?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Remove "req_wct_ofs()"
[Samba/gebeck_regimport.git] / source3 / smbd / reply.c
blob6e4bcab7741e467770a8a911d994283db4af1c29
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44
45 /****************************************************************************
46 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
47 path or anything including wildcards.
48 We're assuming here that '/' is not the second byte in any multibyte char
49 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
50 set.
51 ****************************************************************************/
52
53 /* Custom version for processing POSIX paths. */
54 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
55
56 static NTSTATUS check_path_syntax_internal(char *path,
57 bool posix_path,
58 bool *p_last_component_contains_wcard)
59 {
60 char *d = path;
61 const char *s = path;
62 NTSTATUS ret = NT_STATUS_OK;
63 bool start_of_name_component = True;
64 bool stream_started = false;
65
66 *p_last_component_contains_wcard = False;
67
68 while (*s) {
69 if (stream_started) {
70 switch (*s) {
71 case '/':
72 case '\\':
73 return NT_STATUS_OBJECT_NAME_INVALID;
74 case ':':
75 if (s[1] == '\0') {
76 return NT_STATUS_OBJECT_NAME_INVALID;
77 }
78 if (strchr_m(&s[1], ':')) {
79 return NT_STATUS_OBJECT_NAME_INVALID;
80 }
81 break;
82 }
83 }
84
85 if ((*s == ':') && !posix_path && !stream_started) {
86 if (*p_last_component_contains_wcard) {
87 return NT_STATUS_OBJECT_NAME_INVALID;
88 }
89 /* Stream names allow more characters than file names.
90 We're overloading posix_path here to allow a wider
91 range of characters. If stream_started is true this
92 is still a Windows path even if posix_path is true.
93 JRA.
94 */
95 stream_started = true;
96 start_of_name_component = false;
97 posix_path = true;
98
99 if (s[1] == '\0') {
100 return NT_STATUS_OBJECT_NAME_INVALID;
101 }
102 }
103
104 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
105 /*
106 * Safe to assume is not the second part of a mb char
107 * as this is handled below.
108 */
109 /* Eat multiple '/' or '\\' */
110 while (IS_PATH_SEP(*s,posix_path)) {
111 s++;
112 }
113 if ((d != path) && (*s != '\0')) {
114 /* We only care about non-leading or trailing '/' or '\\' */
115 *d++ = '/';
116 }
117
118 start_of_name_component = True;
119 /* New component. */
120 *p_last_component_contains_wcard = False;
121 continue;
122 }
123
124 if (start_of_name_component) {
125 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
126 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
127
128 /*
129 * No mb char starts with '.' so we're safe checking the directory separator here.
130 */
131
132 /* If we just added a '/' - delete it */
133 if ((d > path) && (*(d-1) == '/')) {
134 *(d-1) = '\0';
135 d--;
136 }
137
138 /* Are we at the start ? Can't go back further if so. */
139 if (d <= path) {
140 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
141 break;
142 }
143 /* Go back one level... */
144 /* We know this is safe as '/' cannot be part of a mb sequence. */
145 /* NOTE - if this assumption is invalid we are not in good shape... */
146 /* Decrement d first as d points to the *next* char to write into. */
147 for (d--; d > path; d--) {
148 if (*d == '/')
149 break;
150 }
151 s += 2; /* Else go past the .. */
152 /* We're still at the start of a name component, just the previous one. */
153 continue;
154
155 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
156 if (posix_path) {
157 /* Eat the '.' */
158 s++;
159 continue;
160 }
161 }
162
163 }
164
165 if (!(*s & 0x80)) {
166 if (!posix_path) {
167 if (*s <= 0x1f || *s == '|') {
168 return NT_STATUS_OBJECT_NAME_INVALID;
169 }
170 switch (*s) {
171 case '*':
172 case '?':
173 case '<':
174 case '>':
175 case '"':
176 *p_last_component_contains_wcard = True;
177 break;
178 default:
179 break;
180 }
181 }
182 *d++ = *s++;
183 } else {
184 size_t siz;
185 /* Get the size of the next MB character. */
186 next_codepoint(s,&siz);
187 switch(siz) {
188 case 5:
189 *d++ = *s++;
190 /*fall through*/
191 case 4:
192 *d++ = *s++;
193 /*fall through*/
194 case 3:
195 *d++ = *s++;
196 /*fall through*/
197 case 2:
198 *d++ = *s++;
199 /*fall through*/
200 case 1:
201 *d++ = *s++;
202 break;
203 default:
204 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
205 *d = '\0';
206 return NT_STATUS_INVALID_PARAMETER;
207 }
208 }
209 start_of_name_component = False;
210 }
211
212 *d = '\0';
213
214 return ret;
215 }
216
217 /****************************************************************************
218 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
219 No wildcards allowed.
220 ****************************************************************************/
221
222 NTSTATUS check_path_syntax(char *path)
223 {
224 bool ignore;
225 return check_path_syntax_internal(path, False, &ignore);
226 }
227
228 /****************************************************************************
229 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
230 Wildcards allowed - p_contains_wcard returns true if the last component contained
231 a wildcard.
232 ****************************************************************************/
233
234 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
235 {
236 return check_path_syntax_internal(path, False, p_contains_wcard);
237 }
238
239 /****************************************************************************
240 Check the path for a POSIX client.
241 We're assuming here that '/' is not the second byte in any multibyte char
242 set (a safe assumption).
243 ****************************************************************************/
244
245 NTSTATUS check_path_syntax_posix(char *path)
246 {
247 bool ignore;
248 return check_path_syntax_internal(path, True, &ignore);
249 }
250
251 /****************************************************************************
252 Pull a string and check the path allowing a wilcard - provide for error return.
253 ****************************************************************************/
254
255 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
256 const char *base_ptr,
257 uint16 smb_flags2,
258 char **pp_dest,
259 const char *src,
260 size_t src_len,
261 int flags,
262 NTSTATUS *err,
263 bool *contains_wcard)
264 {
265 size_t ret;
266
267 *pp_dest = NULL;
268
269 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
270 src_len, flags);
271
272 if (!*pp_dest) {
273 *err = NT_STATUS_INVALID_PARAMETER;
274 return ret;
275 }
276
277 *contains_wcard = False;
278
279 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
280 /*
281 * For a DFS path the function parse_dfs_path()
282 * will do the path processing, just make a copy.
