", fsp->fsp_name));
1755 NDR_PRINT_DEBUG(security_descriptor, psd);
1756 }
1757
1758 SIVAL(params,0,(uint32)sd_size);
1759
1760 if (max_data_count < sd_size) {
1761 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1762 params, 4, *ppdata, 0);
1763 return;
1764 }
1765
1766 /*
1767 * Allocate the data we will point this at.
1768 */
1769
1770 data = nttrans_realloc(ppdata, sd_size);
1771 if(data == NULL) {
1772 reply_doserror(req, ERRDOS, ERRnomem);
1773 return;
1774 }
1775
1776 status = marshall_sec_desc(talloc_tos(), psd,
1777 &blob.data, &blob.length);
1778
1779 if (!NT_STATUS_IS_OK(status)) {
1780 reply_nterror(req, status);
1781 return;
1782 }
1783
1784 SMB_ASSERT(sd_size == blob.length);
1785 memcpy(data, blob.data, sd_size);
1786
1787 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1788
1789 return;
1790 }
1791
1792 /****************************************************************************
1793 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1794 ****************************************************************************/
1795
1796 static void call_nt_transact_set_security_desc(connection_struct *conn,
1797 struct smb_request *req,
1798 uint16 **ppsetup,
1799 uint32 setup_count,
1800 char **ppparams,
1801 uint32 parameter_count,
1802 char **ppdata,
1803 uint32 data_count,
1804 uint32 max_data_count)
1805 {
1806 char *params= *ppparams;
1807 char *data = *ppdata;
1808 files_struct *fsp = NULL;
1809 uint32 security_info_sent = 0;
1810 NTSTATUS status;
1811
1812 if(parameter_count < 8) {
1813 reply_doserror(req, ERRDOS, ERRbadfunc);
1814 return;
1815 }
1816
1817 if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
1818 reply_doserror(req, ERRDOS, ERRbadfid);
1819 return;
1820 }
1821
1822 if(!lp_nt_acl_support(SNUM(conn))) {
1823 goto done;
1824 }
1825
1826 security_info_sent = IVAL(params,4);
1827
1828 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1829 (unsigned int)security_info_sent ));
1830
1831 if (data_count == 0) {
1832 reply_doserror(req, ERRDOS, ERRnoaccess);
1833 return;
1834 }
1835
1836 status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1837
1838 if (!NT_STATUS_IS_OK(status)) {
1839 reply_nterror(req, status);
1840 return;
1841 }
1842
1843 done:
1844 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1845 return;
1846 }
1847
1848 /****************************************************************************
1849 Reply to NT IOCTL
1850 ****************************************************************************/
1851
1852 static void call_nt_transact_ioctl(connection_struct *conn,
1853 struct smb_request *req,
1854 uint16 **ppsetup, uint32 setup_count,
1855 char **ppparams, uint32 parameter_count,
1856 char **ppdata, uint32 data_count,
1857 uint32 max_data_count)
1858 {
1859 uint32 function;
1860 uint16 fidnum;
1861 files_struct *fsp;
1862 uint8 isFSctl;
1863 uint8 compfilter;
1864 char *pdata = *ppdata;
1865
1866 if (setup_count != 8) {
1867 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1868 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1869 return;
1870 }
1871
1872 function = IVAL(*ppsetup, 0);
1873 fidnum = SVAL(*ppsetup, 4);
1874 isFSctl = CVAL(*ppsetup, 6);
1875 compfilter = CVAL(*ppsetup, 7);
1876
1877 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1878 function, fidnum, isFSctl, compfilter));
1879
1880 fsp=file_fsp(req, fidnum);
1881 /* this check is done in each implemented function case for now
1882 because I don't want to break anything... --metze
1883 FSP_BELONGS_CONN(fsp,conn);*/
1884
1885 SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
1886
1887 switch (function) {
1888 case FSCTL_SET_SPARSE:
1889 /* pretend this succeeded - tho strictly we should
1890 mark the file sparse (if the local fs supports it)
1891 so we can know if we need to pre-allocate or not */
1892
1893 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1894 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1895 return;
1896
1897 case FSCTL_CREATE_OR_GET_OBJECT_ID:
1898 {
1899 unsigned char objid[16];
1900
1901 /* This should return the object-id on this file.
1902 * I think I'll make this be the inode+dev. JRA.
