?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3/VERSION: Raise version number up to 3.4.0.
[Samba/gbeck.git] / source3 / smbd / reply.c
blob6fe4f887cc983f3ad97e407e131b60642d99338c
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!posix_path && !stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 break;
132 }
133 /* Go back one level... */
134 /* We know this is safe as '/' cannot be part of a mb sequence. */
135 /* NOTE - if this assumption is invalid we are not in good shape... */
136 /* Decrement d first as d points to the *next* char to write into. */
137 for (d--; d > path; d--) {
138 if (*d == '/')
139 break;
140 }
141 s += 2; /* Else go past the .. */
142 /* We're still at the start of a name component, just the previous one. */
143 continue;
144
145 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
146 if (posix_path) {
147 /* Eat the '.' */
148 s++;
149 continue;
150 }
151 }
152
153 }
154
155 if (!(*s & 0x80)) {
156 if (!posix_path) {
157 if (*s <= 0x1f || *s == '|') {
158 return NT_STATUS_OBJECT_NAME_INVALID;
159 }
160 switch (*s) {
161 case '*':
162 case '?':
163 case '<':
164 case '>':
165 case '"':
166 *p_last_component_contains_wcard = True;
167 break;
168 default:
169 break;
170 }
171 }
172 *d++ = *s++;
173 } else {
174 size_t siz;
175 /* Get the size of the next MB character. */
176 next_codepoint(s,&siz);
177 switch(siz) {
178 case 5:
179 *d++ = *s++;
180 /*fall through*/
181 case 4:
182 *d++ = *s++;
183 /*fall through*/
184 case 3:
185 *d++ = *s++;
186 /*fall through*/
187 case 2:
188 *d++ = *s++;
189 /*fall through*/
190 case 1:
191 *d++ = *s++;
192 break;
193 default:
194 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
195 *d = '\0';
196 return NT_STATUS_INVALID_PARAMETER;
197 }
198 }
199 start_of_name_component = False;
200 }
201
202 *d = '\0';
203
204 return ret;
205 }
206
207 /****************************************************************************
208 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
209 No wildcards allowed.
210 ****************************************************************************/
211
212 NTSTATUS check_path_syntax(char *path)
213 {
214 bool ignore;
215 return check_path_syntax_internal(path, False, &ignore);
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 Wildcards allowed - p_contains_wcard returns true if the last component contained
221 a wildcard.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
225 {
226 return check_path_syntax_internal(path, False, p_contains_wcard);
227 }
228
229 /****************************************************************************
230 Check the path for a POSIX client.
231 We're assuming here that '/' is not the second byte in any multibyte char
232 set (a safe assumption).
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_posix(char *path)
236 {
237 bool ignore;
238 return check_path_syntax_internal(path, True, &ignore);
239 }
240
241 /****************************************************************************
242 Pull a string and check the path allowing a wilcard - provide for error return.
243 ****************************************************************************/
244
245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
246 const char *base_ptr,
247 uint16 smb_flags2,
248 char **pp_dest,
249 const char *src,
250 size_t src_len,
251 int flags,
252 NTSTATUS *err,
253 bool *contains_wcard)
254 {
255 size_t ret;
256
257 *pp_dest = NULL;
258
259 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
260 src_len, flags);
261
262 if (!*pp_dest) {
263 *err = NT_STATUS_INVALID_PARAMETER;
264 return ret;
265 }
266
267 *contains_wcard = False;
268
269 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
270 /*
271 * For a DFS path the function parse_dfs_path()
272 * will do the path processing, just make a copy.
273 */
274 *err = NT_STATUS_OK;
275 return ret;
276 }
277
278 if (lp_posix_pathnames()) {
279 *err = check_path_syntax_posix(*pp_dest);
280 } else {
281 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
282 }
283
284 return ret;
285 }
286
287 /****************************************************************************
288 Pull a string and check the path - provide for error return.
289 ****************************************************************************/
290
291 size_t srvstr_get_path(TALLOC_CTX *ctx,
292 const char *base_ptr,
293 uint16 smb_flags2,
294 char **pp_dest,
295 const char *src,
296 size_t src_len,
297 int flags,
298 NTSTATUS *err)
299 {
300 bool ignore;
301 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
302 src_len, flags, err, &ignore);
303 }
304
305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
306 char **pp_dest, const char *src, int flags,
307 NTSTATUS *err, bool *contains_wcard)
308 {
309 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
310 pp_dest, src, smbreq_bufrem(req, src),
311 flags, err, contains_wcard);
312 }
313
314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err)
317 {
318 bool ignore;
319 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
320 flags, err, &ignore);
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if (!(fsp) || !(conn)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if ((fsp)->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if ((fsp)->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 (fsp)->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 /****************************************************************************
395 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
396 ****************************************************************************/
397
398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
399 files_struct *fsp)
400 {
401 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
402 && (req->vuid == (fsp)->vuid)) {
403 return True;
404 }
405
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return False;
408 }
409
410 /****************************************************************************
411 Reply to a (netbios-level) special message.
412 ****************************************************************************/
413
414 void reply_special(char *inbuf)
415 {
416 int msg_type = CVAL(inbuf,0);
417 int msg_flags = CVAL(inbuf,1);
418 fstring name1,name2;
419 char name_type = 0;
420
421 /*
422 * We only really use 4 bytes of the outbuf, but for the smb_setlen
423 * calculation & friends (srv_send_smb uses that) we need the full smb
424 * header.
425 */
426 char outbuf[smb_size];
427
428 *name1 = *name2 = 0;
429
430 memset(outbuf, '\0', sizeof(outbuf));
431
432 smb_setlen(outbuf,0);
433
434 switch (msg_type) {
435 case 0x81: /* session request */
436
437 if (already_got_session) {
438 exit_server_cleanly("multiple session request not permitted");
439 }
440
441 SCVAL(outbuf,0,0x82);
442 SCVAL(outbuf,3,0);
443 if (name_len(inbuf+4) > 50 ||
444 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
445 DEBUG(0,("Invalid name length in session request\n"));
446 return;
447 }
448 name_extract(inbuf,4,name1);
449 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
450 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
451 name1,name2));
452
453 set_local_machine_name(name1, True);
454 set_remote_machine_name(name2, True);
455
456 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
457 get_local_machine_name(), get_remote_machine_name(),
458 name_type));
459
460 if (name_type == 'R') {
461 /* We are being asked for a pathworks session ---
462 no thanks! */
463 SCVAL(outbuf, 0,0x83);
464 break;
465 }
466
467 /* only add the client's machine name to the list
468 of possibly valid usernames if we are operating
469 in share mode security */
470 if (lp_security() == SEC_SHARE) {
471 add_session_user(get_remote_machine_name());
472 }
473
474 reload_services(True);
475 reopen_logs();
476
477 already_got_session = True;
478 break;
479
480 case 0x89: /* session keepalive request
481 (some old clients produce this?) */
482 SCVAL(outbuf,0,SMBkeepalive);
483 SCVAL(outbuf,3,0);
484 break;
485
486 case 0x82: /* positive session response */
487 case 0x83: /* negative session response */
488 case 0x84: /* retarget session response */
489 DEBUG(0,("Unexpected session response\n"));
490 break;
491
492 case SMBkeepalive: /* session keepalive */
493 default:
494 return;
495 }
496
497 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
498 msg_type, msg_flags));
499
500 srv_send_smb(smbd_server_fd(), outbuf, false, NULL);
501 return;
502 }
503
504 /****************************************************************************
505 Reply to a tcon.
506 conn POINTER CAN BE NULL HERE !
507 ****************************************************************************/
508
509 void reply_tcon(struct smb_request *req)
510 {
511 connection_struct *conn = req->conn;
512 const char *service;
513 char *service_buf = NULL;
514 char *password = NULL;
515 char *dev = NULL;
516 int pwlen=0;
517 NTSTATUS nt_status;
518 const char *p;
519 DATA_BLOB password_blob;
520 TALLOC_CTX *ctx = talloc_tos();
521
522 START_PROFILE(SMBtcon);
523
524 if (req->buflen < 4) {
525 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
526 END_PROFILE(SMBtcon);
527 return;
528 }
529
530 p = (const char *)req->buf + 1;
531 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
532 p += 1;
533 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
534 p += pwlen+1;
535 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
536 p += 1;
537
538 if (service_buf == NULL || password == NULL || dev == NULL) {
539 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
540 END_PROFILE(SMBtcon);
541 return;
542 }
543 p = strrchr_m(service_buf,'\\');
544 if (p) {
545 service = p+1;
546 } else {
547 service = service_buf;
548 }
549
550 password_blob = data_blob(password, pwlen+1);
551
552 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
553 req->conn = conn;
554
555 data_blob_clear_free(&password_blob);
556
557 if (!conn) {
558 reply_nterror(req, nt_status);
559 END_PROFILE(SMBtcon);
560 return;
561 }
562
563 reply_outbuf(req, 2, 0);
564 SSVAL(req->outbuf,smb_vwv0,max_recv);
565 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
566 SSVAL(req->outbuf,smb_tid,conn->cnum);
567
568 DEBUG(3,("tcon service=%s cnum=%d\n",
569 service, conn->cnum));
570
571 END_PROFILE(SMBtcon);
572 return;
573 }
574
575 /****************************************************************************
576 Reply to a tcon and X.
577 conn POINTER CAN BE NULL HERE !
578 ****************************************************************************/
579
580 void reply_tcon_and_X(struct smb_request *req)
581 {
582 connection_struct *conn = req->conn;
583 const char *service = NULL;
584 DATA_BLOB password;
585 TALLOC_CTX *ctx = talloc_tos();
586 /* what the cleint thinks the device is */
587 char *client_devicetype = NULL;
588 /* what the server tells the client the share represents */
589 const char *server_devicetype;
590 NTSTATUS nt_status;
591 int passlen;
592 char *path = NULL;
593 const char *p, *q;
594 uint16 tcon_flags;
595
596 START_PROFILE(SMBtconX);
597
598 if (req->wct < 4) {
599 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
600 END_PROFILE(SMBtconX);
601 return;
602 }
603
604 passlen = SVAL(req->vwv+3, 0);
605 tcon_flags = SVAL(req->vwv+2, 0);
606
607 /* we might have to close an old one */
608 if ((tcon_flags & 0x1) && conn) {
609 close_cnum(conn,req->vuid);
610 req->conn = NULL;
611 conn = NULL;
612 }
613
614 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
615 reply_doserror(req, ERRDOS, ERRbuftoosmall);
616 END_PROFILE(SMBtconX);
617 return;
618 }
619
620 if (global_encrypted_passwords_negotiated) {
621 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
622 if (lp_security() == SEC_SHARE) {
623 /*
624 * Security = share always has a pad byte
625 * after the password.
626 */
627 p = (const char *)req->buf + passlen + 1;
628 } else {
629 p = (const char *)req->buf + passlen;
630 }
631 } else {
632 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
633 /* Ensure correct termination */
634 password.data[passlen]=0;
635 p = (const char *)req->buf + passlen + 1;
636 }
637
638 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
639
640 if (path == NULL) {
641 data_blob_clear_free(&password);
642 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
643 END_PROFILE(SMBtconX);
644 return;
645 }
646
647 /*
648 * the service name can be either: \\server\share
649 * or share directly like on the DELL PowerVault 705
650 */
651 if (*path=='\\') {
652 q = strchr_m(path+2,'\\');
653 if (!q) {
654 data_blob_clear_free(&password);
655 reply_doserror(req, ERRDOS, ERRnosuchshare);
656 END_PROFILE(SMBtconX);
657 return;
658 }
659 service = q+1;
660 } else {
661 service = path;
662 }
663
664 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
665 &client_devicetype, p,
666 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
667
668 if (client_devicetype == NULL) {
669 data_blob_clear_free(&password);
670 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
671 END_PROFILE(SMBtconX);
672 return;
673 }
674
675 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
676
677 conn = make_connection(service, password, client_devicetype,
678 req->vuid, &nt_status);
679 req->conn =conn;
680
681 data_blob_clear_free(&password);
682
683 if (!conn) {
684 reply_nterror(req, nt_status);
685 END_PROFILE(SMBtconX);
686 return;
687 }
688
689 if ( IS_IPC(conn) )
690 server_devicetype = "IPC";
691 else if ( IS_PRINT(conn) )
692 server_devicetype = "LPT1:";
693 else
694 server_devicetype = "A:";
695
696 if (Protocol < PROTOCOL_NT1) {
697 reply_outbuf(req, 2, 0);
698 if (message_push_string(&req->outbuf, server_devicetype,
699 STR_TERMINATE|STR_ASCII) == -1) {
700 reply_nterror(req, NT_STATUS_NO_MEMORY);
701 END_PROFILE(SMBtconX);
702 return;
703 }
704 } else {
705 /* NT sets the fstype of IPC$ to the null string */
706 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
707
708 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
709 /* Return permissions. */
710 uint32 perm1 = 0;
711 uint32 perm2 = 0;
712
713 reply_outbuf(req, 7, 0);
714
715 if (IS_IPC(conn)) {
716 perm1 = FILE_ALL_ACCESS;
717 perm2 = FILE_ALL_ACCESS;
718 } else {
719 perm1 = CAN_WRITE(conn) ?
720 SHARE_ALL_ACCESS :
721 SHARE_READ_ONLY;
722 }
723
724 SIVAL(req->outbuf, smb_vwv3, perm1);
725 SIVAL(req->outbuf, smb_vwv5, perm2);
726 } else {
727 reply_outbuf(req, 3, 0);
728 }
729
730 if ((message_push_string(&req->outbuf, server_devicetype,
731 STR_TERMINATE|STR_ASCII) == -1)
732 || (message_push_string(&req->outbuf, fstype,
733 STR_TERMINATE) == -1)) {
734 reply_nterror(req, NT_STATUS_NO_MEMORY);
735 END_PROFILE(SMBtconX);
736 return;
737 }
738
739 /* what does setting this bit do? It is set by NT4 and
740 may affect the ability to autorun mounted cdroms */
741 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
742 (lp_csc_policy(SNUM(conn)) << 2));
743
744 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
745 DEBUG(2,("Serving %s as a Dfs root\n",
746 lp_servicename(SNUM(conn)) ));
747 SSVAL(req->outbuf, smb_vwv2,
748 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
749 }
750 }
751
752
753 DEBUG(3,("tconX service=%s \n",
754 service));
755
756 /* set the incoming and outgoing tid to the just created one */
757 SSVAL(req->inbuf,smb_tid,conn->cnum);
758 SSVAL(req->outbuf,smb_tid,conn->cnum);
759
760 END_PROFILE(SMBtconX);
761
762 chain_reply(req);
763 return;
764 }
765
766 /****************************************************************************
767 Reply to an unknown type.
768 ****************************************************************************/
769
770 void reply_unknown_new(struct smb_request *req, uint8 type)
771 {
772 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
773 smb_fn_name(type), type, type));
774 reply_doserror(req, ERRSRV, ERRunknownsmb);
775 return;
776 }
777
778 /****************************************************************************
779 Reply to an ioctl.
780 conn POINTER CAN BE NULL HERE !
781 ****************************************************************************/
782
783 void reply_ioctl(struct smb_request *req)
784 {
785 connection_struct *conn = req->conn;
786 uint16 device;
787 uint16 function;
788 uint32 ioctl_code;
789 int replysize;
790 char *p;
791
792 START_PROFILE(SMBioctl);
793
794 if (req->wct < 3) {
795 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
796 END_PROFILE(SMBioctl);
797 return;
798 }
799
800 device = SVAL(req->vwv+1, 0);
801 function = SVAL(req->vwv+2, 0);
802 ioctl_code = (device << 16) + function;
803
804 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
805
806 switch (ioctl_code) {
807 case IOCTL_QUERY_JOB_INFO:
808 replysize = 32;
809 break;
810 default:
811 reply_doserror(req, ERRSRV, ERRnosupport);
812 END_PROFILE(SMBioctl);
813 return;
814 }
815
816 reply_outbuf(req, 8, replysize+1);
817 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
818 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
819 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
820 p = smb_buf(req->outbuf);
821 memset(p, '\0', replysize+1); /* valgrind-safe. */
822 p += 1; /* Allow for alignment */
823
824 switch (ioctl_code) {
825 case IOCTL_QUERY_JOB_INFO:
826 {
827 files_struct *fsp = file_fsp(
828 req, SVAL(req->vwv+0, 0));
829 if (!fsp) {
830 reply_doserror(req, ERRDOS, ERRbadfid);
831 END_PROFILE(SMBioctl);
832 return;
833 }
834 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
835 srvstr_push((char *)req->outbuf, req->flags2, p+2,
836 global_myname(), 15,
837 STR_TERMINATE|STR_ASCII);
838 if (conn) {
839 srvstr_push((char *)req->outbuf, req->flags2,
840 p+18, lp_servicename(SNUM(conn)),
841 13, STR_TERMINATE|STR_ASCII);
842 } else {
843 memset(p+18, 0, 13);
844 }
845 break;
846 }
847 }
848
849 END_PROFILE(SMBioctl);
850 return;
851 }
852
853 /****************************************************************************
854 Strange checkpath NTSTATUS mapping.
855 ****************************************************************************/
856
857 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
858 {
859 /* Strange DOS error code semantics only for checkpath... */
860 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
861 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
862 /* We need to map to ERRbadpath */
863 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
864 }
865 }
866 return status;
867 }
868
869 /****************************************************************************
870 Reply to a checkpath.
871 ****************************************************************************/
872
873 void reply_checkpath(struct smb_request *req)
874 {
875 connection_struct *conn = req->conn;
876 char *name = NULL;
877 SMB_STRUCT_STAT sbuf;
878 NTSTATUS status;
879 TALLOC_CTX *ctx = talloc_tos();
880
881 START_PROFILE(SMBcheckpath);
882
883 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
884 STR_TERMINATE, &status);
885
886 if (!NT_STATUS_IS_OK(status)) {
887 status = map_checkpath_error(req->flags2, status);
888 reply_nterror(req, status);
889 END_PROFILE(SMBcheckpath);
890 return;
891 }
892
893 status = resolve_dfspath(ctx, conn,
894 req->flags2 & FLAGS2_DFS_PATHNAMES,
895 name,
896 &name);
897 if (!NT_STATUS_IS_OK(status)) {
898 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
899 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
900 ERRSRV, ERRbadpath);
901 END_PROFILE(SMBcheckpath);
902 return;
903 }
904 goto path_err;
905 }
906
907 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
908
909 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
910 if (!NT_STATUS_IS_OK(status)) {
911 goto path_err;
912 }
913
914 status = check_name(conn, name);
915 if (!NT_STATUS_IS_OK(status)) {
916 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
917 goto path_err;
918 }
919
920 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
921 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
922 status = map_nt_error_from_unix(errno);
923 goto path_err;
924 }
925
926 if (!S_ISDIR(sbuf.st_mode)) {
927 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
928 ERRDOS, ERRbadpath);
929 END_PROFILE(SMBcheckpath);
930 return;
931 }
932
933 reply_outbuf(req, 0, 0);
934
935 END_PROFILE(SMBcheckpath);
936 return;
937
938 path_err:
939
940 END_PROFILE(SMBcheckpath);
941
942 /* We special case this - as when a Windows machine
943 is parsing a path is steps through the components
944 one at a time - if a component fails it expects
945 ERRbadpath, not ERRbadfile.
946 */
947 status = map_checkpath_error(req->flags2, status);
948 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
949 /*
950 * Windows returns different error codes if
951 * the parent directory is valid but not the
952 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
953 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
954 * if the path is invalid.
955 */
956 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
957 ERRDOS, ERRbadpath);
958 return;
959 }
960
961 reply_nterror(req, status);
962 }
963
964 /****************************************************************************
965 Reply to a getatr.
966 ****************************************************************************/
967
968 void reply_getatr(struct smb_request *req)
969 {
970 connection_struct *conn = req->conn;
971 char *fname = NULL;
972 SMB_STRUCT_STAT sbuf;
973 int mode=0;
974 SMB_OFF_T size=0;
975 time_t mtime=0;
976 const char *p;
977 NTSTATUS status;
978 TALLOC_CTX *ctx = talloc_tos();
979
980 START_PROFILE(SMBgetatr);
981
982 p = (const char *)req->buf + 1;
983 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
984 if (!NT_STATUS_IS_OK(status)) {
985 reply_nterror(req, status);
986 END_PROFILE(SMBgetatr);
987 return;
988 }
989
990 status = resolve_dfspath(ctx, conn,
991 req->flags2 & FLAGS2_DFS_PATHNAMES,
992 fname,
993 &fname);
994 if (!NT_STATUS_IS_OK(status)) {
995 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
996 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
997 ERRSRV, ERRbadpath);
998 END_PROFILE(SMBgetatr);
999 return;
1000 }
1001 reply_nterror(req, status);
1002 END_PROFILE(SMBgetatr);
1003 return;
1004 }
1005
1006 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1007 under WfWg - weird! */
1008 if (*fname == '\0') {
1009 mode = aHIDDEN | aDIR;
1010 if (!CAN_WRITE(conn)) {
1011 mode |= aRONLY;
1012 }
1013 size = 0;
1014 mtime = 0;
1015 } else {
1016 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1017 if (!NT_STATUS_IS_OK(status)) {
1018 reply_nterror(req, status);
1019 END_PROFILE(SMBgetatr);
1020 return;
1021 }
1022 status = check_name(conn, fname);
1023 if (!NT_STATUS_IS_OK(status)) {
1024 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1025 reply_nterror(req, status);
1026 END_PROFILE(SMBgetatr);
1027 return;
1028 }
1029 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1030 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1031 reply_unixerror(req, ERRDOS,ERRbadfile);
1032 END_PROFILE(SMBgetatr);
1033 return;
1034 }
1035
1036 mode = dos_mode(conn,fname,&sbuf);
1037 size = sbuf.st_size;
1038 mtime = sbuf.st_mtime;
1039 if (mode & aDIR) {
1040 size = 0;
1041 }
1042 }
1043
1044 reply_outbuf(req, 10, 0);
1045
1046 SSVAL(req->outbuf,smb_vwv0,mode);
1047 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1048 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1049 } else {
1050 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1051 }
1052 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1053
1054 if (Protocol >= PROTOCOL_NT1) {
1055 SSVAL(req->outbuf, smb_flg2,
1056 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1057 }
1058
1059 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1060
1061 END_PROFILE(SMBgetatr);
1062 return;
1063 }
1064
1065 /****************************************************************************
1066 Reply to a setatr.
1067 ****************************************************************************/
1068
1069 void reply_setatr(struct smb_request *req)
1070 {
1071 struct smb_file_time ft;
1072 connection_struct *conn = req->conn;
1073 char *fname = NULL;
1074 int mode;
1075 time_t mtime;
1076 SMB_STRUCT_STAT sbuf;
1077 const char *p;
1078 NTSTATUS status;
1079 TALLOC_CTX *ctx = talloc_tos();
1080
1081 START_PROFILE(SMBsetatr);
1082
1083 ZERO_STRUCT(ft);
1084
1085 if (req->wct < 2) {
1086 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1087 return;
1088 }
1089
1090 p = (const char *)req->buf + 1;
1091 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1092 if (!NT_STATUS_IS_OK(status)) {
1093 reply_nterror(req, status);
1094 END_PROFILE(SMBsetatr);
1095 return;
1096 }
1097
1098 status = resolve_dfspath(ctx, conn,
1099 req->flags2 & FLAGS2_DFS_PATHNAMES,
1100 fname,
1101 &fname);
1102 if (!NT_STATUS_IS_OK(status)) {
1103 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1104 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1105 ERRSRV, ERRbadpath);
1106 END_PROFILE(SMBsetatr);
1107 return;
1108 }
1109 reply_nterror(req, status);
1110 END_PROFILE(SMBsetatr);
1111 return;
1112 }
1113
1114 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1115 if (!NT_STATUS_IS_OK(status)) {
1116 reply_nterror(req, status);
1117 END_PROFILE(SMBsetatr);
1118 return;
1119 }
1120
1121 status = check_name(conn, fname);
1122 if (!NT_STATUS_IS_OK(status)) {
1123 reply_nterror(req, status);
1124 END_PROFILE(SMBsetatr);
1125 return;
1126 }
1127
1128 if (fname[0] == '.' && fname[1] == '\0') {
1129 /*
1130 * Not sure here is the right place to catch this
1131 * condition. Might be moved to somewhere else later -- vl
1132 */
1133 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1134 END_PROFILE(SMBsetatr);
1135 return;
1136 }
1137
1138 mode = SVAL(req->vwv+0, 0);
1139 mtime = srv_make_unix_date3(req->vwv+1);
1140
1141 ft.mtime = convert_time_t_to_timespec(mtime);
1142 status = smb_set_file_time(conn, NULL, fname,
1143 &sbuf, &ft, true);
1144 if (!NT_STATUS_IS_OK(status)) {
1145 reply_unixerror(req, ERRDOS, ERRnoaccess);
1146 END_PROFILE(SMBsetatr);
1147 return;
1148 }
1149
1150 if (mode != FILE_ATTRIBUTE_NORMAL) {
1151 if (VALID_STAT_OF_DIR(sbuf))
1152 mode |= aDIR;
1153 else
1154 mode &= ~aDIR;
1155
1156 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1157 reply_unixerror(req, ERRDOS, ERRnoaccess);
1158 END_PROFILE(SMBsetatr);
1159 return;
1160 }
1161 }
1162
1163 reply_outbuf(req, 0, 0);
1164
1165 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1166
1167 END_PROFILE(SMBsetatr);
1168 return;
1169 }
1170
1171 /****************************************************************************
