?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r6141: Fix OS/2 EA's for NTcreate. OpenX and mkdir to follow.
[Samba/gbeck.git] / source / smbd / nttrans.c
blob1d4acf28449a05c351e6e1a297bd78a58f30909c
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern enum protocol_types Protocol;
25 extern int smb_read_error;
26 extern int global_oplock_break;
27 extern struct current_user current_user;
28
29 static const char *known_nt_pipes[] = {
30 "\\LANMAN",
31 "\\srvsvc",
32 "\\samr",
33 "\\wkssvc",
34 "\\NETLOGON",
35 "\\ntlsa",
36 "\\ntsvcs",
37 "\\lsass",
38 "\\lsarpc",
39 "\\winreg",
40 "\\spoolss",
41 "\\netdfs",
42 "\\rpcecho",
43 "\\svcctl",
44 "\\eventlog",
45 NULL
46 };
47
48 /* Map generic permissions to file object specific permissions */
49
50 struct generic_mapping file_generic_mapping = {
51 FILE_GENERIC_READ,
52 FILE_GENERIC_WRITE,
53 FILE_GENERIC_EXECUTE,
54 FILE_GENERIC_ALL
55 };
56
57 static char *nttrans_realloc(char **ptr, size_t size)
58 {
59 char *tptr = NULL;
60 if (ptr==NULL)
61 smb_panic("nttrans_realloc() called with NULL ptr\n");
62
63 tptr = SMB_REALLOC(*ptr, size);
64 if(tptr == NULL) {
65 *ptr = NULL;
66 return NULL;
67 }
68 memset(tptr,'\0',size);
69
70 *ptr = tptr;
71
72 return tptr;
73 }
74
75
76 /****************************************************************************
77 Send the required number of replies back.
78 We assume all fields other than the data fields are
79 set correctly for the type of call.
80 HACK ! Always assumes smb_setup field is zero.
81 ****************************************************************************/
82
83 static int send_nt_replies(char *inbuf, char *outbuf, int bufsize, NTSTATUS nt_error, char *params,
84 int paramsize, char *pdata, int datasize)
85 {
86 extern int max_send;
87 int data_to_send = datasize;
88 int params_to_send = paramsize;
89 int useable_space;
90 char *pp = params;
91 char *pd = pdata;
92 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
93 int alignment_offset = 3;
94 int data_alignment_offset = 0;
95
96 /*
97 * Initially set the wcnt area to be 18 - this is true for all
98 * transNT replies.
99 */
100
101 set_message(outbuf,18,0,True);
102
103 if (NT_STATUS_V(nt_error))
104 ERROR_NT(nt_error);
105
106 /*
107 * If there genuinely are no parameters or data to send just send
108 * the empty packet.
109 */
110
111 if(params_to_send == 0 && data_to_send == 0) {
112 if (!send_smb(smbd_server_fd(),outbuf))
113 exit_server("send_nt_replies: send_smb failed.");
114 return 0;
115 }
116
117 /*
118 * When sending params and data ensure that both are nicely aligned.
119 * Only do this alignment when there is also data to send - else
120 * can cause NT redirector problems.
121 */
122
123 if (((params_to_send % 4) != 0) && (data_to_send != 0))
124 data_alignment_offset = 4 - (params_to_send % 4);
125
126 /*
127 * Space is bufsize minus Netbios over TCP header minus SMB header.
128 * The alignment_offset is to align the param bytes on a four byte
129 * boundary (2 bytes for data len, one byte pad).
130 * NT needs this to work correctly.
131 */
132
133 useable_space = bufsize - ((smb_buf(outbuf)+
134 alignment_offset+data_alignment_offset) -
135 outbuf);
136
137 /*
138 * useable_space can never be more than max_send minus the
139 * alignment offset.
140 */
141
142 useable_space = MIN(useable_space,
143 max_send - (alignment_offset+data_alignment_offset));
144
145
146 while (params_to_send || data_to_send) {
147
148 /*
149 * Calculate whether we will totally or partially fill this packet.
150 */
151
152 total_sent_thistime = params_to_send + data_to_send +
153 alignment_offset + data_alignment_offset;
154
155 /*
156 * We can never send more than useable_space.
157 */
158
159 total_sent_thistime = MIN(total_sent_thistime, useable_space);
160
161 set_message(outbuf, 18, total_sent_thistime, True);
162
163 /*
164 * Set total params and data to be sent.
165 */
166
167 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
168 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
169
170 /*
171 * Calculate how many parameters and data we can fit into
172 * this packet. Parameters get precedence.
173 */
174
175 params_sent_thistime = MIN(params_to_send,useable_space);
176 data_sent_thistime = useable_space - params_sent_thistime;
177 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
178
179 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
180
181 if(params_sent_thistime == 0) {
182 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
183 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
184 } else {
185 /*
186 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
187 * parameter bytes, however the first 4 bytes of outbuf are
188 * the Netbios over TCP header. Thus use smb_base() to subtract
189 * them from the calculation.
190 */
191
192 SIVAL(outbuf,smb_ntr_ParameterOffset,
193 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
194 /*
195 * Absolute displacement of param bytes sent in this packet.
196 */
197
198 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
199 }
200
201 /*
202 * Deal with the data portion.
203 */
204
205 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
206
207 if(data_sent_thistime == 0) {
208 SIVAL(outbuf,smb_ntr_DataOffset,0);
209 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
210 } else {
211 /*
212 * The offset of the data bytes is the offset of the
213 * parameter bytes plus the number of parameters being sent this time.
214 */
215
216 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
217 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
218 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
219 }
220
221 /*
222 * Copy the param bytes into the packet.
223 */
224
225 if(params_sent_thistime)
226 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
227
228 /*
229 * Copy in the data bytes
230 */
231
232 if(data_sent_thistime)
233 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
234 data_alignment_offset,pd,data_sent_thistime);
235
236 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
237 params_sent_thistime, data_sent_thistime, useable_space));
238 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
239 params_to_send, data_to_send, paramsize, datasize));
240
241 /* Send the packet */
242 if (!send_smb(smbd_server_fd(),outbuf))
243 exit_server("send_nt_replies: send_smb failed.");
244
245 pp += params_sent_thistime;
246 pd += data_sent_thistime;
247
248 params_to_send -= params_sent_thistime;
249 data_to_send -= data_sent_thistime;
250
251 /*
252 * Sanity check
253 */
254
255 if(params_to_send < 0 || data_to_send < 0) {
256 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
257 params_to_send, data_to_send));
258 return -1;
259 }
260 }
261
262 return 0;
263 }
264
265 /****************************************************************************
266 Save case statics.
267 ****************************************************************************/
268
269 static BOOL saved_case_sensitive;
270 static BOOL saved_case_preserve;
271 static BOOL saved_short_case_preserve;
272
273 /****************************************************************************
274 Save case semantics.
275 ****************************************************************************/
276
277 static void set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
278 {
279 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
280 return;
281
282 saved_case_sensitive = conn->case_sensitive;
283 saved_case_preserve = conn->case_preserve;
284 saved_short_case_preserve = conn->short_case_preserve;
285
286 /* Set to POSIX. */
287 conn->case_sensitive = True;
288 conn->case_preserve = True;
289 conn->short_case_preserve = True;
290 }
291
292 /****************************************************************************
293 Restore case semantics.
294 ****************************************************************************/
295
296 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
297 {
298 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
299 return;
300
301 conn->case_sensitive = saved_case_sensitive;
302 conn->case_preserve = saved_case_preserve;
303 conn->short_case_preserve = saved_short_case_preserve;
304 }
305
306 /****************************************************************************
307 Utility function to map create disposition.
308 ****************************************************************************/
309
310 static int map_create_disposition( uint32 create_disposition)
311 {
312 int ret;
313
314 switch( create_disposition ) {
315 case FILE_CREATE:
316 /* create if not exist, fail if exist */
317 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL);
318 break;
319 case FILE_SUPERSEDE:
320 case FILE_OVERWRITE_IF:
321 /* create if not exist, trunc if exist */
322 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
323 break;
324 case FILE_OPEN:
325 /* fail if not exist, open if exists */
326 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN);
327 break;
328 case FILE_OPEN_IF:
329 /* create if not exist, open if exists */
330 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_OPEN);
331 break;
332 case FILE_OVERWRITE:
333 /* fail if not exist, truncate if exists */
334 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
335 break;
336 default:
337 DEBUG(0,("map_create_disposition: Incorrect value for create_disposition = %d\n",
338 create_disposition ));
339 return -1;
340 }
341
342 DEBUG(10,("map_create_disposition: Mapped create_disposition 0x%lx to 0x%x\n",
343 (unsigned long)create_disposition, ret ));
344
345 return ret;
346 }
347
348 /****************************************************************************
349 Utility function to map share modes.
350 ****************************************************************************/
351
352 static int map_share_mode( char *fname, uint32 create_options,
353 uint32 *desired_access, uint32 share_access, uint32 file_attributes)
354 {
355 int smb_open_mode = -1;
356 uint32 original_desired_access = *desired_access;
357
358 /* This is a nasty hack - must fix... JRA. */
359 if (*desired_access == MAXIMUM_ALLOWED_ACCESS) {
360 *desired_access = FILE_GENERIC_ALL;
361 }
362
363 /*
364 * Convert GENERIC bits to specific bits.
365 */
366
367 se_map_generic(desired_access, &file_generic_mapping);
368
369 switch( *desired_access & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA) ) {
370 case FILE_READ_DATA:
371 smb_open_mode = DOS_OPEN_RDONLY;
372 break;
373 case FILE_WRITE_DATA:
374 case FILE_APPEND_DATA:
375 case FILE_WRITE_DATA|FILE_APPEND_DATA:
376 smb_open_mode = DOS_OPEN_WRONLY;
377 break;
378 case FILE_READ_DATA|FILE_WRITE_DATA:
379 case FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA:
380 case FILE_READ_DATA|FILE_APPEND_DATA:
381 smb_open_mode = DOS_OPEN_RDWR;
382 break;
383 }
384
385 /*
386 * NB. For DELETE_ACCESS we should really check the
387 * directory permissions, as that is what controls
388 * delete, and for WRITE_DAC_ACCESS we should really
389 * check the ownership, as that is what controls the
390 * chmod. Note that this is *NOT* a security hole (this
391 * note is for you, Andrew) as we are not *allowing*
392 * the access at this point, the actual unlink or
393 * chown or chmod call would do this. We are just helping
394 * clients out by telling them if they have a hope
395 * of any of this succeeding. POSIX acls may still
396 * deny the real call. JRA.
397 */
398
399 if (smb_open_mode == -1) {
400
401 if(*desired_access & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS|
402 FILE_EXECUTE|FILE_READ_ATTRIBUTES|
403 FILE_READ_EA|FILE_WRITE_EA|SYSTEM_SECURITY_ACCESS|
404 FILE_WRITE_ATTRIBUTES|READ_CONTROL_ACCESS)) {
405 smb_open_mode = DOS_OPEN_RDONLY;
406 } else if(*desired_access == 0) {
407
408 /*
409 * JRA - NT seems to sometimes send desired_access as zero. play it safe
410 * and map to a stat open.
411 */
412
413 smb_open_mode = DOS_OPEN_RDONLY;
414
415 } else {
416 DEBUG(0,("map_share_mode: Incorrect value 0x%lx for desired_access to file %s\n",
417 (unsigned long)*desired_access, fname));
418 return -1;
419 }
420 }
421
422 /*
423 * Set the special bit that means allow share delete.
424 * This is held outside the normal share mode bits at 1<<15.
425 * JRA.
426 */
427
428 if(share_access & FILE_SHARE_DELETE) {
429 smb_open_mode |= ALLOW_SHARE_DELETE;
430 DEBUG(10,("map_share_mode: FILE_SHARE_DELETE requested. open_mode = 0x%x\n", smb_open_mode));
431 }
432
433 if(*desired_access & DELETE_ACCESS) {
434 DEBUG(10,("map_share_mode: DELETE_ACCESS requested. open_mode = 0x%x\n", smb_open_mode));
435 }
436
437 /*
438 * We need to store the intent to open for Delete. This
439 * is what determines if a delete on close flag can be set.