1903 */
1904
1905 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1906
1907 if (!fsp_belongs_conn(conn, req, fsp)) {
1908 return;
1909 }
1910
1911 data_count = 64;
1912 pdata = nttrans_realloc(ppdata, data_count);
1913 if (pdata == NULL) {
1914 reply_nterror(req, NT_STATUS_NO_MEMORY);
1915 return;
1916 }
1917
1918 /* For backwards compatibility only store the dev/inode. */
1919 push_file_id_16(pdata, &fsp->file_id);
1920 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1921 push_file_id_16(pdata+32, &fsp->file_id);
1922 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1923 pdata, data_count);
1924 return;
1925 }
1926
1927 case FSCTL_GET_REPARSE_POINT:
1928 /* pretend this fail - my winXP does it like this
1929 * --metze
1930 */
1931
1932 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1933 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1934 return;
1935
1936 case FSCTL_SET_REPARSE_POINT:
1937 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1938 * --metze
1939 */
1940
1941 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1942 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1943 return;
1944
1945 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1946 {
1947 /*
1948 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1949 * and return their volume names. If max_data_count is 16, then it is just
1950 * asking for the number of volumes and length of the combined names.
1951 *
1952 * pdata is the data allocated by our caller, but that uses
1953 * total_data_count (which is 0 in our case) rather than max_data_count.
1954 * Allocate the correct amount and return the pointer to let
1955 * it be deallocated when we return.
1956 */
1957 SHADOW_COPY_DATA *shadow_data = NULL;
1958 TALLOC_CTX *shadow_mem_ctx = NULL;
1959 bool labels = False;
1960 uint32 labels_data_count = 0;
1961 uint32 i;
1962 char *cur_pdata;
1963
1964 if (!fsp_belongs_conn(conn, req, fsp)) {
1965 return;
1966 }
1967
1968 if (max_data_count < 16) {
1969 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1970 max_data_count));
1971 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1972 return;
1973 }
1974
1975 if (max_data_count > 16) {
1976 labels = True;
1977 }
1978
1979 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1980 if (shadow_mem_ctx == NULL) {
1981 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1982 reply_nterror(req, NT_STATUS_NO_MEMORY);
1983 return;
1984 }
1985
1986 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1987 if (shadow_data == NULL) {
1988 DEBUG(0,("TALLOC_ZERO() failed!\n"));
1989 talloc_destroy(shadow_mem_ctx);
1990 reply_nterror(req, NT_STATUS_NO_MEMORY);
1991 return;
1992 }
1993
1994 shadow_data->mem_ctx = shadow_mem_ctx;
1995
1996 /*
1997 * Call the VFS routine to actually do the work.
1998 */
1999 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2000 talloc_destroy(shadow_data->mem_ctx);
2001 if (errno == ENOSYS) {
2002 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2003 conn->connectpath));
2004 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2005 return;
2006 } else {
2007 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2008 conn->connectpath));
2009 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
2010 return;
2011 }
2012 }
2013
2014 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2015
2016 if (!labels) {
2017 data_count = 16;
2018 } else {
2019 data_count = 12+labels_data_count+4;
2020 }
2021
2022 if (max_data_count<data_count) {
2023 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2024 max_data_count,data_count));
2025 talloc_destroy(shadow_data->mem_ctx);
2026 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2027 return;
2028 }
2029
2030 pdata = nttrans_realloc(ppdata, data_count);
2031 if (pdata == NULL) {
2032 talloc_destroy(shadow_data->mem_ctx);
2033 reply_nterror(req, NT_STATUS_NO_MEMORY);
2034 return;
2035 }
2036
2037 cur_pdata = pdata;
2038
2039 /* num_volumes 4 bytes */
2040 SIVAL(pdata,0,shadow_data->num_volumes);
2041
2042 if (labels) {
2043 /* num_labels 4 bytes */
2044 SIVAL(pdata,4,shadow_data->num_volumes);
2045 }
2046
2047 /* needed_data_count 4 bytes */
2048 SIVAL(pdata,8,labels_data_count);
2049
2050 cur_pdata+=12;
2051
2052 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2053 shadow_data->num_volumes,fsp->fsp_name));
2054 if (labels && shadow_data->labels) {
2055 for (i=0;i<shadow_data->num_volumes;i++) {
2056 srvstr_push(pdata, req->flags2,
2057 cur_pdata, shadow_data->labels[i],
2058 2*sizeof(SHADOW_COPY_LABEL),
2059 STR_UNICODE|STR_TERMINATE);
2060 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2061 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2062 }
2063 }
2064
2065 talloc_destroy(shadow_data->mem_ctx);
2066
2067 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2068 pdata, data_count);
2069
2070 return;
2071 }
2072
2073 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2074 {
2075 /* pretend this succeeded -
2076 *
2077 * we have to send back a list with all files owned by this SID
2078 *
2079 * but I have to check that --metze