1172 Reply to a dskattr.
1173 ****************************************************************************/
1174
1175 void reply_dskattr(struct smb_request *req)
1176 {
1177 connection_struct *conn = req->conn;
1178 uint64_t dfree,dsize,bsize;
1179 START_PROFILE(SMBdskattr);
1180
1181 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1182 reply_unixerror(req, ERRHRD, ERRgeneral);
1183 END_PROFILE(SMBdskattr);
1184 return;
1185 }
1186
1187 reply_outbuf(req, 5, 0);
1188
1189 if (Protocol <= PROTOCOL_LANMAN2) {
1190 double total_space, free_space;
1191 /* we need to scale this to a number that DOS6 can handle. We
1192 use floating point so we can handle large drives on systems
1193 that don't have 64 bit integers
1194
1195 we end up displaying a maximum of 2G to DOS systems
1196 */
1197 total_space = dsize * (double)bsize;
1198 free_space = dfree * (double)bsize;
1199
1200 dsize = (uint64_t)((total_space+63*512) / (64*512));
1201 dfree = (uint64_t)((free_space+63*512) / (64*512));
1202
1203 if (dsize > 0xFFFF) dsize = 0xFFFF;
1204 if (dfree > 0xFFFF) dfree = 0xFFFF;
1205
1206 SSVAL(req->outbuf,smb_vwv0,dsize);
1207 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1208 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1209 SSVAL(req->outbuf,smb_vwv3,dfree);
1210 } else {
1211 SSVAL(req->outbuf,smb_vwv0,dsize);
1212 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1213 SSVAL(req->outbuf,smb_vwv2,512);
1214 SSVAL(req->outbuf,smb_vwv3,dfree);
1215 }
1216
1217 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1218
1219 END_PROFILE(SMBdskattr);
1220 return;
1221 }
1222
1223 /****************************************************************************
1224 Reply to a search.
1225 Can be called from SMBsearch, SMBffirst or SMBfunique.
1226 ****************************************************************************/
1227
1228 void reply_search(struct smb_request *req)
1229 {
1230 connection_struct *conn = req->conn;
1231 const char *mask = NULL;
1232 char *directory = NULL;
1233 char *fname = NULL;
1234 SMB_OFF_T size;
1235 uint32 mode;
1236 time_t date;
1237 uint32 dirtype;
1238 unsigned int numentries = 0;
1239 unsigned int maxentries = 0;
1240 bool finished = False;
1241 const char *p;
1242 int status_len;
1243 char *path = NULL;
1244 char status[21];
1245 int dptr_num= -1;
1246 bool check_descend = False;
1247 bool expect_close = False;
1248 NTSTATUS nt_status;
1249 bool mask_contains_wcard = False;
1250 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1251 TALLOC_CTX *ctx = talloc_tos();
1252 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1253
1254 START_PROFILE(SMBsearch);
1255
1256 if (req->wct < 2) {
1257 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1258 END_PROFILE(SMBsearch);
1259 return;
1260 }
1261
1262 if (lp_posix_pathnames()) {
1263 reply_unknown_new(req, req->cmd);
1264 END_PROFILE(SMBsearch);
1265 return;
1266 }
1267
1268 /* If we were called as SMBffirst then we must expect close. */
1269 if(req->cmd == SMBffirst) {
1270 expect_close = True;
1271 }
1272
1273 reply_outbuf(req, 1, 3);
1274 maxentries = SVAL(req->vwv+0, 0);
1275 dirtype = SVAL(req->vwv+1, 0);
1276 p = (const char *)req->buf + 1;
1277 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1278 &nt_status, &mask_contains_wcard);
1279 if (!NT_STATUS_IS_OK(nt_status)) {
1280 reply_nterror(req, nt_status);
1281 END_PROFILE(SMBsearch);
1282 return;
1283 }
1284
1285 nt_status = resolve_dfspath_wcard(ctx, conn,
1286 req->flags2 & FLAGS2_DFS_PATHNAMES,
1287 path,
1288 &path,
1289 &mask_contains_wcard);
1290 if (!NT_STATUS_IS_OK(nt_status)) {
1291 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1292 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1293 ERRSRV, ERRbadpath);
1294 END_PROFILE(SMBsearch);
1295 return;
1296 }
1297 reply_nterror(req, nt_status);
1298 END_PROFILE(SMBsearch);
1299 return;
1300 }
1301
1302 p++;
1303 status_len = SVAL(p, 0);
1304 p += 2;
1305
1306 /* dirtype &= ~aDIR; */
1307
1308 if (status_len == 0) {
1309 SMB_STRUCT_STAT sbuf;
1310
1311 nt_status = unix_convert(ctx, conn, path, True,
1312 &directory, NULL, &sbuf);
1313 if (!NT_STATUS_IS_OK(nt_status)) {
1314 reply_nterror(req, nt_status);
1315 END_PROFILE(SMBsearch);
1316 return;
1317 }
1318
1319 nt_status = check_name(conn, directory);
1320 if (!NT_STATUS_IS_OK(nt_status)) {
1321 reply_nterror(req, nt_status);
1322 END_PROFILE(SMBsearch);
1323 return;
1324 }
1325
1326 p = strrchr_m(directory,'/');
1327 if ((p != NULL) && (*directory != '/')) {
1328 mask = p + 1;
1329 directory = talloc_strndup(ctx, directory,
1330 PTR_DIFF(p, directory));
1331 } else {
1332 mask = directory;
1333 directory = talloc_strdup(ctx,".");
1334 }
1335
1336 if (!directory) {
1337 reply_nterror(req, NT_STATUS_NO_MEMORY);
1338 END_PROFILE(SMBsearch);
1339 return;
1340 }
1341
1342 memset((char *)status,'\0',21);
1343 SCVAL(status,0,(dirtype & 0x1F));
1344
1345 nt_status = dptr_create(conn,
1346 directory,
1347 True,
1348 expect_close,
1349 req->smbpid,
1350 mask,
1351 mask_contains_wcard,
1352 dirtype,
1353 &conn->dirptr);
1354 if (!NT_STATUS_IS_OK(nt_status)) {
1355 reply_nterror(req, nt_status);
1356 END_PROFILE(SMBsearch);
1357 return;
1358 }
1359 dptr_num = dptr_dnum(conn->dirptr);
1360 } else {
1361 int status_dirtype;
1362
1363 memcpy(status,p,21);
1364 status_dirtype = CVAL(status,0) & 0x1F;
1365 if (status_dirtype != (dirtype & 0x1F)) {
1366 dirtype = status_dirtype;
1367 }
1368
1369 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1370 if (!conn->dirptr) {
1371 goto SearchEmpty;
1372 }
1373 string_set(&conn->dirpath,dptr_path(dptr_num));
1374 mask = dptr_wcard(dptr_num);
1375 if (!mask) {
1376 goto SearchEmpty;
1377 }
1378 /*
1379 * For a 'continue' search we have no string. So
1380 * check from the initial saved string.
1381 */
1382 mask_contains_wcard = ms_has_wild(mask);
1383 dirtype = dptr_attr(dptr_num);
1384 }
1385
1386 DEBUG(4,("dptr_num is %d\n",dptr_num));
1387
1388 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1389 dptr_init_search_op(conn->dirptr);
1390
1391 if ((dirtype&0x1F) == aVOLID) {
1392 char buf[DIR_STRUCT_SIZE];
1393 memcpy(buf,status,21);
1394 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1395 0,aVOLID,0,!allow_long_path_components)) {
1396 reply_nterror(req, NT_STATUS_NO_MEMORY);
1397 END_PROFILE(SMBsearch);
1398 return;
1399 }
1400 dptr_fill(buf+12,dptr_num);
1401 if (dptr_zero(buf+12) && (status_len==0)) {
1402 numentries = 1;
1403 } else {
1404 numentries = 0;
1405 }
1406 if (message_push_blob(&req->outbuf,
1407 data_blob_const(buf, sizeof(buf)))
1408 == -1) {
1409 reply_nterror(req, NT_STATUS_NO_MEMORY);
1410 END_PROFILE(SMBsearch);
1411 return;
1412 }
1413 } else {
1414 unsigned int i;
1415 maxentries = MIN(
1416 maxentries,
1417 ((BUFFER_SIZE -
1418 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1419 /DIR_STRUCT_SIZE));
1420
1421 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1422 conn->dirpath,lp_dontdescend(SNUM(conn))));
1423 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1424 check_descend = True;
1425 }
1426
1427 for (i=numentries;(i<maxentries) && !finished;i++) {
1428 finished = !get_dir_entry(ctx,
1429 conn,
1430 mask,
1431 dirtype,
1432 &fname,
1433 &size,
1434 &mode,
1435 &date,
1436 check_descend,
1437 ask_sharemode);
1438 if (!finished) {
1439 char buf[DIR_STRUCT_SIZE];
1440 memcpy(buf,status,21);
1441 if (!make_dir_struct(ctx,
1442 buf,
1443 mask,
1444 fname,
1445 size,
1446 mode,
1447 date,
1448 !allow_long_path_components)) {
1449 reply_nterror(req, NT_STATUS_NO_MEMORY);
1450 END_PROFILE(SMBsearch);
1451 return;
1452 }
1453 if (!dptr_fill(buf+12,dptr_num)) {
1454 break;
1455 }
1456 if (message_push_blob(&req->outbuf,
1457 data_blob_const(buf, sizeof(buf)))
1458 == -1) {
1459 reply_nterror(req, NT_STATUS_NO_MEMORY);
1460 END_PROFILE(SMBsearch);
1461 return;
1462 }
1463 numentries++;
1464 }
1465 }
1466 }
1467
1468 SearchEmpty:
1469
1470 /* If we were called as SMBffirst with smb_search_id == NULL
1471 and no entries were found then return error and close dirptr
1472 (X/Open spec) */
1473
1474 if (numentries == 0) {
1475 dptr_close(&dptr_num);
1476 } else if(expect_close && status_len == 0) {
1477 /* Close the dptr - we know it's gone */
1478 dptr_close(&dptr_num);
1479 }
1480
1481 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1482 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1483 dptr_close(&dptr_num);
1484 }
1485
1486 if ((numentries == 0) && !mask_contains_wcard) {
1487 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1488 END_PROFILE(SMBsearch);
1489 return;
1490 }
1491
1492 SSVAL(req->outbuf,smb_vwv0,numentries);
1493 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1494 SCVAL(smb_buf(req->outbuf),0,5);
1495 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1496
1497 /* The replies here are never long name. */
1498 SSVAL(req->outbuf, smb_flg2,
1499 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1500 if (!allow_long_path_components) {
1501 SSVAL(req->outbuf, smb_flg2,
1502 SVAL(req->outbuf, smb_flg2)
1503 & (~FLAGS2_LONG_PATH_COMPONENTS));
1504 }
1505
1506 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1507 SSVAL(req->outbuf, smb_flg2,
1508 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1509
1510 if (!directory) {
1511 directory = dptr_path(dptr_num);
1512 }
1513
1514 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1515 smb_fn_name(req->cmd),
1516 mask,
1517 directory ? directory : "./",
1518 dirtype,
1519 numentries,
1520 maxentries ));
1521
1522 END_PROFILE(SMBsearch);
1523 return;
1524 }
1525
1526 /****************************************************************************
1527 Reply to a fclose (stop directory search).
1528 ****************************************************************************/
1529
1530 void reply_fclose(struct smb_request *req)
1531 {
1532 int status_len;
1533 char status[21];
1534 int dptr_num= -2;
1535 const char *p;
1536 char *path = NULL;
1537 NTSTATUS err;
1538 bool path_contains_wcard = False;
1539 TALLOC_CTX *ctx = talloc_tos();
1540
1541 START_PROFILE(SMBfclose);
1542
1543 if (lp_posix_pathnames()) {
1544 reply_unknown_new(req, req->cmd);
1545 END_PROFILE(SMBfclose);
1546 return;
1547 }
1548
1549 p = (const char *)req->buf + 1;
1550 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1551 &err, &path_contains_wcard);
1552 if (!NT_STATUS_IS_OK(err)) {
1553 reply_nterror(req, err);
1554 END_PROFILE(SMBfclose);
1555 return;
1556 }
1557 p++;
1558 status_len = SVAL(p,0);
1559 p += 2;
1560
1561 if (status_len == 0) {
1562 reply_doserror(req, ERRSRV, ERRsrverror);
1563 END_PROFILE(SMBfclose);
1564 return;
1565 }
1566
1567 memcpy(status,p,21);
1568
1569 if(dptr_fetch(status+12,&dptr_num)) {
1570 /* Close the dptr - we know it's gone */
1571 dptr_close(&dptr_num);
1572 }
1573
1574 reply_outbuf(req, 1, 0);
1575 SSVAL(req->outbuf,smb_vwv0,0);
1576
1577 DEBUG(3,("search close\n"));
1578
1579 END_PROFILE(SMBfclose);
1580 return;
1581 }
1582
1583 /****************************************************************************
1584 Reply to an open.
1585 ****************************************************************************/
1586
1587 void reply_open(struct smb_request *req)
1588 {
1589 connection_struct *conn = req->conn;
1590 char *fname = NULL;
1591 uint32 fattr=0;
1592 SMB_OFF_T size = 0;
1593 time_t mtime=0;
1594 int info;
1595 SMB_STRUCT_STAT sbuf;
1596 files_struct *fsp;
1597 int oplock_request;
1598 int deny_mode;
1599 uint32 dos_attr;
1600 uint32 access_mask;
1601 uint32 share_mode;
1602 uint32 create_disposition;
1603 uint32 create_options = 0;
1604 NTSTATUS status;
1605 TALLOC_CTX *ctx = talloc_tos();
1606
1607 START_PROFILE(SMBopen);
1608
1609 SET_STAT_INVALID(sbuf);
1610
1611 if (req->wct < 2) {
1612 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1613 END_PROFILE(SMBopen);
1614 return;
1615 }
1616
1617 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1618 deny_mode = SVAL(req->vwv+0, 0);
1619 dos_attr = SVAL(req->vwv+1, 0);
1620
1621 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1622 STR_TERMINATE, &status);
1623 if (!NT_STATUS_IS_OK(status)) {
1624 reply_nterror(req, status);
1625 END_PROFILE(SMBopen);
1626 return;
1627 }
1628
1629 if (!map_open_params_to_ntcreate(
1630 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1631 &share_mode, &create_disposition, &create_options)) {
1632 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1633 END_PROFILE(SMBopen);
1634 return;
1635 }
1636
1637 status = SMB_VFS_CREATE_FILE(
1638 conn, /* conn */
1639 req, /* req */
1640 0, /* root_dir_fid */
1641 fname, /* fname */
1642 CFF_DOS_PATH, /* create_file_flags */
1643 access_mask, /* access_mask */
1644 share_mode, /* share_access */
1645 create_disposition, /* create_disposition*/
1646 create_options, /* create_options */
1647 dos_attr, /* file_attributes */
1648 oplock_request, /* oplock_request */
1649 0, /* allocation_size */
1650 NULL, /* sd */
1651 NULL, /* ea_list */
1652 &fsp, /* result */
1653 &info, /* pinfo */
1654 &sbuf); /* psbuf */
1655
1656 if (!NT_STATUS_IS_OK(status)) {
1657 if (open_was_deferred(req->mid)) {
1658 /* We have re-scheduled this call. */
1659 END_PROFILE(SMBopen);
1660 return;
1661 }
1662 reply_openerror(req, status);
1663 END_PROFILE(SMBopen);
1664 return;
1665 }
1666
1667 size = sbuf.st_size;
1668 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1669 mtime = sbuf.st_mtime;
1670
1671 if (fattr & aDIR) {
1672 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1673 close_file(req, fsp, ERROR_CLOSE);
1674 reply_doserror(req, ERRDOS,ERRnoaccess);
1675 END_PROFILE(SMBopen);
1676 return;
1677 }
1678
1679 reply_outbuf(req, 7, 0);
1680 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1681 SSVAL(req->outbuf,smb_vwv1,fattr);
1682 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1683 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1684 } else {
1685 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1686 }
1687 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1688 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1689
1690 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1691 SCVAL(req->outbuf,smb_flg,
1692 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1693 }
1694
1695 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1696 SCVAL(req->outbuf,smb_flg,
1697 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1698 }
1699 END_PROFILE(SMBopen);
1700 return;
1701 }
1702
1703 /****************************************************************************
1704 Reply to an open and X.
1705 ****************************************************************************/
1706
1707 void reply_open_and_X(struct smb_request *req)
1708 {
1709 connection_struct *conn = req->conn;
1710 char *fname = NULL;
1711 uint16 open_flags;
1712 int deny_mode;
1713 uint32 smb_attr;
1714 /* Breakout the oplock request bits so we can set the
1715 reply bits separately. */
1716 int ex_oplock_request;
1717 int core_oplock_request;
1718 int oplock_request;
1719 #if 0
1720 int smb_sattr = SVAL(req->vwv+4, 0);
1721 uint32 smb_time = make_unix_date3(req->vwv+6);
1722 #endif
1723 int smb_ofun;
1724 uint32 fattr=0;
1725 int mtime=0;
1726 SMB_STRUCT_STAT sbuf;
1727 int smb_action = 0;
1728 files_struct *fsp;
1729 NTSTATUS status;
1730 uint64_t allocation_size;
1731 ssize_t retval = -1;
1732 uint32 access_mask;
1733 uint32 share_mode;
1734 uint32 create_disposition;
1735 uint32 create_options = 0;
1736 TALLOC_CTX *ctx = talloc_tos();
1737
1738 START_PROFILE(SMBopenX);
1739
1740 if (req->wct < 15) {
1741 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1742 END_PROFILE(SMBopenX);
1743 return;
1744 }
1745
1746 SET_STAT_INVALID(sbuf);
1747
1748 open_flags = SVAL(req->vwv+2, 0);
1749 deny_mode = SVAL(req->vwv+3, 0);
1750 smb_attr = SVAL(req->vwv+5, 0);
1751 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1752 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1753 oplock_request = ex_oplock_request | core_oplock_request;
1754 smb_ofun = SVAL(req->vwv+8, 0);
1755 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1756
1757 /* If it's an IPC, pass off the pipe handler. */
1758 if (IS_IPC(conn)) {
1759 if (lp_nt_pipe_support()) {
1760 reply_open_pipe_and_X(conn, req);
1761 } else {
1762 reply_doserror(req, ERRSRV, ERRaccess);
1763 }
1764 END_PROFILE(SMBopenX);
1765 return;
1766 }
1767
1768 /* XXXX we need to handle passed times, sattr and flags */
1769 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1770 STR_TERMINATE, &status);
1771 if (!NT_STATUS_IS_OK(status)) {
1772 reply_nterror(req, status);
1773 END_PROFILE(SMBopenX);
1774 return;
1775 }
1776
1777 if (!map_open_params_to_ntcreate(
1778 fname, deny_mode, smb_ofun, &access_mask,
1779 &share_mode, &create_disposition, &create_options)) {
1780 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1781 END_PROFILE(SMBopenX);
1782 return;
1783 }
1784
1785 status = SMB_VFS_CREATE_FILE(
1786 conn, /* conn */
1787 req, /* req */
1788 0, /* root_dir_fid */
1789 fname, /* fname */
1790 CFF_DOS_PATH, /* create_file_flags */
1791 access_mask, /* access_mask */
1792 share_mode, /* share_access */
1793 create_disposition, /* create_disposition*/
1794 create_options, /* create_options */
1795 smb_attr, /* file_attributes */
1796 oplock_request, /* oplock_request */
1797 0, /* allocation_size */
1798 NULL, /* sd */
1799 NULL, /* ea_list */
1800 &fsp, /* result */
1801 &smb_action, /* pinfo */
1802 &sbuf); /* psbuf */
1803
1804 if (!NT_STATUS_IS_OK(status)) {
1805 END_PROFILE(SMBopenX);
1806 if (open_was_deferred(req->mid)) {
1807 /* We have re-scheduled this call. */
1808 return;
1809 }
1810 reply_openerror(req, status);
1811 return;
1812 }
1813
1814 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1815 if the file is truncated or created. */
1816 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1817 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1818 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1819 close_file(req, fsp, ERROR_CLOSE);
1820 reply_nterror(req, NT_STATUS_DISK_FULL);
1821 END_PROFILE(SMBopenX);
1822 return;
1823 }
1824 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1825 if (retval < 0) {
1826 close_file(req, fsp, ERROR_CLOSE);
1827 reply_nterror(req, NT_STATUS_DISK_FULL);
1828 END_PROFILE(SMBopenX);
1829 return;
1830 }
1831 sbuf.st_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
1832 }
1833
1834 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1835 mtime = sbuf.st_mtime;
1836 if (fattr & aDIR) {
1837 close_file(req, fsp, ERROR_CLOSE);
1838 reply_doserror(req, ERRDOS, ERRnoaccess);
1839 END_PROFILE(SMBopenX);
1840 return;
1841 }
1842
1843 /* If the caller set the extended oplock request bit
1844 and we granted one (by whatever means) - set the
1845 correct bit for extended oplock reply.
1846 */
1847
1848 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1849 smb_action |= EXTENDED_OPLOCK_GRANTED;
1850 }
1851
1852 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1853 smb_action |= EXTENDED_OPLOCK_GRANTED;
1854 }
1855
1856 /* If the caller set the core oplock request bit
1857 and we granted one (by whatever means) - set the
1858 correct bit for core oplock reply.
1859 */
1860
1861 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1862 reply_outbuf(req, 19, 0);
1863 } else {
1864 reply_outbuf(req, 15, 0);
1865 }
1866
1867 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1868 SCVAL(req->outbuf, smb_flg,
1869 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1870 }
1871
1872 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1873 SCVAL(req->outbuf, smb_flg,
1874 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1875 }
1876
1877 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1878 SSVAL(req->outbuf,smb_vwv3,fattr);
1879 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1880 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1881 } else {
1882 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1883 }
1884 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1885 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1886 SSVAL(req->outbuf,smb_vwv11,smb_action);
1887
1888 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1889 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1890 }
1891
1892 END_PROFILE(SMBopenX);
1893 chain_reply(req);
1894 return;
1895 }
1896
1897 /****************************************************************************
1898 Reply to a SMBulogoffX.
1899 ****************************************************************************/
1900
1901 void reply_ulogoffX(struct smb_request *req)
1902 {
1903 user_struct *vuser;
1904
1905 START_PROFILE(SMBulogoffX);
1906
1907 vuser = get_valid_user_struct(req->vuid);
1908
1909 if(vuser == NULL) {
1910 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1911 req->vuid));
1912 }
1913
1914 /* in user level security we are supposed to close any files
1915 open by this user */
1916 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1917 file_close_user(req->vuid);
1918 }
1919
1920 invalidate_vuid(req->vuid);
1921
1922 reply_outbuf(req, 2, 0);
1923
1924 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1925
1926 END_PROFILE(SMBulogoffX);
1927 chain_reply(req);
1928 }
1929
1930 /****************************************************************************
1931 Reply to a mknew or a create.
1932 ****************************************************************************/
1933
1934 void reply_mknew(struct smb_request *req)
1935 {
1936 connection_struct *conn = req->conn;
1937 char *fname = NULL;
1938 uint32 fattr = 0;
1939 struct smb_file_time ft;
1940 files_struct *fsp;
1941 int oplock_request = 0;
1942 SMB_STRUCT_STAT sbuf;
1943 NTSTATUS status;
1944 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1945 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1946 uint32 create_disposition;
1947 uint32 create_options = 0;
1948 TALLOC_CTX *ctx = talloc_tos();
1949
1950 START_PROFILE(SMBcreate);
1951 ZERO_STRUCT(ft);
1952 SET_STAT_INVALID(sbuf);
1953
1954 if (req->wct < 3) {
1955 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1956 END_PROFILE(SMBcreate);
1957 return;
1958 }
1959
1960 fattr = SVAL(req->vwv+0, 0);
1961 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1962
1963 /* mtime. */
1964 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
1965
1966 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
1967 STR_TERMINATE, &status);
1968 if (!NT_STATUS_IS_OK(status)) {
1969 reply_nterror(req, status);
1970 END_PROFILE(SMBcreate);
1971 return;
1972 }
1973
1974 if (fattr & aVOLID) {
1975 DEBUG(0,("Attempt to create file (%s) with volid set - "
1976 "please report this\n", fname));
1977 }
1978
1979 if(req->cmd == SMBmknew) {
1980 /* We should fail if file exists. */
1981 create_disposition = FILE_CREATE;
1982 } else {
1983 /* Create if file doesn't exist, truncate if it does. */
1984 create_disposition = FILE_OVERWRITE_IF;
1985 }
1986
1987 status = SMB_VFS_CREATE_FILE(
1988 conn, /* conn */
1989 req, /* req */
1990 0, /* root_dir_fid */
1991 fname, /* fname */
1992 CFF_DOS_PATH, /* create_file_flags */
1993 access_mask, /* access_mask */
1994 share_mode, /* share_access */
1995 create_disposition, /* create_disposition*/
1996 create_options, /* create_options */
1997 fattr, /* file_attributes */
1998 oplock_request, /* oplock_request */
1999 0, /* allocation_size */
2000 NULL, /* sd */
2001 NULL, /* ea_list */
2002 &fsp, /* result */
2003 NULL, /* pinfo */
2004 &sbuf); /* psbuf */
2005
2006 if (!NT_STATUS_IS_OK(status)) {
2007 END_PROFILE(SMBcreate);
2008 if (open_was_deferred(req->mid)) {
2009 /* We have re-scheduled this call. */
2010 return;
2011 }
2012 reply_openerror(req, status);
2013 return;
2014 }
2015
2016 ft.atime = get_atimespec(&sbuf); /* atime. */
2017 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
2018 if (!NT_STATUS_IS_OK(status)) {
2019 END_PROFILE(SMBcreate);
2020 reply_openerror(req, status);
2021 return;
2022 }
2023
2024 reply_outbuf(req, 1, 0);
2025 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2026
2027 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2028 SCVAL(req->outbuf,smb_flg,
2029 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2030 }
2031
2032 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2033 SCVAL(req->outbuf,smb_flg,
2034 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2035 }
2036
2037 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2038 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2039 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2040
2041 END_PROFILE(SMBcreate);
2042 return;
2043 }
2044
2045 /****************************************************************************