283 */
284 *err = NT_STATUS_OK;
285 return ret;
286 }
287
288 if (lp_posix_pathnames()) {
289 *err = check_path_syntax_posix(*pp_dest);
290 } else {
291 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
292 }
293
294 return ret;
295 }
296
297 /****************************************************************************
298 Pull a string and check the path - provide for error return.
299 ****************************************************************************/
300
301 size_t srvstr_get_path(TALLOC_CTX *ctx,
302 const char *base_ptr,
303 uint16 smb_flags2,
304 char **pp_dest,
305 const char *src,
306 size_t src_len,
307 int flags,
308 NTSTATUS *err)
309 {
310 bool ignore;
311 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
312 src_len, flags, err, &ignore);
313 }
314
315 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
316 char **pp_dest, const char *src, int flags,
317 NTSTATUS *err, bool *contains_wcard)
318 {
319 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
320 pp_dest, src, smbreq_bufrem(req, src),
321 flags, err, contains_wcard);
322 }
323
324 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
325 char **pp_dest, const char *src, int flags,
326 NTSTATUS *err)
327 {
328 bool ignore;
329 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
330 flags, err, &ignore);
331 }
332
333 /****************************************************************************
334 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
335 ****************************************************************************/
336
337 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
338 files_struct *fsp)
339 {
340 if ((fsp == NULL) || (conn == NULL)) {
341 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
342 return False;
343 }
344 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
345 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
346 return False;
347 }
348 return True;
349 }
350
351 /****************************************************************************
352 Check if we have a correct fsp pointing to a file.
353 ****************************************************************************/
354
355 bool check_fsp(connection_struct *conn, struct smb_request *req,
356 files_struct *fsp)
357 {
358 if (!check_fsp_open(conn, req, fsp)) {
359 return False;
360 }
361 if (fsp->is_directory) {
362 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
363 return False;
364 }
365 if (fsp->fh->fd == -1) {
366 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
367 return False;
368 }
369 fsp->num_smb_operations++;
370 return True;
371 }
372
373 /****************************************************************************
374 Check if we have a correct fsp pointing to a quota fake file. Replacement for
375 the CHECK_NTQUOTA_HANDLE_OK macro.
376 ****************************************************************************/
377
378 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
379 files_struct *fsp)
380 {
381 if (!check_fsp_open(conn, req, fsp)) {
382 return false;
383 }
384
385 if (fsp->is_directory) {
386 return false;
387 }
388
389 if (fsp->fake_file_handle == NULL) {
390 return false;
391 }
392
393 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
394 return false;
395 }
396
397 if (fsp->fake_file_handle->private_data == NULL) {
398 return false;
399 }
400
401 return true;
402 }
403
404 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
405 const char *name, int name_type)
406 {
407 char *trim_name;
408 char *trim_name_type;
409 const char *retarget_parm;
410 char *retarget;
411 char *p;
412 int retarget_type = 0x20;
413 int retarget_port = NBT_SMB_PORT;
414 struct sockaddr_storage retarget_addr;
415 struct sockaddr_in *in_addr;
416 bool ret = false;
417 uint8_t outbuf[10];
418
419 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
420 return false;
421 }
422
423 trim_name = talloc_strdup(talloc_tos(), name);
424 if (trim_name == NULL) {
425 goto fail;
426 }
427 trim_char(trim_name, ' ', ' ');
428
429 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
430 name_type);
431 if (trim_name_type == NULL) {
432 goto fail;
433 }
434
435 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
436 trim_name_type, NULL);
437 if (retarget_parm == NULL) {
438 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
439 trim_name, NULL);
440 }
441 if (retarget_parm == NULL) {
442 goto fail;
443 }
444
445 retarget = talloc_strdup(trim_name, retarget_parm);
446 if (retarget == NULL) {
447 goto fail;
448 }
449
450 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
451
452 p = strchr(retarget, ':');
453 if (p != NULL) {
454 *p++ = '\0';
455 retarget_port = atoi(p);
456 }
457
458 p = strchr_m(retarget, '#');
459 if (p != NULL) {
460 *p++ = '\0';
461 if (sscanf(p, "%x", &retarget_type) != 1) {
462 goto fail;
463 }
464 }
465
466 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
467 if (!ret) {
468 DEBUG(10, ("could not resolve %s\n", retarget));
469 goto fail;
470 }
471
472 if (retarget_addr.ss_family != AF_INET) {
473 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
474 goto fail;
475 }
476
477 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
478
479 _smb_setlen(outbuf, 6);
480 SCVAL(outbuf, 0, 0x84);
481 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
482 *(uint16_t *)(outbuf+8) = htons(retarget_port);
483
484 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
485 NULL)) {
486 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
487 "failed.");
488 }
489
490 ret = true;
491 fail:
492 TALLOC_FREE(trim_name);
493 return ret;
494 }
495
496 static void reply_called_name_not_present(char *outbuf)
497 {
498 smb_setlen(outbuf, 1);
499 SCVAL(outbuf, 0, 0x83);
500 SCVAL(outbuf, 4, 0x82);
501 }
502
503 /****************************************************************************
504 Reply to a (netbios-level) special message.
505 ****************************************************************************/
506
507 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
508 {
509 int msg_type = CVAL(inbuf,0);
510 int msg_flags = CVAL(inbuf,1);
511 /*
512 * We only really use 4 bytes of the outbuf, but for the smb_setlen
513 * calculation & friends (srv_send_smb uses that) we need the full smb
514 * header.