2080 */
2081 DOM_SID sid;
2082 uid_t uid;
2083 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2084
2085 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2086
2087 if (!fsp_belongs_conn(conn, req, fsp)) {
2088 return;
2089 }
2090
2091 /* unknown 4 bytes: this is not the length of the sid :-( */
2092 /*unknown = IVAL(pdata,0);*/
2093
2094 sid_parse(pdata+4,sid_len,&sid);
2095 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
2096
2097 if (!sid_to_uid(&sid, &uid)) {
2098 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2099 sid_string_dbg(&sid),
2100 (unsigned long)sid_len));
2101 uid = (-1);
2102 }
2103
2104 /* we can take a look at the find source :-)
2105 *
2106 * find ./ -uid $uid -name '*' is what we need here
2107 *
2108 *
2109 * and send 4bytes len and then NULL terminated unicode strings
2110 * for each file
2111 *
2112 * but I don't know how to deal with the paged results
2113 * (maybe we can hang the result anywhere in the fsp struct)
2114 *
2115 * we don't send all files at once
2116 * and at the next we should *not* start from the beginning,
2117 * so we have to cache the result
2118 *
2119 * --metze
2120 */
2121
2122 /* this works for now... */
2123 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2124 return;
2125 }
2126 default:
2127 if (!logged_ioctl_message) {
2128 logged_ioctl_message = true; /* Only print this once... */
2129 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2130 function));
2131 }
2132 }
2133
2134 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2135 }
2136
2137
2138 #ifdef HAVE_SYS_QUOTAS
2139 /****************************************************************************
2140 Reply to get user quota
2141 ****************************************************************************/
2142
2143 static void call_nt_transact_get_user_quota(connection_struct *conn,
2144 struct smb_request *req,
2145 uint16 **ppsetup,
2146 uint32 setup_count,
2147 char **ppparams,
2148 uint32 parameter_count,
2149 char **ppdata,
2150 uint32 data_count,
2151 uint32 max_data_count)
2152 {
2153 NTSTATUS nt_status = NT_STATUS_OK;
2154 char *params = *ppparams;
2155 char *pdata = *ppdata;
2156 char *entry;
2157 int data_len=0,param_len=0;
2158 int qt_len=0;
2159 int entry_len = 0;
2160 files_struct *fsp = NULL;
2161 uint16 level = 0;
2162 size_t sid_len;
2163 DOM_SID sid;
2164 bool start_enum = True;
2165 SMB_NTQUOTA_STRUCT qt;
2166 SMB_NTQUOTA_LIST *tmp_list;
2167 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2168
2169 ZERO_STRUCT(qt);
2170
2171 /* access check */
2172 if (conn->server_info->utok.uid != 0) {
2173 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2174 "[%s]\n", lp_servicename(SNUM(conn)),
2175 conn->server_info->unix_name));
2176 reply_doserror(req, ERRDOS, ERRnoaccess);
2177 return;
2178 }
2179
2180 /*
2181 * Ensure minimum number of parameters sent.
2182 */
2183
2184 if (parameter_count < 4) {
2185 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2186 reply_doserror(req, ERRDOS, ERRinvalidparam);
2187 return;
2188 }
2189
2190 /* maybe we can check the quota_fnum */
2191 fsp = file_fsp(req, SVAL(params,0));
2192 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2193 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2194 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2195 return;
2196 }
2197
2198 /* the NULL pointer checking for fsp->fake_file_handle->pd
2199 * is done by CHECK_NTQUOTA_HANDLE_OK()
2200 */
2201 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2202
2203 level = SVAL(params,2);
2204
2205 /* unknown 12 bytes leading in params */
2206
2207 switch (level) {
2208 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2209 /* seems that we should continue with the enum here --metze */
2210
2211 if (qt_handle->quota_list!=NULL &&
2212 qt_handle->tmp_list==NULL) {
2213
2214 /* free the list */
2215 free_ntquota_list(&(qt_handle->quota_list));
2216
2217 /* Realloc the size of parameters and data we will return */
2218 param_len = 4;
2219 params = nttrans_realloc(ppparams, param_len);
2220 if(params == NULL) {
2221 reply_doserror(req, ERRDOS, ERRnomem);
2222 return;
2223 }
2224
2225 data_len = 0;
2226 SIVAL(params,0,data_len);
2227
2228 break;
2229 }
2230
2231 start_enum = False;
2232
2233 case TRANSACT_GET_USER_QUOTA_LIST_START:
2234
2235 if (qt_handle->quota_list==NULL &&
2236 qt_handle->tmp_list==NULL) {
2237 start_enum = True;
2238 }
2239
2240 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2241 reply_doserror(req, ERRSRV, ERRerror);
2242 return;
2243 }
2244
2245 /* Realloc the size of parameters and data we will return */
2246 param_len = 4;
2247 params = nttrans_realloc(ppparams, param_len);
2248 if(params == NULL) {
2249 reply_doserror(req, ERRDOS, ERRnomem);
2250 return;
2251 }
2252
2253 /* we should not trust the value in max_data_count*/
2254 max_data_count = MIN(max_data_count,2048);
2255
2256 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2257 if(pdata == NULL) {
2258 reply_doserror(req, ERRDOS, ERRnomem);
2259 return;
2260 }