2046 Reply to a create temporary file.
2047 ****************************************************************************/
2048
2049 void reply_ctemp(struct smb_request *req)
2050 {
2051 connection_struct *conn = req->conn;
2052 char *fname = NULL;
2053 uint32 fattr;
2054 files_struct *fsp;
2055 int oplock_request;
2056 int tmpfd;
2057 SMB_STRUCT_STAT sbuf;
2058 char *s;
2059 NTSTATUS status;
2060 TALLOC_CTX *ctx = talloc_tos();
2061
2062 START_PROFILE(SMBctemp);
2063
2064 if (req->wct < 3) {
2065 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2066 END_PROFILE(SMBctemp);
2067 return;
2068 }
2069
2070 fattr = SVAL(req->vwv+0, 0);
2071 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2072
2073 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2074 STR_TERMINATE, &status);
2075 if (!NT_STATUS_IS_OK(status)) {
2076 reply_nterror(req, status);
2077 END_PROFILE(SMBctemp);
2078 return;
2079 }
2080 if (*fname) {
2081 fname = talloc_asprintf(ctx,
2082 "%s/TMXXXXXX",
2083 fname);
2084 } else {
2085 fname = talloc_strdup(ctx, "TMXXXXXX");
2086 }
2087
2088 if (!fname) {
2089 reply_nterror(req, NT_STATUS_NO_MEMORY);
2090 END_PROFILE(SMBctemp);
2091 return;
2092 }
2093
2094 status = resolve_dfspath(ctx, conn,
2095 req->flags2 & FLAGS2_DFS_PATHNAMES,
2096 fname,
2097 &fname);
2098 if (!NT_STATUS_IS_OK(status)) {
2099 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2100 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2101 ERRSRV, ERRbadpath);
2102 END_PROFILE(SMBctemp);
2103 return;
2104 }
2105 reply_nterror(req, status);
2106 END_PROFILE(SMBctemp);
2107 return;
2108 }
2109
2110 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2111 if (!NT_STATUS_IS_OK(status)) {
2112 reply_nterror(req, status);
2113 END_PROFILE(SMBctemp);
2114 return;
2115 }
2116
2117 status = check_name(conn, fname);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 reply_nterror(req, status);
2120 END_PROFILE(SMBctemp);
2121 return;
2122 }
2123
2124 tmpfd = smb_mkstemp(fname);
2125 if (tmpfd == -1) {
2126 reply_unixerror(req, ERRDOS, ERRnoaccess);
2127 END_PROFILE(SMBctemp);
2128 return;
2129 }
2130
2131 SET_STAT_INVALID(sbuf);
2132 SMB_VFS_STAT(conn,fname,&sbuf);
2133
2134 /* We should fail if file does not exist. */
2135 status = SMB_VFS_CREATE_FILE(
2136 conn, /* conn */
2137 req, /* req */
2138 0, /* root_dir_fid */
2139 fname, /* fname */
2140 0, /* create_file_flags */
2141 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2142 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2143 FILE_OPEN, /* create_disposition*/
2144 0, /* create_options */
2145 fattr, /* file_attributes */
2146 oplock_request, /* oplock_request */
2147 0, /* allocation_size */
2148 NULL, /* sd */
2149 NULL, /* ea_list */
2150 &fsp, /* result */
2151 NULL, /* pinfo */
2152 &sbuf); /* psbuf */
2153
2154 /* close fd from smb_mkstemp() */
2155 close(tmpfd);
2156
2157 if (!NT_STATUS_IS_OK(status)) {
2158 if (open_was_deferred(req->mid)) {
2159 /* We have re-scheduled this call. */
2160 END_PROFILE(SMBctemp);
2161 return;
2162 }
2163 reply_openerror(req, status);
2164 END_PROFILE(SMBctemp);
2165 return;
2166 }
2167
2168 reply_outbuf(req, 1, 0);
2169 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2170
2171 /* the returned filename is relative to the directory */
2172 s = strrchr_m(fsp->fsp_name, '/');
2173 if (!s) {
2174 s = fsp->fsp_name;
2175 } else {
2176 s++;
2177 }
2178
2179 #if 0
2180 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2181 thing in the byte section. JRA */
2182 SSVALS(p, 0, -1); /* what is this? not in spec */
2183 #endif
2184 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2185 == -1) {
2186 reply_nterror(req, NT_STATUS_NO_MEMORY);
2187 END_PROFILE(SMBctemp);
2188 return;
2189 }
2190
2191 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2192 SCVAL(req->outbuf, smb_flg,
2193 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2194 }
2195
2196 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2197 SCVAL(req->outbuf, smb_flg,
2198 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2199 }
2200
2201 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2202 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2203 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2204
2205 END_PROFILE(SMBctemp);
2206 return;
2207 }
2208
2209 /*******************************************************************
2210 Check if a user is allowed to rename a file.
2211 ********************************************************************/
2212
2213 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2214 uint16 dirtype, SMB_STRUCT_STAT *pst)
2215 {
2216 uint32 fmode;
2217
2218 if (!CAN_WRITE(conn)) {
2219 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2220 }
2221
2222 fmode = dos_mode(conn, fsp->fsp_name, pst);
2223 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2224 return NT_STATUS_NO_SUCH_FILE;
2225 }
2226
2227 if (S_ISDIR(pst->st_mode)) {
2228 if (fsp->posix_open) {
2229 return NT_STATUS_OK;
2230 }
2231
2232 /* If no pathnames are open below this
2233 directory, allow the rename. */
2234
2235 if (file_find_subpath(fsp)) {
2236 return NT_STATUS_ACCESS_DENIED;
2237 }
2238 return NT_STATUS_OK;
2239 }
2240
2241 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2242 return NT_STATUS_OK;
2243 }
2244
2245 return NT_STATUS_ACCESS_DENIED;
2246 }
2247
2248 /*******************************************************************
2249 * unlink a file with all relevant access checks
2250 *******************************************************************/
2251
2252 static NTSTATUS do_unlink(connection_struct *conn,
2253 struct smb_request *req,
2254 const char *fname,
2255 uint32 dirtype)
2256 {
2257 SMB_STRUCT_STAT sbuf;
2258 uint32 fattr;
2259 files_struct *fsp;
2260 uint32 dirtype_orig = dirtype;
2261 NTSTATUS status;
2262
2263 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2264
2265 if (!CAN_WRITE(conn)) {
2266 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2267 }
2268
2269 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2270 return map_nt_error_from_unix(errno);
2271 }
2272
2273 fattr = dos_mode(conn,fname,&sbuf);
2274
2275 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2276 dirtype = aDIR|aARCH|aRONLY;
2277 }
2278
2279 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2280 if (!dirtype) {
2281 return NT_STATUS_NO_SUCH_FILE;
2282 }
2283
2284 if (!dir_check_ftype(conn, fattr, dirtype)) {
2285 if (fattr & aDIR) {
2286 return NT_STATUS_FILE_IS_A_DIRECTORY;
2287 }
2288 return NT_STATUS_NO_SUCH_FILE;
2289 }
2290
2291 if (dirtype_orig & 0x8000) {
2292 /* These will never be set for POSIX. */
2293 return NT_STATUS_NO_SUCH_FILE;
2294 }
2295
2296 #if 0
2297 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2298 return NT_STATUS_FILE_IS_A_DIRECTORY;
2299 }
2300
2301 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2302 return NT_STATUS_NO_SUCH_FILE;
2303 }
2304
2305 if (dirtype & 0xFF00) {
2306 /* These will never be set for POSIX. */
2307 return NT_STATUS_NO_SUCH_FILE;
2308 }
2309
2310 dirtype &= 0xFF;
2311 if (!dirtype) {
2312 return NT_STATUS_NO_SUCH_FILE;
2313 }
2314
2315 /* Can't delete a directory. */
2316 if (fattr & aDIR) {
2317 return NT_STATUS_FILE_IS_A_DIRECTORY;
2318 }
2319 #endif
2320
2321 #if 0 /* JRATEST */
2322 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2323 return NT_STATUS_OBJECT_NAME_INVALID;
2324 #endif /* JRATEST */
2325
2326 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2327
2328 On a Windows share, a file with read-only dosmode can be opened with
2329 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2330 fails with NT_STATUS_CANNOT_DELETE error.
2331
2332 This semantic causes a problem that a user can not
2333 rename a file with read-only dosmode on a Samba share
2334 from a Windows command prompt (i.e. cmd.exe, but can rename
2335 from Windows Explorer).
2336 */
2337
2338 if (!lp_delete_readonly(SNUM(conn))) {
2339 if (fattr & aRONLY) {
2340 return NT_STATUS_CANNOT_DELETE;
2341 }
2342 }
2343
2344 /* On open checks the open itself will check the share mode, so
2345 don't do it here as we'll get it wrong. */
2346
2347 status = SMB_VFS_CREATE_FILE
2348 (conn, /* conn */
2349 req, /* req */
2350 0, /* root_dir_fid */
2351 fname, /* fname */
2352 0, /* create_file_flags */
2353 DELETE_ACCESS, /* access_mask */
2354 FILE_SHARE_NONE, /* share_access */
2355 FILE_OPEN, /* create_disposition*/
2356 FILE_NON_DIRECTORY_FILE, /* create_options */
2357 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2358 0, /* oplock_request */
2359 0, /* allocation_size */
2360 NULL, /* sd */
2361 NULL, /* ea_list */
2362 &fsp, /* result */
2363 NULL, /* pinfo */
2364 &sbuf); /* psbuf */
2365
2366 if (!NT_STATUS_IS_OK(status)) {
2367 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2368 nt_errstr(status)));
2369 return status;
2370 }
2371
2372 /* The set is across all open files on this dev/inode pair. */
2373 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2374 close_file(req, fsp, NORMAL_CLOSE);
2375 return NT_STATUS_ACCESS_DENIED;
2376 }
2377
2378 return close_file(req, fsp, NORMAL_CLOSE);
2379 }
2380
2381 /****************************************************************************
2382 The guts of the unlink command, split out so it may be called by the NT SMB
2383 code.
2384 ****************************************************************************/
2385
2386 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2387 uint32 dirtype, const char *name_in, bool has_wild)
2388 {
2389 const char *directory = NULL;
2390 char *mask = NULL;
2391 char *name = NULL;
2392 char *p = NULL;
2393 int count=0;
2394 NTSTATUS status = NT_STATUS_OK;
2395 SMB_STRUCT_STAT sbuf, st;
2396 TALLOC_CTX *ctx = talloc_tos();
2397
2398 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2399 if (!NT_STATUS_IS_OK(status)) {
2400 return status;
2401 }
2402
2403 p = strrchr_m(name,'/');
2404 if (!p) {
2405 directory = talloc_strdup(ctx, ".");
2406 if (!directory) {
2407 return NT_STATUS_NO_MEMORY;
2408 }
2409 mask = name;
2410 } else {
2411 *p = 0;
2412 directory = name;
2413 mask = p+1;
2414 }
2415
2416 /*
2417 * We should only check the mangled cache
2418 * here if unix_convert failed. This means
2419 * that the path in 'mask' doesn't exist
2420 * on the file system and so we need to look
2421 * for a possible mangle. This patch from
2422 * Tine Smukavec <valentin.smukavec@hermes.si>.
2423 */
2424
2425 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2426 char *new_mask = NULL;
2427 mangle_lookup_name_from_8_3(ctx,
2428 mask,
2429 &new_mask,
2430 conn->params );
2431 if (new_mask) {
2432 mask = new_mask;
2433 }
2434 }
2435
2436 if (!has_wild) {
2437 directory = talloc_asprintf(ctx,
2438 "%s/%s",
2439 directory,
2440 mask);
2441 if (!directory) {
2442 return NT_STATUS_NO_MEMORY;
2443 }
2444 if (dirtype == 0) {
2445 dirtype = FILE_ATTRIBUTE_NORMAL;
2446 }
2447
2448 status = check_name(conn, directory);
2449 if (!NT_STATUS_IS_OK(status)) {
2450 return status;
2451 }
2452
2453 status = do_unlink(conn, req, directory, dirtype);
2454 if (!NT_STATUS_IS_OK(status)) {
2455 return status;
2456 }
2457
2458 count++;
2459 } else {
2460 struct smb_Dir *dir_hnd = NULL;
2461 long offset = 0;
2462 const char *dname;
2463
2464 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2465 return NT_STATUS_OBJECT_NAME_INVALID;
2466 }
2467
2468 if (strequal(mask,"????????.???")) {
2469 mask[0] = '*';
2470 mask[1] = '\0';
2471 }
2472
2473 status = check_name(conn, directory);
2474 if (!NT_STATUS_IS_OK(status)) {
2475 return status;
2476 }
2477
2478 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2479 dirtype);
2480 if (dir_hnd == NULL) {
2481 return map_nt_error_from_unix(errno);
2482 }
2483
2484 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2485 the pattern matches against the long name, otherwise the short name
2486 We don't implement this yet XXXX
2487 */
2488
2489 status = NT_STATUS_NO_SUCH_FILE;
2490
2491 while ((dname = ReadDirName(dir_hnd, &offset, &st))) {
2492 char *fname = NULL;
2493
2494 if (!is_visible_file(conn, directory, dname, &st,
2495 true))
2496 {
2497 continue;
2498 }
2499
2500 /* Quick check for "." and ".." */
2501 if (ISDOT(dname) || ISDOTDOT(dname)) {
2502 continue;
2503 }
2504
2505 if(!mask_match(dname, mask, conn->case_sensitive)) {
2506 continue;
2507 }
2508
2509 fname = talloc_asprintf(ctx, "%s/%s",
2510 directory,
2511 dname);
2512 if (!fname) {
2513 return NT_STATUS_NO_MEMORY;
2514 }
2515
2516 status = check_name(conn, fname);
2517 if (!NT_STATUS_IS_OK(status)) {
2518 TALLOC_FREE(dir_hnd);
2519 return status;
2520 }
2521
2522 status = do_unlink(conn, req, fname, dirtype);
2523 if (!NT_STATUS_IS_OK(status)) {
2524 TALLOC_FREE(fname);
2525 continue;
2526 }
2527
2528 count++;
2529 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2530 fname));
2531
2532 TALLOC_FREE(fname);
2533 }
2534 TALLOC_FREE(dir_hnd);
2535 }
2536
2537 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2538 status = map_nt_error_from_unix(errno);
2539 }
2540
2541 return status;
2542 }
2543
2544 /****************************************************************************
2545 Reply to a unlink
2546 ****************************************************************************/
2547
2548 void reply_unlink(struct smb_request *req)
2549 {
2550 connection_struct *conn = req->conn;
2551 char *name = NULL;
2552 uint32 dirtype;
2553 NTSTATUS status;
2554 bool path_contains_wcard = False;
2555 TALLOC_CTX *ctx = talloc_tos();
2556
2557 START_PROFILE(SMBunlink);
2558
2559 if (req->wct < 1) {
2560 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2561 END_PROFILE(SMBunlink);
2562 return;
2563 }
2564
2565 dirtype = SVAL(req->vwv+0, 0);
2566
2567 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2568 STR_TERMINATE, &status,
2569 &path_contains_wcard);
2570 if (!NT_STATUS_IS_OK(status)) {
2571 reply_nterror(req, status);
2572 END_PROFILE(SMBunlink);
2573 return;
2574 }
2575
2576 status = resolve_dfspath_wcard(ctx, conn,
2577 req->flags2 & FLAGS2_DFS_PATHNAMES,
2578 name,
2579 &name,
2580 &path_contains_wcard);
2581 if (!NT_STATUS_IS_OK(status)) {
2582 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2583 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2584 ERRSRV, ERRbadpath);
2585 END_PROFILE(SMBunlink);
2586 return;
2587 }
2588 reply_nterror(req, status);
2589 END_PROFILE(SMBunlink);
2590 return;
2591 }
2592
2593 DEBUG(3,("reply_unlink : %s\n",name));
2594
2595 status = unlink_internals(conn, req, dirtype, name,
2596 path_contains_wcard);
2597 if (!NT_STATUS_IS_OK(status)) {
2598 if (open_was_deferred(req->mid)) {
2599 /* We have re-scheduled this call. */
2600 END_PROFILE(SMBunlink);
2601 return;
2602 }
2603 reply_nterror(req, status);
2604 END_PROFILE(SMBunlink);
2605 return;
2606 }
2607
2608 reply_outbuf(req, 0, 0);
2609 END_PROFILE(SMBunlink);
2610
2611 return;
2612 }
2613
2614 /****************************************************************************
2615 Fail for readbraw.
2616 ****************************************************************************/
2617
2618 static void fail_readraw(void)
2619 {
2620 const char *errstr = talloc_asprintf(talloc_tos(),
2621 "FAIL ! reply_readbraw: socket write fail (%s)",
2622 strerror(errno));
2623 if (!errstr) {
2624 errstr = "";
2625 }
2626 exit_server_cleanly(errstr);
2627 }
2628
2629 /****************************************************************************
2630 Fake (read/write) sendfile. Returns -1 on read or write fail.
2631 ****************************************************************************/
2632
2633 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2634 size_t nread)
2635 {
2636 size_t bufsize;
2637 size_t tosend = nread;
2638 char *buf;
2639
2640 if (nread == 0) {
2641 return 0;
2642 }
2643
2644 bufsize = MIN(nread, 65536);
2645
2646 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2647 return -1;
2648 }
2649
2650 while (tosend > 0) {
2651 ssize_t ret;
2652 size_t cur_read;
2653
2654 if (tosend > bufsize) {
2655 cur_read = bufsize;
2656 } else {
2657 cur_read = tosend;
2658 }
2659 ret = read_file(fsp,buf,startpos,cur_read);
2660 if (ret == -1) {
2661 SAFE_FREE(buf);
2662 return -1;
2663 }
2664
2665 /* If we had a short read, fill with zeros. */
2666 if (ret < cur_read) {
2667 memset(buf + ret, '\0', cur_read - ret);
2668 }
2669
2670 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2671 SAFE_FREE(buf);
2672 return -1;
2673 }
2674 tosend -= cur_read;
2675 startpos += cur_read;
2676 }
2677
2678 SAFE_FREE(buf);
2679 return (ssize_t)nread;
2680 }
2681
2682 #if defined(WITH_SENDFILE)
2683 /****************************************************************************
2684 Deal with the case of sendfile reading less bytes from the file than
2685 requested. Fill with zeros (all we can do).
2686 ****************************************************************************/
2687
2688 static void sendfile_short_send(files_struct *fsp,
2689 ssize_t nread,
2690 size_t headersize,
2691 size_t smb_maxcnt)
2692 {
2693 #define SHORT_SEND_BUFSIZE 1024
2694 if (nread < headersize) {
2695 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2696 "header for file %s (%s). Terminating\n",
2697 fsp->fsp_name, strerror(errno) ));
2698 exit_server_cleanly("sendfile_short_send failed");
2699 }
2700
2701 nread -= headersize;
2702
2703 if (nread < smb_maxcnt) {
2704 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2705 if (!buf) {
2706 exit_server_cleanly("sendfile_short_send: "
2707 "malloc failed");
2708 }
2709
2710 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2711 "with zeros !\n", fsp->fsp_name));
2712
2713 while (nread < smb_maxcnt) {
2714 /*
2715 * We asked for the real file size and told sendfile
2716 * to not go beyond the end of the file. But it can
2717 * happen that in between our fstat call and the
2718 * sendfile call the file was truncated. This is very
2719 * bad because we have already announced the larger
2720 * number of bytes to the client.
2721 *
2722 * The best we can do now is to send 0-bytes, just as
2723 * a read from a hole in a sparse file would do.
2724 *
2725 * This should happen rarely enough that I don't care
2726 * about efficiency here :-)
2727 */
2728 size_t to_write;
2729
2730 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2731 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2732 exit_server_cleanly("sendfile_short_send: "
2733 "write_data failed");
2734 }
2735 nread += to_write;
2736 }
2737 SAFE_FREE(buf);
2738 }
2739 }
2740 #endif /* defined WITH_SENDFILE */
2741
2742 /****************************************************************************
2743 Return a readbraw error (4 bytes of zero).
2744 ****************************************************************************/
2745
2746 static void reply_readbraw_error(void)
2747 {
2748 char header[4];
2749 SIVAL(header,0,0);
2750 if (write_data(smbd_server_fd(),header,4) != 4) {
2751 fail_readraw();
2752 }
2753 }
2754
2755 /****************************************************************************
2756 Use sendfile in readbraw.
2757 ****************************************************************************/
2758
2759 static void send_file_readbraw(connection_struct *conn,
2760 struct smb_request *req,
2761 files_struct *fsp,
2762 SMB_OFF_T startpos,
2763 size_t nread,
2764 ssize_t mincount)
2765 {
2766 char *outbuf = NULL;
2767 ssize_t ret=0;
2768
2769 #if defined(WITH_SENDFILE)
2770 /*
2771 * We can only use sendfile on a non-chained packet
2772 * but we can use on a non-oplocked file. tridge proved this
2773 * on a train in Germany :-). JRA.
2774 * reply_readbraw has already checked the length.
2775 */
2776
2777 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2778 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2779 ssize_t sendfile_read = -1;
2780 char header[4];
2781 DATA_BLOB header_blob;
2782
2783 _smb_setlen(header,nread);
2784 header_blob = data_blob_const(header, 4);
2785
2786 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2787 &header_blob, startpos, nread)) == -1) {
2788 /* Returning ENOSYS means no data at all was sent.
2789 * Do this as a normal read. */
2790 if (errno == ENOSYS) {
2791 goto normal_readbraw;
2792 }
2793
2794 /*
2795 * Special hack for broken Linux with no working sendfile. If we
2796 * return EINTR we sent the header but not the rest of the data.
2797 * Fake this up by doing read/write calls.
2798 */
2799 if (errno == EINTR) {
2800 /* Ensure we don't do this again. */
2801 set_use_sendfile(SNUM(conn), False);
2802 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2803
2804 if (fake_sendfile(fsp, startpos, nread) == -1) {
2805 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2806 fsp->fsp_name, strerror(errno) ));
2807 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2808 }
2809 return;
2810 }
2811
2812 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2813 fsp->fsp_name, strerror(errno) ));
2814 exit_server_cleanly("send_file_readbraw sendfile failed");
2815 } else if (sendfile_read == 0) {
2816 /*
2817 * Some sendfile implementations return 0 to indicate
2818 * that there was a short read, but nothing was
2819 * actually written to the socket. In this case,
2820 * fallback to the normal read path so the header gets
2821 * the correct byte count.
2822 */
2823 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2824 "bytes falling back to the normal read: "
2825 "%s\n", fsp->fsp_name));
2826 goto normal_readbraw;
2827 }
2828
2829 /* Deal with possible short send. */
2830 if (sendfile_read != 4+nread) {
2831 sendfile_short_send(fsp, sendfile_read, 4, nread);
2832 }
2833 return;
2834 }
2835
2836 normal_readbraw:
2837 #endif
2838
2839 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2840 if (!outbuf) {
2841 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2842 (unsigned)(nread+4)));
2843 reply_readbraw_error();
2844 return;
2845 }
2846
2847 if (nread > 0) {
2848 ret = read_file(fsp,outbuf+4,startpos,nread);
2849 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2850 if (ret < mincount)
2851 ret = 0;
2852 #else
2853 if (ret < nread)
2854 ret = 0;
2855 #endif
2856 }
2857
2858 _smb_setlen(outbuf,ret);
2859 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2860 fail_readraw();
2861
2862 TALLOC_FREE(outbuf);
2863 }
2864
2865 /****************************************************************************
2866 Reply to a readbraw (core+ protocol).
2867 ****************************************************************************/
2868
2869 void reply_readbraw(struct smb_request *req)
2870 {
2871 connection_struct *conn = req->conn;
2872 ssize_t maxcount,mincount;
2873 size_t nread = 0;
2874 SMB_OFF_T startpos;
2875 files_struct *fsp;
2876 struct lock_struct lock;
2877 SMB_STRUCT_STAT st;
2878 SMB_OFF_T size = 0;
2879
2880 START_PROFILE(SMBreadbraw);
2881
2882 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2883 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2884 "raw reads/writes are disallowed.");
2885 }
2886
2887 if (req->wct < 8) {
2888 reply_readbraw_error();
2889 END_PROFILE(SMBreadbraw);
2890 return;
2891 }
2892
2893 /*
2894 * Special check if an oplock break has been issued
2895 * and the readraw request croses on the wire, we must
2896 * return a zero length response here.
2897 */
2898
2899 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
2900
2901 /*
2902 * We have to do a check_fsp by hand here, as
2903 * we must always return 4 zero bytes on error,
2904 * not a NTSTATUS.
2905 */
2906
2907 if (!fsp || !conn || conn != fsp->conn ||
2908 req->vuid != fsp->vuid ||
2909 fsp->is_directory || fsp->fh->fd == -1) {
2910 /*
2911 * fsp could be NULL here so use the value from the packet. JRA.
2912 */
2913 DEBUG(3,("reply_readbraw: fnum %d not valid "
2914 "- cache prime?\n",
2915 (int)SVAL(req->vwv+0, 0)));
2916 reply_readbraw_error();
2917 END_PROFILE(SMBreadbraw);
2918 return;
2919 }
2920
2921 /* Do a "by hand" version of CHECK_READ. */
2922 if (!(fsp->can_read ||
2923 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2924 (fsp->access_mask & FILE_EXECUTE)))) {
2925 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2926 (int)SVAL(req->vwv+0, 0)));
2927 reply_readbraw_error();
2928 END_PROFILE(SMBreadbraw);
2929 return;
2930 }
2931
2932 flush_write_cache(fsp, READRAW_FLUSH);
2933
2934 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
2935 if(req->wct == 10) {
2936 /*
2937 * This is a large offset (64 bit) read.