440 * This is the wrong way (and place) to store this, but for 2.2 this
441 * is the only practical way. JRA.
442 */
443
444 if (create_options & FILE_DELETE_ON_CLOSE) {
445 /*
446 * W2K3 bug compatibility mode... To set delete on close
447 * the redirector must have *specifically* set DELETE_ACCESS
448 * in the desired_access field. Just asking for GENERIC_ALL won't do. JRA.
449 */
450
451 if (!(original_desired_access & DELETE_ACCESS)) {
452 DEBUG(5,("map_share_mode: FILE_DELETE_ON_CLOSE requested without \
453 DELETE_ACCESS for file %s. (desired_access = 0x%lx)\n",
454 fname, (unsigned long)*desired_access));
455 return -1;
456 }
457 /* Implicit delete access is *NOT* requested... */
458 smb_open_mode |= DELETE_ON_CLOSE_FLAG;
459 DEBUG(10,("map_share_mode: FILE_DELETE_ON_CLOSE requested. open_mode = 0x%x\n", smb_open_mode));
460 }
461
462 /* Add in the requested share mode. */
463 switch( share_access & (FILE_SHARE_READ|FILE_SHARE_WRITE)) {
464 case FILE_SHARE_READ:
465 smb_open_mode |= SET_DENY_MODE(DENY_WRITE);
466 break;
467 case FILE_SHARE_WRITE:
468 smb_open_mode |= SET_DENY_MODE(DENY_READ);
469 break;
470 case (FILE_SHARE_READ|FILE_SHARE_WRITE):
471 smb_open_mode |= SET_DENY_MODE(DENY_NONE);
472 break;
473 case FILE_SHARE_NONE:
474 smb_open_mode |= SET_DENY_MODE(DENY_ALL);
475 break;
476 }
477
478 /*
479 * Handle an O_SYNC request.
480 */
481
482 if(file_attributes & FILE_FLAG_WRITE_THROUGH)
483 smb_open_mode |= FILE_SYNC_OPENMODE;
484
485 DEBUG(10,("map_share_mode: Mapped desired access 0x%lx, share access 0x%lx, file attributes 0x%lx \
486 to open_mode 0x%x\n", (unsigned long)*desired_access, (unsigned long)share_access,
487 (unsigned long)file_attributes, smb_open_mode ));
488
489 return smb_open_mode;
490 }
491
492 /****************************************************************************
493 Reply to an NT create and X call on a pipe.
494 ****************************************************************************/
495
496 static int nt_open_pipe(char *fname, connection_struct *conn,
497 char *inbuf, char *outbuf, int *ppnum)
498 {
499 smb_np_struct *p = NULL;
500
501 uint16 vuid = SVAL(inbuf, smb_uid);
502 int i;
503
504 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
505
506 /* See if it is one we want to handle. */
507
508 if (lp_disable_spoolss() && strequal(fname, "\\spoolss"))
509 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
510
511 for( i = 0; known_nt_pipes[i]; i++ )
512 if( strequal(fname,known_nt_pipes[i]))
513 break;
514
515 if ( known_nt_pipes[i] == NULL )
516 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
517
518 /* Strip \\ off the name. */
519 fname++;
520
521 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
522
523 p = open_rpc_pipe_p(fname, conn, vuid);
524 if (!p)
525 return(ERROR_DOS(ERRSRV,ERRnofids));
526
527 *ppnum = p->pnum;
528
529 return 0;
530 }
531
532 /****************************************************************************
533 Reply to an NT create and X call for pipes.
534 ****************************************************************************/
535
536 static int do_ntcreate_pipe_open(connection_struct *conn,
537 char *inbuf,char *outbuf,int length,int bufsize)
538 {
539 pstring fname;
540 int ret;
541 int pnum = -1;
542 char *p = NULL;
543
544 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
545
546 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
547 return ret;
548
549 /*
550 * Deal with pipe return.
551 */
552
553 set_message(outbuf,34,0,True);
554
555 p = outbuf + smb_vwv2;
556 p++;
557 SSVAL(p,0,pnum);
558 p += 2;
559 SIVAL(p,0,FILE_WAS_OPENED);
560 p += 4;
561 p += 32;
562 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
563 p += 20;
564 /* File type. */
565 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
566 /* Device state. */
567 SSVAL(p,2, 0x5FF); /* ? */
568
569 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
570
571 return chain_reply(inbuf,outbuf,length,bufsize);
572 }
573
574 /****************************************************************************
575 Reply to an NT create and X call.
576 ****************************************************************************/
577
578 int reply_ntcreate_and_X(connection_struct *conn,
579 char *inbuf,char *outbuf,int length,int bufsize)
580 {
581 int result;
582 pstring fname;
583 enum FAKE_FILE_TYPE fake_file_type = FAKE_FILE_TYPE_NONE;
584 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
585 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
586 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
587 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
588 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
589 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
590 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
591 SMB_BIG_UINT allocation_size = 0;
592 int smb_ofun;
593 int smb_open_mode;
594 /* Breakout the oplock request bits so we can set the
595 reply bits separately. */
596 int oplock_request = 0;
597 int fmode=0,rmode=0;
598 SMB_OFF_T file_len = 0;
599 SMB_STRUCT_STAT sbuf;
600 int smb_action = 0;
601 BOOL bad_path = False;
602 files_struct *fsp=NULL;
603 char *p = NULL;
604 time_t c_time;
605 BOOL extended_oplock_granted = False;
606 NTSTATUS status;
607
608 START_PROFILE(SMBntcreateX);
609
610 DEBUG(10,("reply_ntcreateX: flags = 0x%x, desired_access = 0x%x \
611 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
612 create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attributes,
613 share_access, create_disposition,
614 create_options, root_dir_fid ));
615
616 /* If it's an IPC, use the pipe handler. */
617
618 if (IS_IPC(conn)) {
619 if (lp_nt_pipe_support()) {
620 END_PROFILE(SMBntcreateX);
621 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
622 } else {
623 END_PROFILE(SMBntcreateX);
624 return(ERROR_DOS(ERRDOS,ERRnoaccess));
625 }
626 }
627
628 if (create_options & FILE_OPEN_BY_FILE_ID) {
629 END_PROFILE(SMBntcreateX);
630 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
631 }
632
633 /*
634 * We need to construct the open_and_X ofun value from the
635 * NT values, as that's what our code is structured to accept.
636 */
637
638 if((smb_ofun = map_create_disposition( create_disposition )) == -1) {
639 END_PROFILE(SMBntcreateX);
640 return(ERROR_DOS(ERRDOS,ERRnoaccess));
641 }
642
643 /*
644 * Get the file name.
645 */
646
647 if(root_dir_fid != 0) {
648 /*
649 * This filename is relative to a directory fid.
650 */
651 pstring rel_fname;
652 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
653 size_t dir_name_len;
654
655 if(!dir_fsp) {
656 END_PROFILE(SMBntcreateX);
657 return(ERROR_DOS(ERRDOS,ERRbadfid));
658 }
659
660 if(!dir_fsp->is_directory) {
661
662 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status,False);
663 if (!NT_STATUS_IS_OK(status)) {
664 END_PROFILE(SMBntcreateX);
665 return ERROR_NT(status);
666 }
667
668 /*
669 * Check to see if this is a mac fork of some kind.
670 */
671
672 if( strchr_m(fname, ':')) {
673 END_PROFILE(SMBntcreateX);
674 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
675 }
676
677 /*
678 we need to handle the case when we get a
679 relative open relative to a file and the
680 pathname is blank - this is a reopen!
681 (hint from demyn plantenberg)
682 */
683
684 END_PROFILE(SMBntcreateX);
685 return(ERROR_DOS(ERRDOS,ERRbadfid));
686 }
687
688 /*
689 * Copy in the base directory name.
690 */
691
692 pstrcpy( fname, dir_fsp->fsp_name );
693 dir_name_len = strlen(fname);
694
695 /*
696 * Ensure it ends in a '\'.
697 */
698
699 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
700 pstrcat(fname, "/");
701 dir_name_len++;
702 }
703
704 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status,False);
705 if (!NT_STATUS_IS_OK(status)) {
706 END_PROFILE(SMBntcreateX);
707 return ERROR_NT(status);
708 }
709 pstrcat(fname, rel_fname);
710 } else {
711 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status,False);
712 if (!NT_STATUS_IS_OK(status)) {
713 END_PROFILE(SMBntcreateX);
714 return ERROR_NT(status);
715 }
716
717 /*
718 * Check to see if this is a mac fork of some kind.
719 */
720
721 if( strchr_m(fname, ':')) {
722
723 #ifdef HAVE_SYS_QUOTAS
724 if ((fake_file_type=is_fake_file(fname))!=FAKE_FILE_TYPE_NONE) {
725 /*
726 * here we go! support for changing the disk quotas --metze
727 *
728 * we need to fake up to open this MAGIC QUOTA file
729 * and return a valid FID
730 *
731 * w2k close this file directly after openening
732 * xp also tries a QUERY_FILE_INFO on the file and then close it
733 */
734 } else {
735 #endif
736 END_PROFILE(SMBntcreateX);
737 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
738 #ifdef HAVE_SYS_QUOTAS
739 }
740 #endif
741 }
742 }
743
744 /*
745 * Now contruct the smb_open_mode value from the filename,
746 * desired access and the share access.
747 */
748 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
749
750 if((smb_open_mode = map_share_mode(fname, create_options, &desired_access,
751 share_access,
752 file_attributes)) == -1) {
753 END_PROFILE(SMBntcreateX);
754 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
755 }
756
757 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
758 if (oplock_request) {
759 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
760 }
761
762 /*
763 * Ordinary file or directory.
764 */
765
766 /*
767 * Check if POSIX semantics are wanted.
768 */
769
770 set_posix_case_semantics(conn, file_attributes);
771
772 unix_convert(fname,conn,0,&bad_path,&sbuf);
773
774 /* FAKE_FILE is a special case */
775 if (fake_file_type == FAKE_FILE_TYPE_NONE) {
776 /* Normal file. */
777 if (bad_path) {
778 restore_case_semantics(conn, file_attributes);
779 END_PROFILE(SMBntcreateX);
780 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
781 }
782 /* All file access must go through check_name() */
783 if (!check_name(fname,conn)) {
784 restore_case_semantics(conn, file_attributes);
785 END_PROFILE(SMBntcreateX);
786 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
787 }
788 }
789
790 #if 0
791 /* This is the correct thing to do (check every time) but can_delete is
792 expensive (it may have to read the parent directory permissions). So
793 for now we're not doing it unless we have a strong hint the client
794 is really going to delete this file. */
795 if (desired_access & DELETE_ACCESS) {
796 #else
797 /* Setting FILE_SHARE_DELETE is the hint. */
798 if ((share_access & FILE_SHARE_DELETE) && (desired_access & DELETE_ACCESS)) {
799 #endif
800 status = can_delete(conn, fname, file_attributes, bad_path, True);
801 /* We're only going to fail here if it's access denied, as that's the
802 only error we care about for "can we delete this ?" questions. */
803 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
804 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
805 restore_case_semantics(conn, file_attributes);
806 END_PROFILE(SMBntcreateX);
807 return ERROR_NT(status);
808 }
809 }
810
811 /*
812 * If it's a request for a directory open, deal with it separately.
813 */
814
815 if(create_options & FILE_DIRECTORY_FILE) {
816 oplock_request = 0;
817
818 /* Can't open a temp directory. IFS kit test. */
819 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
820 END_PROFILE(SMBntcreateX);
821 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
822 }
823
824 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
825
826 restore_case_semantics(conn, file_attributes);
827
828 if(!fsp) {
829 END_PROFILE(SMBntcreateX);
830 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
831 }
832 } else {
833 /*
834 * Ordinary file case.