515 */
516 char outbuf[smb_size];
517
518 memset(outbuf, '\0', sizeof(outbuf));
519
520 smb_setlen(outbuf,0);
521
522 switch (msg_type) {
523 case NBSSrequest: /* session request */
524 {
525 /* inbuf_size is guarenteed to be at least 4. */
526 fstring name1,name2;
527 int name_type1, name_type2;
528 int name_len1, name_len2;
529
530 *name1 = *name2 = 0;
531
532 if (sconn->nbt.got_session) {
533 exit_server_cleanly("multiple session request not permitted");
534 }
535
536 SCVAL(outbuf,0,NBSSpositive);
537 SCVAL(outbuf,3,0);
538
539 /* inbuf_size is guaranteed to be at least 4. */
540 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
541 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
542 DEBUG(0,("Invalid name length in session request\n"));
543 reply_called_name_not_present(outbuf);
544 break;
545 }
546 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
547 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
548 DEBUG(0,("Invalid name length in session request\n"));
549 reply_called_name_not_present(outbuf);
550 break;
551 }
552
553 name_type1 = name_extract((unsigned char *)inbuf,
554 inbuf_size,(unsigned int)4,name1);
555 name_type2 = name_extract((unsigned char *)inbuf,
556 inbuf_size,(unsigned int)(4 + name_len1),name2);
557
558 if (name_type1 == -1 || name_type2 == -1) {
559 DEBUG(0,("Invalid name type in session request\n"));
560 reply_called_name_not_present(outbuf);
561 break;
562 }
563
564 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
565 name1, name_type1, name2, name_type2));
566
567 if (netbios_session_retarget(sconn, name1, name_type1)) {
568 exit_server_cleanly("retargeted client");
569 }
570
571 /*
572 * Windows NT/2k uses "*SMBSERVER" and XP uses
573 * "*SMBSERV" arrggg!!!
574 */
575 if (strequal(name1, "*SMBSERVER ")
576 || strequal(name1, "*SMBSERV ")) {
577 char *raddr;
578
579 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
580 talloc_tos());
581 if (raddr == NULL) {
582 exit_server_cleanly("could not allocate raddr");
583 }
584
585 fstrcpy(name1, raddr);
586 }
587
588 set_local_machine_name(name1, True);
589 set_remote_machine_name(name2, True);
590
591 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
592 get_local_machine_name(), get_remote_machine_name(),
593 name_type2));
594
595 if (name_type2 == 'R') {
596 /* We are being asked for a pathworks session ---
597 no thanks! */
598 reply_called_name_not_present(outbuf);
599 break;
600 }
601
602 reload_services(sconn, conn_snum_used, true);
603 reopen_logs();
604
605 sconn->nbt.got_session = true;
606 break;
607 }
608
609 case 0x89: /* session keepalive request
610 (some old clients produce this?) */
611 SCVAL(outbuf,0,NBSSkeepalive);
612 SCVAL(outbuf,3,0);
613 break;
614
615 case NBSSpositive: /* positive session response */
616 case NBSSnegative: /* negative session response */
617 case NBSSretarget: /* retarget session response */
618 DEBUG(0,("Unexpected session response\n"));
619 break;
620
621 case NBSSkeepalive: /* session keepalive */
622 default:
623 return;
624 }
625
626 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
627 msg_type, msg_flags));
628
629 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
630
631 if (CVAL(outbuf, 0) != 0x82) {
632 exit_server_cleanly("invalid netbios session");
633 }
634 return;
635 }
636
637 /****************************************************************************
638 Reply to a tcon.
639 conn POINTER CAN BE NULL HERE !
640 ****************************************************************************/
641
642 void reply_tcon(struct smb_request *req)
643 {
644 connection_struct *conn = req->conn;
645 const char *service;
646 char *service_buf = NULL;
647 char *password = NULL;
648 char *dev = NULL;
649 int pwlen=0;
650 NTSTATUS nt_status;
651 const char *p;
652 TALLOC_CTX *ctx = talloc_tos();
653 struct smbd_server_connection *sconn = req->sconn;
654
655 START_PROFILE(SMBtcon);
656
657 if (req->buflen < 4) {
658 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
659 END_PROFILE(SMBtcon);
660 return;
661 }
662
663 p = (const char *)req->buf + 1;
664 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
665 p += 1;
666 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
667 p += pwlen+1;
668 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
669 p += 1;
670
671 if (service_buf == NULL || password == NULL || dev == NULL) {
672 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
673 END_PROFILE(SMBtcon);
674 return;
675 }
676 p = strrchr_m(service_buf,'\\');
677 if (p) {
678 service = p+1;
679 } else {
680 service = service_buf;
681 }
682
683 conn = make_connection(sconn,service,dev,
684 req->vuid,&nt_status);
685 req->conn = conn;
686
687 if (!conn) {
688 reply_nterror(req, nt_status);
689 END_PROFILE(SMBtcon);
690 return;
691 }
692
693 reply_outbuf(req, 2, 0);
694 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
695 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
696 SSVAL(req->outbuf,smb_tid,conn->cnum);
697
698 DEBUG(3,("tcon service=%s cnum=%d\n",
699 service, conn->cnum));
700
701 END_PROFILE(SMBtcon);
702 return;
703 }
704
705 /****************************************************************************
706 Reply to a tcon and X.
707 conn POINTER CAN BE NULL HERE !