2261
2262 entry = pdata;
2263
2264 /* set params Size of returned Quota Data 4 bytes*/
2265 /* but set it later when we know it */
2266
2267 /* for each entry push the data */
2268
2269 if (start_enum) {
2270 qt_handle->tmp_list = qt_handle->quota_list;
2271 }
2272
2273 tmp_list = qt_handle->tmp_list;
2274
2275 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2276 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2277
2278 sid_len = ndr_size_dom_sid(
2279 &tmp_list->quotas->sid, NULL, 0);
2280 entry_len = 40 + sid_len;
2281
2282 /* nextoffset entry 4 bytes */
2283 SIVAL(entry,0,entry_len);
2284
2285 /* then the len of the SID 4 bytes */
2286 SIVAL(entry,4,sid_len);
2287
2288 /* unknown data 8 bytes uint64_t */
2289 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/
2290
2291 /* the used disk space 8 bytes uint64_t */
2292 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2293
2294 /* the soft quotas 8 bytes uint64_t */
2295 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2296
2297 /* the hard quotas 8 bytes uint64_t */
2298 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2299
2300 /* and now the SID */
2301 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2302 }
2303
2304 qt_handle->tmp_list = tmp_list;
2305
2306 /* overwrite the offset of the last entry */
2307 SIVAL(entry-entry_len,0,0);
2308
2309 data_len = 4+qt_len;
2310 /* overwrite the params quota_data_len */
2311 SIVAL(params,0,data_len);
2312
2313 break;
2314
2315 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2316
2317 /* unknown 4 bytes IVAL(pdata,0) */
2318
2319 if (data_count < 8) {
2320 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2321 reply_doserror(req, ERRDOS, ERRunknownlevel);
2322 return;
2323 }
2324
2325 sid_len = IVAL(pdata,4);
2326 /* Ensure this is less than 1mb. */
2327 if (sid_len > (1024*1024)) {
2328 reply_doserror(req, ERRDOS, ERRnomem);
2329 return;
2330 }
2331
2332 if (data_count < 8+sid_len) {
2333 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2334 reply_doserror(req, ERRDOS, ERRunknownlevel);
2335 return;
2336 }
2337
2338 data_len = 4+40+sid_len;
2339
2340 if (max_data_count < data_len) {
2341 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2342 max_data_count, data_len));
2343 param_len = 4;
2344 SIVAL(params,0,data_len);
2345 data_len = 0;
2346 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2347 break;
2348 }
2349
2350 sid_parse(pdata+8,sid_len,&sid);
2351
2352 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2353 ZERO_STRUCT(qt);
2354 /*
2355 * we have to return zero's in all fields
2356 * instead of returning an error here
2357 * --metze
2358 */
2359 }
2360
2361 /* Realloc the size of parameters and data we will return */
2362 param_len = 4;
2363 params = nttrans_realloc(ppparams, param_len);
2364 if(params == NULL) {
2365 reply_doserror(req, ERRDOS, ERRnomem);
2366 return;
2367 }
2368
2369 pdata = nttrans_realloc(ppdata, data_len);
2370 if(pdata == NULL) {
2371 reply_doserror(req, ERRDOS, ERRnomem);
2372 return;
2373 }
2374
2375 entry = pdata;
2376
2377 /* set params Size of returned Quota Data 4 bytes*/
2378 SIVAL(params,0,data_len);
2379
2380 /* nextoffset entry 4 bytes */
2381 SIVAL(entry,0,0);
2382
2383 /* then the len of the SID 4 bytes */
2384 SIVAL(entry,4,sid_len);
2385
2386 /* unknown data 8 bytes uint64_t */
2387 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/
2388
2389 /* the used disk space 8 bytes uint64_t */
2390 SBIG_UINT(entry,16,qt.usedspace);
2391
2392 /* the soft quotas 8 bytes uint64_t */
2393 SBIG_UINT(entry,24,qt.softlim);
2394
2395 /* the hard quotas 8 bytes uint64_t */
2396 SBIG_UINT(entry,32,qt.hardlim);
2397
2398 /* and now the SID */
2399 sid_linearize(entry+40, sid_len, &sid);
2400
2401 break;
2402
2403 default:
2404 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2405 reply_doserror(req, ERRSRV, ERRerror);
2406 return;
2407 break;
2408 }
2409
2410 send_nt_replies(conn, req, nt_status, params, param_len,
2411 pdata, data_len);
2412 }
2413
2414 /****************************************************************************
2415 Reply to set user quota
2416 ****************************************************************************/
2417
2418 static void call_nt_transact_set_user_quota(connection_struct *conn,
2419 struct smb_request *req,
2420 uint16 **ppsetup,
2421 uint32 setup_count,
2422 char **ppparams,
2423 uint32 parameter_count,
2424 char **ppdata,
2425 uint32 data_count,
2426 uint32 max_data_count)
2427 {
2428 char *params = *ppparams;
2429 char *pdata = *ppdata;
2430 int data_len=0,param_len=0;
2431 SMB_NTQUOTA_STRUCT qt;
2432 size_t sid_len;
2433 DOM_SID sid;
2434 files_struct *fsp = NULL;
2435
2436 ZERO_STRUCT(qt);
2437
2438 /* access check */
2439 if (conn->server_info->utok.uid != 0) {
2440 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2441 "[%s]\n", lp_servicename(SNUM(conn)),
2442 conn->server_info->unix_name));
2443 reply_doserror(req, ERRDOS, ERRnoaccess);
2444 return;
2445 }
2446
2447 /*
2448 * Ensure minimum number of parameters sent.