835 */
836
837 /* NB. We have a potential bug here. If we
838 * cause an oplock break to ourselves, then we
839 * could end up processing filename related
840 * SMB requests whilst we await the oplock
841 * break response. As we may have changed the
842 * filename case semantics to be POSIX-like,
843 * this could mean a filename request could
844 * fail when it should succeed. This is a rare
845 * condition, but eventually we must arrange
846 * to restore the correct case semantics
847 * before issuing an oplock break request to
848 * our client. JRA. */
849
850 if (fake_file_type==FAKE_FILE_TYPE_NONE) {
851 fsp = open_file_shared1(conn,fname,&sbuf,
852 desired_access,
853 smb_open_mode,
854 smb_ofun,file_attributes,oplock_request,
855 &rmode,&smb_action);
856 } else {
857 /* to open a fake_file --metze */
858 fsp = open_fake_file_shared1(fake_file_type,conn,fname,&sbuf,
859 desired_access,
860 smb_open_mode,
861 smb_ofun,file_attributes, oplock_request,
862 &rmode,&smb_action);
863 }
864
865 if (!fsp) {
866 /* We cheat here. There are two cases we
867 * care about. One is a directory rename,
868 * where the NT client will attempt to
869 * open the source directory for
870 * DELETE access. Note that when the
871 * NT client does this it does *not*
872 * set the directory bit in the
873 * request packet. This is translated
874 * into a read/write open
875 * request. POSIX states that any open
876 * for write request on a directory
877 * will generate an EISDIR error, so
878 * we can catch this here and open a
879 * pseudo handle that is flagged as a
880 * directory. The second is an open
881 * for a permissions read only, which
882 * we handle in the open_file_stat case. JRA.
883 */
884
885 if(errno == EISDIR) {
886
887 /*
888 * Fail the open if it was explicitly a non-directory file.
889 */
890
891 if (create_options & FILE_NON_DIRECTORY_FILE) {
892 restore_case_semantics(conn, file_attributes);
893 SSVAL(outbuf, smb_flg2,
894 SVAL(outbuf,smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
895 END_PROFILE(SMBntcreateX);
896 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
897 }
898
899 oplock_request = 0;
900 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
901
902 if(!fsp) {
903 restore_case_semantics(conn, file_attributes);
904 END_PROFILE(SMBntcreateX);
905 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
906 }
907 } else {
908
909 restore_case_semantics(conn, file_attributes);
910 END_PROFILE(SMBntcreateX);
911 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
912 /* We have re-scheduled this call. */
913 clear_cached_errors();
914 return -1;
915 }
916 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
917 }
918 }
919 }
920
921 restore_case_semantics(conn, file_attributes);
922
923 file_len = sbuf.st_size;
924 fmode = dos_mode(conn,fname,&sbuf);
925 if(fmode == 0)
926 fmode = FILE_ATTRIBUTE_NORMAL;
927 if (!fsp->is_directory && (fmode & aDIR)) {
928 close_file(fsp,False);
929 END_PROFILE(SMBntcreateX);
930 return ERROR_DOS(ERRDOS,ERRnoaccess);
931 }
932
933 /* Save the requested allocation size. */
934 allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
935 #ifdef LARGE_SMB_OFF_T
936 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
937 #endif
938 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
939 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
940 if (fsp->is_directory) {
941 close_file(fsp,False);
942 END_PROFILE(SMBntcreateX);
943 /* Can't set allocation size on a directory. */
944 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
945 }
946 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
947 close_file(fsp,False);
948 END_PROFILE(SMBntcreateX);
949 return ERROR_NT(NT_STATUS_DISK_FULL);
950 }
951 } else {
952 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
953 }
954
955 /*
956 * If the caller set the extended oplock request bit
957 * and we granted one (by whatever means) - set the
958 * correct bit for extended oplock reply.
959 */
960
961 if (oplock_request && lp_fake_oplocks(SNUM(conn)))
962 extended_oplock_granted = True;
963
964 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
965 extended_oplock_granted = True;
966
967 #if 0
968 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
969 set_message(outbuf,42,0,True);
970 #else
971 set_message(outbuf,34,0,True);
972 #endif
973
974 p = outbuf + smb_vwv2;
975
976 /*
977 * Currently as we don't support level II oplocks we just report
978 * exclusive & batch here.
979 */
980
981 if (extended_oplock_granted) {
982 if (flags & REQUEST_BATCH_OPLOCK) {
983 SCVAL(p,0, BATCH_OPLOCK_RETURN);
984 } else {
985 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
986 }
987 } else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type)) {
988 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
989 } else {
990 SCVAL(p,0,NO_OPLOCK_RETURN);
991 }
992
993 p++;
994 SSVAL(p,0,fsp->fnum);
995 p += 2;
996 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
997 SIVAL(p,0,FILE_WAS_SUPERSEDED);
998 else
999 SIVAL(p,0,smb_action);
1000 p += 4;
1001
1002 /* Create time. */
1003 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1004
1005 if (lp_dos_filetime_resolution(SNUM(conn))) {
1006 c_time &= ~1;
1007 sbuf.st_atime &= ~1;
1008 sbuf.st_mtime &= ~1;
1009 sbuf.st_mtime &= ~1;
1010 }
1011
1012 put_long_date(p,c_time);
1013 p += 8;
1014 put_long_date(p,sbuf.st_atime); /* access time */
1015 p += 8;
1016 put_long_date(p,sbuf.st_mtime); /* write time */
1017 p += 8;
1018 put_long_date(p,sbuf.st_mtime); /* change time */
1019 p += 8;
1020 SIVAL(p,0,fmode); /* File Attributes. */
1021 p += 4;
1022 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1023 p += 8;
1024 SOFF_T(p,0,file_len);
1025 p += 8;
1026 if (flags & EXTENDED_RESPONSE_REQUIRED)
1027 SSVAL(p,2,0x7);
1028 p += 4;
1029 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1030
1031 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
1032
1033 result = chain_reply(inbuf,outbuf,length,bufsize);
1034 END_PROFILE(SMBntcreateX);
1035 return result;
1036 }
1037
1038 /****************************************************************************
1039 Reply to a NT_TRANSACT_CREATE call to open a pipe.
1040 ****************************************************************************/
1041
1042 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1043 char **ppsetup, uint32 setup_count,
1044 char **ppparams, uint32 parameter_count,
1045 char **ppdata, uint32 data_count)
1046 {
1047 pstring fname;
1048 char *params = *ppparams;
1049 int ret;
1050 int pnum = -1;
1051 char *p = NULL;
1052 NTSTATUS status;
1053
1054 /*
1055 * Ensure minimum number of parameters sent.
1056 */
1057
1058 if(parameter_count < 54) {
1059 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1060 return ERROR_DOS(ERRDOS,ERRnoaccess);
1061 }
1062
1063 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1064 if (!NT_STATUS_IS_OK(status)) {
1065 return ERROR_NT(status);
1066 }
1067
1068 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
1069 return ret;
1070
1071 /* Realloc the size of parameters and data we will return */
1072 params = nttrans_realloc(ppparams, 69);
1073 if(params == NULL)
1074 return ERROR_DOS(ERRDOS,ERRnomem);
1075
1076 p = params;
1077 SCVAL(p,0,NO_OPLOCK_RETURN);
1078
1079 p += 2;
1080 SSVAL(p,0,pnum);
1081 p += 2;
1082 SIVAL(p,0,FILE_WAS_OPENED);
1083 p += 8;
1084
1085 p += 32;
1086 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1087 p += 20;
1088 /* File type. */
1089 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1090 /* Device state. */
1091 SSVAL(p,2, 0x5FF); /* ? */
1092
1093 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1094
1095 /* Send the required number of replies */
1096 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1097
1098 return -1;
1099 }
1100
1101 /****************************************************************************
1102 Internal fn to set security descriptors.
1103 ****************************************************************************/
1104
1105 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1106 {
1107 prs_struct pd;
1108 SEC_DESC *psd = NULL;
1109 TALLOC_CTX *mem_ctx;
1110 BOOL ret;
1111
1112 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
1113 return NT_STATUS_OK;
1114 }
1115
1116 /*
1117 * Init the parse struct we will unmarshall from.
1118 */
1119
1120 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1121 DEBUG(0,("set_sd: talloc_init failed.\n"));
1122 return NT_STATUS_NO_MEMORY;
1123 }
1124
1125 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1126
1127 /*
1128 * Setup the prs_struct to point at the memory we just
1129 * allocated.
1130 */
1131
1132 prs_give_memory( &pd, data, sd_len, False);
1133
1134 /*
1135 * Finally, unmarshall from the data buffer.
1136 */
1137
1138 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1139 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1140 /*
1141 * Return access denied for want of a better error message..
1142 */
1143 talloc_destroy(mem_ctx);
1144 return NT_STATUS_NO_MEMORY;
1145 }
1146
1147 if (psd->off_owner_sid==0)
1148 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1149 if (psd->off_grp_sid==0)
1150 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1151 if (psd->off_sacl==0)
1152 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1153 if (psd->off_dacl==0)
1154 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1155
1156 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fd, security_info_sent, psd);
1157
1158 if (!ret) {
1159 talloc_destroy(mem_ctx);
1160 return NT_STATUS_ACCESS_DENIED;
1161 }
1162
1163 talloc_destroy(mem_ctx);
1164
1165 return NT_STATUS_OK;
1166 }
1167
1168 /****************************************************************************
1169 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1170 ****************************************************************************/
1171
1172 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1173 {
1174 struct ea_list *ea_list_head = NULL;
1175 size_t offset = 0;
1176
1177 if (data_size < 4) {
1178 return NULL;
1179 }
1180
1181 while (offset + 4 <= data_size) {
1182 size_t next_offset = IVAL(pdata,offset);
1183 struct ea_list *tmp;
1184 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1185
1186 DLIST_ADD_END(ea_list_head, eal, tmp);
1187 if (next_offset == 0) {
1188 break;
1189 }
1190 offset += next_offset;
1191 }
1192
1193 return ea_list_head;
1194 }
1195
1196 /****************************************************************************
1197 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1198 ****************************************************************************/
1199
1200 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1201 char **ppsetup, uint32 setup_count,
1202 char **ppparams, uint32 parameter_count,
1203 char **ppdata, uint32 data_count, uint32 max_data_count)
1204 {
1205 pstring fname;
1206 char *params = *ppparams;
1207 char *data = *ppdata;
1208 /* Breakout the oplock request bits so we can set the reply bits separately. */
1209 int oplock_request = 0;
1210 int fmode=0,rmode=0;
1211 SMB_OFF_T file_len = 0;
1212 SMB_STRUCT_STAT sbuf;
1213 int smb_action = 0;
1214 BOOL bad_path = False;
1215 files_struct *fsp = NULL;
1216 char *p = NULL;
1217 BOOL extended_oplock_granted = False;
1218 uint32 flags;
1219 uint32 desired_access;
1220 uint32 file_attributes;
1221 uint32 share_access;
1222 uint32 create_disposition;
1223 uint32 create_options;
1224 uint32 sd_len;
1225 uint32 ea_len;
1226 uint16 root_dir_fid;
1227 SMB_BIG_UINT allocation_size = 0;
1228 int smb_ofun;
1229 int smb_open_mode;
1230 time_t c_time;
1231 struct ea_list *ea_list = NULL;
1232 TALLOC_CTX *ctx = NULL;
1233 char *pdata = NULL;
1234 NTSTATUS status;
1235
1236 DEBUG(5,("call_nt_transact_create\n"));
1237
1238 /*
1239 * If it's an IPC, use the pipe handler.
1240 */
1241
1242 if (IS_IPC(conn)) {
1243 if (lp_nt_pipe_support())
1244 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1245 bufsize,
1246 ppsetup, setup_count,
1247 ppparams, parameter_count,
1248 ppdata, data_count);
1249 else
1250 return ERROR_DOS(ERRDOS,ERRnoaccess);
1251 }
1252
1253 /*
1254 * Ensure minimum number of parameters sent.