2938 */
2939 #ifdef LARGE_SMB_OFF_T
2940
2941 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
2942
2943 #else /* !LARGE_SMB_OFF_T */
2944
2945 /*
2946 * Ensure we haven't been sent a >32 bit offset.
2947 */
2948
2949 if(IVAL(req->vwv+8, 0) != 0) {
2950 DEBUG(0,("reply_readbraw: large offset "
2951 "(%x << 32) used and we don't support "
2952 "64 bit offsets.\n",
2953 (unsigned int)IVAL(req->vwv+8, 0) ));
2954 reply_readbraw_error();
2955 END_PROFILE(SMBreadbraw);
2956 return;
2957 }
2958
2959 #endif /* LARGE_SMB_OFF_T */
2960
2961 if(startpos < 0) {
2962 DEBUG(0,("reply_readbraw: negative 64 bit "
2963 "readraw offset (%.0f) !\n",
2964 (double)startpos ));
2965 reply_readbraw_error();
2966 END_PROFILE(SMBreadbraw);
2967 return;
2968 }
2969 }
2970
2971 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
2972 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
2973
2974 /* ensure we don't overrun the packet size */
2975 maxcount = MIN(65535,maxcount);
2976
2977 init_strict_lock_struct(fsp, (uint32)req->smbpid,
2978 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
2979 &lock);
2980
2981 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
2982 reply_readbraw_error();
2983 END_PROFILE(SMBreadbraw);
2984 return;
2985 }
2986
2987 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2988 size = st.st_size;
2989 }
2990
2991 if (startpos >= size) {
2992 nread = 0;
2993 } else {
2994 nread = MIN(maxcount,(size - startpos));
2995 }
2996
2997 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2998 if (nread < mincount)
2999 nread = 0;
3000 #endif
3001
3002 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3003 "min=%lu nread=%lu\n",
3004 fsp->fnum, (double)startpos,
3005 (unsigned long)maxcount,
3006 (unsigned long)mincount,
3007 (unsigned long)nread ) );
3008
3009 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3010
3011 DEBUG(5,("reply_readbraw finished\n"));
3012
3013 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3014
3015 END_PROFILE(SMBreadbraw);
3016 return;
3017 }
3018
3019 #undef DBGC_CLASS
3020 #define DBGC_CLASS DBGC_LOCKING
3021
3022 /****************************************************************************
3023 Reply to a lockread (core+ protocol).
3024 ****************************************************************************/
3025
3026 void reply_lockread(struct smb_request *req)
3027 {
3028 connection_struct *conn = req->conn;
3029 ssize_t nread = -1;
3030 char *data;
3031 SMB_OFF_T startpos;
3032 size_t numtoread;
3033 NTSTATUS status;
3034 files_struct *fsp;
3035 struct byte_range_lock *br_lck = NULL;
3036 char *p = NULL;
3037
3038 START_PROFILE(SMBlockread);
3039
3040 if (req->wct < 5) {
3041 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3042 END_PROFILE(SMBlockread);
3043 return;
3044 }
3045
3046 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3047
3048 if (!check_fsp(conn, req, fsp)) {
3049 END_PROFILE(SMBlockread);
3050 return;
3051 }
3052
3053 if (!CHECK_READ(fsp,req)) {
3054 reply_doserror(req, ERRDOS, ERRbadaccess);
3055 END_PROFILE(SMBlockread);
3056 return;
3057 }
3058
3059 numtoread = SVAL(req->vwv+1, 0);
3060 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3061
3062 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3063
3064 reply_outbuf(req, 5, numtoread + 3);
3065
3066 data = smb_buf(req->outbuf) + 3;
3067
3068 /*
3069 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3070 * protocol request that predates the read/write lock concept.
3071 * Thus instead of asking for a read lock here we need to ask
3072 * for a write lock. JRA.
3073 * Note that the requested lock size is unaffected by max_recv.
3074 */
3075
3076 br_lck = do_lock(smbd_messaging_context(),
3077 fsp,
3078 req->smbpid,
3079 (uint64_t)numtoread,
3080 (uint64_t)startpos,
3081 WRITE_LOCK,
3082 WINDOWS_LOCK,
3083 False, /* Non-blocking lock. */
3084 &status,
3085 NULL,
3086 NULL);
3087 TALLOC_FREE(br_lck);
3088
3089 if (NT_STATUS_V(status)) {
3090 reply_nterror(req, status);
3091 END_PROFILE(SMBlockread);
3092 return;
3093 }
3094
3095 /*
3096 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3097 */
3098
3099 if (numtoread > max_recv) {
3100 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3101 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3102 (unsigned int)numtoread, (unsigned int)max_recv ));
3103 numtoread = MIN(numtoread,max_recv);
3104 }
3105 nread = read_file(fsp,data,startpos,numtoread);
3106
3107 if (nread < 0) {
3108 reply_unixerror(req, ERRDOS, ERRnoaccess);
3109 END_PROFILE(SMBlockread);
3110 return;
3111 }
3112
3113 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3114
3115 SSVAL(req->outbuf,smb_vwv0,nread);
3116 SSVAL(req->outbuf,smb_vwv5,nread+3);
3117 p = smb_buf(req->outbuf);
3118 SCVAL(p,0,0); /* pad byte. */
3119 SSVAL(p,1,nread);
3120
3121 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3122 fsp->fnum, (int)numtoread, (int)nread));
3123
3124 END_PROFILE(SMBlockread);
3125 return;
3126 }
3127
3128 #undef DBGC_CLASS
3129 #define DBGC_CLASS DBGC_ALL
3130
3131 /****************************************************************************
3132 Reply to a read.
3133 ****************************************************************************/
3134
3135 void reply_read(struct smb_request *req)
3136 {
3137 connection_struct *conn = req->conn;
3138 size_t numtoread;
3139 ssize_t nread = 0;
3140 char *data;
3141 SMB_OFF_T startpos;
3142 int outsize = 0;
3143 files_struct *fsp;
3144 struct lock_struct lock;
3145
3146 START_PROFILE(SMBread);
3147
3148 if (req->wct < 3) {
3149 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3150 END_PROFILE(SMBread);
3151 return;
3152 }
3153
3154 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3155
3156 if (!check_fsp(conn, req, fsp)) {
3157 END_PROFILE(SMBread);
3158 return;
3159 }
3160
3161 if (!CHECK_READ(fsp,req)) {
3162 reply_doserror(req, ERRDOS, ERRbadaccess);
3163 END_PROFILE(SMBread);
3164 return;
3165 }
3166
3167 numtoread = SVAL(req->vwv+1, 0);
3168 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3169
3170 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3171
3172 /*
3173 * The requested read size cannot be greater than max_recv. JRA.
3174 */
3175 if (numtoread > max_recv) {
3176 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3177 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3178 (unsigned int)numtoread, (unsigned int)max_recv ));
3179 numtoread = MIN(numtoread,max_recv);
3180 }
3181
3182 reply_outbuf(req, 5, numtoread+3);
3183
3184 data = smb_buf(req->outbuf) + 3;
3185
3186 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3187 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3188 &lock);
3189
3190 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3191 reply_doserror(req, ERRDOS,ERRlock);
3192 END_PROFILE(SMBread);
3193 return;
3194 }
3195
3196 if (numtoread > 0)
3197 nread = read_file(fsp,data,startpos,numtoread);
3198
3199 if (nread < 0) {
3200 reply_unixerror(req, ERRDOS,ERRnoaccess);
3201 goto strict_unlock;
3202 }
3203
3204 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3205
3206 SSVAL(req->outbuf,smb_vwv0,nread);
3207 SSVAL(req->outbuf,smb_vwv5,nread+3);
3208 SCVAL(smb_buf(req->outbuf),0,1);
3209 SSVAL(smb_buf(req->outbuf),1,nread);
3210
3211 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3212 fsp->fnum, (int)numtoread, (int)nread ) );
3213
3214 strict_unlock:
3215 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3216
3217 END_PROFILE(SMBread);
3218 return;
3219 }
3220
3221 /****************************************************************************
3222 Setup readX header.
3223 ****************************************************************************/
3224
3225 static int setup_readX_header(struct smb_request *req, char *outbuf,
3226 size_t smb_maxcnt)
3227 {
3228 int outsize;
3229 char *data;
3230
3231 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3232 data = smb_buf(outbuf);
3233
3234 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3235
3236 SCVAL(outbuf,smb_vwv0,0xFF);
3237 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3238 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3239 SSVAL(outbuf,smb_vwv6,
3240 req_wct_ofs(req)
3241 + 1 /* the wct field */
3242 + 12 * sizeof(uint16_t) /* vwv */
3243 + 2); /* the buflen field */
3244 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3245 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3246 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3247 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3248 return outsize;
3249 }
3250
3251 /****************************************************************************
3252 Reply to a read and X - possibly using sendfile.
3253 ****************************************************************************/
3254
3255 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3256 files_struct *fsp, SMB_OFF_T startpos,
3257 size_t smb_maxcnt)
3258 {
3259 SMB_STRUCT_STAT sbuf;
3260 ssize_t nread = -1;
3261 struct lock_struct lock;
3262
3263 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3264 reply_unixerror(req, ERRDOS, ERRnoaccess);
3265 return;
3266 }
3267
3268 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3269 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3270 &lock);
3271
3272 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3273 reply_doserror(req, ERRDOS, ERRlock);
3274 return;
3275 }
3276
3277 if (!S_ISREG(sbuf.st_mode) || (startpos > sbuf.st_size)
3278 || (smb_maxcnt > (sbuf.st_size - startpos))) {
3279 /*
3280 * We already know that we would do a short read, so don't
3281 * try the sendfile() path.
3282 */
3283 goto nosendfile_read;
3284 }
3285
3286 #if defined(WITH_SENDFILE)
3287 /*
3288 * We can only use sendfile on a non-chained packet
3289 * but we can use on a non-oplocked file. tridge proved this
3290 * on a train in Germany :-). JRA.
3291 */
3292
3293 if (!req_is_in_chain(req) &&
3294 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3295 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3296 uint8 headerbuf[smb_size + 12 * 2];
3297 DATA_BLOB header;
3298
3299 /*
3300 * Set up the packet header before send. We
3301 * assume here the sendfile will work (get the
3302 * correct amount of data).
3303 */
3304
3305 header = data_blob_const(headerbuf, sizeof(headerbuf));
3306
3307 construct_reply_common_req(req, (char *)headerbuf);
3308 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3309
3310 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3311 /* Returning ENOSYS means no data at all was sent.
3312 Do this as a normal read. */
3313 if (errno == ENOSYS) {
3314 goto normal_read;
3315 }
3316
3317 /*
3318 * Special hack for broken Linux with no working sendfile. If we
3319 * return EINTR we sent the header but not the rest of the data.
3320 * Fake this up by doing read/write calls.
3321 */
3322
3323 if (errno == EINTR) {
3324 /* Ensure we don't do this again. */
3325 set_use_sendfile(SNUM(conn), False);
3326 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3327 nread = fake_sendfile(fsp, startpos,
3328 smb_maxcnt);
3329 if (nread == -1) {
3330 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3331 fsp->fsp_name, strerror(errno) ));
3332 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3333 }
3334 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3335 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3336 /* No outbuf here means successful sendfile. */
3337 goto strict_unlock;
3338 }
3339
3340 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3341 fsp->fsp_name, strerror(errno) ));
3342 exit_server_cleanly("send_file_readX sendfile failed");
3343 } else if (nread == 0) {
3344 /*
3345 * Some sendfile implementations return 0 to indicate
3346 * that there was a short read, but nothing was
3347 * actually written to the socket. In this case,
3348 * fallback to the normal read path so the header gets
3349 * the correct byte count.
3350 */
3351 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3352 "falling back to the normal read: %s\n",
3353 fsp->fsp_name));
3354 goto normal_read;
3355 }
3356
3357 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3358 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3359
3360 /* Deal with possible short send. */
3361 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3362 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3363 }
3364 /* No outbuf here means successful sendfile. */
3365 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3366 SMB_PERFCOUNT_END(&req->pcd);
3367 goto strict_unlock;
3368 }
3369
3370 normal_read:
3371
3372 #endif
3373
3374 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3375 uint8 headerbuf[smb_size + 2*12];
3376
3377 construct_reply_common_req(req, (char *)headerbuf);
3378 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3379
3380 /* Send out the header. */
3381 if (write_data(smbd_server_fd(), (char *)headerbuf,
3382 sizeof(headerbuf)) != sizeof(headerbuf)) {
3383 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3384 fsp->fsp_name, strerror(errno) ));
3385 exit_server_cleanly("send_file_readX sendfile failed");
3386 }
3387 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3388 if (nread == -1) {
3389 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3390 fsp->fsp_name, strerror(errno) ));
3391 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3392 }
3393 goto strict_unlock;
3394 }
3395
3396 nosendfile_read:
3397
3398 reply_outbuf(req, 12, smb_maxcnt);
3399
3400 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3401
3402 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3403
3404 if (nread < 0) {
3405 reply_unixerror(req, ERRDOS, ERRnoaccess);
3406 return;
3407 }
3408
3409 setup_readX_header(req, (char *)req->outbuf, nread);
3410
3411 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3412 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3413
3414 chain_reply(req);
3415 return;
3416
3417 strict_unlock:
3418 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3419 TALLOC_FREE(req->outbuf);
3420 return;
3421 }
3422
3423 /****************************************************************************
3424 Reply to a read and X.
3425 ****************************************************************************/
3426
3427 void reply_read_and_X(struct smb_request *req)
3428 {
3429 connection_struct *conn = req->conn;
3430 files_struct *fsp;
3431 SMB_OFF_T startpos;
3432 size_t smb_maxcnt;
3433 bool big_readX = False;
3434 #if 0
3435 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3436 #endif
3437
3438 START_PROFILE(SMBreadX);
3439
3440 if ((req->wct != 10) && (req->wct != 12)) {
3441 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3442 return;
3443 }
3444
3445 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3446 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3447 smb_maxcnt = SVAL(req->vwv+5, 0);
3448
3449 /* If it's an IPC, pass off the pipe handler. */
3450 if (IS_IPC(conn)) {
3451 reply_pipe_read_and_X(req);
3452 END_PROFILE(SMBreadX);
3453 return;
3454 }
3455
3456 if (!check_fsp(conn, req, fsp)) {
3457 END_PROFILE(SMBreadX);
3458 return;
3459 }
3460
3461 if (!CHECK_READ(fsp,req)) {
3462 reply_doserror(req, ERRDOS,ERRbadaccess);
3463 END_PROFILE(SMBreadX);
3464 return;
3465 }
3466
3467 if (global_client_caps & CAP_LARGE_READX) {
3468 size_t upper_size = SVAL(req->vwv+7, 0);
3469 smb_maxcnt |= (upper_size<<16);
3470 if (upper_size > 1) {
3471 /* Can't do this on a chained packet. */
3472 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3473 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3474 END_PROFILE(SMBreadX);
3475 return;
3476 }
3477 /* We currently don't do this on signed or sealed data. */
3478 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3479 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3480 END_PROFILE(SMBreadX);
3481 return;
3482 }
3483 /* Is there room in the reply for this data ? */
3484 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3485 reply_nterror(req,
3486 NT_STATUS_INVALID_PARAMETER);
3487 END_PROFILE(SMBreadX);
3488 return;
3489 }
3490 big_readX = True;
3491 }
3492 }
3493
3494 if (req->wct == 12) {
3495 #ifdef LARGE_SMB_OFF_T
3496 /*
3497 * This is a large offset (64 bit) read.
3498 */
3499 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3500
3501 #else /* !LARGE_SMB_OFF_T */
3502
3503 /*
3504 * Ensure we haven't been sent a >32 bit offset.
3505 */
3506
3507 if(IVAL(req->vwv+10, 0) != 0) {
3508 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3509 "used and we don't support 64 bit offsets.\n",
3510 (unsigned int)IVAL(req->vwv+10, 0) ));
3511 END_PROFILE(SMBreadX);
3512 reply_doserror(req, ERRDOS, ERRbadaccess);
3513 return;
3514 }
3515
3516 #endif /* LARGE_SMB_OFF_T */
3517
3518 }
3519
3520 if (!big_readX &&
3521 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3522 goto out;
3523 }
3524
3525 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3526
3527 out:
3528 END_PROFILE(SMBreadX);
3529 return;
3530 }
3531
3532 /****************************************************************************
3533 Error replies to writebraw must have smb_wct == 1. Fix this up.
3534 ****************************************************************************/
3535
3536 void error_to_writebrawerr(struct smb_request *req)
3537 {
3538 uint8 *old_outbuf = req->outbuf;
3539
3540 reply_outbuf(req, 1, 0);
3541
3542 memcpy(req->outbuf, old_outbuf, smb_size);
3543 TALLOC_FREE(old_outbuf);
3544 }
3545
3546 /****************************************************************************
3547 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3548 ****************************************************************************/
3549
3550 void reply_writebraw(struct smb_request *req)
3551 {
3552 connection_struct *conn = req->conn;
3553 char *buf = NULL;
3554 ssize_t nwritten=0;
3555 ssize_t total_written=0;
3556 size_t numtowrite=0;
3557 size_t tcount;
3558 SMB_OFF_T startpos;
3559 char *data=NULL;
3560 bool write_through;
3561 files_struct *fsp;
3562 struct lock_struct lock;
3563 NTSTATUS status;
3564
3565 START_PROFILE(SMBwritebraw);
3566
3567 /*
3568 * If we ever reply with an error, it must have the SMB command
3569 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3570 * we're finished.
3571 */
3572 SCVAL(req->inbuf,smb_com,SMBwritec);
3573
3574 if (srv_is_signing_active()) {
3575 END_PROFILE(SMBwritebraw);
3576 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3577 "raw reads/writes are disallowed.");
3578 }
3579
3580 if (req->wct < 12) {
3581 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3582 error_to_writebrawerr(req);
3583 END_PROFILE(SMBwritebraw);
3584 return;
3585 }
3586
3587 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3588 if (!check_fsp(conn, req, fsp)) {
3589 error_to_writebrawerr(req);
3590 END_PROFILE(SMBwritebraw);
3591 return;
3592 }
3593
3594 if (!CHECK_WRITE(fsp)) {
3595 reply_doserror(req, ERRDOS, ERRbadaccess);
3596 error_to_writebrawerr(req);
3597 END_PROFILE(SMBwritebraw);
3598 return;
3599 }
3600
3601 tcount = IVAL(req->vwv+1, 0);
3602 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3603 write_through = BITSETW(req->vwv+7,0);
3604
3605 /* We have to deal with slightly different formats depending
3606 on whether we are using the core+ or lanman1.0 protocol */
3607
3608 if(Protocol <= PROTOCOL_COREPLUS) {
3609 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3610 data = smb_buf(req->inbuf);
3611 } else {
3612 numtowrite = SVAL(req->vwv+10, 0);
3613 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3614 }
3615
3616 /* Ensure we don't write bytes past the end of this packet. */
3617 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3618 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3619 error_to_writebrawerr(req);
3620 END_PROFILE(SMBwritebraw);
3621 return;
3622 }
3623
3624 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3625 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3626 &lock);
3627
3628 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3629 reply_doserror(req, ERRDOS, ERRlock);
3630 error_to_writebrawerr(req);
3631 END_PROFILE(SMBwritebraw);
3632 return;
3633 }
3634
3635 if (numtowrite>0) {
3636 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3637 }
3638
3639 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3640 "wrote=%d sync=%d\n",
3641 fsp->fnum, (double)startpos, (int)numtowrite,
3642 (int)nwritten, (int)write_through));
3643
3644 if (nwritten < (ssize_t)numtowrite) {
3645 reply_unixerror(req, ERRHRD, ERRdiskfull);
3646 error_to_writebrawerr(req);
3647 goto strict_unlock;
3648 }
3649
3650 total_written = nwritten;
3651
3652 /* Allocate a buffer of 64k + length. */
3653 buf = TALLOC_ARRAY(NULL, char, 65540);
3654 if (!buf) {
3655 reply_doserror(req, ERRDOS, ERRnomem);
3656 error_to_writebrawerr(req);
3657 goto strict_unlock;
3658 }
3659
3660 /* Return a SMBwritebraw message to the redirector to tell
3661 * it to send more bytes */
3662
3663 memcpy(buf, req->inbuf, smb_size);
3664 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3665 SCVAL(buf,smb_com,SMBwritebraw);
3666 SSVALS(buf,smb_vwv0,0xFFFF);
3667 show_msg(buf);
3668 if (!srv_send_smb(smbd_server_fd(),
3669 buf,
3670 IS_CONN_ENCRYPTED(conn),
3671 &req->pcd)) {
3672 exit_server_cleanly("reply_writebraw: srv_send_smb "
3673 "failed.");
3674 }
3675
3676 /* Now read the raw data into the buffer and write it */
3677 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3678 &numtowrite);
3679 if (!NT_STATUS_IS_OK(status)) {
3680 exit_server_cleanly("secondary writebraw failed");
3681 }
3682
3683 /* Set up outbuf to return the correct size */
3684 reply_outbuf(req, 1, 0);
3685
3686 if (numtowrite != 0) {
3687
3688 if (numtowrite > 0xFFFF) {
3689 DEBUG(0,("reply_writebraw: Oversize secondary write "
3690 "raw requested (%u). Terminating\n",
3691 (unsigned int)numtowrite ));
3692 exit_server_cleanly("secondary writebraw failed");
3693 }
3694
3695 if (tcount > nwritten+numtowrite) {
3696 DEBUG(3,("reply_writebraw: Client overestimated the "
3697 "write %d %d %d\n",
3698 (int)tcount,(int)nwritten,(int)numtowrite));
3699 }
3700
3701 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3702
3703 if (!NT_STATUS_IS_OK(status)) {
3704 DEBUG(0,("reply_writebraw: Oversize secondary write "
3705 "raw read failed (%s). Terminating\n",
3706 nt_errstr(status)));
3707 exit_server_cleanly("secondary writebraw failed");
3708 }
3709
3710 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3711 if (nwritten == -1) {
3712 TALLOC_FREE(buf);
3713 reply_unixerror(req, ERRHRD, ERRdiskfull);
3714 error_to_writebrawerr(req);
3715 goto strict_unlock;
3716 }
3717
3718 if (nwritten < (ssize_t)numtowrite) {
3719 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3720 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3721 }
3722
3723 if (nwritten > 0) {
3724 total_written += nwritten;
3725 }
3726 }
3727
3728 TALLOC_FREE(buf);
3729 SSVAL(req->outbuf,smb_vwv0,total_written);
3730
3731 status = sync_file(conn, fsp, write_through);
3732 if (!NT_STATUS_IS_OK(status)) {
3733 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3734 fsp->fsp_name, nt_errstr(status) ));
3735 reply_nterror(req, status);
3736 error_to_writebrawerr(req);
3737 goto strict_unlock;
3738 }
3739
3740 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3741 "wrote=%d\n",
3742 fsp->fnum, (double)startpos, (int)numtowrite,
3743 (int)total_written));
3744
3745 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3746
3747 /* We won't return a status if write through is not selected - this
3748 * follows what WfWg does */
3749 END_PROFILE(SMBwritebraw);
3750
3751 if (!write_through && total_written==tcount) {
3752
3753 #if RABBIT_PELLET_FIX
3754 /*
3755 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3756 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3757 * JRA.