708 ****************************************************************************/
709
710 void reply_tcon_and_X(struct smb_request *req)
711 {
712 connection_struct *conn = req->conn;
713 const char *service = NULL;
714 TALLOC_CTX *ctx = talloc_tos();
715 /* what the cleint thinks the device is */
716 char *client_devicetype = NULL;
717 /* what the server tells the client the share represents */
718 const char *server_devicetype;
719 NTSTATUS nt_status;
720 int passlen;
721 char *path = NULL;
722 const char *p, *q;
723 uint16 tcon_flags;
724 struct smbd_server_connection *sconn = req->sconn;
725
726 START_PROFILE(SMBtconX);
727
728 if (req->wct < 4) {
729 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
730 END_PROFILE(SMBtconX);
731 return;
732 }
733
734 passlen = SVAL(req->vwv+3, 0);
735 tcon_flags = SVAL(req->vwv+2, 0);
736
737 /* we might have to close an old one */
738 if ((tcon_flags & 0x1) && conn) {
739 close_cnum(conn,req->vuid);
740 req->conn = NULL;
741 conn = NULL;
742 }
743
744 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
745 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
746 END_PROFILE(SMBtconX);
747 return;
748 }
749
750 if (sconn->smb1.negprot.encrypted_passwords) {
751 p = (const char *)req->buf + passlen;
752 } else {
753 p = (const char *)req->buf + passlen + 1;
754 }
755
756 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
757
758 if (path == NULL) {
759 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
760 END_PROFILE(SMBtconX);
761 return;
762 }
763
764 /*
765 * the service name can be either: \\server\share
766 * or share directly like on the DELL PowerVault 705
767 */
768 if (*path=='\\') {
769 q = strchr_m(path+2,'\\');
770 if (!q) {
771 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
772 END_PROFILE(SMBtconX);
773 return;
774 }
775 service = q+1;
776 } else {
777 service = path;
778 }
779
780 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
781 &client_devicetype, p,
782 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
783
784 if (client_devicetype == NULL) {
785 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
786 END_PROFILE(SMBtconX);
787 return;
788 }
789
790 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
791
792 conn = make_connection(sconn, service, client_devicetype,
793 req->vuid, &nt_status);
794 req->conn =conn;
795
796 if (!conn) {
797 reply_nterror(req, nt_status);
798 END_PROFILE(SMBtconX);
799 return;
800 }
801
802 if ( IS_IPC(conn) )
803 server_devicetype = "IPC";
804 else if ( IS_PRINT(conn) )
805 server_devicetype = "LPT1:";
806 else
807 server_devicetype = "A:";
808
809 if (get_Protocol() < PROTOCOL_NT1) {
810 reply_outbuf(req, 2, 0);
811 if (message_push_string(&req->outbuf, server_devicetype,
812 STR_TERMINATE|STR_ASCII) == -1) {
813 reply_nterror(req, NT_STATUS_NO_MEMORY);
814 END_PROFILE(SMBtconX);
815 return;
816 }
817 } else {
818 /* NT sets the fstype of IPC$ to the null string */
819 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
820
821 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
822 /* Return permissions. */
823 uint32 perm1 = 0;
824 uint32 perm2 = 0;
825
826 reply_outbuf(req, 7, 0);
827
828 if (IS_IPC(conn)) {
829 perm1 = FILE_ALL_ACCESS;
830 perm2 = FILE_ALL_ACCESS;
831 } else {
832 perm1 = conn->share_access;
833 }
834
835 SIVAL(req->outbuf, smb_vwv3, perm1);
836 SIVAL(req->outbuf, smb_vwv5, perm2);
837 } else {
838 reply_outbuf(req, 3, 0);
839 }
840
841 if ((message_push_string(&req->outbuf, server_devicetype,
842 STR_TERMINATE|STR_ASCII) == -1)
843 || (message_push_string(&req->outbuf, fstype,
844 STR_TERMINATE) == -1)) {
845 reply_nterror(req, NT_STATUS_NO_MEMORY);
846 END_PROFILE(SMBtconX);
847 return;
848 }
849
850 /* what does setting this bit do? It is set by NT4 and
851 may affect the ability to autorun mounted cdroms */
852 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
853 (lp_csc_policy(SNUM(conn)) << 2));
854
855 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
856 DEBUG(2,("Serving %s as a Dfs root\n",
857 lp_servicename(SNUM(conn)) ));
858 SSVAL(req->outbuf, smb_vwv2,
859 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
860 }
861 }
862
863 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
864 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
865
866 DEBUG(3,("tconX service=%s \n",
867 service));
868
869 /* set the incoming and outgoing tid to the just created one */
870 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
871 SSVAL(req->outbuf,smb_tid,conn->cnum);
872
873 END_PROFILE(SMBtconX);
874
875 req->tid = conn->cnum;
876 }
877
878 /****************************************************************************
879 Reply to an unknown type.
880 ****************************************************************************/
881
882 void reply_unknown_new(struct smb_request *req, uint8 type)
883 {
884 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
885 smb_fn_name(type), type, type));
886 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
887 return;
888 }
889
890 /****************************************************************************
891 Reply to an ioctl.
892 conn POINTER CAN BE NULL HERE !
893 ****************************************************************************/
894
895 void reply_ioctl(struct smb_request *req)
896 {
897 connection_struct *conn = req->conn;
898 uint16 device;
899 uint16 function;
900 uint32 ioctl_code;
901 int replysize;
902 char *p;
903
904 START_PROFILE(SMBioctl);
905
906 if (req->wct < 3) {
907 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
908 END_PROFILE(SMBioctl);
909 return;
910 }
911
912 device = SVAL(req->vwv+1, 0);
913 function = SVAL(req->vwv+2, 0);
914 ioctl_code = (device << 16) + function;
915
916 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
917
918 switch (ioctl_code) {
919 case IOCTL_QUERY_JOB_INFO:
920 replysize = 32;
921 break;
922 default:
923 reply_force_doserror(req, ERRSRV, ERRnosupport);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927
928 reply_outbuf(req, 8, replysize+1);
929 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
930 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
931 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
932 p = smb_buf(req->outbuf);
933 memset(p, '\0', replysize+1); /* valgrind-safe. */
934 p += 1; /* Allow for alignment */
935
936 switch (ioctl_code) {
937 case IOCTL_QUERY_JOB_INFO:
938 {
939 files_struct *fsp = file_fsp(
940 req, SVAL(req->vwv+0, 0));
941 if (!fsp) {
942 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
943 END_PROFILE(SMBioctl);
944 return;
945 }
946 /* Job number */
947 if (fsp->print_file) {
948 SSVAL(p, 0, fsp->print_file->rap_jobid);
949 } else {
950 SSVAL(p, 0, 0);
951 }
952 srvstr_push((char *)req->outbuf, req->flags2, p+2,
953 lp_netbios_name(), 15,
954 STR_TERMINATE|STR_ASCII);
955 if (conn) {
956 srvstr_push((char *)req->outbuf, req->flags2,
957 p+18, lp_servicename(SNUM(conn)),
958 13, STR_TERMINATE|STR_ASCII);
959 } else {
960 memset(p+18, 0, 13);
961 }
962 break;
963 }
964 }
965
966 END_PROFILE(SMBioctl);
967 return;
968 }
969
970 /****************************************************************************