1255 */
1256
1257 if(parameter_count < 54) {
1258 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1259 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1260 }
1261
1262 flags = IVAL(params,0);
1263 desired_access = IVAL(params,8);
1264 file_attributes = IVAL(params,20);
1265 share_access = IVAL(params,24);
1266 create_disposition = IVAL(params,28);
1267 create_options = IVAL(params,32);
1268 sd_len = IVAL(params,36);
1269 ea_len = IVAL(params,40);
1270 root_dir_fid = (uint16)IVAL(params,4);
1271
1272 /* Ensure the data_len is correct for the sd and ea values given. */
1273 if ((ea_len + sd_len > data_count) ||
1274 (ea_len > data_count) || (sd_len > data_count) ||
1275 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1276 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1277 }
1278
1279 if (ea_len && !lp_ea_support(SNUM(conn))) {
1280 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1281 }
1282
1283 if (ea_len < 10) {
1284 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1285 }
1286
1287 if (create_options & FILE_OPEN_BY_FILE_ID) {
1288 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1289 }
1290
1291 /*
1292 * We need to construct the open_and_X ofun value from the
1293 * NT values, as that's what our code is structured to accept.
1294 */
1295
1296 if((smb_ofun = map_create_disposition( create_disposition )) == -1)
1297 return ERROR_DOS(ERRDOS,ERRbadmem);
1298
1299 /*
1300 * Get the file name.
1301 */
1302
1303 if(root_dir_fid != 0) {
1304 /*
1305 * This filename is relative to a directory fid.
1306 */
1307 files_struct *dir_fsp = file_fsp(params,4);
1308 size_t dir_name_len;
1309
1310 if(!dir_fsp)
1311 return ERROR_DOS(ERRDOS,ERRbadfid);
1312
1313 if(!dir_fsp->is_directory) {
1314 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1315 if (!NT_STATUS_IS_OK(status)) {
1316 return ERROR_NT(status);
1317 }
1318
1319 /*
1320 * Check to see if this is a mac fork of some kind.
1321 */
1322
1323 if( strchr_m(fname, ':'))
1324 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1325
1326 return ERROR_DOS(ERRDOS,ERRbadfid);
1327 }
1328
1329 /*
1330 * Copy in the base directory name.
1331 */
1332
1333 pstrcpy( fname, dir_fsp->fsp_name );
1334 dir_name_len = strlen(fname);
1335
1336 /*
1337 * Ensure it ends in a '\'.
1338 */
1339
1340 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1341 pstrcat(fname, "/");
1342 dir_name_len++;
1343 }
1344
1345 {
1346 pstring tmpname;
1347 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status, False);
1348 if (!NT_STATUS_IS_OK(status)) {
1349 return ERROR_NT(status);
1350 }
1351 pstrcat(fname, tmpname);
1352 }
1353 } else {
1354 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1355 if (!NT_STATUS_IS_OK(status)) {
1356 return ERROR_NT(status);
1357 }
1358
1359 /*
1360 * Check to see if this is a mac fork of some kind.
1361 */
1362
1363 if( strchr_m(fname, ':'))
1364 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1365 }
1366
1367 /*
1368 * Now contruct the smb_open_mode value from the desired access
1369 * and the share access.
1370 */
1371
1372 if((smb_open_mode = map_share_mode( fname, create_options, &desired_access,
1373 share_access, file_attributes)) == -1)
1374 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1375
1376 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1377 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1378
1379 /*
1380 * Check if POSIX semantics are wanted.
1381 */
1382
1383 set_posix_case_semantics(conn, file_attributes);
1384
1385 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1386
1387 unix_convert(fname,conn,0,&bad_path,&sbuf);
1388 if (bad_path) {
1389 restore_case_semantics(conn, file_attributes);
1390 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1391 }
1392 /* All file access must go through check_name() */
1393 if (!check_name(fname,conn)) {
1394 restore_case_semantics(conn, file_attributes);
1395 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
1396 }
1397
1398 #if 0
1399 /* This is the correct thing to do (check every time) but can_delete is
1400 expensive (it may have to read the parent directory permissions). So
1401 for now we're not doing it unless we have a strong hint the client
1402 is really going to delete this file. */
1403 if (desired_access & DELETE_ACCESS) {
1404 #else
1405 /* Setting FILE_SHARE_DELETE is the hint. */
1406 if ((share_access & FILE_SHARE_DELETE) && (desired_access & DELETE_ACCESS)) {
1407 #endif
1408 status = can_delete(conn, fname, file_attributes, bad_path, True);
1409 /* We're only going to fail here if it's access denied, as that's the
1410 only error we care about for "can we delete this ?" questions. */
1411 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
1412 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
1413 restore_case_semantics(conn, file_attributes);
1414 END_PROFILE(SMBntcreateX);
1415 return ERROR_NT(status);
1416 }
1417 }
1418
1419 ctx = talloc_init("NTTRANS_CREATE_EA");
1420 if (!ctx) {
1421 talloc_destroy(ctx);
1422 restore_case_semantics(conn, file_attributes);
1423 return ERROR_NT(NT_STATUS_NO_MEMORY);
1424 }
1425
1426 pdata = data + sd_len;
1427
1428 /* We have already checked that ea_len <= data_count here. */
1429 ea_list = read_nttrans_ea_list(ctx, pdata, ea_len);
1430 if (!ea_list ) {
1431 talloc_destroy(ctx);
1432 restore_case_semantics(conn, file_attributes);
1433 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1434 }
1435
1436 /*
1437 * If it's a request for a directory open, deal with it separately.
1438 */
1439
1440 if(create_options & FILE_DIRECTORY_FILE) {
1441
1442 /* Can't open a temp directory. IFS kit test. */
1443 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1444 talloc_destroy(ctx);
1445 restore_case_semantics(conn, file_attributes);
1446 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1447 }
1448
1449 oplock_request = 0;
1450
1451 /*
1452 * We will get a create directory here if the Win32
1453 * app specified a security descriptor in the
1454 * CreateDirectory() call.
1455 */
1456
1457 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
1458
1459 if(!fsp) {
1460 talloc_destroy(ctx);
1461 restore_case_semantics(conn, file_attributes);
1462 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1463 }
1464
1465 } else {
1466
1467 /*
1468 * Ordinary file case.
1469 */
1470
1471 fsp = open_file_shared1(conn,fname,&sbuf,desired_access,
1472 smb_open_mode,smb_ofun,file_attributes,
1473 oplock_request,&rmode,&smb_action);
1474
1475 if (!fsp) {
1476
1477 if(errno == EISDIR) {
1478
1479 /*
1480 * Fail the open if it was explicitly a non-directory file.
1481 */
1482
1483 if (create_options & FILE_NON_DIRECTORY_FILE) {
1484 restore_case_semantics(conn, file_attributes);
1485 SSVAL(outbuf, smb_flg2, SVAL(outbuf,smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
1486 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1487 }
1488
1489 oplock_request = 0;
1490 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
1491
1492 if(!fsp) {
1493 talloc_destroy(ctx);
1494 restore_case_semantics(conn, file_attributes);
1495 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1496 }
1497 } else {
1498 talloc_destroy(ctx);
1499 restore_case_semantics(conn, file_attributes);
1500 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1501 /* We have re-scheduled this call. */
1502 clear_cached_errors();
1503 return -1;
1504 }
1505 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1506 }
1507 }
1508
1509 file_len = sbuf.st_size;
1510 fmode = dos_mode(conn,fname,&sbuf);
1511 if(fmode == 0)
1512 fmode = FILE_ATTRIBUTE_NORMAL;
1513
1514 if (fmode & aDIR) {
1515 talloc_destroy(ctx);
1516 close_file(fsp,False);
1517 restore_case_semantics(conn, file_attributes);
1518 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1519 }
1520
1521 /*
1522 * If the caller set the extended oplock request bit
1523 * and we granted one (by whatever means) - set the
1524 * correct bit for extended oplock reply.
1525 */
1526
1527 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1528 extended_oplock_granted = True;
1529 }
1530
1531 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1532 extended_oplock_granted = True;
1533 }
1534 }
1535
1536 /*
1537 * According to the MS documentation, the only time the security
1538 * descriptor is applied to the opened file is iff we *created* the
1539 * file; an existing file stays the same.
1540 *
1541 * Also, it seems (from observation) that you can open the file with
1542 * any access mask but you can still write the sd. We need to override
1543 * the granted access before we call set_sd
1544 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1545 */
1546
1547 if (lp_nt_acl_support(SNUM(conn)) && sd_len && smb_action == FILE_WAS_CREATED) {
1548 uint32 saved_access = fsp->desired_access;
1549
1550 /* We have already checked that sd_len <= data_count here. */
1551
1552 fsp->desired_access = FILE_GENERIC_ALL;
1553
1554 if (!NT_STATUS_IS_OK(status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION))) {
1555 talloc_destroy(ctx);
1556 close_file(fsp,False);
1557 restore_case_semantics(conn, file_attributes);
1558 return ERROR_NT(status);
1559 }
1560 fsp->desired_access = saved_access;
1561 }
1562
1563 if (ea_len && smb_action == FILE_WAS_CREATED) {
1564 status = set_ea(conn, fsp, fname, ea_list);
1565 talloc_destroy(ctx);
1566 if (NT_STATUS_V(status) != NT_STATUS_V(NT_STATUS_OK)) {
1567 close_file(fsp,False);
1568 restore_case_semantics(conn, file_attributes);
1569 return ERROR_NT(status);
1570 }
1571 }
1572
1573 restore_case_semantics(conn, file_attributes);
1574
1575 /* Save the requested allocation size. */
1576 allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1577 #ifdef LARGE_SMB_OFF_T
1578 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1579 #endif
1580 if (allocation_size && (allocation_size > file_len)) {
1581 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1582 if (fsp->is_directory) {
1583 close_file(fsp,False);
1584 END_PROFILE(SMBntcreateX);
1585 /* Can't set allocation size on a directory. */
1586 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1587 }
1588 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1589 close_file(fsp,False);
1590 return ERROR_NT(NT_STATUS_DISK_FULL);
1591 }
1592 } else {
1593 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1594 }
1595
1596 /* Realloc the size of parameters and data we will return */
1597 params = nttrans_realloc(ppparams, 69);
1598 if(params == NULL)
1599 return ERROR_DOS(ERRDOS,ERRnomem);
1600
1601 p = params;
1602 if (extended_oplock_granted)
1603 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1604 else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type))
1605 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1606 else
1607 SCVAL(p,0,NO_OPLOCK_RETURN);
1608
1609 p += 2;
1610 SSVAL(p,0,fsp->fnum);
1611 p += 2;
1612 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
1613 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1614 else
1615 SIVAL(p,0,smb_action);
1616 p += 8;
1617
1618 /* Create time. */
1619 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1620
1621 if (lp_dos_filetime_resolution(SNUM(conn))) {
1622 c_time &= ~1;
1623 sbuf.st_atime &= ~1;
1624 sbuf.st_mtime &= ~1;
1625 sbuf.st_mtime &= ~1;
1626 }
1627
1628 put_long_date(p,c_time);
1629 p += 8;
1630 put_long_date(p,sbuf.st_atime); /* access time */
1631 p += 8;
1632 put_long_date(p,sbuf.st_mtime); /* write time */
1633 p += 8;
1634 put_long_date(p,sbuf.st_mtime); /* change time */
1635 p += 8;
1636 SIVAL(p,0,fmode); /* File Attributes. */
1637 p += 4;
1638 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1639 p += 8;
1640 SOFF_T(p,0,file_len);
1641 p += 8;
1642 if (flags & EXTENDED_RESPONSE_REQUIRED)
1643 SSVAL(p,2,0x7);
1644 p += 4;
1645 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1646
1647 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1648
1649 /* Send the required number of replies */
1650 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1651
1652 return -1;
1653 }
1654
1655 /****************************************************************************
1656 Reply to a NT CANCEL request.
1657 ****************************************************************************/
1658
1659 int reply_ntcancel(connection_struct *conn,
1660 char *inbuf,char *outbuf,int length,int bufsize)
1661 {
1662 /*
1663 * Go through and cancel any pending change notifies.