3758 */
3759 if (!send_keepalive(smbd_server_fd())) {
3760 exit_server_cleanly("reply_writebraw: send of "
3761 "keepalive failed");
3762 }
3763 #endif
3764 TALLOC_FREE(req->outbuf);
3765 }
3766 return;
3767
3768 strict_unlock:
3769 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3770
3771 END_PROFILE(SMBwritebraw);
3772 return;
3773 }
3774
3775 #undef DBGC_CLASS
3776 #define DBGC_CLASS DBGC_LOCKING
3777
3778 /****************************************************************************
3779 Reply to a writeunlock (core+).
3780 ****************************************************************************/
3781
3782 void reply_writeunlock(struct smb_request *req)
3783 {
3784 connection_struct *conn = req->conn;
3785 ssize_t nwritten = -1;
3786 size_t numtowrite;
3787 SMB_OFF_T startpos;
3788 const char *data;
3789 NTSTATUS status = NT_STATUS_OK;
3790 files_struct *fsp;
3791 struct lock_struct lock;
3792
3793 START_PROFILE(SMBwriteunlock);
3794
3795 if (req->wct < 5) {
3796 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3797 END_PROFILE(SMBwriteunlock);
3798 return;
3799 }
3800
3801 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3802
3803 if (!check_fsp(conn, req, fsp)) {
3804 END_PROFILE(SMBwriteunlock);
3805 return;
3806 }
3807
3808 if (!CHECK_WRITE(fsp)) {
3809 reply_doserror(req, ERRDOS,ERRbadaccess);
3810 END_PROFILE(SMBwriteunlock);
3811 return;
3812 }
3813
3814 numtowrite = SVAL(req->vwv+1, 0);
3815 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3816 data = (const char *)req->buf + 3;
3817
3818 if (numtowrite) {
3819 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3820 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3821 &lock);
3822
3823 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3824 reply_doserror(req, ERRDOS, ERRlock);
3825 END_PROFILE(SMBwriteunlock);
3826 return;
3827 }
3828 }
3829
3830 /* The special X/Open SMB protocol handling of
3831 zero length writes is *NOT* done for
3832 this call */
3833 if(numtowrite == 0) {
3834 nwritten = 0;
3835 } else {
3836 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3837 }
3838
3839 status = sync_file(conn, fsp, False /* write through */);
3840 if (!NT_STATUS_IS_OK(status)) {
3841 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3842 fsp->fsp_name, nt_errstr(status) ));
3843 reply_nterror(req, status);
3844 goto strict_unlock;
3845 }
3846
3847 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3848 reply_unixerror(req, ERRHRD, ERRdiskfull);
3849 goto strict_unlock;
3850 }
3851
3852 if (numtowrite) {
3853 status = do_unlock(smbd_messaging_context(),
3854 fsp,
3855 req->smbpid,
3856 (uint64_t)numtowrite,
3857 (uint64_t)startpos,
3858 WINDOWS_LOCK);
3859
3860 if (NT_STATUS_V(status)) {
3861 reply_nterror(req, status);
3862 goto strict_unlock;
3863 }
3864 }
3865
3866 reply_outbuf(req, 1, 0);
3867
3868 SSVAL(req->outbuf,smb_vwv0,nwritten);
3869
3870 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3871 fsp->fnum, (int)numtowrite, (int)nwritten));
3872
3873 strict_unlock:
3874 if (numtowrite) {
3875 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3876 }
3877
3878 END_PROFILE(SMBwriteunlock);
3879 return;
3880 }
3881
3882 #undef DBGC_CLASS
3883 #define DBGC_CLASS DBGC_ALL
3884
3885 /****************************************************************************
3886 Reply to a write.
3887 ****************************************************************************/
3888
3889 void reply_write(struct smb_request *req)
3890 {
3891 connection_struct *conn = req->conn;
3892 size_t numtowrite;
3893 ssize_t nwritten = -1;
3894 SMB_OFF_T startpos;
3895 const char *data;
3896 files_struct *fsp;
3897 struct lock_struct lock;
3898 NTSTATUS status;
3899
3900 START_PROFILE(SMBwrite);
3901
3902 if (req->wct < 5) {
3903 END_PROFILE(SMBwrite);
3904 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3905 return;
3906 }
3907
3908 /* If it's an IPC, pass off the pipe handler. */
3909 if (IS_IPC(conn)) {
3910 reply_pipe_write(req);
3911 END_PROFILE(SMBwrite);
3912 return;
3913 }
3914
3915 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3916
3917 if (!check_fsp(conn, req, fsp)) {
3918 END_PROFILE(SMBwrite);
3919 return;
3920 }
3921
3922 if (!CHECK_WRITE(fsp)) {
3923 reply_doserror(req, ERRDOS, ERRbadaccess);
3924 END_PROFILE(SMBwrite);
3925 return;
3926 }
3927
3928 numtowrite = SVAL(req->vwv+1, 0);
3929 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3930 data = (const char *)req->buf + 3;
3931
3932 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3933 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3934 &lock);
3935
3936 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3937 reply_doserror(req, ERRDOS, ERRlock);
3938 END_PROFILE(SMBwrite);
3939 return;
3940 }
3941
3942 /*
3943 * X/Open SMB protocol says that if smb_vwv1 is
3944 * zero then the file size should be extended or
3945 * truncated to the size given in smb_vwv[2-3].
3946 */
3947
3948 if(numtowrite == 0) {
3949 /*
3950 * This is actually an allocate call, and set EOF. JRA.
3951 */
3952 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3953 if (nwritten < 0) {
3954 reply_nterror(req, NT_STATUS_DISK_FULL);
3955 goto strict_unlock;
3956 }
3957 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3958 if (nwritten < 0) {
3959 reply_nterror(req, NT_STATUS_DISK_FULL);
3960 goto strict_unlock;
3961 }
3962 trigger_write_time_update_immediate(fsp);
3963 } else {
3964 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3965 }
3966
3967 status = sync_file(conn, fsp, False);
3968 if (!NT_STATUS_IS_OK(status)) {
3969 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3970 fsp->fsp_name, nt_errstr(status) ));
3971 reply_nterror(req, status);
3972 goto strict_unlock;
3973 }
3974
3975 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3976 reply_unixerror(req, ERRHRD, ERRdiskfull);
3977 goto strict_unlock;
3978 }
3979
3980 reply_outbuf(req, 1, 0);
3981
3982 SSVAL(req->outbuf,smb_vwv0,nwritten);
3983
3984 if (nwritten < (ssize_t)numtowrite) {
3985 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3986 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3987 }
3988
3989 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3990
3991 strict_unlock:
3992 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3993
3994 END_PROFILE(SMBwrite);
3995 return;
3996 }
3997
3998 /****************************************************************************
3999 Ensure a buffer is a valid writeX for recvfile purposes.
4000 ****************************************************************************/
4001
4002 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4003 (2*14) + /* word count (including bcc) */ \
4004 1 /* pad byte */)
4005
4006 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4007 {
4008 size_t numtowrite;
4009 connection_struct *conn = NULL;
4010 unsigned int doff = 0;
4011 size_t len = smb_len_large(inbuf);
4012
4013 if (is_encrypted_packet(inbuf)) {
4014 /* Can't do this on encrypted
4015 * connections. */
4016 return false;
4017 }
4018
4019 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4020 return false;
4021 }
4022
4023 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4024 CVAL(inbuf,smb_wct) != 14) {
4025 DEBUG(10,("is_valid_writeX_buffer: chained or "
4026 "invalid word length.\n"));
4027 return false;
4028 }
4029
4030 conn = conn_find(SVAL(inbuf, smb_tid));
4031 if (conn == NULL) {
4032 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4033 return false;
4034 }
4035 if (IS_IPC(conn)) {
4036 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4037 return false;
4038 }
4039 if (IS_PRINT(conn)) {
4040 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4041 return false;
4042 }
4043 doff = SVAL(inbuf,smb_vwv11);
4044
4045 numtowrite = SVAL(inbuf,smb_vwv10);
4046
4047 if (len > doff && len - doff > 0xFFFF) {
4048 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4049 }
4050
4051 if (numtowrite == 0) {
4052 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4053 return false;
4054 }
4055
4056 /* Ensure the sizes match up. */
4057 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4058 /* no pad byte...old smbclient :-( */
4059 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4060 (unsigned int)doff,
4061 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4062 return false;
4063 }
4064
4065 if (len - doff != numtowrite) {
4066 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4067 "len = %u, doff = %u, numtowrite = %u\n",
4068 (unsigned int)len,
4069 (unsigned int)doff,
4070 (unsigned int)numtowrite ));
4071 return false;
4072 }
4073
4074 DEBUG(10,("is_valid_writeX_buffer: true "
4075 "len = %u, doff = %u, numtowrite = %u\n",
4076 (unsigned int)len,
4077 (unsigned int)doff,
4078 (unsigned int)numtowrite ));
4079
4080 return true;
4081 }
4082
4083 /****************************************************************************
4084 Reply to a write and X.
4085 ****************************************************************************/
4086
4087 void reply_write_and_X(struct smb_request *req)
4088 {
4089 connection_struct *conn = req->conn;
4090 files_struct *fsp;
4091 struct lock_struct lock;
4092 SMB_OFF_T startpos;
4093 size_t numtowrite;
4094 bool write_through;
4095 ssize_t nwritten;
4096 unsigned int smb_doff;
4097 unsigned int smblen;
4098 char *data;
4099 NTSTATUS status;
4100
4101 START_PROFILE(SMBwriteX);
4102
4103 if ((req->wct != 12) && (req->wct != 14)) {
4104 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4105 END_PROFILE(SMBwriteX);
4106 return;
4107 }
4108
4109 numtowrite = SVAL(req->vwv+10, 0);
4110 smb_doff = SVAL(req->vwv+11, 0);
4111 smblen = smb_len(req->inbuf);
4112
4113 if (req->unread_bytes > 0xFFFF ||
4114 (smblen > smb_doff &&
4115 smblen - smb_doff > 0xFFFF)) {
4116 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4117 }
4118
4119 if (req->unread_bytes) {
4120 /* Can't do a recvfile write on IPC$ */
4121 if (IS_IPC(conn)) {
4122 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4123 END_PROFILE(SMBwriteX);
4124 return;
4125 }
4126 if (numtowrite != req->unread_bytes) {
4127 reply_doserror(req, ERRDOS, ERRbadmem);
4128 END_PROFILE(SMBwriteX);
4129 return;
4130 }
4131 } else {
4132 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4133 smb_doff + numtowrite > smblen) {
4134 reply_doserror(req, ERRDOS, ERRbadmem);
4135 END_PROFILE(SMBwriteX);
4136 return;
4137 }
4138 }
4139
4140 /* If it's an IPC, pass off the pipe handler. */
4141 if (IS_IPC(conn)) {
4142 if (req->unread_bytes) {
4143 reply_doserror(req, ERRDOS, ERRbadmem);
4144 END_PROFILE(SMBwriteX);
4145 return;
4146 }
4147 reply_pipe_write_and_X(req);
4148 END_PROFILE(SMBwriteX);
4149 return;
4150 }
4151
4152 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4153 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4154 write_through = BITSETW(req->vwv+7,0);
4155
4156 if (!check_fsp(conn, req, fsp)) {
4157 END_PROFILE(SMBwriteX);
4158 return;
4159 }
4160
4161 if (!CHECK_WRITE(fsp)) {
4162 reply_doserror(req, ERRDOS, ERRbadaccess);
4163 END_PROFILE(SMBwriteX);
4164 return;
4165 }
4166
4167 data = smb_base(req->inbuf) + smb_doff;
4168
4169 if(req->wct == 14) {
4170 #ifdef LARGE_SMB_OFF_T
4171 /*
4172 * This is a large offset (64 bit) write.
4173 */
4174 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4175
4176 #else /* !LARGE_SMB_OFF_T */
4177
4178 /*
4179 * Ensure we haven't been sent a >32 bit offset.
4180 */
4181
4182 if(IVAL(req->vwv+12, 0) != 0) {
4183 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4184 "used and we don't support 64 bit offsets.\n",
4185 (unsigned int)IVAL(req->vwv+12, 0) ));
4186 reply_doserror(req, ERRDOS, ERRbadaccess);
4187 END_PROFILE(SMBwriteX);
4188 return;
4189 }
4190
4191 #endif /* LARGE_SMB_OFF_T */
4192 }
4193
4194 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4195 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4196 &lock);
4197
4198 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4199 reply_doserror(req, ERRDOS, ERRlock);
4200 END_PROFILE(SMBwriteX);
4201 return;
4202 }
4203
4204 /* X/Open SMB protocol says that, unlike SMBwrite
4205 if the length is zero then NO truncation is
4206 done, just a write of zero. To truncate a file,
4207 use SMBwrite. */
4208
4209 if(numtowrite == 0) {
4210 nwritten = 0;
4211 } else {
4212
4213 if ((req->unread_bytes == 0) &&
4214 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4215 numtowrite)) {
4216 goto strict_unlock;
4217 }
4218
4219 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4220 }
4221
4222 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4223 reply_unixerror(req, ERRHRD, ERRdiskfull);
4224 goto strict_unlock;
4225 }
4226
4227 reply_outbuf(req, 6, 0);
4228 SSVAL(req->outbuf,smb_vwv2,nwritten);
4229 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4230
4231 if (nwritten < (ssize_t)numtowrite) {
4232 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4233 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4234 }
4235
4236 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4237 fsp->fnum, (int)numtowrite, (int)nwritten));
4238
4239 status = sync_file(conn, fsp, write_through);
4240 if (!NT_STATUS_IS_OK(status)) {
4241 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4242 fsp->fsp_name, nt_errstr(status) ));
4243 reply_nterror(req, status);
4244 goto strict_unlock;
4245 }
4246
4247 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4248
4249 END_PROFILE(SMBwriteX);
4250 chain_reply(req);
4251 return;
4252
4253 strict_unlock:
4254 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4255
4256 END_PROFILE(SMBwriteX);
4257 return;
4258 }
4259
4260 /****************************************************************************
4261 Reply to a lseek.
4262 ****************************************************************************/
4263
4264 void reply_lseek(struct smb_request *req)
4265 {
4266 connection_struct *conn = req->conn;
4267 SMB_OFF_T startpos;
4268 SMB_OFF_T res= -1;
4269 int mode,umode;
4270 files_struct *fsp;
4271
4272 START_PROFILE(SMBlseek);
4273
4274 if (req->wct < 4) {
4275 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4276 END_PROFILE(SMBlseek);
4277 return;
4278 }
4279
4280 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4281
4282 if (!check_fsp(conn, req, fsp)) {
4283 return;
4284 }
4285
4286 flush_write_cache(fsp, SEEK_FLUSH);
4287
4288 mode = SVAL(req->vwv+1, 0) & 3;
4289 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4290 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4291
4292 switch (mode) {
4293 case 0:
4294 umode = SEEK_SET;
4295 res = startpos;
4296 break;
4297 case 1:
4298 umode = SEEK_CUR;
4299 res = fsp->fh->pos + startpos;
4300 break;
4301 case 2:
4302 umode = SEEK_END;
4303 break;
4304 default:
4305 umode = SEEK_SET;
4306 res = startpos;
4307 break;
4308 }
4309
4310 if (umode == SEEK_END) {
4311 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4312 if(errno == EINVAL) {
4313 SMB_OFF_T current_pos = startpos;
4314 SMB_STRUCT_STAT sbuf;
4315
4316 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4317 reply_unixerror(req, ERRDOS,
4318 ERRnoaccess);
4319 END_PROFILE(SMBlseek);
4320 return;
4321 }
4322
4323 current_pos += sbuf.st_size;
4324 if(current_pos < 0)
4325 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4326 }
4327 }
4328
4329 if(res == -1) {
4330 reply_unixerror(req, ERRDOS, ERRnoaccess);
4331 END_PROFILE(SMBlseek);
4332 return;
4333 }
4334 }
4335
4336 fsp->fh->pos = res;
4337
4338 reply_outbuf(req, 2, 0);
4339 SIVAL(req->outbuf,smb_vwv0,res);
4340
4341 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4342 fsp->fnum, (double)startpos, (double)res, mode));
4343
4344 END_PROFILE(SMBlseek);
4345 return;
4346 }
4347
4348 /****************************************************************************
4349 Reply to a flush.
4350 ****************************************************************************/
4351
4352 void reply_flush(struct smb_request *req)
4353 {
4354 connection_struct *conn = req->conn;
4355 uint16 fnum;
4356 files_struct *fsp;
4357
4358 START_PROFILE(SMBflush);
4359
4360 if (req->wct < 1) {
4361 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4362 return;
4363 }
4364
4365 fnum = SVAL(req->vwv+0, 0);
4366 fsp = file_fsp(req, fnum);
4367
4368 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4369 return;
4370 }
4371
4372 if (!fsp) {
4373 file_sync_all(conn);
4374 } else {
4375 NTSTATUS status = sync_file(conn, fsp, True);
4376 if (!NT_STATUS_IS_OK(status)) {
4377 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4378 fsp->fsp_name, nt_errstr(status) ));
4379 reply_nterror(req, status);
4380 END_PROFILE(SMBflush);
4381 return;
4382 }
4383 }
4384
4385 reply_outbuf(req, 0, 0);
4386
4387 DEBUG(3,("flush\n"));
4388 END_PROFILE(SMBflush);
4389 return;
4390 }
4391
4392 /****************************************************************************
4393 Reply to a exit.
4394 conn POINTER CAN BE NULL HERE !
4395 ****************************************************************************/
4396
4397 void reply_exit(struct smb_request *req)
4398 {
4399 START_PROFILE(SMBexit);
4400
4401 file_close_pid(req->smbpid, req->vuid);
4402
4403 reply_outbuf(req, 0, 0);
4404
4405 DEBUG(3,("exit\n"));
4406
4407 END_PROFILE(SMBexit);
4408 return;
4409 }
4410
4411 /****************************************************************************
4412 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4413 ****************************************************************************/
4414
4415 void reply_close(struct smb_request *req)
4416 {
4417 connection_struct *conn = req->conn;
4418 NTSTATUS status = NT_STATUS_OK;
4419 files_struct *fsp = NULL;
4420 START_PROFILE(SMBclose);
4421
4422 if (req->wct < 3) {
4423 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4424 END_PROFILE(SMBclose);
4425 return;
4426 }
4427
4428 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4429
4430 /*
4431 * We can only use check_fsp if we know it's not a directory.
4432 */
4433
4434 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4435 reply_doserror(req, ERRDOS, ERRbadfid);
4436 END_PROFILE(SMBclose);
4437 return;
4438 }
4439
4440 if(fsp->is_directory) {
4441 /*
4442 * Special case - close NT SMB directory handle.
4443 */
4444 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4445 status = close_file(req, fsp, NORMAL_CLOSE);
4446 } else {
4447 time_t t;
4448 /*
4449 * Close ordinary file.
4450 */
4451
4452 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4453 fsp->fh->fd, fsp->fnum,
4454 conn->num_files_open));
4455
4456 /*
4457 * Take care of any time sent in the close.
4458 */
4459
4460 t = srv_make_unix_date3(req->vwv+1);
4461 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4462
4463 /*
4464 * close_file() returns the unix errno if an error
4465 * was detected on close - normally this is due to
4466 * a disk full error. If not then it was probably an I/O error.
4467 */
4468
4469 status = close_file(req, fsp, NORMAL_CLOSE);
4470 }
4471
4472 if (!NT_STATUS_IS_OK(status)) {
4473 reply_nterror(req, status);
4474 END_PROFILE(SMBclose);
4475 return;
4476 }
4477
4478 reply_outbuf(req, 0, 0);
4479 END_PROFILE(SMBclose);
4480 return;
4481 }
4482
4483 /****************************************************************************
4484 Reply to a writeclose (Core+ protocol).
4485 ****************************************************************************/
4486
4487 void reply_writeclose(struct smb_request *req)
4488 {
4489 connection_struct *conn = req->conn;
4490 size_t numtowrite;
4491 ssize_t nwritten = -1;
4492 NTSTATUS close_status = NT_STATUS_OK;
4493 SMB_OFF_T startpos;
4494 const char *data;
4495 struct timespec mtime;
4496 files_struct *fsp;
4497 struct lock_struct lock;
4498
4499 START_PROFILE(SMBwriteclose);
4500
4501 if (req->wct < 6) {
4502 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4503 END_PROFILE(SMBwriteclose);
4504 return;
4505 }
4506
4507 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4508
4509 if (!check_fsp(conn, req, fsp)) {
4510 END_PROFILE(SMBwriteclose);
4511 return;
4512 }
4513 if (!CHECK_WRITE(fsp)) {
4514 reply_doserror(req, ERRDOS,ERRbadaccess);
4515 END_PROFILE(SMBwriteclose);
4516 return;
4517 }
4518
4519 numtowrite = SVAL(req->vwv+1, 0);
4520 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4521 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4522 data = (const char *)req->buf + 1;
4523
4524 if (numtowrite) {
4525 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4526 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4527 &lock);
4528
4529 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4530 reply_doserror(req, ERRDOS,ERRlock);
4531 END_PROFILE(SMBwriteclose);
4532 return;
4533 }
4534 }
4535
4536 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4537
4538 set_close_write_time(fsp, mtime);
4539
4540 /*
4541 * More insanity. W2K only closes the file if writelen > 0.
4542 * JRA.
4543 */
4544
4545 if (numtowrite) {
4546 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4547 fsp->fsp_name ));
4548 close_status = close_file(req, fsp, NORMAL_CLOSE);
4549 }
4550
4551 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4552 fsp->fnum, (int)numtowrite, (int)nwritten,
4553 conn->num_files_open));
4554
4555 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4556 reply_doserror(req, ERRHRD, ERRdiskfull);
4557 goto strict_unlock;
4558 }
4559
4560 if(!NT_STATUS_IS_OK(close_status)) {
4561 reply_nterror(req, close_status);
4562 goto strict_unlock;
4563 }
4564
4565 reply_outbuf(req, 1, 0);
4566
4567 SSVAL(req->outbuf,smb_vwv0,nwritten);
4568
4569 strict_unlock:
4570 if (numtowrite) {
4571 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4572 }
4573
4574 END_PROFILE(SMBwriteclose);
4575 return;
4576 }
4577
4578 #undef DBGC_CLASS
4579 #define DBGC_CLASS DBGC_LOCKING
4580
4581 /****************************************************************************
4582 Reply to a lock.
4583 ****************************************************************************/
4584
4585 void reply_lock(struct smb_request *req)
4586 {
4587 connection_struct *conn = req->conn;
4588 uint64_t count,offset;
4589 NTSTATUS status;
4590 files_struct *fsp;
4591 struct byte_range_lock *br_lck = NULL;
4592
4593 START_PROFILE(SMBlock);
4594
4595 if (req->wct < 5) {
4596 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4597 END_PROFILE(SMBlock);
4598 return;
4599 }
4600
4601 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4602
4603 if (!check_fsp(conn, req, fsp)) {
4604 END_PROFILE(SMBlock);
4605 return;
4606 }
4607
4608 count = (uint64_t)IVAL(req->vwv+1, 0);
4609 offset = (uint64_t)IVAL(req->vwv+3, 0);
4610
4611 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4612 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4613
4614 br_lck = do_lock(smbd_messaging_context(),
4615 fsp,
4616 req->smbpid,
4617 count,
4618 offset,
4619 WRITE_LOCK,
4620 WINDOWS_LOCK,
4621 False, /* Non-blocking lock. */
4622 &status,
4623 NULL,
4624 NULL);
4625
4626 TALLOC_FREE(br_lck);
4627
4628 if (NT_STATUS_V(status)) {
4629 reply_nterror(req, status);
4630 END_PROFILE(SMBlock);
4631 return;
4632 }
4633
4634 reply_outbuf(req, 0, 0);
4635
4636 END_PROFILE(SMBlock);
4637 return;
4638 }
4639
4640 /****************************************************************************
4641 Reply to a unlock.
4642 ****************************************************************************/
4643
4644 void reply_unlock(struct smb_request *req)
4645 {
4646 connection_struct *conn = req->conn;
4647 uint64_t count,offset;
4648 NTSTATUS status;
4649 files_struct *fsp;
4650
4651 START_PROFILE(SMBunlock);
4652
4653 if (req->wct < 5) {
4654 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4655 END_PROFILE(SMBunlock);
4656 return;
4657 }
4658
4659 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4660
4661 if (!check_fsp(conn, req, fsp)) {
4662 END_PROFILE(SMBunlock);
4663 return;
4664 }
4665
4666 count = (uint64_t)IVAL(req->vwv+1, 0);
4667 offset = (uint64_t)IVAL(req->vwv+3, 0);
4668
4669 status = do_unlock(smbd_messaging_context(),
4670 fsp,
4671 req->smbpid,
4672 count,
4673 offset,
4674 WINDOWS_LOCK);
4675
4676 if (NT_STATUS_V(status)) {
4677 reply_nterror(req, status);
4678 END_PROFILE(SMBunlock);
4679 return;
4680 }
4681
4682 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4683 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4684
4685 reply_outbuf(req, 0, 0);
4686
4687 END_PROFILE(SMBunlock);
4688 return;
4689 }
4690
4691 #undef DBGC_CLASS
4692 #define DBGC_CLASS DBGC_ALL
4693
4694 /****************************************************************************
4695 Reply to a tdis.
4696 conn POINTER CAN BE NULL HERE !
4697 ****************************************************************************/
4698
4699 void reply_tdis(struct smb_request *req)
4700 {
4701 connection_struct *conn = req->conn;
4702 START_PROFILE(SMBtdis);
4703
4704 if (!conn) {
4705 DEBUG(4,("Invalid connection in tdis\n"));
4706 reply_doserror(req, ERRSRV, ERRinvnid);
4707 END_PROFILE(SMBtdis);
4708 return;
4709 }
4710
4711 conn->used = False;
4712
4713 close_cnum(conn,req->vuid);
4714 req->conn = NULL;
4715
4716 reply_outbuf(req, 0, 0);
4717 END_PROFILE(SMBtdis);
4718 return;
4719 }
4720
4721 /****************************************************************************
4722 Reply to a echo.
4723 conn POINTER CAN BE NULL HERE !