971 Strange checkpath NTSTATUS mapping.
972 ****************************************************************************/
973
974 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
975 {
976 /* Strange DOS error code semantics only for checkpath... */
977 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
978 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
979 /* We need to map to ERRbadpath */
980 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
981 }
982 }
983 return status;
984 }
985
986 /****************************************************************************
987 Reply to a checkpath.
988 ****************************************************************************/
989
990 void reply_checkpath(struct smb_request *req)
991 {
992 connection_struct *conn = req->conn;
993 struct smb_filename *smb_fname = NULL;
994 char *name = NULL;
995 NTSTATUS status;
996 TALLOC_CTX *ctx = talloc_tos();
997
998 START_PROFILE(SMBcheckpath);
999
1000 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1001 STR_TERMINATE, &status);
1002
1003 if (!NT_STATUS_IS_OK(status)) {
1004 status = map_checkpath_error(req->flags2, status);
1005 reply_nterror(req, status);
1006 END_PROFILE(SMBcheckpath);
1007 return;
1008 }
1009
1010 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1011
1012 status = filename_convert(ctx,
1013 conn,
1014 req->flags2 & FLAGS2_DFS_PATHNAMES,
1015 name,
1016 0,
1017 NULL,
1018 &smb_fname);
1019
1020 if (!NT_STATUS_IS_OK(status)) {
1021 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1022 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1023 ERRSRV, ERRbadpath);
1024 END_PROFILE(SMBcheckpath);
1025 return;
1026 }
1027 goto path_err;
1028 }
1029
1030 if (!VALID_STAT(smb_fname->st) &&
1031 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1032 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1033 smb_fname_str_dbg(smb_fname), strerror(errno)));
1034 status = map_nt_error_from_unix(errno);
1035 goto path_err;
1036 }
1037
1038 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1039 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1040 ERRDOS, ERRbadpath);
1041 goto out;
1042 }
1043
1044 reply_outbuf(req, 0, 0);
1045
1046 path_err:
1047 /* We special case this - as when a Windows machine
1048 is parsing a path is steps through the components
1049 one at a time - if a component fails it expects
1050 ERRbadpath, not ERRbadfile.
1051 */
1052 status = map_checkpath_error(req->flags2, status);
1053 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1054 /*
1055 * Windows returns different error codes if
1056 * the parent directory is valid but not the
1057 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1058 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1059 * if the path is invalid.
1060 */
1061 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1062 ERRDOS, ERRbadpath);
1063 goto out;
1064 }
1065
1066 reply_nterror(req, status);
1067
1068 out:
1069 TALLOC_FREE(smb_fname);
1070 END_PROFILE(SMBcheckpath);
1071 return;
1072 }
1073
1074 /****************************************************************************
1075 Reply to a getatr.
1076 ****************************************************************************/
1077
1078 void reply_getatr(struct smb_request *req)
1079 {
1080 connection_struct *conn = req->conn;
1081 struct smb_filename *smb_fname = NULL;
1082 char *fname = NULL;
1083 int mode=0;
1084 SMB_OFF_T size=0;
1085 time_t mtime=0;
1086 const char *p;
1087 NTSTATUS status;
1088 TALLOC_CTX *ctx = talloc_tos();
1089 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1090
1091 START_PROFILE(SMBgetatr);
1092
1093 p = (const char *)req->buf + 1;
1094 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1095 if (!NT_STATUS_IS_OK(status)) {
1096 reply_nterror(req, status);
1097 goto out;
1098 }
1099
1100 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1101 under WfWg - weird! */
1102 if (*fname == '\0') {
1103 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1104 if (!CAN_WRITE(conn)) {
1105 mode |= FILE_ATTRIBUTE_READONLY;
1106 }
1107 size = 0;
1108 mtime = 0;
1109 } else {
1110 status = filename_convert(ctx,
1111 conn,
1112 req->flags2 & FLAGS2_DFS_PATHNAMES,
1113 fname,
1114 0,
1115 NULL,
1116 &smb_fname);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1119 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1120 ERRSRV, ERRbadpath);
1121 goto out;
1122 }
1123 reply_nterror(req, status);
1124 goto out;
1125 }
1126 if (!VALID_STAT(smb_fname->st) &&
1127 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1128 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1129 smb_fname_str_dbg(smb_fname),
1130 strerror(errno)));
1131 reply_nterror(req, map_nt_error_from_unix(errno));
1132 goto out;
1133 }
1134
1135 mode = dos_mode(conn, smb_fname);
1136 size = smb_fname->st.st_ex_size;
1137
1138 if (ask_sharemode) {
1139 struct timespec write_time_ts;
1140 struct file_id fileid;
1141
1142 ZERO_STRUCT(write_time_ts);
1143 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1144 get_file_infos(fileid, 0, NULL, &write_time_ts);
1145 if (!null_timespec(write_time_ts)) {
1146 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1147 }
1148 }
1149
1150 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1151 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1152 size = 0;
1153 }
1154 }
1155
1156 reply_outbuf(req, 10, 0);
1157
1158 SSVAL(req->outbuf,smb_vwv0,mode);
1159 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1160 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1161 } else {
1162 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1163 }
1164 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1165
1166 if (get_Protocol() >= PROTOCOL_NT1) {
1167 SSVAL(req->outbuf, smb_flg2,
1168 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1169 }
1170
1171 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1172 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1173
1174 out:
1175 TALLOC_FREE(smb_fname);
1176 TALLOC_FREE(fname);
1177 END_PROFILE(SMBgetatr);
1178 return;
1179 }
1180
1181 /****************************************************************************