2449 */
2450
2451 if (parameter_count < 2) {
2452 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2453 reply_doserror(req, ERRDOS, ERRinvalidparam);
2454 return;
2455 }
2456
2457 /* maybe we can check the quota_fnum */
2458 fsp = file_fsp(req, SVAL(params,0));
2459 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2460 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2461 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2462 return;
2463 }
2464
2465 if (data_count < 40) {
2466 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2467 reply_doserror(req, ERRDOS, ERRunknownlevel);
2468 return;
2469 }
2470
2471 /* offset to next quota record.
2472 * 4 bytes IVAL(pdata,0)
2473 * unused here...
2474 */
2475
2476 /* sid len */
2477 sid_len = IVAL(pdata,4);
2478
2479 if (data_count < 40+sid_len) {
2480 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2481 reply_doserror(req, ERRDOS, ERRunknownlevel);
2482 return;
2483 }
2484
2485 /* unknown 8 bytes in pdata
2486 * maybe its the change time in NTTIME
2487 */
2488
2489 /* the used space 8 bytes (uint64_t)*/
2490 qt.usedspace = (uint64_t)IVAL(pdata,16);
2491 #ifdef LARGE_SMB_OFF_T
2492 qt.usedspace |= (((uint64_t)IVAL(pdata,20)) << 32);
2493 #else /* LARGE_SMB_OFF_T */
2494 if ((IVAL(pdata,20) != 0)&&
2495 ((qt.usedspace != 0xFFFFFFFF)||
2496 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2497 /* more than 32 bits? */
2498 reply_doserror(req, ERRDOS, ERRunknownlevel);
2499 return;
2500 }
2501 #endif /* LARGE_SMB_OFF_T */
2502
2503 /* the soft quotas 8 bytes (uint64_t)*/
2504 qt.softlim = (uint64_t)IVAL(pdata,24);
2505 #ifdef LARGE_SMB_OFF_T
2506 qt.softlim |= (((uint64_t)IVAL(pdata,28)) << 32);
2507 #else /* LARGE_SMB_OFF_T */
2508 if ((IVAL(pdata,28) != 0)&&
2509 ((qt.softlim != 0xFFFFFFFF)||
2510 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2511 /* more than 32 bits? */
2512 reply_doserror(req, ERRDOS, ERRunknownlevel);
2513 return;
2514 }
2515 #endif /* LARGE_SMB_OFF_T */
2516
2517 /* the hard quotas 8 bytes (uint64_t)*/
2518 qt.hardlim = (uint64_t)IVAL(pdata,32);
2519 #ifdef LARGE_SMB_OFF_T
2520 qt.hardlim |= (((uint64_t)IVAL(pdata,36)) << 32);
2521 #else /* LARGE_SMB_OFF_T */
2522 if ((IVAL(pdata,36) != 0)&&
2523 ((qt.hardlim != 0xFFFFFFFF)||
2524 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2525 /* more than 32 bits? */
2526 reply_doserror(req, ERRDOS, ERRunknownlevel);
2527 return;
2528 }
2529 #endif /* LARGE_SMB_OFF_T */
2530
2531 sid_parse(pdata+40,sid_len,&sid);
2532 DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2533
2534 /* 44 unknown bytes left... */
2535
2536 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2537 reply_doserror(req, ERRSRV, ERRerror);
2538 return;
2539 }
2540
2541 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2542 pdata, data_len);
2543 }
2544 #endif /* HAVE_SYS_QUOTAS */
2545
2546 static void handle_nttrans(connection_struct *conn,
2547 struct trans_state *state,
2548 struct smb_request *req)
2549 {
2550 if (Protocol >= PROTOCOL_NT1) {
2551 req->flags2 |= 0x40; /* IS_LONG_NAME */
2552 SSVAL(req->inbuf,smb_flg2,req->flags2);
2553 }
2554
2555
2556 SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2557
2558 /* Now we must call the relevant NT_TRANS function */