1664 */
1665
1666 int mid = SVAL(inbuf,smb_mid);
1667 START_PROFILE(SMBntcancel);
1668 remove_pending_change_notify_requests_by_mid(mid);
1669 remove_pending_lock_requests_by_mid(mid);
1670 srv_cancel_sign_response(mid);
1671
1672 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1673
1674 END_PROFILE(SMBntcancel);
1675 return(-1);
1676 }
1677
1678 /****************************************************************************
1679 Copy a file.
1680 ****************************************************************************/
1681
1682 static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint16 attrs)
1683 {
1684 BOOL bad_path_oldname = False;
1685 BOOL bad_path_newname = False;
1686 SMB_STRUCT_STAT sbuf1, sbuf2;
1687 pstring last_component_oldname;
1688 pstring last_component_newname;
1689 files_struct *fsp1,*fsp2;
1690 uint16 fmode;
1691 int access_mode;
1692 int smb_action;
1693 SMB_OFF_T ret=-1;
1694 int close_ret;
1695 NTSTATUS status = NT_STATUS_OK;
1696
1697 ZERO_STRUCT(sbuf1);
1698 ZERO_STRUCT(sbuf2);
1699
1700 /* No wildcards. */
1701 if (ms_has_wild(newname) || ms_has_wild(oldname)) {
1702 return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1703 }
1704
1705 if (!CAN_WRITE(conn))
1706 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1707
1708 unix_convert(oldname,conn,last_component_oldname,&bad_path_oldname,&sbuf1);
1709 if (bad_path_oldname) {
1710 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1711 }
1712
1713 /* Quick check for "." and ".." */
1714 if (last_component_oldname[0] == '.') {
1715 if (!last_component_oldname[1] || (last_component_oldname[1] == '.' && !last_component_oldname[2])) {
1716 return NT_STATUS_OBJECT_NAME_INVALID;
1717 }
1718 }
1719
1720 /* Source must already exist. */
1721 if (!VALID_STAT(sbuf1)) {
1722 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1723 }
1724 if (!check_name(oldname,conn)) {
1725 return NT_STATUS_ACCESS_DENIED;
1726 }
1727
1728 /* Ensure attributes match. */
1729 fmode = dos_mode(conn,oldname,&sbuf1);
1730 if ((fmode & ~attrs) & (aHIDDEN | aSYSTEM))
1731 return NT_STATUS_NO_SUCH_FILE;
1732
1733 unix_convert(newname,conn,last_component_newname,&bad_path_newname,&sbuf2);
1734 if (bad_path_newname) {
1735 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1736 }
1737
1738 /* Quick check for "." and ".." */
1739 if (last_component_newname[0] == '.') {
1740 if (!last_component_newname[1] || (last_component_newname[1] == '.' && !last_component_newname[2])) {
1741 return NT_STATUS_OBJECT_NAME_INVALID;
1742 }
1743 }
1744
1745 /* Disallow if newname already exists. */
1746 if (VALID_STAT(sbuf2)) {
1747 return NT_STATUS_OBJECT_NAME_COLLISION;
1748 }
1749
1750 if (!check_name(newname,conn)) {
1751 return NT_STATUS_ACCESS_DENIED;
1752 }
1753
1754 /* No links from a directory. */
1755 if (S_ISDIR(sbuf1.st_mode)) {
1756 return NT_STATUS_FILE_IS_A_DIRECTORY;
1757 }
1758
1759 /* Ensure this is within the share. */
1760 if (!reduce_name(conn, oldname) != 0) {
1761 return NT_STATUS_ACCESS_DENIED;
1762 }
1763
1764 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1765
1766 fsp1 = open_file_shared1(conn,oldname,&sbuf1,FILE_READ_DATA,SET_DENY_MODE(DENY_ALL)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
1767 (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,0,
1768 &access_mode,&smb_action);
1769
1770 if (!fsp1) {
1771 status = NT_STATUS_ACCESS_DENIED;
1772 if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
1773 status = NT_STATUS_SHARING_VIOLATION;
1774 unix_ERR_class = 0;
1775 unix_ERR_code = 0;
1776 unix_ERR_ntstatus = NT_STATUS_OK;
1777 return status;
1778 }
1779
1780 fsp2 = open_file_shared1(conn,newname,&sbuf2,FILE_WRITE_DATA,SET_DENY_MODE(DENY_ALL)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
1781 (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL),fmode,INTERNAL_OPEN_ONLY,
1782 &access_mode,&smb_action);
1783
1784 if (!fsp2) {
1785 status = NT_STATUS_ACCESS_DENIED;
1786 if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
1787 status = NT_STATUS_SHARING_VIOLATION;
1788 unix_ERR_class = 0;
1789 unix_ERR_code = 0;
1790 unix_ERR_ntstatus = NT_STATUS_OK;
1791 close_file(fsp1,False);
1792 return status;
1793 }
1794
1795 if (sbuf1.st_size)
1796 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1797
1798 /*
1799 * As we are opening fsp1 read-only we only expect
1800 * an error on close on fsp2 if we are out of space.
1801 * Thus we don't look at the error return from the
1802 * close of fsp1.
1803 */
1804 close_file(fsp1,False);
1805
1806 /* Ensure the modtime is set correctly on the destination file. */
1807 fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1808
1809 close_ret = close_file(fsp2,False);
1810
1811 /* Grrr. We have to do this as open_file_shared1 adds aARCH when it
1812 creates the file. This isn't the correct thing to do in the copy case. JRA */
1813 file_set_dosmode(conn, newname, fmode, &sbuf2, True);
1814
1815 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1816 return NT_STATUS_DISK_FULL;
1817 }
1818
1819 if (close_ret != 0) {
1820 status = map_nt_error_from_unix(close_ret);
1821 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1822 nt_errstr(status), oldname, newname));
1823 }
1824 return status;
1825 }
1826
1827 /****************************************************************************
1828 Reply to a NT rename request.
1829 ****************************************************************************/
1830
1831 int reply_ntrename(connection_struct *conn,
1832 char *inbuf,char *outbuf,int length,int bufsize)
1833 {
1834 int outsize = 0;
1835 pstring oldname;
1836 pstring newname;
1837 char *p;
1838 NTSTATUS status;
1839 uint16 attrs = SVAL(inbuf,smb_vwv0);
1840 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1841
1842 START_PROFILE(SMBntrename);
1843
1844 p = smb_buf(inbuf) + 1;
1845 p += srvstr_get_path(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, True);
1846 if (!NT_STATUS_IS_OK(status)) {
1847 END_PROFILE(SMBntrename);
1848 return ERROR_NT(status);
1849 }
1850
1851 if( strchr_m(oldname, ':')) {
1852 /* Can't rename a stream. */
1853 END_PROFILE(SMBntrename);
1854 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1855 }
1856
1857 if (ms_has_wild(oldname)) {
1858 END_PROFILE(SMBntrename);
1859 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1860 }
1861
1862 p++;
1863 p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, False);
1864 if (!NT_STATUS_IS_OK(status)) {
1865 END_PROFILE(SMBntrename);
1866 return ERROR_NT(status);
1867 }
1868
1869 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1870 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1871
1872 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1873
1874 switch(rename_type) {
1875 case RENAME_FLAG_RENAME:
1876 status = rename_internals(conn, oldname, newname, attrs, False);
1877 break;
1878 case RENAME_FLAG_HARD_LINK:
1879 status = hardlink_internals(conn, oldname, newname);
1880 break;
1881 case RENAME_FLAG_COPY:
1882 status = copy_internals(conn, oldname, newname, attrs);
1883 break;
1884 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1885 status = NT_STATUS_INVALID_PARAMETER;
1886 break;
1887 default:
1888 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1889 break;
1890 }
1891
1892 if (!NT_STATUS_IS_OK(status)) {
1893 END_PROFILE(SMBntrename);
1894 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1895 /* We have re-scheduled this call. */
1896 clear_cached_errors();
1897 return -1;
1898 }
1899 return ERROR_NT(status);
1900 }
1901
1902 /*
1903 * Win2k needs a changenotify request response before it will
1904 * update after a rename..
1905 */
1906 process_pending_change_notify_queue((time_t)0);
1907 outsize = set_message(outbuf,0,0,True);
1908
1909 END_PROFILE(SMBntrename);
1910 return(outsize);
1911 }
1912
1913 /****************************************************************************
1914 Reply to an unsolicited SMBNTtranss - just ignore it!
1915 ****************************************************************************/
1916
1917 int reply_nttranss(connection_struct *conn,
1918 char *inbuf,char *outbuf,int length,int bufsize)
1919 {
1920 START_PROFILE(SMBnttranss);
1921 DEBUG(4,("Ignoring nttranss of length %d\n",length));
1922 END_PROFILE(SMBnttranss);
1923 return(-1);
1924 }
1925
1926 /****************************************************************************
1927 Reply to a notify change - queue the request and
1928 don't allow a directory to be opened.
1929 ****************************************************************************/
1930
1931 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1932 char **ppsetup, uint32 setup_count,
1933 char **ppparams, uint32 parameter_count,
1934 char **ppdata, uint32 data_count, uint32 max_data_count)
1935 {
1936 char *setup = *ppsetup;
1937 files_struct *fsp;
1938 uint32 flags;
1939
1940 if(setup_count < 6)
1941 return ERROR_DOS(ERRDOS,ERRbadfunc);
1942
1943 fsp = file_fsp(setup,4);
1944 flags = IVAL(setup, 0);
1945
1946 DEBUG(3,("call_nt_transact_notify_change\n"));
1947
1948 if(!fsp)
1949 return ERROR_DOS(ERRDOS,ERRbadfid);
1950
1951 if((!fsp->is_directory) || (conn != fsp->conn))
1952 return ERROR_DOS(ERRDOS,ERRbadfid);
1953
1954 if (!change_notify_set(inbuf, fsp, conn, flags))
1955 return(UNIXERROR(ERRDOS,ERRbadfid));
1956
1957 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1958 name = %s\n", fsp->fsp_name ));
1959
1960 return -1;
1961 }
1962
1963 /****************************************************************************
1964 Reply to an NT transact rename command.
1965 ****************************************************************************/
1966
1967 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1968 char **ppsetup, uint32 setup_count,
1969 char **ppparams, uint32 parameter_count,
1970 char **ppdata, uint32 data_count, uint32 max_data_count)
1971 {
1972 char *params = *ppparams;
1973 pstring new_name;
1974 files_struct *fsp = NULL;
1975 BOOL replace_if_exists = False;
1976 NTSTATUS status;
1977
1978 if(parameter_count < 4)
1979 return ERROR_DOS(ERRDOS,ERRbadfunc);
1980
1981 fsp = file_fsp(params, 0);
1982 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1983 CHECK_FSP(fsp, conn);
1984 srvstr_get_path(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE, &status, True);
1985 if (!NT_STATUS_IS_OK(status)) {
1986 return ERROR_NT(status);
1987 }
1988
1989 status = rename_internals(conn, fsp->fsp_name,
1990 new_name, 0, replace_if_exists);
1991 if (!NT_STATUS_IS_OK(status))
1992 return ERROR_NT(status);
1993
1994 /*
1995 * Rename was successful.
1996 */
1997 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1998
1999 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
2000 fsp->fsp_name, new_name));
2001
2002 /*
2003 * Win2k needs a changenotify request response before it will
2004 * update after a rename..