1182 Reply to a setatr.
1183 ****************************************************************************/
1184
1185 void reply_setatr(struct smb_request *req)
1186 {
1187 struct smb_file_time ft;
1188 connection_struct *conn = req->conn;
1189 struct smb_filename *smb_fname = NULL;
1190 char *fname = NULL;
1191 int mode;
1192 time_t mtime;
1193 const char *p;
1194 NTSTATUS status;
1195 TALLOC_CTX *ctx = talloc_tos();
1196
1197 START_PROFILE(SMBsetatr);
1198
1199 ZERO_STRUCT(ft);
1200
1201 if (req->wct < 2) {
1202 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1203 goto out;
1204 }
1205
1206 p = (const char *)req->buf + 1;
1207 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1208 if (!NT_STATUS_IS_OK(status)) {
1209 reply_nterror(req, status);
1210 goto out;
1211 }
1212
1213 status = filename_convert(ctx,
1214 conn,
1215 req->flags2 & FLAGS2_DFS_PATHNAMES,
1216 fname,
1217 0,
1218 NULL,
1219 &smb_fname);
1220 if (!NT_STATUS_IS_OK(status)) {
1221 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1222 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1223 ERRSRV, ERRbadpath);
1224 goto out;
1225 }
1226 reply_nterror(req, status);
1227 goto out;
1228 }
1229
1230 if (smb_fname->base_name[0] == '.' &&
1231 smb_fname->base_name[1] == '\0') {
1232 /*
1233 * Not sure here is the right place to catch this
1234 * condition. Might be moved to somewhere else later -- vl
1235 */
1236 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1237 goto out;
1238 }
1239
1240 mode = SVAL(req->vwv+0, 0);
1241 mtime = srv_make_unix_date3(req->vwv+1);
1242
1243 if (mode != FILE_ATTRIBUTE_NORMAL) {
1244 if (VALID_STAT_OF_DIR(smb_fname->st))
1245 mode |= FILE_ATTRIBUTE_DIRECTORY;
1246 else
1247 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1248
1249 status = check_access(conn, NULL, smb_fname,
1250 FILE_WRITE_ATTRIBUTES);
1251 if (!NT_STATUS_IS_OK(status)) {
1252 reply_nterror(req, status);
1253 goto out;
1254 }
1255
1256 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1257 false) != 0) {
1258 reply_nterror(req, map_nt_error_from_unix(errno));
1259 goto out;
1260 }
1261 }
1262
1263 ft.mtime = convert_time_t_to_timespec(mtime);
1264 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1265 if (!NT_STATUS_IS_OK(status)) {
1266 reply_nterror(req, status);
1267 goto out;
1268 }
1269
1270 reply_outbuf(req, 0, 0);
1271
1272 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1273 mode));
1274 out:
1275 TALLOC_FREE(smb_fname);
1276 END_PROFILE(SMBsetatr);
1277 return;
1278 }
1279
1280 /****************************************************************************
1281 Reply to a dskattr.
1282 ****************************************************************************/
1283
1284 void reply_dskattr(struct smb_request *req)
1285 {
1286 connection_struct *conn = req->conn;
1287 uint64_t dfree,dsize,bsize;
1288 START_PROFILE(SMBdskattr);
1289
1290 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1291 reply_nterror(req, map_nt_error_from_unix(errno));
1292 END_PROFILE(SMBdskattr);
1293 return;
1294 }
1295
1296 reply_outbuf(req, 5, 0);
1297
1298 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1299 double total_space, free_space;
1300 /* we need to scale this to a number that DOS6 can handle. We
1301 use floating point so we can handle large drives on systems
1302 that don't have 64 bit integers
1303
1304 we end up displaying a maximum of 2G to DOS systems
1305 */
1306 total_space = dsize * (double)bsize;
1307 free_space = dfree * (double)bsize;
1308
1309 dsize = (uint64_t)((total_space+63*512) / (64*512));
1310 dfree = (uint64_t)((free_space+63*512) / (64*512));
1311
1312 if (dsize > 0xFFFF) dsize = 0xFFFF;
1313 if (dfree > 0xFFFF) dfree = 0xFFFF;
1314
1315 SSVAL(req->outbuf,smb_vwv0,dsize);
1316 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1317 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1318 SSVAL(req->outbuf,smb_vwv3,dfree);
1319 } else {
1320 SSVAL(req->outbuf,smb_vwv0,dsize);
1321 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1322 SSVAL(req->outbuf,smb_vwv2,512);
1323 SSVAL(req->outbuf,smb_vwv3,dfree);
1324 }
1325
1326 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1327
1328 END_PROFILE(SMBdskattr);
1329 return;
1330 }
1331
1332 /*
1333 * Utility function to split the filename from the directory.
1334 */
1335 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1336 char **fname_dir_out,
1337 char **fname_mask_out)
1338 {
1339 const char *p = NULL;
1340 char *fname_dir = NULL;
1341 char *fname_mask = NULL;
1342
1343 p = strrchr_m(fname_in, '/');
1344 if (!p) {
1345 fname_dir = talloc_strdup(ctx, ".");
1346 fname_mask = talloc_strdup(ctx, fname_in);
1347 } else {
1348 fname_dir = talloc_strndup(ctx, fname_in,
1349 PTR_DIFF(p, fname_in));
1350 fname_mask = talloc_strdup(ctx, p+1);
1351 }
1352
1353 if (!fname_dir || !fname_mask) {
1354 TALLOC_FREE(fname_dir);
1355 TALLOC_FREE(fname_mask);
1356 return NT_STATUS_NO_MEMORY;
1357 }
1358
1359 *fname_dir_out = fname_dir;
1360 *fname_mask_out = fname_mask;
1361 return NT_STATUS_OK;
1362 }
1363
1364 /****************************************************************************