2559 switch(state->call) {
2560 case NT_TRANSACT_CREATE:
2561 {
2562 START_PROFILE(NT_transact_create);
2563 call_nt_transact_create(
2564 conn, req,
2565 &state->setup, state->setup_count,
2566 &state->param, state->total_param,
2567 &state->data, state->total_data,
2568 state->max_data_return);
2569 END_PROFILE(NT_transact_create);
2570 break;
2571 }
2572
2573 case NT_TRANSACT_IOCTL:
2574 {
2575 START_PROFILE(NT_transact_ioctl);
2576 call_nt_transact_ioctl(
2577 conn, req,
2578 &state->setup, state->setup_count,
2579 &state->param, state->total_param,
2580 &state->data, state->total_data,
2581 state->max_data_return);
2582 END_PROFILE(NT_transact_ioctl);
2583 break;
2584 }
2585
2586 case NT_TRANSACT_SET_SECURITY_DESC:
2587 {
2588 START_PROFILE(NT_transact_set_security_desc);
2589 call_nt_transact_set_security_desc(
2590 conn, req,
2591 &state->setup, state->setup_count,
2592 &state->param, state->total_param,
2593 &state->data, state->total_data,
2594 state->max_data_return);
2595 END_PROFILE(NT_transact_set_security_desc);
2596 break;
2597 }
2598
2599 case NT_TRANSACT_NOTIFY_CHANGE:
2600 {
2601 START_PROFILE(NT_transact_notify_change);
2602 call_nt_transact_notify_change(
2603 conn, req,
2604 &state->setup, state->setup_count,
2605 &state->param, state->total_param,
2606 &state->data, state->total_data,
2607 state->max_data_return,
2608 state->max_param_return);
2609 END_PROFILE(NT_transact_notify_change);
2610 break;
2611 }
2612
2613 case NT_TRANSACT_RENAME:
2614 {
2615 START_PROFILE(NT_transact_rename);
2616 call_nt_transact_rename(
2617 conn, req,
2618 &state->setup, state->setup_count,
2619 &state->param, state->total_param,
2620 &state->data, state->total_data,
2621 state->max_data_return);
2622 END_PROFILE(NT_transact_rename);
2623 break;
2624 }
2625
2626 case NT_TRANSACT_QUERY_SECURITY_DESC:
2627 {
2628 START_PROFILE(NT_transact_query_security_desc);
2629 call_nt_transact_query_security_desc(
2630 conn, req,
2631 &state->setup, state->setup_count,
2632 &state->param, state->total_param,
2633 &state->data, state->total_data,
2634 state->max_data_return);
2635 END_PROFILE(NT_transact_query_security_desc);
2636 break;
2637 }
2638
2639 #ifdef HAVE_SYS_QUOTAS
2640 case NT_TRANSACT_GET_USER_QUOTA:
2641 {
2642 START_PROFILE(NT_transact_get_user_quota);
2643 call_nt_transact_get_user_quota(
2644 conn, req,
2645 &state->setup, state->setup_count,
2646 &state->param, state->total_param,
2647 &state->data, state->total_data,
2648 state->max_data_return);
2649 END_PROFILE(NT_transact_get_user_quota);
2650 break;
2651 }
2652
2653 case NT_TRANSACT_SET_USER_QUOTA:
2654 {
2655 START_PROFILE(NT_transact_set_user_quota);
2656 call_nt_transact_set_user_quota(
2657 conn, req,
2658 &state->setup, state->setup_count,
2659 &state->param, state->total_param,
2660 &state->data, state->total_data,
2661 state->max_data_return);
2662 END_PROFILE(NT_transact_set_user_quota);
2663 break;
2664 }
2665 #endif /* HAVE_SYS_QUOTAS */
2666
2667 default:
2668 /* Error in request */
2669 DEBUG(0,("handle_nttrans: Unknown request %d in "
2670 "nttrans call\n", state->call));
2671 reply_doserror(req, ERRSRV, ERRerror);
2672 return;
2673 }
2674 return;
2675 }
2676
2677 /****************************************************************************