4724 ****************************************************************************/
4725
4726 void reply_echo(struct smb_request *req)
4727 {
4728 connection_struct *conn = req->conn;
4729 struct smb_perfcount_data local_pcd;
4730 struct smb_perfcount_data *cur_pcd;
4731 int smb_reverb;
4732 int seq_num;
4733
4734 START_PROFILE(SMBecho);
4735
4736 smb_init_perfcount_data(&local_pcd);
4737
4738 if (req->wct < 1) {
4739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4740 END_PROFILE(SMBecho);
4741 return;
4742 }
4743
4744 smb_reverb = SVAL(req->vwv+0, 0);
4745
4746 reply_outbuf(req, 1, req->buflen);
4747
4748 /* copy any incoming data back out */
4749 if (req->buflen > 0) {
4750 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4751 }
4752
4753 if (smb_reverb > 100) {
4754 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4755 smb_reverb = 100;
4756 }
4757
4758 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4759
4760 /* this makes sure we catch the request pcd */
4761 if (seq_num == smb_reverb) {
4762 cur_pcd = &req->pcd;
4763 } else {
4764 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4765 cur_pcd = &local_pcd;
4766 }
4767
4768 SSVAL(req->outbuf,smb_vwv0,seq_num);
4769
4770 show_msg((char *)req->outbuf);
4771 if (!srv_send_smb(smbd_server_fd(),
4772 (char *)req->outbuf,
4773 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4774 cur_pcd))
4775 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4776 }
4777
4778 DEBUG(3,("echo %d times\n", smb_reverb));
4779
4780 TALLOC_FREE(req->outbuf);
4781
4782 END_PROFILE(SMBecho);
4783 return;
4784 }
4785
4786 /****************************************************************************
4787 Reply to a printopen.
4788 ****************************************************************************/
4789
4790 void reply_printopen(struct smb_request *req)
4791 {
4792 connection_struct *conn = req->conn;
4793 files_struct *fsp;
4794 SMB_STRUCT_STAT sbuf;
4795 NTSTATUS status;
4796
4797 START_PROFILE(SMBsplopen);
4798
4799 if (req->wct < 2) {
4800 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4801 END_PROFILE(SMBsplopen);
4802 return;
4803 }
4804
4805 if (!CAN_PRINT(conn)) {
4806 reply_doserror(req, ERRDOS, ERRnoaccess);
4807 END_PROFILE(SMBsplopen);
4808 return;
4809 }
4810
4811 status = file_new(req, conn, &fsp);
4812 if(!NT_STATUS_IS_OK(status)) {
4813 reply_nterror(req, status);
4814 END_PROFILE(SMBsplopen);
4815 return;
4816 }
4817
4818 /* Open for exclusive use, write only. */
4819 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4820
4821 if (!NT_STATUS_IS_OK(status)) {
4822 reply_nterror(req, status);
4823 END_PROFILE(SMBsplopen);
4824 return;
4825 }
4826
4827 reply_outbuf(req, 1, 0);
4828 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4829
4830 DEBUG(3,("openprint fd=%d fnum=%d\n",
4831 fsp->fh->fd, fsp->fnum));
4832
4833 END_PROFILE(SMBsplopen);
4834 return;
4835 }
4836
4837 /****************************************************************************
4838 Reply to a printclose.
4839 ****************************************************************************/
4840
4841 void reply_printclose(struct smb_request *req)
4842 {
4843 connection_struct *conn = req->conn;
4844 files_struct *fsp;
4845 NTSTATUS status;
4846
4847 START_PROFILE(SMBsplclose);
4848
4849 if (req->wct < 1) {
4850 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4851 END_PROFILE(SMBsplclose);
4852 return;
4853 }
4854
4855 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4856
4857 if (!check_fsp(conn, req, fsp)) {
4858 END_PROFILE(SMBsplclose);
4859 return;
4860 }
4861
4862 if (!CAN_PRINT(conn)) {
4863 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4864 END_PROFILE(SMBsplclose);
4865 return;
4866 }
4867
4868 DEBUG(3,("printclose fd=%d fnum=%d\n",
4869 fsp->fh->fd,fsp->fnum));
4870
4871 status = close_file(req, fsp, NORMAL_CLOSE);
4872
4873 if(!NT_STATUS_IS_OK(status)) {
4874 reply_nterror(req, status);
4875 END_PROFILE(SMBsplclose);
4876 return;
4877 }
4878
4879 reply_outbuf(req, 0, 0);
4880
4881 END_PROFILE(SMBsplclose);
4882 return;
4883 }
4884
4885 /****************************************************************************
4886 Reply to a printqueue.
4887 ****************************************************************************/
4888
4889 void reply_printqueue(struct smb_request *req)
4890 {
4891 connection_struct *conn = req->conn;
4892 int max_count;
4893 int start_index;
4894
4895 START_PROFILE(SMBsplretq);
4896
4897 if (req->wct < 2) {
4898 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4899 END_PROFILE(SMBsplretq);
4900 return;
4901 }
4902
4903 max_count = SVAL(req->vwv+0, 0);
4904 start_index = SVAL(req->vwv+1, 0);
4905
4906 /* we used to allow the client to get the cnum wrong, but that
4907 is really quite gross and only worked when there was only
4908 one printer - I think we should now only accept it if they
4909 get it right (tridge) */
4910 if (!CAN_PRINT(conn)) {
4911 reply_doserror(req, ERRDOS, ERRnoaccess);
4912 END_PROFILE(SMBsplretq);
4913 return;
4914 }
4915
4916 reply_outbuf(req, 2, 3);
4917 SSVAL(req->outbuf,smb_vwv0,0);
4918 SSVAL(req->outbuf,smb_vwv1,0);
4919 SCVAL(smb_buf(req->outbuf),0,1);
4920 SSVAL(smb_buf(req->outbuf),1,0);
4921
4922 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4923 start_index, max_count));
4924
4925 {
4926 print_queue_struct *queue = NULL;
4927 print_status_struct status;
4928 int count = print_queue_status(SNUM(conn), &queue, &status);
4929 int num_to_get = ABS(max_count);
4930 int first = (max_count>0?start_index:start_index+max_count+1);
4931 int i;
4932
4933 if (first >= count)
4934 num_to_get = 0;
4935 else
4936 num_to_get = MIN(num_to_get,count-first);
4937
4938
4939 for (i=first;i<first+num_to_get;i++) {
4940 char blob[28];
4941 char *p = blob;
4942
4943 srv_put_dos_date2(p,0,queue[i].time);
4944 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4945 SSVAL(p,5, queue[i].job);
4946 SIVAL(p,7,queue[i].size);
4947 SCVAL(p,11,0);
4948 srvstr_push(blob, req->flags2, p+12,
4949 queue[i].fs_user, 16, STR_ASCII);
4950
4951 if (message_push_blob(
4952 &req->outbuf,
4953 data_blob_const(
4954 blob, sizeof(blob))) == -1) {
4955 reply_nterror(req, NT_STATUS_NO_MEMORY);
4956 END_PROFILE(SMBsplretq);
4957 return;
4958 }
4959 }
4960
4961 if (count > 0) {
4962 SSVAL(req->outbuf,smb_vwv0,count);
4963 SSVAL(req->outbuf,smb_vwv1,
4964 (max_count>0?first+count:first-1));
4965 SCVAL(smb_buf(req->outbuf),0,1);
4966 SSVAL(smb_buf(req->outbuf),1,28*count);
4967 }
4968
4969 SAFE_FREE(queue);
4970
4971 DEBUG(3,("%d entries returned in queue\n",count));
4972 }
4973
4974 END_PROFILE(SMBsplretq);
4975 return;
4976 }
4977
4978 /****************************************************************************
4979 Reply to a printwrite.
4980 ****************************************************************************/
4981
4982 void reply_printwrite(struct smb_request *req)
4983 {
4984 connection_struct *conn = req->conn;
4985 int numtowrite;
4986 const char *data;
4987 files_struct *fsp;
4988
4989 START_PROFILE(SMBsplwr);
4990
4991 if (req->wct < 1) {
4992 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4993 END_PROFILE(SMBsplwr);
4994 return;
4995 }
4996
4997 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4998
4999 if (!check_fsp(conn, req, fsp)) {
5000 END_PROFILE(SMBsplwr);
5001 return;
5002 }
5003
5004 if (!CAN_PRINT(conn)) {
5005 reply_doserror(req, ERRDOS, ERRnoaccess);
5006 END_PROFILE(SMBsplwr);
5007 return;
5008 }
5009
5010 if (!CHECK_WRITE(fsp)) {
5011 reply_doserror(req, ERRDOS, ERRbadaccess);
5012 END_PROFILE(SMBsplwr);
5013 return;
5014 }
5015
5016 numtowrite = SVAL(req->buf, 1);
5017
5018 if (req->buflen < numtowrite + 3) {
5019 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5020 END_PROFILE(SMBsplwr);
5021 return;
5022 }
5023
5024 data = (const char *)req->buf + 3;
5025
5026 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5027 reply_unixerror(req, ERRHRD, ERRdiskfull);
5028 END_PROFILE(SMBsplwr);
5029 return;
5030 }
5031
5032 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5033
5034 END_PROFILE(SMBsplwr);
5035 return;
5036 }
5037
5038 /****************************************************************************
5039 Reply to a mkdir.
5040 ****************************************************************************/
5041
5042 void reply_mkdir(struct smb_request *req)
5043 {
5044 connection_struct *conn = req->conn;
5045 char *directory = NULL;
5046 NTSTATUS status;
5047 SMB_STRUCT_STAT sbuf;
5048 TALLOC_CTX *ctx = talloc_tos();
5049
5050 START_PROFILE(SMBmkdir);
5051
5052 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5053 STR_TERMINATE, &status);
5054 if (!NT_STATUS_IS_OK(status)) {
5055 reply_nterror(req, status);
5056 END_PROFILE(SMBmkdir);
5057 return;
5058 }
5059
5060 status = resolve_dfspath(ctx, conn,
5061 req->flags2 & FLAGS2_DFS_PATHNAMES,
5062 directory,
5063 &directory);
5064 if (!NT_STATUS_IS_OK(status)) {
5065 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5066 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5067 ERRSRV, ERRbadpath);
5068 END_PROFILE(SMBmkdir);
5069 return;
5070 }
5071 reply_nterror(req, status);
5072 END_PROFILE(SMBmkdir);
5073 return;
5074 }
5075
5076 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
5077 if (!NT_STATUS_IS_OK(status)) {
5078 reply_nterror(req, status);
5079 END_PROFILE(SMBmkdir);
5080 return;
5081 }
5082
5083 status = check_name(conn, directory);
5084 if (!NT_STATUS_IS_OK(status)) {
5085 reply_nterror(req, status);
5086 END_PROFILE(SMBmkdir);
5087 return;
5088 }
5089
5090 status = create_directory(conn, req, directory);
5091
5092 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5093
5094 if (!NT_STATUS_IS_OK(status)) {
5095
5096 if (!use_nt_status()
5097 && NT_STATUS_EQUAL(status,
5098 NT_STATUS_OBJECT_NAME_COLLISION)) {
5099 /*
5100 * Yes, in the DOS error code case we get a
5101 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5102 * samba4 torture test.
5103 */
5104 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5105 }
5106
5107 reply_nterror(req, status);
5108 END_PROFILE(SMBmkdir);
5109 return;
5110 }
5111
5112 reply_outbuf(req, 0, 0);
5113
5114 DEBUG( 3, ( "mkdir %s\n", directory ) );
5115
5116 END_PROFILE(SMBmkdir);
5117 return;
5118 }
5119
5120 /****************************************************************************
5121 Static function used by reply_rmdir to delete an entire directory
5122 tree recursively. Return True on ok, False on fail.
5123 ****************************************************************************/
5124
5125 static bool recursive_rmdir(TALLOC_CTX *ctx,
5126 connection_struct *conn,
5127 char *directory)
5128 {
5129 const char *dname = NULL;
5130 bool ret = True;
5131 long offset = 0;
5132 SMB_STRUCT_STAT st;
5133 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5134 NULL, 0);
5135
5136 if(dir_hnd == NULL)
5137 return False;
5138
5139 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5140 char *fullname = NULL;
5141
5142 if (ISDOT(dname) || ISDOTDOT(dname)) {
5143 continue;
5144 }
5145
5146 if (!is_visible_file(conn, directory, dname, &st, False)) {
5147 continue;
5148 }
5149
5150 /* Construct the full name. */
5151 fullname = talloc_asprintf(ctx,
5152 "%s/%s",
5153 directory,
5154 dname);
5155 if (!fullname) {
5156 errno = ENOMEM;
5157 ret = False;
5158 break;
5159 }
5160
5161 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5162 ret = False;
5163 break;
5164 }
5165
5166 if(st.st_mode & S_IFDIR) {
5167 if(!recursive_rmdir(ctx, conn, fullname)) {
5168 ret = False;
5169 break;
5170 }
5171 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5172 ret = False;
5173 break;
5174 }
5175 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5176 ret = False;
5177 break;
5178 }
5179 TALLOC_FREE(fullname);
5180 }
5181 TALLOC_FREE(dir_hnd);
5182 return ret;
5183 }
5184
5185 /****************************************************************************
5186 The internals of the rmdir code - called elsewhere.
5187 ****************************************************************************/
5188
5189 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5190 connection_struct *conn,
5191 const char *directory)
5192 {
5193 int ret;
5194 SMB_STRUCT_STAT st;
5195
5196 /* Might be a symlink. */
5197 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5198 return map_nt_error_from_unix(errno);
5199 }
5200
5201 if (S_ISLNK(st.st_mode)) {
5202 /* Is what it points to a directory ? */
5203 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5204 return map_nt_error_from_unix(errno);
5205 }
5206 if (!(S_ISDIR(st.st_mode))) {
5207 return NT_STATUS_NOT_A_DIRECTORY;
5208 }
5209 ret = SMB_VFS_UNLINK(conn,directory);
5210 } else {
5211 ret = SMB_VFS_RMDIR(conn,directory);
5212 }
5213 if (ret == 0) {
5214 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5215 FILE_NOTIFY_CHANGE_DIR_NAME,
5216 directory);
5217 return NT_STATUS_OK;
5218 }
5219
5220 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5221 /*
5222 * Check to see if the only thing in this directory are
5223 * vetoed files/directories. If so then delete them and
5224 * retry. If we fail to delete any of them (and we *don't*
5225 * do a recursive delete) then fail the rmdir.
5226 */
5227 const char *dname;
5228 long dirpos = 0;
5229 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5230 directory, NULL, 0);
5231
5232 if(dir_hnd == NULL) {
5233 errno = ENOTEMPTY;
5234 goto err;
5235 }
5236
5237 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5238 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5239 continue;
5240 if (!is_visible_file(conn, directory, dname, &st, False))
5241 continue;
5242 if(!IS_VETO_PATH(conn, dname)) {
5243 TALLOC_FREE(dir_hnd);
5244 errno = ENOTEMPTY;
5245 goto err;
5246 }
5247 }
5248
5249 /* We only have veto files/directories.
5250 * Are we allowed to delete them ? */
5251
5252 if(!lp_recursive_veto_delete(SNUM(conn))) {
5253 TALLOC_FREE(dir_hnd);
5254 errno = ENOTEMPTY;
5255 goto err;
5256 }
5257
5258 /* Do a recursive delete. */
5259 RewindDir(dir_hnd,&dirpos);
5260 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5261 char *fullname = NULL;
5262
5263 if (ISDOT(dname) || ISDOTDOT(dname)) {
5264 continue;
5265 }
5266 if (!is_visible_file(conn, directory, dname, &st, False)) {
5267 continue;
5268 }
5269
5270 fullname = talloc_asprintf(ctx,
5271 "%s/%s",
5272 directory,
5273 dname);
5274
5275 if(!fullname) {
5276 errno = ENOMEM;
5277 break;
5278 }
5279
5280 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5281 break;
5282 }
5283 if(st.st_mode & S_IFDIR) {
5284 if(!recursive_rmdir(ctx, conn, fullname)) {
5285 break;
5286 }
5287 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5288 break;
5289 }
5290 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5291 break;
5292 }
5293 TALLOC_FREE(fullname);
5294 }
5295 TALLOC_FREE(dir_hnd);
5296 /* Retry the rmdir */
5297 ret = SMB_VFS_RMDIR(conn,directory);
5298 }
5299
5300 err:
5301
5302 if (ret != 0) {
5303 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5304 "%s\n", directory,strerror(errno)));
5305 return map_nt_error_from_unix(errno);
5306 }
5307
5308 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5309 FILE_NOTIFY_CHANGE_DIR_NAME,
5310 directory);
5311
5312 return NT_STATUS_OK;
5313 }
5314
5315 /****************************************************************************
5316 Reply to a rmdir.
5317 ****************************************************************************/
5318
5319 void reply_rmdir(struct smb_request *req)
5320 {
5321 connection_struct *conn = req->conn;
5322 char *directory = NULL;
5323 SMB_STRUCT_STAT sbuf;
5324 NTSTATUS status;
5325 TALLOC_CTX *ctx = talloc_tos();
5326
5327 START_PROFILE(SMBrmdir);
5328
5329 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5330 STR_TERMINATE, &status);
5331 if (!NT_STATUS_IS_OK(status)) {
5332 reply_nterror(req, status);
5333 END_PROFILE(SMBrmdir);
5334 return;
5335 }
5336
5337 status = resolve_dfspath(ctx, conn,
5338 req->flags2 & FLAGS2_DFS_PATHNAMES,
5339 directory,
5340 &directory);
5341 if (!NT_STATUS_IS_OK(status)) {
5342 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5343 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5344 ERRSRV, ERRbadpath);
5345 END_PROFILE(SMBrmdir);
5346 return;
5347 }
5348 reply_nterror(req, status);
5349 END_PROFILE(SMBrmdir);
5350 return;
5351 }
5352
5353 status = unix_convert(ctx, conn, directory, False, &directory,
5354 NULL, &sbuf);
5355 if (!NT_STATUS_IS_OK(status)) {
5356 reply_nterror(req, status);
5357 END_PROFILE(SMBrmdir);
5358 return;
5359 }
5360
5361 status = check_name(conn, directory);
5362 if (!NT_STATUS_IS_OK(status)) {
5363 reply_nterror(req, status);
5364 END_PROFILE(SMBrmdir);
5365 return;
5366 }
5367
5368 dptr_closepath(directory, req->smbpid);
5369 status = rmdir_internals(ctx, conn, directory);
5370 if (!NT_STATUS_IS_OK(status)) {
5371 reply_nterror(req, status);
5372 END_PROFILE(SMBrmdir);
5373 return;
5374 }
5375
5376 reply_outbuf(req, 0, 0);
5377
5378 DEBUG( 3, ( "rmdir %s\n", directory ) );
5379
5380 END_PROFILE(SMBrmdir);
5381 return;
5382 }
5383
5384 /*******************************************************************
5385 Resolve wildcards in a filename rename.
5386 ********************************************************************/
5387
5388 static bool resolve_wildcards(TALLOC_CTX *ctx,
5389 const char *name1,
5390 const char *name2,
5391 char **pp_newname)
5392 {
5393 char *name2_copy = NULL;
5394 char *root1 = NULL;
5395 char *root2 = NULL;
5396 char *ext1 = NULL;
5397 char *ext2 = NULL;
5398 char *p,*p2, *pname1, *pname2;
5399
5400 name2_copy = talloc_strdup(ctx, name2);
5401 if (!name2_copy) {
5402 return False;
5403 }
5404
5405 pname1 = strrchr_m(name1,'/');
5406 pname2 = strrchr_m(name2_copy,'/');
5407
5408 if (!pname1 || !pname2) {
5409 return False;
5410 }
5411
5412 /* Truncate the copy of name2 at the last '/' */
5413 *pname2 = '\0';
5414
5415 /* Now go past the '/' */
5416 pname1++;
5417 pname2++;
5418
5419 root1 = talloc_strdup(ctx, pname1);
5420 root2 = talloc_strdup(ctx, pname2);
5421
5422 if (!root1 || !root2) {
5423 return False;
5424 }
5425
5426 p = strrchr_m(root1,'.');
5427 if (p) {
5428 *p = 0;
5429 ext1 = talloc_strdup(ctx, p+1);
5430 } else {
5431 ext1 = talloc_strdup(ctx, "");
5432 }
5433 p = strrchr_m(root2,'.');
5434 if (p) {
5435 *p = 0;
5436 ext2 = talloc_strdup(ctx, p+1);
5437 } else {
5438 ext2 = talloc_strdup(ctx, "");
5439 }
5440
5441 if (!ext1 || !ext2) {
5442 return False;
5443 }
5444
5445 p = root1;
5446 p2 = root2;
5447 while (*p2) {
5448 if (*p2 == '?') {
5449 /* Hmmm. Should this be mb-aware ? */
5450 *p2 = *p;
5451 p2++;
5452 } else if (*p2 == '*') {
5453 *p2 = '\0';
5454 root2 = talloc_asprintf(ctx, "%s%s",
5455 root2,
5456 p);
5457 if (!root2) {
5458 return False;
5459 }
5460 break;
5461 } else {
5462 p2++;
5463 }
5464 if (*p) {
5465 p++;
5466 }
5467 }
5468
5469 p = ext1;
5470 p2 = ext2;
5471 while (*p2) {
5472 if (*p2 == '?') {
5473 /* Hmmm. Should this be mb-aware ? */
5474 *p2 = *p;
5475 p2++;
5476 } else if (*p2 == '*') {
5477 *p2 = '\0';
5478 ext2 = talloc_asprintf(ctx, "%s%s",
5479 ext2,
5480 p);
5481 if (!ext2) {
5482 return False;
5483 }
5484 break;
5485 } else {
5486 p2++;
5487 }
5488 if (*p) {
5489 p++;
5490 }
5491 }
5492
5493 if (*ext2) {
5494 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5495 name2_copy,
5496 root2,
5497 ext2);
5498 } else {
5499 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5500 name2_copy,
5501 root2);
5502 }
5503
5504 if (!*pp_newname) {
5505 return False;
5506 }
5507
5508 return True;
5509 }
5510
5511 /****************************************************************************
5512 Ensure open files have their names updated. Updated to notify other smbd's
5513 asynchronously.
5514 ****************************************************************************/
5515
5516 static void rename_open_files(connection_struct *conn,
5517 struct share_mode_lock *lck,
5518 const char *newname)
5519 {
5520 files_struct *fsp;
5521 bool did_rename = False;
5522
5523 for(fsp = file_find_di_first(lck->id); fsp;
5524 fsp = file_find_di_next(fsp)) {
5525 /* fsp_name is a relative path under the fsp. To change this for other
5526 sharepaths we need to manipulate relative paths. */
5527 /* TODO - create the absolute path and manipulate the newname
5528 relative to the sharepath. */
5529 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5530 continue;
5531 }
5532 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5533 fsp->fnum, file_id_string_tos(&fsp->file_id),
5534 fsp->fsp_name, newname ));
5535 string_set(&fsp->fsp_name, newname);
5536 did_rename = True;
5537 }
5538
5539 if (!did_rename) {
5540 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5541 file_id_string_tos(&lck->id), newname ));
5542 }
5543
5544 /* Send messages to all smbd's (not ourself) that the name has changed. */
5545 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5546 newname);
5547 }
5548
5549 /****************************************************************************
5550 We need to check if the source path is a parent directory of the destination
5551 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5552 refuse the rename with a sharing violation. Under UNIX the above call can
5553 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5554 probably need to check that the client is a Windows one before disallowing
5555 this as a UNIX client (one with UNIX extensions) can know the source is a
5556 symlink and make this decision intelligently. Found by an excellent bug
5557 report from <AndyLiebman@aol.com>.
5558 ****************************************************************************/
5559
5560 static bool rename_path_prefix_equal(const char *src, const char *dest)
5561 {
5562 const char *psrc = src;
5563 const char *pdst = dest;
5564 size_t slen;
5565
5566 if (psrc[0] == '.' && psrc[1] == '/') {
5567 psrc += 2;
5568 }
5569 if (pdst[0] == '.' && pdst[1] == '/') {
5570 pdst += 2;
5571 }
5572 if ((slen = strlen(psrc)) > strlen(pdst)) {
5573 return False;
5574 }
5575 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5576 }
5577
5578 /*
5579 * Do the notify calls from a rename
5580 */
5581
5582 static void notify_rename(connection_struct *conn, bool is_dir,
5583 const char *oldpath, const char *newpath)
5584 {
5585 char *olddir, *newdir;
5586 const char *oldname, *newname;
5587 uint32 mask;
5588
5589 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5590 : FILE_NOTIFY_CHANGE_FILE_NAME;
5591
5592 if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
5593 || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
5594 TALLOC_FREE(olddir);
5595 return;
5596 }
5597
5598 if (strcmp(olddir, newdir) == 0) {
5599 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5600 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5601 }
5602 else {
5603 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5604 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5605 }
5606 TALLOC_FREE(olddir);
5607 TALLOC_FREE(newdir);
5608
5609 /* this is a strange one. w2k3 gives an additional event for
5610 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5611 files, but not directories */
5612 if (!is_dir) {
5613 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5614 FILE_NOTIFY_CHANGE_ATTRIBUTES
5615 |FILE_NOTIFY_CHANGE_CREATION,
5616 newpath);
5617 }
5618 }
5619
5620 /****************************************************************************
5621 Rename an open file - given an fsp.
5622 ****************************************************************************/
5623
5624 NTSTATUS rename_internals_fsp(connection_struct *conn,
5625 files_struct *fsp,
5626 char *newname,
5627 const char *newname_last_component,
5628 uint32 attrs,
5629 bool replace_if_exists)
5630 {
5631 TALLOC_CTX *ctx = talloc_tos();
5632 SMB_STRUCT_STAT sbuf, sbuf1;
5633 NTSTATUS status = NT_STATUS_OK;
5634 struct share_mode_lock *lck = NULL;
5635 bool dst_exists, old_is_stream, new_is_stream;
5636
5637 ZERO_STRUCT(sbuf);
5638
5639 status = check_name(conn, newname);
5640 if (!NT_STATUS_IS_OK(status)) {
5641 return status;
5642 }
5643
5644 /* Ensure newname contains a '/' */
5645 if(strrchr_m(newname,'/') == 0) {
5646 newname = talloc_asprintf(ctx,
5647 "./%s",
5648 newname);
5649 if (!newname) {
5650 return NT_STATUS_NO_MEMORY;
5651 }
5652 }
5653
5654 /*
5655 * Check for special case with case preserving and not
5656 * case sensitive. If the old last component differs from the original
5657 * last component only by case, then we should allow
5658 * the rename (user is trying to change the case of the
5659 * filename).
5660 */
5661
5662 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5663 strequal(newname, fsp->fsp_name)) {
5664 char *p;
5665 char *newname_modified_last_component = NULL;
5666
5667 /*
5668 * Get the last component of the modified name.
5669 * Note that we guarantee that newname contains a '/'
5670 * character above.
5671 */
5672 p = strrchr_m(newname,'/');
5673 newname_modified_last_component = talloc_strdup(ctx,
5674 p+1);
5675 if (!newname_modified_last_component) {
5676 return NT_STATUS_NO_MEMORY;
5677 }
5678
5679 if(strcsequal(newname_modified_last_component,
5680 newname_last_component) == False) {
5681 /*
5682 * Replace the modified last component with
5683 * the original.
5684 */
5685 *p = '\0'; /* Truncate at the '/' */
5686 newname = talloc_asprintf(ctx,
5687 "%s/%s",
5688 newname,
5689 newname_last_component);
5690 }
5691 }
5692
5693 /*
5694 * If the src and dest names are identical - including case,
5695 * don't do the rename, just return success.