2005 */
2006
2007 process_pending_change_notify_queue((time_t)0);
2008
2009 return -1;
2010 }
2011
2012 /******************************************************************************
2013 Fake up a completely empty SD.
2014 *******************************************************************************/
2015
2016 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
2017 {
2018 extern DOM_SID global_sid_World;
2019 size_t sd_size;
2020
2021 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2022 if(!*ppsd) {
2023 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2024 sd_size = 0;
2025 }
2026
2027 return sd_size;
2028 }
2029
2030 /****************************************************************************
2031 Reply to query a security descriptor.
2032 ****************************************************************************/
2033
2034 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2035 char **ppsetup, uint32 setup_count,
2036 char **ppparams, uint32 parameter_count,
2037 char **ppdata, uint32 data_count, uint32 max_data_count)
2038 {
2039 char *params = *ppparams;
2040 char *data = *ppdata;
2041 prs_struct pd;
2042 SEC_DESC *psd = NULL;
2043 size_t sd_size;
2044 uint32 security_info_wanted;
2045 TALLOC_CTX *mem_ctx;
2046 files_struct *fsp = NULL;
2047
2048 if(parameter_count < 8)
2049 return ERROR_DOS(ERRDOS,ERRbadfunc);
2050
2051 fsp = file_fsp(params,0);
2052 if(!fsp)
2053 return ERROR_DOS(ERRDOS,ERRbadfid);
2054
2055 security_info_wanted = IVAL(params,4);
2056
2057 DEBUG(3,("call_nt_transact_query_security_desc: file = %s\n", fsp->fsp_name ));
2058
2059 params = nttrans_realloc(ppparams, 4);
2060 if(params == NULL)
2061 return ERROR_DOS(ERRDOS,ERRnomem);
2062
2063 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2064 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2065 return ERROR_DOS(ERRDOS,ERRnomem);
2066 }
2067
2068 /*
2069 * Get the permissions to return.
2070 */
2071
2072 if (!lp_nt_acl_support(SNUM(conn)))
2073 sd_size = get_null_nt_acl(mem_ctx, &psd);
2074 else
2075 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, security_info_wanted, &psd);
2076
2077 if (sd_size == 0) {
2078 talloc_destroy(mem_ctx);
2079 return(UNIXERROR(ERRDOS,ERRnoaccess));
2080 }
2081
2082 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %d.\n",(int)sd_size));
2083
2084 SIVAL(params,0,(uint32)sd_size);
2085
2086 if(max_data_count < sd_size) {
2087
2088 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2089 params, 4, *ppdata, 0);
2090 talloc_destroy(mem_ctx);
2091 return -1;
2092 }
2093
2094 /*
2095 * Allocate the data we will point this at.
2096 */
2097
2098 data = nttrans_realloc(ppdata, sd_size);
2099 if(data == NULL) {
2100 talloc_destroy(mem_ctx);
2101 return ERROR_DOS(ERRDOS,ERRnomem);
2102 }
2103
2104 /*
2105 * Init the parse struct we will marshall into.
2106 */
2107
2108 prs_init(&pd, 0, mem_ctx, MARSHALL);
2109
2110 /*
2111 * Setup the prs_struct to point at the memory we just
2112 * allocated.
2113 */
2114
2115 prs_give_memory( &pd, data, (uint32)sd_size, False);
2116
2117 /*
2118 * Finally, linearize into the outgoing buffer.
2119 */
2120
2121 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2122 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2123 security descriptor.\n"));
2124 /*
2125 * Return access denied for want of a better error message..
2126 */
2127 talloc_destroy(mem_ctx);
2128 return(UNIXERROR(ERRDOS,ERRnoaccess));
2129 }
2130
2131 /*
2132 * Now we can delete the security descriptor.
2133 */
2134
2135 talloc_destroy(mem_ctx);
2136
2137 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data, (int)sd_size);
2138 return -1;
2139 }
2140
2141 /****************************************************************************
2142 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2143 ****************************************************************************/
2144
2145 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2146 char **ppsetup, uint32 setup_count,
2147 char **ppparams, uint32 parameter_count,
2148 char **ppdata, uint32 data_count, uint32 max_data_count)
2149 {
2150 char *params= *ppparams;
2151 char *data = *ppdata;
2152 files_struct *fsp = NULL;
2153 uint32 security_info_sent = 0;
2154 NTSTATUS nt_status;
2155
2156 if(parameter_count < 8)
2157 return ERROR_DOS(ERRDOS,ERRbadfunc);
2158
2159 if((fsp = file_fsp(params,0)) == NULL)
2160 return ERROR_DOS(ERRDOS,ERRbadfid);
2161
2162 if(!lp_nt_acl_support(SNUM(conn)))
2163 goto done;
2164
2165 security_info_sent = IVAL(params,4);
2166
2167 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2168 (unsigned int)security_info_sent ));
2169
2170 if (data_count == 0)
2171 return ERROR_DOS(ERRDOS, ERRnoaccess);
2172
2173 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent)))
2174 return ERROR_NT(nt_status);
2175
2176 done:
2177
2178 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2179 return -1;
2180 }
2181
2182 /****************************************************************************
2183 Reply to NT IOCTL
2184 ****************************************************************************/
2185
2186 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2187 char **ppsetup, uint32 setup_count,
2188 char **ppparams, uint32 parameter_count,
2189 char **ppdata, uint32 data_count, uint32 max_data_count)
2190 {
2191 uint32 function;
2192 uint16 fidnum;
2193 files_struct *fsp;
2194 uint8 isFSctl;
2195 uint8 compfilter;
2196 static BOOL logged_message;
2197 char *pdata = *ppdata;
2198
2199 if (setup_count != 8) {
2200 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2201 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2202 }
2203
2204 function = IVAL(*ppsetup, 0);
2205 fidnum = SVAL(*ppsetup, 4);
2206 isFSctl = CVAL(*ppsetup, 6);
2207 compfilter = CVAL(*ppsetup, 7);
2208
2209 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2210 function, fidnum, isFSctl, compfilter));
2211
2212 fsp=file_fsp(*ppsetup, 4);
2213 /* this check is done in each implemented function case for now
2214 because I don't want to break anything... --metze
2215 FSP_BELONGS_CONN(fsp,conn);*/
2216
2217 switch (function) {
2218 case FSCTL_SET_SPARSE:
2219 /* pretend this succeeded - tho strictly we should
2220 mark the file sparse (if the local fs supports it)
2221 so we can know if we need to pre-allocate or not */
2222
2223 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2224 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2225 return -1;
2226
2227 case FSCTL_0x000900C0:
2228 /* pretend this succeeded - don't know what this really is
2229 but works ok like this --metze
2230 */
2231
2232 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2233 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2234 return -1;
2235
2236 case FSCTL_GET_REPARSE_POINT:
2237 /* pretend this fail - my winXP does it like this
2238 * --metze
2239 */
2240
2241 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2242 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2243 return -1;
2244
2245 case FSCTL_SET_REPARSE_POINT:
2246 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2247 * --metze
2248 */
2249
2250 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2251 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2252 return -1;
2253
2254 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2255 {
2256 /*
2257 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2258 * and return their volume names. If max_data_count is 16, then it is just
2259 * asking for the number of volumes and length of the combined names.
2260 *
2261 * pdata is the data allocated by our caller, but that uses
2262 * total_data_count (which is 0 in our case) rather than max_data_count.
2263 * Allocate the correct amount and return the pointer to let
2264 * it be deallocated when we return.
2265 */
2266 SHADOW_COPY_DATA *shadow_data = NULL;
2267 TALLOC_CTX *shadow_mem_ctx = NULL;
2268 BOOL labels = False;
2269 uint32 labels_data_count = 0;
2270 uint32 i;
2271 char *cur_pdata;
2272
2273 FSP_BELONGS_CONN(fsp,conn);
2274
2275 if (max_data_count < 16) {
2276 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2277 max_data_count));
2278 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2279 }
2280
2281 if (max_data_count > 16) {
2282 labels = True;
2283 }
2284
2285 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2286 if (shadow_mem_ctx == NULL) {
2287 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2288 return ERROR_NT(NT_STATUS_NO_MEMORY);
2289 }
2290
2291 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2292 if (shadow_data == NULL) {
2293 DEBUG(0,("talloc_zero() failed!\n"));
2294 talloc_destroy(shadow_mem_ctx);
2295 return ERROR_NT(NT_STATUS_NO_MEMORY);
2296 }
2297
2298 shadow_data->mem_ctx = shadow_mem_ctx;
2299
2300 /*
2301 * Call the VFS routine to actually do the work.
2302 */
2303 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2304 talloc_destroy(shadow_data->mem_ctx);
2305 if (errno == ENOSYS) {
2306 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2307 conn->connectpath));
2308 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2309 } else {
2310 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2311 conn->connectpath));
2312 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2313 }
2314 }
2315
2316 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2317
2318 if (!labels) {
2319 data_count = 16;
2320 } else {
2321 data_count = 12+labels_data_count+4;
2322 }
2323
2324 if (max_data_count<data_count) {
2325 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2326 max_data_count,data_count));
2327 talloc_destroy(shadow_data->mem_ctx);
2328 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2329 }
2330
2331 pdata = nttrans_realloc(ppdata, data_count);
2332 if (pdata == NULL) {
2333 talloc_destroy(shadow_data->mem_ctx);
2334 return ERROR_NT(NT_STATUS_NO_MEMORY);
2335 }
2336
2337 cur_pdata = pdata;
2338
2339 /* num_volumes 4 bytes */
2340 SIVAL(pdata,0,shadow_data->num_volumes);
2341
2342 if (labels) {
2343 /* num_labels 4 bytes */
2344 SIVAL(pdata,4,shadow_data->num_volumes);
2345 }
2346
2347 /* needed_data_count 4 bytes */
2348 SIVAL(pdata,8,labels_data_count);
2349
2350 cur_pdata+=12;
2351
2352 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2353 shadow_data->num_volumes,fsp->fsp_name));
2354 if (labels && shadow_data->labels) {
2355 for (i=0;i<shadow_data->num_volumes;i++) {
2356 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2357 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2358 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2359 }
2360 }
2361
2362 talloc_destroy(shadow_data->mem_ctx);
2363
2364 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2365
2366 return -1;
2367 }
2368
2369 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2370 {
2371 /* pretend this succeeded -
2372 *
2373 * we have to send back a list with all files owned by this SID
2374 *
2375 * but I have to check that --metze
2376 */
2377 DOM_SID sid;
2378 uid_t uid;
2379 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2380
2381 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2382
2383 FSP_BELONGS_CONN(fsp,conn);
2384
2385 /* unknown 4 bytes: this is not the length of the sid :-( */
2386 /*unknown = IVAL(pdata,0);*/
2387
2388 sid_parse(pdata+4,sid_len,&sid);
2389 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2390
2391 if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) {
2392 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2393 sid_string_static(&sid),(unsigned long)sid_len));
2394 uid = (-1);
2395 }
2396
2397 /* we can take a look at the find source :-)
2398 *
2399 * find ./ -uid $uid -name '*' is what we need here
2400 *
2401 *
2402 * and send 4bytes len and then NULL terminated unicode strings
2403 * for each file
2404 *
2405 * but I don't know how to deal with the paged results
2406 * (maybe we can hang the result anywhere in the fsp struct)
2407 *
2408 * we don't send all files at once
2409 * and at the next we should *not* start from the beginning,
2410 * so we have to cache the result
2411 *
2412 * --metze
2413 */
2414
2415 /* this works for now... */
2416 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2417 return -1;
2418 }
2419 default:
2420 if (!logged_message) {
2421 logged_message = True; /* Only print this once... */
2422 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2423 function));
2424 }
2425 }
2426
2427 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2428 }
2429
2430
2431 #ifdef HAVE_SYS_QUOTAS
2432 /****************************************************************************
2433 Reply to get user quota
2434 ****************************************************************************/
2435
2436 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2437 char **ppsetup, uint32 setup_count,
2438 char **ppparams, uint32 parameter_count,
2439 char **ppdata, uint32 data_count, uint32 max_data_count)
2440 {
2441 NTSTATUS nt_status = NT_STATUS_OK;
2442 char *params = *ppparams;
2443 char *pdata = *ppdata;
2444 char *entry;
2445 int data_len=0,param_len=0;
2446 int qt_len=0;
2447 int entry_len = 0;
2448 files_struct *fsp = NULL;
2449 uint16 level = 0;
2450 size_t sid_len;
2451 DOM_SID sid;
2452 BOOL start_enum = True;
2453 SMB_NTQUOTA_STRUCT qt;
2454 SMB_NTQUOTA_LIST *tmp_list;
2455 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2456 extern struct current_user current_user;
2457
2458 ZERO_STRUCT(qt);
2459
2460 /* access check */
2461 if (current_user.uid != 0) {
2462 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2463 lp_servicename(SNUM(conn)),conn->user));
2464 return ERROR_DOS(ERRDOS,ERRnoaccess);
2465 }
2466
2467 /*
2468 * Ensure minimum number of parameters sent.