1365 Reply to a search.
1366 Can be called from SMBsearch, SMBffirst or SMBfunique.
1367 ****************************************************************************/
1368
1369 void reply_search(struct smb_request *req)
1370 {
1371 connection_struct *conn = req->conn;
1372 char *path = NULL;
1373 const char *mask = NULL;
1374 char *directory = NULL;
1375 struct smb_filename *smb_fname = NULL;
1376 char *fname = NULL;
1377 SMB_OFF_T size;
1378 uint32 mode;
1379 struct timespec date;
1380 uint32 dirtype;
1381 unsigned int numentries = 0;
1382 unsigned int maxentries = 0;
1383 bool finished = False;
1384 const char *p;
1385 int status_len;
1386 char status[21];
1387 int dptr_num= -1;
1388 bool check_descend = False;
1389 bool expect_close = False;
1390 NTSTATUS nt_status;
1391 bool mask_contains_wcard = False;
1392 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1393 TALLOC_CTX *ctx = talloc_tos();
1394 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1395 struct dptr_struct *dirptr = NULL;
1396 struct smbd_server_connection *sconn = req->sconn;
1397
1398 START_PROFILE(SMBsearch);
1399
1400 if (req->wct < 2) {
1401 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1402 goto out;
1403 }
1404
1405 if (lp_posix_pathnames()) {
1406 reply_unknown_new(req, req->cmd);
1407 goto out;
1408 }
1409
1410 /* If we were called as SMBffirst then we must expect close. */
1411 if(req->cmd == SMBffirst) {
1412 expect_close = True;
1413 }
1414
1415 reply_outbuf(req, 1, 3);
1416 maxentries = SVAL(req->vwv+0, 0);
1417 dirtype = SVAL(req->vwv+1, 0);
1418 p = (const char *)req->buf + 1;
1419 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1420 &nt_status, &mask_contains_wcard);
1421 if (!NT_STATUS_IS_OK(nt_status)) {
1422 reply_nterror(req, nt_status);
1423 goto out;
1424 }
1425
1426 p++;
1427 status_len = SVAL(p, 0);
1428 p += 2;
1429
1430 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1431
1432 if (status_len == 0) {
1433 nt_status = filename_convert(ctx, conn,
1434 req->flags2 & FLAGS2_DFS_PATHNAMES,
1435 path,
1436 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1437 &mask_contains_wcard,
1438 &smb_fname);
1439 if (!NT_STATUS_IS_OK(nt_status)) {
1440 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1441 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1442 ERRSRV, ERRbadpath);
1443 goto out;
1444 }
1445 reply_nterror(req, nt_status);
1446 goto out;
1447 }
1448
1449 directory = smb_fname->base_name;
1450
1451 p = strrchr_m(directory,'/');
1452 if ((p != NULL) && (*directory != '/')) {
1453 mask = p + 1;
1454 directory = talloc_strndup(ctx, directory,
1455 PTR_DIFF(p, directory));
1456 } else {
1457 mask = directory;
1458 directory = talloc_strdup(ctx,".");
1459 }
1460
1461 if (!directory) {
1462 reply_nterror(req, NT_STATUS_NO_MEMORY);
1463 goto out;
1464 }
1465
1466 memset((char *)status,'\0',21);
1467 SCVAL(status,0,(dirtype & 0x1F));
1468
1469 nt_status = dptr_create(conn,
1470 NULL, /* req */
1471 NULL, /* fsp */
1472 directory,
1473 True,
1474 expect_close,
1475 req->smbpid,
1476 mask,
1477 mask_contains_wcard,
1478 dirtype,
1479 &dirptr);
1480 if (!NT_STATUS_IS_OK(nt_status)) {
1481 reply_nterror(req, nt_status);
1482 goto out;
1483 }
1484 dptr_num = dptr_dnum(dirptr);
1485 } else {
1486 int status_dirtype;
1487 const char *dirpath;
1488
1489 memcpy(status,p,21);
1490 status_dirtype = CVAL(status,0) & 0x1F;
1491 if (status_dirtype != (dirtype & 0x1F)) {
1492 dirtype = status_dirtype;
1493 }
1494
1495 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1496 if (!dirptr) {
1497 goto SearchEmpty;
1498 }
1499 dirpath = dptr_path(sconn, dptr_num);
1500 directory = talloc_strdup(ctx, dirpath);
1501 if (!directory) {
1502 reply_nterror(req, NT_STATUS_NO_MEMORY);
1503 goto out;
1504 }
1505
1506 mask = dptr_wcard(sconn, dptr_num);
1507 if (!mask) {
1508 goto SearchEmpty;
1509 }
1510 /*
1511 * For a 'continue' search we have no string. So
1512 * check from the initial saved string.