5696 */
5697
5698 if (strcsequal(fsp->fsp_name, newname)) {
5699 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5700 newname));
5701 return NT_STATUS_OK;
5702 }
5703
5704 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5705 new_is_stream = is_ntfs_stream_name(newname);
5706
5707 /* Return the correct error code if both names aren't streams. */
5708 if (!old_is_stream && new_is_stream) {
5709 return NT_STATUS_OBJECT_NAME_INVALID;
5710 }
5711
5712 if (old_is_stream && !new_is_stream) {
5713 return NT_STATUS_INVALID_PARAMETER;
5714 }
5715
5716 /*
5717 * Have vfs_object_exist also fill sbuf1
5718 */
5719 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5720
5721 if(!replace_if_exists && dst_exists) {
5722 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5723 fsp->fsp_name,newname));
5724 return NT_STATUS_OBJECT_NAME_COLLISION;
5725 }
5726
5727 if (dst_exists) {
5728 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5729 files_struct *dst_fsp = file_find_di_first(fileid);
5730 /* The file can be open when renaming a stream */
5731 if (dst_fsp && !new_is_stream) {
5732 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5733 return NT_STATUS_ACCESS_DENIED;
5734 }
5735 }
5736
5737 /* Ensure we have a valid stat struct for the source. */
5738 if (fsp->fh->fd != -1) {
5739 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5740 return map_nt_error_from_unix(errno);
5741 }
5742 } else {
5743 int ret = -1;
5744 if (fsp->posix_open) {
5745 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5746 } else {
5747 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5748 }
5749 if (ret == -1) {
5750 return map_nt_error_from_unix(errno);
5751 }
5752 }
5753
5754 status = can_rename(conn, fsp, attrs, &sbuf);
5755
5756 if (!NT_STATUS_IS_OK(status)) {
5757 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5758 nt_errstr(status), fsp->fsp_name,newname));
5759 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5760 status = NT_STATUS_ACCESS_DENIED;
5761 return status;
5762 }
5763
5764 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5765 return NT_STATUS_ACCESS_DENIED;
5766 }
5767
5768 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5769 NULL);
5770
5771 /*
5772 * We have the file open ourselves, so not being able to get the
5773 * corresponding share mode lock is a fatal error.
5774 */
5775
5776 SMB_ASSERT(lck != NULL);
5777
5778 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5779 uint32 create_options = fsp->fh->private_options;
5780
5781 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5782 fsp->fsp_name,newname));
5783
5784 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5785
5786 rename_open_files(conn, lck, newname);
5787
5788 /*
5789 * A rename acts as a new file create w.r.t. allowing an initial delete
5790 * on close, probably because in Windows there is a new handle to the
5791 * new file. If initial delete on close was requested but not
5792 * originally set, we need to set it here. This is probably not 100% correct,
5793 * but will work for the CIFSFS client which in non-posix mode
5794 * depends on these semantics. JRA.
5795 */
5796
5797 if (create_options & FILE_DELETE_ON_CLOSE) {
5798 status = can_set_delete_on_close(fsp, True, 0);
5799
5800 if (NT_STATUS_IS_OK(status)) {
5801 /* Note that here we set the *inital* delete on close flag,
5802 * not the regular one. The magic gets handled in close. */
5803 fsp->initial_delete_on_close = True;
5804 }
5805 }
5806 TALLOC_FREE(lck);
5807 return NT_STATUS_OK;
5808 }
5809
5810 TALLOC_FREE(lck);
5811
5812 if (errno == ENOTDIR || errno == EISDIR) {
5813 status = NT_STATUS_OBJECT_NAME_COLLISION;
5814 } else {
5815 status = map_nt_error_from_unix(errno);
5816 }
5817
5818 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5819 nt_errstr(status), fsp->fsp_name,newname));
5820
5821 return status;
5822 }
5823
5824 /****************************************************************************
5825 The guts of the rename command, split out so it may be called by the NT SMB
5826 code.
5827 ****************************************************************************/
5828
5829 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5830 connection_struct *conn,
5831 struct smb_request *req,
5832 const char *name_in,
5833 const char *newname_in,
5834 uint32 attrs,
5835 bool replace_if_exists,
5836 bool src_has_wild,
5837 bool dest_has_wild,
5838 uint32_t access_mask)
5839 {
5840 char *directory = NULL;
5841 char *mask = NULL;
5842 char *last_component_src = NULL;
5843 char *last_component_dest = NULL;
5844 char *name = NULL;
5845 char *newname = NULL;
5846 char *p;
5847 int count=0;
5848 NTSTATUS status = NT_STATUS_OK;
5849 SMB_STRUCT_STAT sbuf1, sbuf2;
5850 struct smb_Dir *dir_hnd = NULL;
5851 const char *dname;
5852 long offset = 0;
5853 int create_options = 0;
5854 bool posix_pathnames = lp_posix_pathnames();
5855
5856 ZERO_STRUCT(sbuf1);
5857 ZERO_STRUCT(sbuf2);
5858
5859 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5860 &last_component_src, &sbuf1);
5861 if (!NT_STATUS_IS_OK(status)) {
5862 return status;
5863 }
5864
5865 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5866 &last_component_dest, &sbuf2);
5867 if (!NT_STATUS_IS_OK(status)) {
5868 return status;
5869 }
5870
5871 /*
5872 * Split the old name into directory and last component
5873 * strings. Note that unix_convert may have stripped off a
5874 * leading ./ from both name and newname if the rename is
5875 * at the root of the share. We need to make sure either both
5876 * name and newname contain a / character or neither of them do
5877 * as this is checked in resolve_wildcards().
5878 */
5879
5880 p = strrchr_m(name,'/');
5881 if (!p) {
5882 directory = talloc_strdup(ctx, ".");
5883 if (!directory) {
5884 return NT_STATUS_NO_MEMORY;
5885 }
5886 mask = name;
5887 } else {
5888 *p = 0;
5889 directory = talloc_strdup(ctx, name);
5890 if (!directory) {
5891 return NT_STATUS_NO_MEMORY;
5892 }
5893 mask = p+1;
5894 *p = '/'; /* Replace needed for exceptional test below. */
5895 }
5896
5897 /*
5898 * We should only check the mangled cache
5899 * here if unix_convert failed. This means
5900 * that the path in 'mask' doesn't exist
5901 * on the file system and so we need to look
5902 * for a possible mangle. This patch from
5903 * Tine Smukavec <valentin.smukavec@hermes.si>.
5904 */
5905
5906 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5907 char *new_mask = NULL;
5908 mangle_lookup_name_from_8_3(ctx,
5909 mask,
5910 &new_mask,
5911 conn->params );
5912 if (new_mask) {
5913 mask = new_mask;
5914 }
5915 }
5916
5917 if (!src_has_wild) {
5918 files_struct *fsp;
5919
5920 /*
5921 * No wildcards - just process the one file.
5922 */
5923 /* Add a terminating '/' to the directory name. */
5924 directory = talloc_asprintf_append(directory,
5925 "/%s",
5926 mask);
5927 if (!directory) {
5928 return NT_STATUS_NO_MEMORY;
5929 }
5930
5931 /* Ensure newname contains a '/' also */
5932 if(strrchr_m(newname,'/') == 0) {
5933 newname = talloc_asprintf(ctx,
5934 "./%s",
5935 newname);
5936 if (!newname) {
5937 return NT_STATUS_NO_MEMORY;
5938 }
5939 }
5940
5941 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5942 "case_preserve = %d, short case preserve = %d, "
5943 "directory = %s, newname = %s, "
5944 "last_component_dest = %s\n",
5945 conn->case_sensitive, conn->case_preserve,
5946 conn->short_case_preserve, directory,
5947 newname, last_component_dest));
5948
5949 /* The dest name still may have wildcards. */
5950 if (dest_has_wild) {
5951 char *mod_newname = NULL;
5952 if (!resolve_wildcards(ctx,
5953 directory,newname,&mod_newname)) {
5954 DEBUG(6, ("rename_internals: resolve_wildcards "
5955 "%s %s failed\n",
5956 directory,
5957 newname));
5958 return NT_STATUS_NO_MEMORY;
5959 }
5960 newname = mod_newname;
5961 }
5962
5963 ZERO_STRUCT(sbuf1);
5964 if (posix_pathnames) {
5965 SMB_VFS_LSTAT(conn, directory, &sbuf1);
5966 } else {
5967 SMB_VFS_STAT(conn, directory, &sbuf1);
5968 }
5969
5970 if (S_ISDIR(sbuf1.st_mode)) {
5971 create_options |= FILE_DIRECTORY_FILE;
5972 }
5973
5974 status = SMB_VFS_CREATE_FILE(
5975 conn, /* conn */
5976 req, /* req */
5977 0, /* root_dir_fid */
5978 directory, /* fname */
5979 0, /* create_file_flags */
5980 access_mask, /* access_mask */
5981 (FILE_SHARE_READ | /* share_access */
5982 FILE_SHARE_WRITE),
5983 FILE_OPEN, /* create_disposition*/
5984 create_options, /* create_options */
5985 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
5986 0, /* oplock_request */
5987 0, /* allocation_size */
5988 NULL, /* sd */
5989 NULL, /* ea_list */
5990 &fsp, /* result */
5991 NULL, /* pinfo */
5992 &sbuf1); /* psbuf */
5993
5994 if (!NT_STATUS_IS_OK(status)) {
5995 DEBUG(3, ("Could not open rename source %s: %s\n",
5996 directory, nt_errstr(status)));
5997 return status;
5998 }
5999
6000 status = rename_internals_fsp(conn, fsp, newname,
6001 last_component_dest,
6002 attrs, replace_if_exists);
6003
6004 close_file(req, fsp, NORMAL_CLOSE);
6005
6006 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6007 nt_errstr(status), directory,newname));
6008
6009 return status;
6010 }
6011
6012 /*
6013 * Wildcards - process each file that matches.
6014 */
6015 if (strequal(mask,"????????.???")) {
6016 mask[0] = '*';
6017 mask[1] = '\0';
6018 }
6019
6020 status = check_name(conn, directory);
6021 if (!NT_STATUS_IS_OK(status)) {
6022 return status;
6023 }
6024
6025 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
6026 if (dir_hnd == NULL) {
6027 return map_nt_error_from_unix(errno);
6028 }
6029
6030 status = NT_STATUS_NO_SUCH_FILE;
6031 /*
6032 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6033 * - gentest fix. JRA
6034 */
6035
6036 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6037 files_struct *fsp = NULL;
6038 char *fname = NULL;
6039 char *destname = NULL;
6040 bool sysdir_entry = False;
6041
6042 /* Quick check for "." and ".." */
6043 if (ISDOT(dname) || ISDOTDOT(dname)) {
6044 if (attrs & aDIR) {
6045 sysdir_entry = True;
6046 } else {
6047 continue;
6048 }
6049 }
6050
6051 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6052 continue;
6053 }
6054
6055 if(!mask_match(dname, mask, conn->case_sensitive)) {
6056 continue;
6057 }
6058
6059 if (sysdir_entry) {
6060 status = NT_STATUS_OBJECT_NAME_INVALID;
6061 break;
6062 }
6063
6064 fname = talloc_asprintf(ctx,
6065 "%s/%s",
6066 directory,
6067 dname);
6068 if (!fname) {
6069 return NT_STATUS_NO_MEMORY;
6070 }
6071
6072 if (!resolve_wildcards(ctx,
6073 fname,newname,&destname)) {
6074 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6075 fname, destname));
6076 TALLOC_FREE(fname);
6077 continue;
6078 }
6079 if (!destname) {
6080 return NT_STATUS_NO_MEMORY;
6081 }
6082
6083 ZERO_STRUCT(sbuf1);
6084 if (posix_pathnames) {
6085 SMB_VFS_LSTAT(conn, fname, &sbuf1);
6086 } else {
6087 SMB_VFS_STAT(conn, fname, &sbuf1);
6088 }
6089
6090 create_options = 0;
6091
6092 if (S_ISDIR(sbuf1.st_mode)) {
6093 create_options |= FILE_DIRECTORY_FILE;
6094 }
6095
6096 status = SMB_VFS_CREATE_FILE(
6097 conn, /* conn */
6098 req, /* req */
6099 0, /* root_dir_fid */
6100 fname, /* fname */
6101 0, /* create_file_flags */
6102 access_mask, /* access_mask */
6103 (FILE_SHARE_READ | /* share_access */
6104 FILE_SHARE_WRITE),
6105 FILE_OPEN, /* create_disposition*/
6106 create_options, /* create_options */
6107 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6108 0, /* oplock_request */
6109 0, /* allocation_size */
6110 NULL, /* sd */
6111 NULL, /* ea_list */
6112 &fsp, /* result */
6113 NULL, /* pinfo */
6114 &sbuf1); /* psbuf */
6115
6116 if (!NT_STATUS_IS_OK(status)) {
6117 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6118 "returned %s rename %s -> %s\n",
6119 nt_errstr(status), directory, newname));
6120 break;
6121 }
6122
6123 status = rename_internals_fsp(conn, fsp, destname, dname,
6124 attrs, replace_if_exists);
6125
6126 close_file(req, fsp, NORMAL_CLOSE);
6127
6128 if (!NT_STATUS_IS_OK(status)) {
6129 DEBUG(3, ("rename_internals_fsp returned %s for "
6130 "rename %s -> %s\n", nt_errstr(status),
6131 directory, newname));
6132 break;
6133 }
6134
6135 count++;
6136
6137 DEBUG(3,("rename_internals: doing rename on %s -> "
6138 "%s\n",fname,destname));
6139
6140 TALLOC_FREE(fname);
6141 TALLOC_FREE(destname);
6142 }
6143 TALLOC_FREE(dir_hnd);
6144
6145 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6146 status = map_nt_error_from_unix(errno);
6147 }
6148
6149 return status;
6150 }
6151
6152 /****************************************************************************
6153 Reply to a mv.
6154 ****************************************************************************/
6155
6156 void reply_mv(struct smb_request *req)
6157 {
6158 connection_struct *conn = req->conn;
6159 char *name = NULL;
6160 char *newname = NULL;
6161 const char *p;
6162 uint32 attrs;
6163 NTSTATUS status;
6164 bool src_has_wcard = False;
6165 bool dest_has_wcard = False;
6166 TALLOC_CTX *ctx = talloc_tos();
6167
6168 START_PROFILE(SMBmv);
6169
6170 if (req->wct < 1) {
6171 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6172 END_PROFILE(SMBmv);
6173 return;
6174 }
6175
6176 attrs = SVAL(req->vwv+0, 0);
6177
6178 p = (const char *)req->buf + 1;
6179 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6180 &status, &src_has_wcard);
6181 if (!NT_STATUS_IS_OK(status)) {
6182 reply_nterror(req, status);
6183 END_PROFILE(SMBmv);
6184 return;
6185 }
6186 p++;
6187 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6188 &status, &dest_has_wcard);
6189 if (!NT_STATUS_IS_OK(status)) {
6190 reply_nterror(req, status);
6191 END_PROFILE(SMBmv);
6192 return;
6193 }
6194
6195 status = resolve_dfspath_wcard(ctx, conn,
6196 req->flags2 & FLAGS2_DFS_PATHNAMES,
6197 name,
6198 &name,
6199 &src_has_wcard);
6200 if (!NT_STATUS_IS_OK(status)) {
6201 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6202 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6203 ERRSRV, ERRbadpath);
6204 END_PROFILE(SMBmv);
6205 return;
6206 }
6207 reply_nterror(req, status);
6208 END_PROFILE(SMBmv);
6209 return;
6210 }
6211
6212 status = resolve_dfspath_wcard(ctx, conn,
6213 req->flags2 & FLAGS2_DFS_PATHNAMES,
6214 newname,
6215 &newname,
6216 &dest_has_wcard);
6217 if (!NT_STATUS_IS_OK(status)) {
6218 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6219 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6220 ERRSRV, ERRbadpath);
6221 END_PROFILE(SMBmv);
6222 return;
6223 }
6224 reply_nterror(req, status);
6225 END_PROFILE(SMBmv);
6226 return;
6227 }
6228
6229 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6230
6231 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6232 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6233 if (!NT_STATUS_IS_OK(status)) {
6234 if (open_was_deferred(req->mid)) {
6235 /* We have re-scheduled this call. */
6236 END_PROFILE(SMBmv);
6237 return;
6238 }
6239 reply_nterror(req, status);
6240 END_PROFILE(SMBmv);
6241 return;
6242 }
6243
6244 reply_outbuf(req, 0, 0);
6245
6246 END_PROFILE(SMBmv);
6247 return;
6248 }
6249
6250 /*******************************************************************
6251 Copy a file as part of a reply_copy.
6252 ******************************************************************/
6253
6254 /*
6255 * TODO: check error codes on all callers
6256 */
6257
6258 NTSTATUS copy_file(TALLOC_CTX *ctx,
6259 connection_struct *conn,
6260 const char *src,
6261 const char *dest1,
6262 int ofun,
6263 int count,
6264 bool target_is_directory)
6265 {
6266 SMB_STRUCT_STAT src_sbuf, sbuf2;
6267 SMB_OFF_T ret=-1;
6268 files_struct *fsp1,*fsp2;
6269 char *dest = NULL;
6270 uint32 dosattrs;
6271 uint32 new_create_disposition;
6272 NTSTATUS status;
6273
6274 dest = talloc_strdup(ctx, dest1);
6275 if (!dest) {
6276 return NT_STATUS_NO_MEMORY;
6277 }
6278 if (target_is_directory) {
6279 const char *p = strrchr_m(src,'/');
6280 if (p) {
6281 p++;
6282 } else {
6283 p = src;
6284 }
6285 dest = talloc_asprintf_append(dest,
6286 "/%s",
6287 p);
6288 if (!dest) {
6289 return NT_STATUS_NO_MEMORY;
6290 }
6291 }
6292
6293 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6294 TALLOC_FREE(dest);
6295 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6296 }
6297
6298 if (!target_is_directory && count) {
6299 new_create_disposition = FILE_OPEN;
6300 } else {
6301 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6302 NULL, NULL, &new_create_disposition, NULL)) {
6303 TALLOC_FREE(dest);
6304 return NT_STATUS_INVALID_PARAMETER;
6305 }
6306 }
6307
6308 status = SMB_VFS_CREATE_FILE(
6309 conn, /* conn */
6310 NULL, /* req */
6311 0, /* root_dir_fid */
6312 src, /* fname */
6313 0, /* create_file_flags */
6314 FILE_GENERIC_READ, /* access_mask */
6315 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6316 FILE_OPEN, /* create_disposition*/
6317 0, /* create_options */
6318 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6319 INTERNAL_OPEN_ONLY, /* oplock_request */
6320 0, /* allocation_size */
6321 NULL, /* sd */
6322 NULL, /* ea_list */
6323 &fsp1, /* result */
6324 NULL, /* pinfo */
6325 &src_sbuf); /* psbuf */
6326
6327 if (!NT_STATUS_IS_OK(status)) {
6328 TALLOC_FREE(dest);
6329 return status;
6330 }
6331
6332 dosattrs = dos_mode(conn, src, &src_sbuf);
6333 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6334 ZERO_STRUCTP(&sbuf2);
6335 }
6336
6337 status = SMB_VFS_CREATE_FILE(
6338 conn, /* conn */
6339 NULL, /* req */
6340 0, /* root_dir_fid */
6341 dest, /* fname */
6342 0, /* create_file_flags */
6343 FILE_GENERIC_WRITE, /* access_mask */
6344 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6345 new_create_disposition, /* create_disposition*/
6346 0, /* create_options */
6347 dosattrs, /* file_attributes */
6348 INTERNAL_OPEN_ONLY, /* oplock_request */
6349 0, /* allocation_size */
6350 NULL, /* sd */
6351 NULL, /* ea_list */
6352 &fsp2, /* result */
6353 NULL, /* pinfo */
6354 &sbuf2); /* psbuf */
6355
6356 TALLOC_FREE(dest);
6357
6358 if (!NT_STATUS_IS_OK(status)) {
6359 close_file(NULL, fsp1, ERROR_CLOSE);
6360 return status;
6361 }
6362
6363 if ((ofun&3) == 1) {
6364 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6365 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6366 /*
6367 * Stop the copy from occurring.
6368 */
6369 ret = -1;
6370 src_sbuf.st_size = 0;
6371 }
6372 }
6373
6374 if (src_sbuf.st_size) {
6375 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6376 }
6377
6378 close_file(NULL, fsp1, NORMAL_CLOSE);
6379
6380 /* Ensure the modtime is set correctly on the destination file. */
6381 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6382
6383 /*
6384 * As we are opening fsp1 read-only we only expect
6385 * an error on close on fsp2 if we are out of space.
6386 * Thus we don't look at the error return from the
6387 * close of fsp1.
6388 */
6389 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6390
6391 if (!NT_STATUS_IS_OK(status)) {
6392 return status;
6393 }
6394
6395 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6396 return NT_STATUS_DISK_FULL;
6397 }
6398
6399 return NT_STATUS_OK;
6400 }
6401
6402 /****************************************************************************
6403 Reply to a file copy.
6404 ****************************************************************************/
6405
6406 void reply_copy(struct smb_request *req)
6407 {
6408 connection_struct *conn = req->conn;
6409 char *name = NULL;
6410 char *newname = NULL;
6411 char *directory = NULL;
6412 const char *mask = NULL;
6413 const char mask_star[] = "*";
6414 const char *p;
6415 int count=0;
6416 int error = ERRnoaccess;
6417 int err = 0;
6418 int tid2;
6419 int ofun;
6420 int flags;
6421 bool target_is_directory=False;
6422 bool source_has_wild = False;
6423 bool dest_has_wild = False;
6424 SMB_STRUCT_STAT sbuf1, sbuf2;
6425 NTSTATUS status;
6426 TALLOC_CTX *ctx = talloc_tos();
6427
6428 START_PROFILE(SMBcopy);
6429
6430 if (req->wct < 3) {
6431 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6432 END_PROFILE(SMBcopy);
6433 return;
6434 }
6435
6436 tid2 = SVAL(req->vwv+0, 0);
6437 ofun = SVAL(req->vwv+1, 0);
6438 flags = SVAL(req->vwv+2, 0);
6439
6440 p = (const char *)req->buf;
6441 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6442 &status, &source_has_wild);
6443 if (!NT_STATUS_IS_OK(status)) {
6444 reply_nterror(req, status);
6445 END_PROFILE(SMBcopy);
6446 return;
6447 }
6448 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6449 &status, &dest_has_wild);
6450 if (!NT_STATUS_IS_OK(status)) {
6451 reply_nterror(req, status);
6452 END_PROFILE(SMBcopy);
6453 return;
6454 }
6455
6456 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6457
6458 if (tid2 != conn->cnum) {
6459 /* can't currently handle inter share copies XXXX */
6460 DEBUG(3,("Rejecting inter-share copy\n"));
6461 reply_doserror(req, ERRSRV, ERRinvdevice);
6462 END_PROFILE(SMBcopy);
6463 return;
6464 }
6465
6466 status = resolve_dfspath_wcard(ctx, conn,
6467 req->flags2 & FLAGS2_DFS_PATHNAMES,
6468 name,
6469 &name,
6470 &source_has_wild);
6471 if (!NT_STATUS_IS_OK(status)) {
6472 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6473 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6474 ERRSRV, ERRbadpath);
6475 END_PROFILE(SMBcopy);
6476 return;
6477 }
6478 reply_nterror(req, status);
6479 END_PROFILE(SMBcopy);
6480 return;
6481 }
6482
6483 status = resolve_dfspath_wcard(ctx, conn,
6484 req->flags2 & FLAGS2_DFS_PATHNAMES,
6485 newname,
6486 &newname,
6487 &dest_has_wild);
6488 if (!NT_STATUS_IS_OK(status)) {
6489 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6490 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6491 ERRSRV, ERRbadpath);
6492 END_PROFILE(SMBcopy);
6493 return;
6494 }
6495 reply_nterror(req, status);
6496 END_PROFILE(SMBcopy);
6497 return;
6498 }
6499
6500 status = unix_convert(ctx, conn, name, source_has_wild,
6501 &name, NULL, &sbuf1);
6502 if (!NT_STATUS_IS_OK(status)) {
6503 reply_nterror(req, status);
6504 END_PROFILE(SMBcopy);
6505 return;
6506 }
6507
6508 status = unix_convert(ctx, conn, newname, dest_has_wild,
6509 &newname, NULL, &sbuf2);
6510 if (!NT_STATUS_IS_OK(status)) {
6511 reply_nterror(req, status);
6512 END_PROFILE(SMBcopy);
6513 return;
6514 }
6515
6516 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6517
6518 if ((flags&1) && target_is_directory) {
6519 reply_doserror(req, ERRDOS, ERRbadfile);
6520 END_PROFILE(SMBcopy);
6521 return;
6522 }
6523
6524 if ((flags&2) && !target_is_directory) {
6525 reply_doserror(req, ERRDOS, ERRbadpath);
6526 END_PROFILE(SMBcopy);
6527 return;
6528 }
6529
6530 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6531 /* wants a tree copy! XXXX */
6532 DEBUG(3,("Rejecting tree copy\n"));
6533 reply_doserror(req, ERRSRV, ERRerror);
6534 END_PROFILE(SMBcopy);
6535 return;
6536 }
6537
6538 p = strrchr_m(name,'/');
6539 if (p != NULL) {
6540 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6541 mask = p+1;
6542 } else {
6543 directory = talloc_strdup(ctx, "./");
6544 mask = name;
6545 }
6546
6547 if (!directory) {
6548 reply_nterror(req, NT_STATUS_NO_MEMORY);
6549 END_PROFILE(SMBcopy);
6550 return;
6551 }
6552
6553 /*
6554 * We should only check the mangled cache
6555 * here if unix_convert failed. This means
6556 * that the path in 'mask' doesn't exist
6557 * on the file system and so we need to look
6558 * for a possible mangle. This patch from
6559 * Tine Smukavec <valentin.smukavec@hermes.si>.