2469 */
2470
2471 if (parameter_count < 4) {
2472 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2473 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2474 }
2475
2476 /* maybe we can check the quota_fnum */
2477 fsp = file_fsp(params,0);
2478 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2479 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2480 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2481 }
2482
2483 /* the NULL pointer cheking for fsp->fake_file_handle->pd
2484 * is done by CHECK_NTQUOTA_HANDLE_OK()
2485 */
2486 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2487
2488 level = SVAL(params,2);
2489
2490 /* unknown 12 bytes leading in params */
2491
2492 switch (level) {
2493 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2494 /* seems that we should continue with the enum here --metze */
2495
2496 if (qt_handle->quota_list!=NULL &&
2497 qt_handle->tmp_list==NULL) {
2498
2499 /* free the list */
2500 free_ntquota_list(&(qt_handle->quota_list));
2501
2502 /* Realloc the size of parameters and data we will return */
2503 param_len = 4;
2504 params = nttrans_realloc(ppparams, param_len);
2505 if(params == NULL)
2506 return ERROR_DOS(ERRDOS,ERRnomem);
2507
2508 data_len = 0;
2509 SIVAL(params,0,data_len);
2510
2511 break;
2512 }
2513
2514 start_enum = False;
2515
2516 case TRANSACT_GET_USER_QUOTA_LIST_START:
2517
2518 if (qt_handle->quota_list==NULL &&
2519 qt_handle->tmp_list==NULL) {
2520 start_enum = True;
2521 }
2522
2523 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2524 return ERROR_DOS(ERRSRV,ERRerror);
2525
2526 /* Realloc the size of parameters and data we will return */
2527 param_len = 4;
2528 params = nttrans_realloc(ppparams, param_len);
2529 if(params == NULL)
2530 return ERROR_DOS(ERRDOS,ERRnomem);
2531
2532 /* we should not trust the value in max_data_count*/
2533 max_data_count = MIN(max_data_count,2048);
2534
2535 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2536 if(pdata == NULL)
2537 return ERROR_DOS(ERRDOS,ERRnomem);
2538
2539 entry = pdata;
2540
2541
2542 /* set params Size of returned Quota Data 4 bytes*/
2543 /* but set it later when we know it */
2544
2545 /* for each entry push the data */
2546
2547 if (start_enum) {
2548 qt_handle->tmp_list = qt_handle->quota_list;
2549 }
2550
2551 tmp_list = qt_handle->tmp_list;
2552
2553 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2554 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2555
2556 sid_len = sid_size(&tmp_list->quotas->sid);
2557 entry_len = 40 + sid_len;
2558
2559 /* nextoffset entry 4 bytes */
2560 SIVAL(entry,0,entry_len);
2561
2562 /* then the len of the SID 4 bytes */
2563 SIVAL(entry,4,sid_len);
2564
2565 /* unknown data 8 bytes SMB_BIG_UINT */
2566 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2567
2568 /* the used disk space 8 bytes SMB_BIG_UINT */
2569 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2570
2571 /* the soft quotas 8 bytes SMB_BIG_UINT */
2572 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2573
2574 /* the hard quotas 8 bytes SMB_BIG_UINT */
2575 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2576
2577 /* and now the SID */
2578 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2579 }
2580
2581 qt_handle->tmp_list = tmp_list;
2582
2583 /* overwrite the offset of the last entry */
2584 SIVAL(entry-entry_len,0,0);
2585
2586 data_len = 4+qt_len;
2587 /* overwrite the params quota_data_len */
2588 SIVAL(params,0,data_len);
2589
2590 break;
2591
2592 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2593
2594 /* unknown 4 bytes IVAL(pdata,0) */
2595
2596 if (data_count < 8) {
2597 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2598 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2599 }
2600
2601 sid_len = IVAL(pdata,4);
2602 /* Ensure this is less than 1mb. */
2603 if (sid_len > (1024*1024)) {
2604 return ERROR_DOS(ERRDOS,ERRnomem);
2605 }
2606
2607 if (data_count < 8+sid_len) {
2608 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2609 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2610 }
2611
2612 data_len = 4+40+sid_len;
2613
2614 if (max_data_count < data_len) {
2615 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2616 max_data_count, data_len));
2617 param_len = 4;
2618 SIVAL(params,0,data_len);
2619 data_len = 0;
2620 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2621 break;
2622 }
2623
2624 sid_parse(pdata+8,sid_len,&sid);
2625
2626
2627 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2628 ZERO_STRUCT(qt);
2629 /*
2630 * we have to return zero's in all fields
2631 * instead of returning an error here
2632 * --metze
2633 */
2634 }
2635
2636 /* Realloc the size of parameters and data we will return */
2637 param_len = 4;
2638 params = nttrans_realloc(ppparams, param_len);
2639 if(params == NULL)
2640 return ERROR_DOS(ERRDOS,ERRnomem);
2641
2642 pdata = nttrans_realloc(ppdata, data_len);
2643 if(pdata == NULL)
2644 return ERROR_DOS(ERRDOS,ERRnomem);
2645
2646 entry = pdata;
2647
2648 /* set params Size of returned Quota Data 4 bytes*/
2649 SIVAL(params,0,data_len);
2650
2651 /* nextoffset entry 4 bytes */
2652 SIVAL(entry,0,0);
2653
2654 /* then the len of the SID 4 bytes */
2655 SIVAL(entry,4,sid_len);
2656
2657 /* unknown data 8 bytes SMB_BIG_UINT */
2658 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2659
2660 /* the used disk space 8 bytes SMB_BIG_UINT */
2661 SBIG_UINT(entry,16,qt.usedspace);
2662
2663 /* the soft quotas 8 bytes SMB_BIG_UINT */
2664 SBIG_UINT(entry,24,qt.softlim);
2665
2666 /* the hard quotas 8 bytes SMB_BIG_UINT */
2667 SBIG_UINT(entry,32,qt.hardlim);
2668
2669 /* and now the SID */
2670 sid_linearize(entry+40, sid_len, &sid);
2671
2672 break;
2673
2674 default:
2675 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2676 return ERROR_DOS(ERRSRV,ERRerror);
2677 break;
2678 }
2679
2680 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len);
2681
2682 return -1;
2683 }
2684
2685 /****************************************************************************
2686 Reply to set user quota
2687 ****************************************************************************/
2688
2689 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2690 char **ppsetup, uint32 setup_count,
2691 char **ppparams, uint32 parameter_count,
2692 char **ppdata, uint32 data_count, uint32 max_data_count)
2693 {
2694 char *params = *ppparams;
2695 char *pdata = *ppdata;
2696 int data_len=0,param_len=0;
2697 SMB_NTQUOTA_STRUCT qt;
2698 size_t sid_len;
2699 DOM_SID sid;
2700 files_struct *fsp = NULL;
2701
2702 ZERO_STRUCT(qt);
2703
2704 /* access check */
2705 if (current_user.uid != 0) {
2706 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2707 lp_servicename(SNUM(conn)),conn->user));
2708 return ERROR_DOS(ERRDOS,ERRnoaccess);
2709 }
2710
2711 /*
2712 * Ensure minimum number of parameters sent.
2713 */
2714
2715 if (parameter_count < 2) {
2716 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2717 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2718 }
2719
2720 /* maybe we can check the quota_fnum */
2721 fsp = file_fsp(params,0);
2722 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2723 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2724 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2725 }
2726
2727 if (data_count < 40) {
2728 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2729 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2730 }
2731
2732 /* offset to next quota record.
2733 * 4 bytes IVAL(pdata,0)
2734 * unused here...
2735 */
2736
2737 /* sid len */
2738 sid_len = IVAL(pdata,4);
2739
2740 if (data_count < 40+sid_len) {
2741 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2742 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2743 }
2744
2745 /* unknown 8 bytes in pdata
2746 * maybe its the change time in NTTIME
2747 */
2748
2749 /* the used space 8 bytes (SMB_BIG_UINT)*/
2750 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2751 #ifdef LARGE_SMB_OFF_T
2752 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2753 #else /* LARGE_SMB_OFF_T */
2754 if ((IVAL(pdata,20) != 0)&&
2755 ((qt.usedspace != 0xFFFFFFFF)||
2756 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2757 /* more than 32 bits? */
2758 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2759 }
2760 #endif /* LARGE_SMB_OFF_T */
2761
2762 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2763 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2764 #ifdef LARGE_SMB_OFF_T
2765 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2766 #else /* LARGE_SMB_OFF_T */
2767 if ((IVAL(pdata,28) != 0)&&
2768 ((qt.softlim != 0xFFFFFFFF)||
2769 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2770 /* more than 32 bits? */
2771 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2772 }
2773 #endif /* LARGE_SMB_OFF_T */
2774
2775 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2776 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2777 #ifdef LARGE_SMB_OFF_T
2778 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2779 #else /* LARGE_SMB_OFF_T */
2780 if ((IVAL(pdata,36) != 0)&&
2781 ((qt.hardlim != 0xFFFFFFFF)||
2782 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2783 /* more than 32 bits? */
2784 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2785 }
2786 #endif /* LARGE_SMB_OFF_T */
2787
2788 sid_parse(pdata+40,sid_len,&sid);
2789 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2790
2791 /* 44 unknown bytes left... */
2792
2793 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2794 return ERROR_DOS(ERRSRV,ERRerror);
2795 }
2796
2797 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len);
2798
2799 return -1;
2800 }
2801 #endif /* HAVE_SYS_QUOTAS */
2802
2803 /****************************************************************************
2804 Reply to a SMBNTtrans.
2805 ****************************************************************************/
2806
2807 int reply_nttrans(connection_struct *conn,
2808 char *inbuf,char *outbuf,int length,int bufsize)
2809 {
2810 int outsize = 0;
2811 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2812 #if 0 /* Not used. */
2813 uint16 max_setup_count = CVAL(inbuf, smb_nt_MaxSetupCount);
2814 uint32 max_parameter_count = IVAL(inbuf, smb_nt_MaxParameterCount);
2815 #endif /* Not used. */
2816 uint32 total_parameter_count = IVAL(inbuf, smb_nt_TotalParameterCount);
2817 uint32 total_data_count = IVAL(inbuf, smb_nt_TotalDataCount);
2818 uint32 parameter_count = IVAL(inbuf,smb_nt_ParameterCount);
2819 uint32 parameter_offset = IVAL(inbuf,smb_nt_ParameterOffset);
2820 uint32 data_count = IVAL(inbuf,smb_nt_DataCount);
2821 uint32 data_offset = IVAL(inbuf,smb_nt_DataOffset);
2822 uint16 setup_count = 2*CVAL(inbuf,smb_nt_SetupCount); /* setup count is in *words* */
2823 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2824 char *params = NULL, *data = NULL, *setup = NULL;
2825 uint32 num_params_sofar, num_data_sofar;
2826 START_PROFILE(SMBnttrans);
2827
2828 if(global_oplock_break &&
2829 ((function_code == NT_TRANSACT_CREATE) ||
2830 (function_code == NT_TRANSACT_RENAME))) {
2831 /*
2832 * Queue this open message as we are the process of an oplock break.
2833 */
2834
2835 DEBUG(2,("reply_nttrans: queueing message code 0x%x \
2836 due to being in oplock break state.\n", (unsigned int)function_code ));
2837
2838 push_oplock_pending_smb_message( inbuf, length);
2839 END_PROFILE(SMBnttrans);
2840 return -1;
2841 }
2842
2843 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2844 END_PROFILE(SMBnttrans);
2845 return ERROR_DOS(ERRSRV,ERRaccess);
2846 }
2847
2848 outsize = set_message(outbuf,0,0,True);
2849
2850 /*
2851 * All nttrans messages we handle have smb_wct == 19 + setup_count.