2678 Reply to a SMBNTtrans.
2679 ****************************************************************************/
2680
2681 void reply_nttrans(struct smb_request *req)
2682 {
2683 connection_struct *conn = req->conn;
2684 uint32_t pscnt;
2685 uint32_t psoff;
2686 uint32_t dscnt;
2687 uint32_t dsoff;
2688 uint16 function_code;
2689 NTSTATUS result;
2690 struct trans_state *state;
2691
2692 START_PROFILE(SMBnttrans);
2693
2694 if (req->wct < 19) {
2695 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2696 END_PROFILE(SMBnttrans);
2697 return;
2698 }
2699
2700 pscnt = IVAL(req->vwv+9, 1);
2701 psoff = IVAL(req->vwv+11, 1);
2702 dscnt = IVAL(req->vwv+13, 1);
2703 dsoff = IVAL(req->vwv+15, 1);
2704 function_code = SVAL(req->vwv+18, 0);
2705
2706 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2707 reply_doserror(req, ERRSRV, ERRaccess);
2708 END_PROFILE(SMBnttrans);
2709 return;
2710 }
2711
2712 result = allow_new_trans(conn->pending_trans, req->mid);
2713 if (!NT_STATUS_IS_OK(result)) {
2714 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2715 reply_nterror(req, result);
2716 END_PROFILE(SMBnttrans);
2717 return;
2718 }
2719
2720 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2721 reply_doserror(req, ERRSRV, ERRaccess);
2722 END_PROFILE(SMBnttrans);
2723 return;
2724 }
2725
2726 state->cmd = SMBnttrans;
2727
2728 state->mid = req->mid;
2729 state->vuid = req->vuid;
2730 state->total_data = IVAL(req->vwv+3, 1);
2731 state->data = NULL;
2732 state->total_param = IVAL(req->vwv+1, 1);
2733 state->param = NULL;
2734 state->max_data_return = IVAL(req->vwv+7, 1);
2735 state->max_param_return = IVAL(req->vwv+5, 1);
2736
2737 /* setup count is in *words* */
2738 state->setup_count = 2*CVAL(req->vwv+17, 1);
2739 state->setup = NULL;
2740 state->call = function_code;
2741
2742 DEBUG(10, ("num_setup=%u, "
2743 "param_total=%u, this_param=%u, max_param=%u, "
2744 "data_total=%u, this_data=%u, max_data=%u, "
2745 "param_offset=%u, data_offset=%u\n",
2746 (unsigned)state->setup_count,
2747 (unsigned)state->total_param, (unsigned)pscnt,
2748 (unsigned)state->max_param_return,
2749 (unsigned)state->total_data, (unsigned)dscnt,
2750 (unsigned)state->max_data_return,
2751 (unsigned)psoff, (unsigned)dsoff));
2752
2753 /*
2754 * All nttrans messages we handle have smb_wct == 19 +
2755 * state->setup_count. Ensure this is so as a sanity check.
2756 */
2757
2758 if(req->wct != 19 + (state->setup_count/2)) {
2759 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2760 req->wct, 19 + (state->setup_count/2)));
2761 goto bad_param;
2762 }
2763
2764 /* Don't allow more than 128mb for each value. */
2765 if ((state->total_data > (1024*1024*128)) ||
2766 (state->total_param > (1024*1024*128))) {
2767 reply_doserror(req, ERRDOS, ERRnomem);
2768 END_PROFILE(SMBnttrans);
2769 return;
2770 }
2771
2772 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2773 goto bad_param;
2774
2775 if (state->total_data) {
2776
2777 if (trans_oob(state->total_data, 0, dscnt)
2778 || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
2779 goto bad_param;
2780 }
2781
2782 /* Can't use talloc here, the core routines do realloc on the
2783 * params and data. */
2784 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2785 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2786 "bytes !\n", (unsigned int)state->total_data));
2787 TALLOC_FREE(state);
2788 reply_doserror(req, ERRDOS, ERRnomem);
2789 END_PROFILE(SMBnttrans);
2790 return;
2791 }
2792
2793 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2794 }
2795
2796 if (state->total_param) {
2797
2798 if (trans_oob(state->total_param, 0, pscnt)
2799 || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
2800 goto bad_param;
2801 }
2802
2803 /* Can't use talloc here, the core routines do realloc on the
2804 * params and data. */
2805 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2806 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2807 "bytes !\n", (unsigned int)state->total_param));
2808 SAFE_FREE(state->data);
2809 TALLOC_FREE(state);
2810 reply_doserror(req, ERRDOS, ERRnomem);
2811 END_PROFILE(SMBnttrans);
2812 return;
2813 }
2814
2815 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2816 }
2817
2818 state->received_data = dscnt;
2819 state->received_param = pscnt;
2820
2821 if(state->setup_count > 0) {
2822 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2823 state->setup_count));
2824
2825 /*
2826 * No overflow possible here, state->setup_count is an
2827 * unsigned int, being filled by a single byte from
2828 * CVAL(req->vwv+13, 0) above. The cast in the comparison
2829 * below is not necessary, it's here to clarify things. The
2830 * validity of req->vwv and req->wct has been checked in
2831 * init_smb_request already.