6560 */
6561
6562 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6563 char *new_mask = NULL;
6564 mangle_lookup_name_from_8_3(ctx,
6565 mask,
6566 &new_mask,
6567 conn->params );
6568 if (new_mask) {
6569 mask = new_mask;
6570 }
6571 }
6572
6573 if (!source_has_wild) {
6574 directory = talloc_asprintf_append(directory,
6575 "/%s",
6576 mask);
6577 if (dest_has_wild) {
6578 char *mod_newname = NULL;
6579 if (!resolve_wildcards(ctx,
6580 directory,newname,&mod_newname)) {
6581 reply_nterror(req, NT_STATUS_NO_MEMORY);
6582 END_PROFILE(SMBcopy);
6583 return;
6584 }
6585 newname = mod_newname;
6586 }
6587
6588 status = check_name(conn, directory);
6589 if (!NT_STATUS_IS_OK(status)) {
6590 reply_nterror(req, status);
6591 END_PROFILE(SMBcopy);
6592 return;
6593 }
6594
6595 status = check_name(conn, newname);
6596 if (!NT_STATUS_IS_OK(status)) {
6597 reply_nterror(req, status);
6598 END_PROFILE(SMBcopy);
6599 return;
6600 }
6601
6602 status = copy_file(ctx,conn,directory,newname,ofun,
6603 count,target_is_directory);
6604
6605 if(!NT_STATUS_IS_OK(status)) {
6606 reply_nterror(req, status);
6607 END_PROFILE(SMBcopy);
6608 return;
6609 } else {
6610 count++;
6611 }
6612 } else {
6613 struct smb_Dir *dir_hnd = NULL;
6614 const char *dname = NULL;
6615 long offset = 0;
6616
6617 if (strequal(mask,"????????.???")) {
6618 mask = mask_star;
6619 }
6620
6621 status = check_name(conn, directory);
6622 if (!NT_STATUS_IS_OK(status)) {
6623 reply_nterror(req, status);
6624 END_PROFILE(SMBcopy);
6625 return;
6626 }
6627
6628 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6629 if (dir_hnd == NULL) {
6630 status = map_nt_error_from_unix(errno);
6631 reply_nterror(req, status);
6632 END_PROFILE(SMBcopy);
6633 return;
6634 }
6635
6636 error = ERRbadfile;
6637
6638 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6639 char *destname = NULL;
6640 char *fname = NULL;
6641
6642 if (ISDOT(dname) || ISDOTDOT(dname)) {
6643 continue;
6644 }
6645
6646 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6647 continue;
6648 }
6649
6650 if(!mask_match(dname, mask, conn->case_sensitive)) {
6651 continue;
6652 }
6653
6654 error = ERRnoaccess;
6655 fname = talloc_asprintf(ctx,
6656 "%s/%s",
6657 directory,
6658 dname);
6659 if (!fname) {
6660 TALLOC_FREE(dir_hnd);
6661 reply_nterror(req, NT_STATUS_NO_MEMORY);
6662 END_PROFILE(SMBcopy);
6663 return;
6664 }
6665
6666 if (!resolve_wildcards(ctx,
6667 fname,newname,&destname)) {
6668 continue;
6669 }
6670 if (!destname) {
6671 TALLOC_FREE(dir_hnd);
6672 reply_nterror(req, NT_STATUS_NO_MEMORY);
6673 END_PROFILE(SMBcopy);
6674 return;
6675 }
6676
6677 status = check_name(conn, fname);
6678 if (!NT_STATUS_IS_OK(status)) {
6679 TALLOC_FREE(dir_hnd);
6680 reply_nterror(req, status);
6681 END_PROFILE(SMBcopy);
6682 return;
6683 }
6684
6685 status = check_name(conn, destname);
6686 if (!NT_STATUS_IS_OK(status)) {
6687 TALLOC_FREE(dir_hnd);
6688 reply_nterror(req, status);
6689 END_PROFILE(SMBcopy);
6690 return;
6691 }
6692
6693 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6694
6695 status = copy_file(ctx,conn,fname,destname,ofun,
6696 count,target_is_directory);
6697 if (NT_STATUS_IS_OK(status)) {
6698 count++;
6699 }
6700 TALLOC_FREE(fname);
6701 TALLOC_FREE(destname);
6702 }
6703 TALLOC_FREE(dir_hnd);
6704 }
6705
6706 if (count == 0) {
6707 if(err) {
6708 /* Error on close... */
6709 errno = err;
6710 reply_unixerror(req, ERRHRD, ERRgeneral);
6711 END_PROFILE(SMBcopy);
6712 return;
6713 }
6714
6715 reply_doserror(req, ERRDOS, error);
6716 END_PROFILE(SMBcopy);
6717 return;
6718 }
6719
6720 reply_outbuf(req, 1, 0);
6721 SSVAL(req->outbuf,smb_vwv0,count);
6722
6723 END_PROFILE(SMBcopy);
6724 return;
6725 }
6726
6727 #undef DBGC_CLASS
6728 #define DBGC_CLASS DBGC_LOCKING
6729
6730 /****************************************************************************
6731 Get a lock pid, dealing with large count requests.
6732 ****************************************************************************/
6733
6734 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6735 bool large_file_format)
6736 {
6737 if(!large_file_format)
6738 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6739 else
6740 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6741 }
6742
6743 /****************************************************************************
6744 Get a lock count, dealing with large count requests.
6745 ****************************************************************************/
6746
6747 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6748 bool large_file_format)
6749 {
6750 uint64_t count = 0;
6751
6752 if(!large_file_format) {
6753 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6754 } else {
6755
6756 #if defined(HAVE_LONGLONG)
6757 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6758 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6759 #else /* HAVE_LONGLONG */
6760
6761 /*
6762 * NT4.x seems to be broken in that it sends large file (64 bit)
6763 * lockingX calls even if the CAP_LARGE_FILES was *not*
6764 * negotiated. For boxes without large unsigned ints truncate the
6765 * lock count by dropping the top 32 bits.
6766 */
6767
6768 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6769 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6770 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6771 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6772 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6773 }
6774
6775 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6776 #endif /* HAVE_LONGLONG */
6777 }
6778
6779 return count;
6780 }
6781
6782 #if !defined(HAVE_LONGLONG)
6783 /****************************************************************************
6784 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6785 ****************************************************************************/
6786
6787 static uint32 map_lock_offset(uint32 high, uint32 low)
6788 {
6789 unsigned int i;
6790 uint32 mask = 0;
6791 uint32 highcopy = high;
6792
6793 /*
6794 * Try and find out how many significant bits there are in high.
6795 */
6796
6797 for(i = 0; highcopy; i++)
6798 highcopy >>= 1;
6799
6800 /*
6801 * We use 31 bits not 32 here as POSIX
6802 * lock offsets may not be negative.
6803 */
6804
6805 mask = (~0) << (31 - i);
6806
6807 if(low & mask)
6808 return 0; /* Fail. */
6809
6810 high <<= (31 - i);
6811
6812 return (high|low);
6813 }
6814 #endif /* !defined(HAVE_LONGLONG) */
6815
6816 /****************************************************************************
6817 Get a lock offset, dealing with large offset requests.
6818 ****************************************************************************/
6819
6820 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6821 bool large_file_format, bool *err)
6822 {
6823 uint64_t offset = 0;
6824
6825 *err = False;
6826
6827 if(!large_file_format) {
6828 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6829 } else {
6830
6831 #if defined(HAVE_LONGLONG)
6832 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6833 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6834 #else /* HAVE_LONGLONG */
6835
6836 /*
6837 * NT4.x seems to be broken in that it sends large file (64 bit)
6838 * lockingX calls even if the CAP_LARGE_FILES was *not*
6839 * negotiated. For boxes without large unsigned ints mangle the
6840 * lock offset by mapping the top 32 bits onto the lower 32.
6841 */
6842
6843 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6844 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6845 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6846 uint32 new_low = 0;
6847
6848 if((new_low = map_lock_offset(high, low)) == 0) {
6849 *err = True;
6850 return (uint64_t)-1;
6851 }
6852
6853 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6854 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6855 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6856 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6857 }
6858
6859 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6860 #endif /* HAVE_LONGLONG */
6861 }
6862
6863 return offset;
6864 }
6865
6866 /****************************************************************************
6867 Reply to a lockingX request.
6868 ****************************************************************************/
6869
6870 void reply_lockingX(struct smb_request *req)
6871 {
6872 connection_struct *conn = req->conn;
6873 files_struct *fsp;
6874 unsigned char locktype;
6875 unsigned char oplocklevel;
6876 uint16 num_ulocks;
6877 uint16 num_locks;
6878 uint64_t count = 0, offset = 0;
6879 uint32 lock_pid;
6880 int32 lock_timeout;
6881 int i;
6882 const uint8_t *data;
6883 bool large_file_format;
6884 bool err;
6885 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6886
6887 START_PROFILE(SMBlockingX);
6888
6889 if (req->wct < 8) {
6890 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6891 END_PROFILE(SMBlockingX);
6892 return;
6893 }
6894
6895 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
6896 locktype = CVAL(req->vwv+3, 0);
6897 oplocklevel = CVAL(req->vwv+3, 1);
6898 num_ulocks = SVAL(req->vwv+6, 0);
6899 num_locks = SVAL(req->vwv+7, 0);
6900 lock_timeout = IVAL(req->vwv+4, 0);
6901 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6902
6903 if (!check_fsp(conn, req, fsp)) {
6904 END_PROFILE(SMBlockingX);
6905 return;
6906 }
6907
6908 data = req->buf;
6909
6910 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6911 /* we don't support these - and CANCEL_LOCK makes w2k
6912 and XP reboot so I don't really want to be
6913 compatible! (tridge) */
6914 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6915 END_PROFILE(SMBlockingX);
6916 return;
6917 }
6918
6919 /* Check if this is an oplock break on a file
6920 we have granted an oplock on.
6921 */
6922 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6923 /* Client can insist on breaking to none. */
6924 bool break_to_none = (oplocklevel == 0);
6925 bool result;
6926
6927 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6928 "for fnum = %d\n", (unsigned int)oplocklevel,
6929 fsp->fnum ));
6930
6931 /*
6932 * Make sure we have granted an exclusive or batch oplock on
6933 * this file.
6934 */
6935
6936 if (fsp->oplock_type == 0) {
6937
6938 /* The Samba4 nbench simulator doesn't understand
6939 the difference between break to level2 and break
6940 to none from level2 - it sends oplock break
6941 replies in both cases. Don't keep logging an error
6942 message here - just ignore it. JRA. */
6943
6944 DEBUG(5,("reply_lockingX: Error : oplock break from "
6945 "client for fnum = %d (oplock=%d) and no "
6946 "oplock granted on this file (%s).\n",
6947 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6948
6949 /* if this is a pure oplock break request then don't
6950 * send a reply */
6951 if (num_locks == 0 && num_ulocks == 0) {
6952 END_PROFILE(SMBlockingX);
6953 return;
6954 } else {
6955 END_PROFILE(SMBlockingX);
6956 reply_doserror(req, ERRDOS, ERRlock);
6957 return;
6958 }
6959 }
6960
6961 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6962 (break_to_none)) {
6963 result = remove_oplock(fsp);
6964 } else {
6965 result = downgrade_oplock(fsp);
6966 }
6967
6968 if (!result) {
6969 DEBUG(0, ("reply_lockingX: error in removing "
6970 "oplock on file %s\n", fsp->fsp_name));
6971 /* Hmmm. Is this panic justified? */
6972 smb_panic("internal tdb error");
6973 }
6974
6975 reply_to_oplock_break_requests(fsp);
6976
6977 /* if this is a pure oplock break request then don't send a
6978 * reply */
6979 if (num_locks == 0 && num_ulocks == 0) {
6980 /* Sanity check - ensure a pure oplock break is not a
6981 chained request. */
6982 if(CVAL(req->vwv+0, 0) != 0xff)
6983 DEBUG(0,("reply_lockingX: Error : pure oplock "
6984 "break is a chained %d request !\n",
6985 (unsigned int)CVAL(req->vwv+0, 0)));
6986 END_PROFILE(SMBlockingX);
6987 return;
6988 }
6989 }
6990
6991 if (req->buflen <
6992 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6993 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6994 END_PROFILE(SMBlockingX);
6995 return;
6996 }
6997
6998 /* Data now points at the beginning of the list
6999 of smb_unlkrng structs */
7000 for(i = 0; i < (int)num_ulocks; i++) {
7001 lock_pid = get_lock_pid( data, i, large_file_format);
7002 count = get_lock_count( data, i, large_file_format);
7003 offset = get_lock_offset( data, i, large_file_format, &err);
7004
7005 /*
7006 * There is no error code marked "stupid client bug".... :-).
7007 */
7008 if(err) {
7009 END_PROFILE(SMBlockingX);
7010 reply_doserror(req, ERRDOS, ERRnoaccess);
7011 return;
7012 }
7013
7014 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
7015 "pid %u, file %s\n", (double)offset, (double)count,
7016 (unsigned int)lock_pid, fsp->fsp_name ));
7017
7018 status = do_unlock(smbd_messaging_context(),
7019 fsp,
7020 lock_pid,
7021 count,
7022 offset,
7023 WINDOWS_LOCK);
7024
7025 DEBUG(10, ("reply_lockingX: unlock returned %s\n",
7026 nt_errstr(status)));
7027
7028 if (NT_STATUS_V(status)) {
7029 END_PROFILE(SMBlockingX);
7030 reply_nterror(req, status);
7031 return;
7032 }
7033 }
7034
7035 /* Setup the timeout in seconds. */
7036
7037 if (!lp_blocking_locks(SNUM(conn))) {
7038 lock_timeout = 0;
7039 }
7040
7041 /* Now do any requested locks */
7042 data += ((large_file_format ? 20 : 10)*num_ulocks);
7043
7044 /* Data now points at the beginning of the list
7045 of smb_lkrng structs */
7046
7047 for(i = 0; i < (int)num_locks; i++) {
7048 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
7049 READ_LOCK:WRITE_LOCK);
7050 lock_pid = get_lock_pid( data, i, large_file_format);
7051 count = get_lock_count( data, i, large_file_format);
7052 offset = get_lock_offset( data, i, large_file_format, &err);
7053
7054 /*
7055 * There is no error code marked "stupid client bug".... :-).
7056 */
7057 if(err) {
7058 END_PROFILE(SMBlockingX);
7059 reply_doserror(req, ERRDOS, ERRnoaccess);
7060 return;
7061 }
7062
7063 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
7064 "%u, file %s timeout = %d\n", (double)offset,
7065 (double)count, (unsigned int)lock_pid,
7066 fsp->fsp_name, (int)lock_timeout ));
7067
7068 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7069 struct blocking_lock_record *blr = NULL;
7070
7071 if (lp_blocking_locks(SNUM(conn))) {
7072
7073 /* Schedule a message to ourselves to
7074 remove the blocking lock record and
7075 return the right error. */
7076
7077 blr = blocking_lock_cancel(fsp,
7078 lock_pid,
7079 offset,
7080 count,
7081 WINDOWS_LOCK,
7082 locktype,
7083 NT_STATUS_FILE_LOCK_CONFLICT);
7084 if (blr == NULL) {
7085 END_PROFILE(SMBlockingX);
7086 reply_nterror(
7087 req,
7088 NT_STATUS_DOS(
7089 ERRDOS,
7090 ERRcancelviolation));
7091 return;
7092 }
7093 }
7094 /* Remove a matching pending lock. */
7095 status = do_lock_cancel(fsp,
7096 lock_pid,
7097 count,
7098 offset,
7099 WINDOWS_LOCK,
7100 blr);
7101 } else {
7102 bool blocking_lock = lock_timeout ? True : False;
7103 bool defer_lock = False;
7104 struct byte_range_lock *br_lck;
7105 uint32 block_smbpid;
7106
7107 br_lck = do_lock(smbd_messaging_context(),
7108 fsp,
7109 lock_pid,
7110 count,
7111 offset,
7112 lock_type,
7113 WINDOWS_LOCK,
7114 blocking_lock,
7115 &status,
7116 &block_smbpid,
7117 NULL);
7118
7119 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7120 /* Windows internal resolution for blocking locks seems
7121 to be about 200ms... Don't wait for less than that. JRA. */
7122 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
7123 lock_timeout = lp_lock_spin_time();
7124 }
7125 defer_lock = True;
7126 }
7127
7128 /* This heuristic seems to match W2K3 very well. If a
7129 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7130 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7131 far as I can tell. Replacement for do_lock_spin(). JRA. */
7132
7133 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7134 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7135 defer_lock = True;
7136 lock_timeout = lp_lock_spin_time();
7137 }
7138
7139 if (br_lck && defer_lock) {
7140 /*
7141 * A blocking lock was requested. Package up
7142 * this smb into a queued request and push it
7143 * onto the blocking lock queue.
7144 */
7145 if(push_blocking_lock_request(br_lck,
7146 req,
7147 fsp,
7148 lock_timeout,
7149 i,
7150 lock_pid,
7151 lock_type,
7152 WINDOWS_LOCK,
7153 offset,
7154 count,
7155 block_smbpid)) {
7156 TALLOC_FREE(br_lck);
7157 END_PROFILE(SMBlockingX);
7158 return;
7159 }
7160 }
7161
7162 TALLOC_FREE(br_lck);
7163 }
7164
7165 if (NT_STATUS_V(status)) {
7166 END_PROFILE(SMBlockingX);
7167 reply_nterror(req, status);
7168 return;
7169 }
7170 }
7171
7172 /* If any of the above locks failed, then we must unlock
7173 all of the previous locks (X/Open spec). */
7174
7175 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7176 (i != num_locks) &&
7177 (num_locks != 0)) {
7178 /*
7179 * Ensure we don't do a remove on the lock that just failed,
7180 * as under POSIX rules, if we have a lock already there, we
7181 * will delete it (and we shouldn't) .....
7182 */
7183 for(i--; i >= 0; i--) {
7184 lock_pid = get_lock_pid( data, i, large_file_format);
7185 count = get_lock_count( data, i, large_file_format);
7186 offset = get_lock_offset( data, i, large_file_format,
7187 &err);
7188
7189 /*
7190 * There is no error code marked "stupid client
7191 * bug".... :-).
7192 */
7193 if(err) {
7194 END_PROFILE(SMBlockingX);
7195 reply_doserror(req, ERRDOS, ERRnoaccess);
7196 return;
7197 }
7198
7199 do_unlock(smbd_messaging_context(),
7200 fsp,
7201 lock_pid,
7202 count,
7203 offset,
7204 WINDOWS_LOCK);
7205 }
7206 END_PROFILE(SMBlockingX);
7207 reply_nterror(req, status);
7208 return;
7209 }
7210
7211 reply_outbuf(req, 2, 0);
7212
7213 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7214 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7215
7216 END_PROFILE(SMBlockingX);
7217 chain_reply(req);
7218 }
7219
7220 #undef DBGC_CLASS
7221 #define DBGC_CLASS DBGC_ALL
7222
7223 /****************************************************************************
7224 Reply to a SMBreadbmpx (read block multiplex) request.
7225 Always reply with an error, if someone has a platform really needs this,
7226 please contact vl@samba.org
7227 ****************************************************************************/
7228
7229 void reply_readbmpx(struct smb_request *req)
7230 {
7231 START_PROFILE(SMBreadBmpx);
7232 reply_doserror(req, ERRSRV, ERRuseSTD);
7233 END_PROFILE(SMBreadBmpx);
7234 return;
7235 }
7236
7237 /****************************************************************************
7238 Reply to a SMBreadbs (read block multiplex secondary) request.
7239 Always reply with an error, if someone has a platform really needs this,
7240 please contact vl@samba.org
7241 ****************************************************************************/
7242
7243 void reply_readbs(struct smb_request *req)
7244 {
7245 START_PROFILE(SMBreadBs);
7246 reply_doserror(req, ERRSRV, ERRuseSTD);
7247 END_PROFILE(SMBreadBs);
7248 return;
7249 }
7250
7251 /****************************************************************************
7252 Reply to a SMBsetattrE.
7253 ****************************************************************************/
7254
7255 void reply_setattrE(struct smb_request *req)
7256 {
7257 connection_struct *conn = req->conn;
7258 struct smb_file_time ft;
7259 files_struct *fsp;
7260 SMB_STRUCT_STAT sbuf;
7261 NTSTATUS status;
7262
7263 START_PROFILE(SMBsetattrE);
7264 ZERO_STRUCT(ft);
7265
7266 if (req->wct < 7) {
7267 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7268 END_PROFILE(SMBsetattrE);
7269 return;
7270 }
7271
7272 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7273
7274 if(!fsp || (fsp->conn != conn)) {
7275 reply_doserror(req, ERRDOS, ERRbadfid);
7276 END_PROFILE(SMBsetattrE);
7277 return;
7278 }
7279
7280
7281 /*
7282 * Convert the DOS times into unix times.
7283 */
7284
7285 ft.atime = convert_time_t_to_timespec(
7286 srv_make_unix_date2(req->vwv+3));
7287 ft.mtime = convert_time_t_to_timespec(
7288 srv_make_unix_date2(req->vwv+5));
7289 ft.create_time = convert_time_t_to_timespec(
7290 srv_make_unix_date2(req->vwv+1));
7291
7292 reply_outbuf(req, 0, 0);
7293
7294 /*
7295 * Patch from Ray Frush <frush@engr.colostate.edu>
7296 * Sometimes times are sent as zero - ignore them.
7297 */
7298
7299 /* Ensure we have a valid stat struct for the source. */
7300 if (fsp->fh->fd != -1) {
7301 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7302 status = map_nt_error_from_unix(errno);
7303 reply_nterror(req, status);
7304 END_PROFILE(SMBsetattrE);
7305 return;
7306 }
7307 } else {
7308 int ret = -1;
7309
7310 if (fsp->posix_open) {
7311 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7312 } else {
7313 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7314 }
7315 if (ret == -1) {
7316 status = map_nt_error_from_unix(errno);
7317 reply_nterror(req, status);
7318 END_PROFILE(SMBsetattrE);
7319 return;
7320 }
7321 }
7322
7323 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7324 &sbuf, &ft, true);
7325 if (!NT_STATUS_IS_OK(status)) {
7326 reply_doserror(req, ERRDOS, ERRnoaccess);
7327 END_PROFILE(SMBsetattrE);
7328 return;
7329 }
7330
7331 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7332 " createtime=%u\n",
7333 fsp->fnum,
7334 (unsigned int)ft.atime.tv_sec,
7335 (unsigned int)ft.mtime.tv_sec,
7336 (unsigned int)ft.create_time.tv_sec
7337 ));
7338
7339 END_PROFILE(SMBsetattrE);
7340 return;
7341 }
7342
7343
7344 /* Back from the dead for OS/2..... JRA. */
7345
7346 /****************************************************************************
7347 Reply to a SMBwritebmpx (write block multiplex primary) request.
7348 Always reply with an error, if someone has a platform really needs this,
7349 please contact vl@samba.org
7350 ****************************************************************************/
7351
7352 void reply_writebmpx(struct smb_request *req)
7353 {
7354 START_PROFILE(SMBwriteBmpx);
7355 reply_doserror(req, ERRSRV, ERRuseSTD);
7356 END_PROFILE(SMBwriteBmpx);
7357 return;
7358 }
7359
7360 /****************************************************************************
7361 Reply to a SMBwritebs (write block multiplex secondary) request.
7362 Always reply with an error, if someone has a platform really needs this,
7363 please contact vl@samba.org
7364 ****************************************************************************/
7365
7366 void reply_writebs(struct smb_request *req)
7367 {
7368 START_PROFILE(SMBwriteBs);
7369 reply_doserror(req, ERRSRV, ERRuseSTD);
7370 END_PROFILE(SMBwriteBs);
7371 return;
7372 }
7373
7374 /****************************************************************************
7375 Reply to a SMBgetattrE.
7376 ****************************************************************************/
7377
7378 void reply_getattrE(struct smb_request *req)
7379 {
7380 connection_struct *conn = req->conn;
7381 SMB_STRUCT_STAT sbuf;
7382 int mode;
7383 files_struct *fsp;
7384 struct timespec create_ts;
7385
7386 START_PROFILE(SMBgetattrE);
7387
7388 if (req->wct < 1) {
7389 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7390 END_PROFILE(SMBgetattrE);
7391 return;
7392 }
7393
7394 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7395
7396 if(!fsp || (fsp->conn != conn)) {
7397 reply_doserror(req, ERRDOS, ERRbadfid);
7398 END_PROFILE(SMBgetattrE);
7399 return;
7400 }
7401
7402 /* Do an fstat on this file */
7403 if(fsp_stat(fsp, &sbuf)) {
7404 reply_unixerror(req, ERRDOS, ERRnoaccess);
7405 END_PROFILE(SMBgetattrE);
7406 return;
7407 }
7408
7409 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7410
7411 /*
7412 * Convert the times into dos times. Set create
7413 * date to be last modify date as UNIX doesn't save
7414 * this.
7415 */
7416
7417 reply_outbuf(req, 11, 0);
7418
7419 create_ts = get_create_timespec(&sbuf,
7420 lp_fake_dir_create_times(SNUM(conn)));
7421 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7422 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7423 /* Should we check pending modtime here ? JRA */
7424 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7425
7426 if (mode & aDIR) {
7427 SIVAL(req->outbuf, smb_vwv6, 0);
7428 SIVAL(req->outbuf, smb_vwv8, 0);
7429 } else {
7430 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7431 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7432 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7433 }
7434 SSVAL(req->outbuf,smb_vwv10, mode);
7435
7436 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7437
7438 END_PROFILE(SMBgetattrE);
7439 return;
7440 }
WIP