2852 * Ensure this is so as a sanity check.
2853 */
2854
2855 if(CVAL(inbuf, smb_wct) != 19 + (setup_count/2)) {
2856 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2857 CVAL(inbuf, smb_wct), 19 + (setup_count/2)));
2858 goto bad_param;
2859 }
2860
2861 /* Don't allow more than 128mb for each value. */
2862 if ((total_parameter_count > (1024*1024*128)) || (total_data_count > (1024*1024*128))) {
2863 END_PROFILE(SMBnttrans);
2864 return ERROR_DOS(ERRDOS,ERRnomem);
2865 }
2866
2867 /* Allocate the space for the setup, the maximum needed parameters and data */
2868
2869 if(setup_count > 0)
2870 setup = (char *)SMB_MALLOC(setup_count);
2871 if (total_parameter_count > 0)
2872 params = (char *)SMB_MALLOC(total_parameter_count);
2873 if (total_data_count > 0)
2874 data = (char *)SMB_MALLOC(total_data_count);
2875
2876 if ((total_parameter_count && !params) || (total_data_count && !data) ||
2877 (setup_count && !setup)) {
2878 SAFE_FREE(setup);
2879 SAFE_FREE(params);
2880 SAFE_FREE(data);
2881 DEBUG(0,("reply_nttrans : Out of memory\n"));
2882 END_PROFILE(SMBnttrans);
2883 return ERROR_DOS(ERRDOS,ERRnomem);
2884 }
2885
2886 /* Copy the param and data bytes sent with this request into the params buffer */
2887 num_params_sofar = parameter_count;
2888 num_data_sofar = data_count;
2889
2890 if (parameter_count > total_parameter_count || data_count > total_data_count)
2891 goto bad_param;
2892
2893 if(setup) {
2894 DEBUG(10,("reply_nttrans: setup_count = %d\n", setup_count));
2895 if ((smb_nt_SetupStart + setup_count < smb_nt_SetupStart) ||
2896 (smb_nt_SetupStart + setup_count < setup_count))
2897 goto bad_param;
2898 if (smb_nt_SetupStart + setup_count > length)
2899 goto bad_param;
2900
2901 memcpy( setup, &inbuf[smb_nt_SetupStart], setup_count);
2902 dump_data(10, setup, setup_count);
2903 }
2904 if(params) {
2905 DEBUG(10,("reply_nttrans: parameter_count = %d\n", parameter_count));
2906 if ((parameter_offset + parameter_count < parameter_offset) ||
2907 (parameter_offset + parameter_count < parameter_count))
2908 goto bad_param;
2909 if ((smb_base(inbuf) + parameter_offset + parameter_count > inbuf + length)||
2910 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2911 goto bad_param;
2912
2913 memcpy( params, smb_base(inbuf) + parameter_offset, parameter_count);
2914 dump_data(10, params, parameter_count);
2915 }
2916 if(data) {
2917 DEBUG(10,("reply_nttrans: data_count = %d\n",data_count));
2918 if ((data_offset + data_count < data_offset) || (data_offset + data_count < data_count))
2919 goto bad_param;
2920 if ((smb_base(inbuf) + data_offset + data_count > inbuf + length) ||
2921 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
2922 goto bad_param;
2923
2924 memcpy( data, smb_base(inbuf) + data_offset, data_count);
2925 dump_data(10, data, data_count);
2926 }
2927
2928 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2929
2930 if(num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2931 /* We need to send an interim response then receive the rest
2932 of the parameter/data bytes */
2933 outsize = set_message(outbuf,0,0,True);
2934 srv_signing_trans_stop();
2935 if (!send_smb(smbd_server_fd(),outbuf))
2936 exit_server("reply_nttrans: send_smb failed.");
2937
2938 while( num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2939 BOOL ret;
2940 uint32 parameter_displacement;
2941 uint32 data_displacement;
2942
2943 ret = receive_next_smb(inbuf,bufsize,SMB_SECONDARY_WAIT);
2944
2945 /*
2946 * The sequence number for the trans reply is always
2947 * based on the last secondary received.
2948 */
2949
2950 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2951
2952 if((ret && (CVAL(inbuf, smb_com) != SMBnttranss)) || !ret) {
2953 outsize = set_message(outbuf,0,0,True);
2954 if(ret) {
2955 DEBUG(0,("reply_nttrans: Invalid secondary nttrans packet\n"));
2956 } else {
2957 DEBUG(0,("reply_nttrans: %s in getting secondary nttrans response.\n",
2958 (smb_read_error == READ_ERROR) ? "error" : "timeout" ));
2959 }
2960 goto bad_param;
2961 }
2962
2963 /* Revise total_params and total_data in case they have changed downwards */
2964 if (IVAL(inbuf, smb_nts_TotalParameterCount) < total_parameter_count)
2965 total_parameter_count = IVAL(inbuf, smb_nts_TotalParameterCount);
2966 if (IVAL(inbuf, smb_nts_TotalDataCount) < total_data_count)
2967 total_data_count = IVAL(inbuf, smb_nts_TotalDataCount);
2968
2969 parameter_count = IVAL(inbuf,smb_nts_ParameterCount);
2970 parameter_offset = IVAL(inbuf, smb_nts_ParameterOffset);
2971 parameter_displacement = IVAL(inbuf, smb_nts_ParameterDisplacement);
2972 num_params_sofar += parameter_count;
2973
2974 data_count = IVAL(inbuf, smb_nts_DataCount);
2975 data_displacement = IVAL(inbuf, smb_nts_DataDisplacement);
2976 data_offset = IVAL(inbuf, smb_nts_DataOffset);
2977 num_data_sofar += data_count;
2978
2979 if (num_params_sofar > total_parameter_count || num_data_sofar > total_data_count) {
2980 DEBUG(0,("reply_nttrans2: data overflow in secondary nttrans packet"));
2981 goto bad_param;
2982 }
2983
2984 if (parameter_count) {
2985 if (parameter_displacement + parameter_count > total_parameter_count)
2986 goto bad_param;
2987 if ((parameter_displacement + parameter_count < parameter_displacement) ||
2988 (parameter_displacement + parameter_count < parameter_count))
2989 goto bad_param;
2990 if (parameter_displacement > total_parameter_count)
2991 goto bad_param;
2992 if ((smb_base(inbuf) + parameter_offset + parameter_count >= inbuf + bufsize) ||
2993 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2994 goto bad_param;
2995 if (parameter_displacement + params < params)
2996 goto bad_param;
2997
2998 memcpy( &params[parameter_displacement], smb_base(inbuf) + parameter_offset, parameter_count);
2999 }
3000
3001 if (data_count) {
3002 if (data_displacement + data_count > total_data_count)
3003 goto bad_param;
3004 if ((data_displacement + data_count < data_displacement) ||
3005 (data_displacement + data_count < data_count))
3006 goto bad_param;
3007 if (data_displacement > total_data_count)
3008 goto bad_param;
3009 if ((smb_base(inbuf) + data_offset + data_count >= inbuf + bufsize) ||
3010 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
3011 goto bad_param;
3012 if (data_displacement + data < data)
3013 goto bad_param;
3014
3015 memcpy( &data[data_displacement], smb_base(inbuf)+ data_offset, data_count);
3016 }
3017 }
3018 }
3019
3020 if (Protocol >= PROTOCOL_NT1)
3021 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | FLAGS2_IS_LONG_NAME);
3022
3023 /* Now we must call the relevant NT_TRANS function */
3024 switch(function_code) {
3025 case NT_TRANSACT_CREATE:
3026 START_PROFILE_NESTED(NT_transact_create);
3027 outsize = call_nt_transact_create(conn, inbuf, outbuf,
3028 length, bufsize,
3029 &setup, setup_count,
3030 &params, total_parameter_count,
3031 &data, total_data_count, max_data_count);
3032 END_PROFILE_NESTED(NT_transact_create);
3033 break;
3034 case NT_TRANSACT_IOCTL:
3035 START_PROFILE_NESTED(NT_transact_ioctl);
3036 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
3037 length, bufsize,
3038 &setup, setup_count,
3039 &params, total_parameter_count,
3040 &data, total_data_count, max_data_count);
3041 END_PROFILE_NESTED(NT_transact_ioctl);
3042 break;
3043 case NT_TRANSACT_SET_SECURITY_DESC:
3044 START_PROFILE_NESTED(NT_transact_set_security_desc);
3045 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
3046 length, bufsize,
3047 &setup, setup_count,
3048 &params, total_parameter_count,
3049 &data, total_data_count, max_data_count);
3050 END_PROFILE_NESTED(NT_transact_set_security_desc);
3051 break;
3052 case NT_TRANSACT_NOTIFY_CHANGE:
3053 START_PROFILE_NESTED(NT_transact_notify_change);
3054 outsize = call_nt_transact_notify_change(conn, inbuf, outbuf,
3055 length, bufsize,
3056 &setup, setup_count,
3057 &params, total_parameter_count,
3058 &data, total_data_count, max_data_count);
3059 END_PROFILE_NESTED(NT_transact_notify_change);
3060 break;
3061 case NT_TRANSACT_RENAME:
3062 START_PROFILE_NESTED(NT_transact_rename);
3063 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
3064 length, bufsize,
3065 &setup, setup_count,
3066 &params, total_parameter_count,
3067 &data, total_data_count, max_data_count);
3068 END_PROFILE_NESTED(NT_transact_rename);
3069 break;
3070
3071 case NT_TRANSACT_QUERY_SECURITY_DESC:
3072 START_PROFILE_NESTED(NT_transact_query_security_desc);
3073 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
3074 length, bufsize,
3075 &setup, setup_count,
3076 &params, total_parameter_count,
3077 &data, total_data_count, max_data_count);
3078 END_PROFILE_NESTED(NT_transact_query_security_desc);
3079 break;
3080 #ifdef HAVE_SYS_QUOTAS
3081 case NT_TRANSACT_GET_USER_QUOTA:
3082 START_PROFILE_NESTED(NT_transact_get_user_quota);
3083 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
3084 length, bufsize,
3085 &setup, setup_count,
3086 &params, total_parameter_count,
3087 &data, total_data_count, max_data_count);
3088 END_PROFILE_NESTED(NT_transact_get_user_quota);
3089 break;
3090 case NT_TRANSACT_SET_USER_QUOTA:
3091 START_PROFILE_NESTED(NT_transact_set_user_quota);
3092 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
3093 length, bufsize,
3094 &setup, setup_count,
3095 &params, total_parameter_count,
3096 &data, total_data_count, max_data_count);
3097 END_PROFILE_NESTED(NT_transact_set_user_quota);
3098 break;
3099 #endif /* HAVE_SYS_QUOTAS */
3100 default:
3101 /* Error in request */
3102 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n", function_code));
3103 SAFE_FREE(setup);
3104 SAFE_FREE(params);
3105 SAFE_FREE(data);
3106 END_PROFILE(SMBnttrans);
3107 srv_signing_trans_stop();
3108 return ERROR_DOS(ERRSRV,ERRerror);
3109 }
3110
3111 /* As we do not know how many data packets will need to be
3112 returned here the various call_nt_transact_xxxx calls
3113 must send their own. Thus a call_nt_transact_xxxx routine only
3114 returns a value other than -1 when it wants to send
3115 an error packet.
3116 */
3117
3118 srv_signing_trans_stop();
3119
3120 SAFE_FREE(setup);
3121 SAFE_FREE(params);
3122 SAFE_FREE(data);
3123 END_PROFILE(SMBnttrans);
3124 return outsize; /* If a correct response was needed the call_nt_transact_xxxx
3125 calls have already sent it. If outsize != -1 then it is
3126 returning an error packet. */
3127
3128 bad_param:
3129
3130 srv_signing_trans_stop();
3131 SAFE_FREE(params);
3132 SAFE_FREE(data);
3133 SAFE_FREE(setup);
3134 END_PROFILE(SMBnttrans);
3135 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3136 }
WIP