2832 */
2833 if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
2834 goto bad_param;
2835 }
2836
2837 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2838 if (state->setup == NULL) {
2839 DEBUG(0,("reply_nttrans : Out of memory\n"));
2840 SAFE_FREE(state->data);
2841 SAFE_FREE(state->param);
2842 TALLOC_FREE(state);
2843 reply_doserror(req, ERRDOS, ERRnomem);
2844 END_PROFILE(SMBnttrans);
2845 return;
2846 }
2847
2848 memcpy(state->setup, req->vwv+19, state->setup_count);
2849 dump_data(10, (uint8 *)state->setup, state->setup_count);
2850 }
2851
2852 if ((state->received_data == state->total_data) &&
2853 (state->received_param == state->total_param)) {
2854 handle_nttrans(conn, state, req);
2855 SAFE_FREE(state->param);
2856 SAFE_FREE(state->data);
2857 TALLOC_FREE(state);
2858 END_PROFILE(SMBnttrans);
2859 return;
2860 }
2861
2862 DLIST_ADD(conn->pending_trans, state);
2863
2864 /* We need to send an interim response then receive the rest
2865 of the parameter/data bytes */
2866 reply_outbuf(req, 0, 0);
2867 show_msg((char *)req->outbuf);
2868 END_PROFILE(SMBnttrans);
2869 return;
2870
2871 bad_param:
2872
2873 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2874 SAFE_FREE(state->data);
2875 SAFE_FREE(state->param);
2876 TALLOC_FREE(state);
2877 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2878 END_PROFILE(SMBnttrans);
2879 return;
2880 }
2881
2882 /****************************************************************************
2883 Reply to a SMBnttranss
2884 ****************************************************************************/
2885
2886 void reply_nttranss(struct smb_request *req)
2887 {
2888 connection_struct *conn = req->conn;
2889 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2890 struct trans_state *state;
2891
2892 START_PROFILE(SMBnttranss);
2893
2894 show_msg((char *)req->inbuf);
2895
2896 if (req->wct < 18) {
2897 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2898 END_PROFILE(SMBnttranss);
2899 return;
2900 }
2901
2902 for (state = conn->pending_trans; state != NULL;
2903 state = state->next) {
2904 if (state->mid == req->mid) {
2905 break;
2906 }
2907 }
2908
2909 if ((state == NULL) || (state->cmd != SMBnttrans)) {
2910 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2911 END_PROFILE(SMBnttranss);
2912 return;
2913 }
2914
2915 /* Revise state->total_param and state->total_data in case they have
2916 changed downwards */
2917 if (IVAL(req->vwv+1, 1) < state->total_param) {
2918 state->total_param = IVAL(req->vwv+1, 1);
2919 }
2920 if (IVAL(req->vwv+3, 1) < state->total_data) {
2921 state->total_data = IVAL(req->vwv+3, 1);
2922 }
2923
2924 pcnt = IVAL(req->vwv+5, 1);
2925 poff = IVAL(req->vwv+7, 1);
2926 pdisp = IVAL(req->vwv+9, 1);
2927
2928 dcnt = IVAL(req->vwv+11, 1);
2929 doff = IVAL(req->vwv+13, 1);
2930 ddisp = IVAL(req->vwv+15, 1);
2931
2932 state->received_param += pcnt;
2933 state->received_data += dcnt;
2934
2935 if ((state->received_data > state->total_data) ||
2936 (state->received_param > state->total_param))
2937 goto bad_param;
2938
2939 if (pcnt) {
2940 if (trans_oob(state->total_param, pdisp, pcnt)
2941 || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
2942 goto bad_param;
2943 }
2944 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
2945 }
2946
2947 if (dcnt) {
2948 if (trans_oob(state->total_data, ddisp, dcnt)
2949 || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
2950 goto bad_param;
2951 }
2952 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
2953 }
2954
2955 if ((state->received_param < state->total_param) ||
2956 (state->received_data < state->total_data)) {
2957 END_PROFILE(SMBnttranss);
2958 return;
2959 }
2960
2961 handle_nttrans(conn, state, req);
2962
2963 DLIST_REMOVE(conn->pending_trans, state);
2964 SAFE_FREE(state->data);
2965 SAFE_FREE(state->param);
2966 TALLOC_FREE(state);
2967 END_PROFILE(SMBnttranss);
2968 return;
2969
2970 bad_param:
2971
2972 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2973 DLIST_REMOVE(conn->pending_trans, state);
2974 SAFE_FREE(state->data);
2975 SAFE_FREE(state->param);
2976 TALLOC_FREE(state);
2977 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2978 END_PROFILE(SMBnttranss);
2979 return;
2980 }
WIP