1513 */
1514 mask_contains_wcard = ms_has_wild(mask);
1515 dirtype = dptr_attr(sconn, dptr_num);
1516 }
1517
1518 DEBUG(4,("dptr_num is %d\n",dptr_num));
1519
1520 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1521 dptr_init_search_op(dirptr);
1522
1523 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1524 char buf[DIR_STRUCT_SIZE];
1525 memcpy(buf,status,21);
1526 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1527 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1528 reply_nterror(req, NT_STATUS_NO_MEMORY);
1529 goto out;
1530 }
1531 dptr_fill(sconn, buf+12,dptr_num);
1532 if (dptr_zero(buf+12) && (status_len==0)) {
1533 numentries = 1;
1534 } else {
1535 numentries = 0;
1536 }
1537 if (message_push_blob(&req->outbuf,
1538 data_blob_const(buf, sizeof(buf)))
1539 == -1) {
1540 reply_nterror(req, NT_STATUS_NO_MEMORY);
1541 goto out;
1542 }
1543 } else {
1544 unsigned int i;
1545 maxentries = MIN(
1546 maxentries,
1547 ((BUFFER_SIZE -
1548 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1549 /DIR_STRUCT_SIZE));
1550
1551 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1552 directory,lp_dontdescend(SNUM(conn))));
1553 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1554 check_descend = True;
1555 }
1556
1557 for (i=numentries;(i<maxentries) && !finished;i++) {
1558 finished = !get_dir_entry(ctx,
1559 dirptr,
1560 mask,
1561 dirtype,
1562 &fname,
1563 &size,
1564 &mode,
1565 &date,
1566 check_descend,
1567 ask_sharemode);
1568 if (!finished) {
1569 char buf[DIR_STRUCT_SIZE];
1570 memcpy(buf,status,21);
1571 if (!make_dir_struct(ctx,
1572 buf,
1573 mask,
1574 fname,
1575 size,
1576 mode,
1577 convert_timespec_to_time_t(date),
1578 !allow_long_path_components)) {
1579 reply_nterror(req, NT_STATUS_NO_MEMORY);
1580 goto out;
1581 }
1582 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1583 break;
1584 }
1585 if (message_push_blob(&req->outbuf,
1586 data_blob_const(buf, sizeof(buf)))
1587 == -1) {
1588 reply_nterror(req, NT_STATUS_NO_MEMORY);
1589 goto out;
1590 }
1591 numentries++;
1592 }
1593 }
1594 }
1595
1596 SearchEmpty:
1597
1598 /* If we were called as SMBffirst with smb_search_id == NULL
1599 and no entries were found then return error and close dirptr
1600 (X/Open spec) */
1601
1602 if (numentries == 0) {
1603 dptr_close(sconn, &dptr_num);
1604 } else if(expect_close && status_len == 0) {
1605 /* Close the dptr - we know it's gone */
1606 dptr_close(sconn, &dptr_num);
1607 }
1608
1609 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1610 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1611 dptr_close(sconn, &dptr_num);
1612 }
1613
1614 if ((numentries == 0) && !mask_contains_wcard) {
1615 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1616 goto out;
1617 }
1618
1619 SSVAL(req->outbuf,smb_vwv0,numentries);
1620 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1621 SCVAL(smb_buf(req->outbuf),0,5);
1622 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1623
1624 /* The replies here are never long name. */
1625 SSVAL(req->outbuf, smb_flg2,
1626 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1627 if (!allow_long_path_components) {
1628 SSVAL(req->outbuf, smb_flg2,
1629 SVAL(req->outbuf, smb_flg2)
1630 & (~FLAGS2_LONG_PATH_COMPONENTS));
1631 }
1632
1633 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1634 SSVAL(req->outbuf, smb_flg2,
1635 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1636
1637 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1638 smb_fn_name(req->cmd),
1639 mask,
1640 directory,
1641 dirtype,
1642 numentries,
1643 maxentries ));
1644 out:
1645 TALLOC_FREE(directory);
1646 TALLOC_FREE(smb_fname);
1647 END_PROFILE(SMBsearch);
1648 return;
1649 }
1650
1651 /****************************************************************************
1652 Reply to a fclose (stop directory search).
1653 ****************************************************************************/
1654
1655 void reply_fclose(struct smb_request *req)
1656 {
1657 int status_len;
1658 char status[21];
1659 int dptr_num= -2;
1660 const char *p;
1661 char *path = NULL;
1662 NTSTATUS err;
1663 bool path_contains_wcard = False;
1664 TALLOC_CTX *ctx = talloc_tos();
1665 struct smbd_server_connection *sconn = req->sconn;
1666
1667 START_PROFILE(SMBfclose);
1668
1669 if (lp_posix_pathnames()) {
1670 reply_unknown_new(req, req->cmd);
1671 END_PROFILE(SMBfclose);
1672 return;
1673 }
1674
1675 p = (const char *)req->buf + 1;
1676 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1677 &err, &path_contains_wcard);
1678 if (!NT_STATUS_IS_OK(err)) {
1679 reply_nterror(req, err);
1680 END_PROFILE(SMBfclose);
1681 return;
1682 }
1683 p++;
1684 status_len = SVAL(p,0);
1685 p += 2;
1686
1687 if (status_len == 0) {
1688 reply_force_doserror(req, ERRSRV, ERRsrverror);
1689 END_PROFILE(SMBfclose);
1690 return;
1691 }
1692
1693 memcpy(status,p,21);
1694
1695 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1696 /* Close the dptr - we know it's gone */
1697 dptr_close(sconn, &dptr_num);
1698 }
1699
1700 reply_outbuf(req, 1, 0);
1701 SSVAL(req->outbuf,smb_vwv0,0);
1702
1703 DEBUG(3,("search close\n"));
1704
1705 END_PROFILE(SMBfclose);
1706 return;
1707 }
1708
1709 /****************************************************************************
1710 Reply to an open.
1711 ****************************************************************************/
1712
1713 void reply_open(struct smb_request *req)
1714 {
1715 connection_struct *conn = req->conn;
1716 struct smb_filename *smb_fname = NULL;
1717 char *fname = NULL;
1718 uint32 fattr=0;
1719 SMB_OFF_T size = 0;
1720 time_t mtime=0;
1721 int info;
1722 files_struct *fsp;
1723 int oplock_request;
1724 int deny_mode;
1725 uint32 dos_attr;
1726 uint32 access_mask;
1727 uint32 share_mode;
1728 uint32 create_disposition;
1729 uint32 create_options = 0;
1730 uint32_t private_flags = 0;
1731 NTSTATUS status;
1732 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1733 TALLOC_CTX *ctx = talloc_tos();
1734
1735 START_PROFILE(SMBopen);
1736
1737 if (req->wct < 2) {
1738 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1739 goto out;
1740 }
1741
1742 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1743 deny_mode = SVAL(req->vwv+0, 0);
1744 dos_attr = SVAL(req->vwv+1, 0);
1745
1746 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1747 STR_TERMINATE, &status);
1748 if (!NT_STATUS_IS_OK(status)) {
1749 reply_nterror(req, status);
1750 goto out;
1751 }
1752
1753 status = filename_convert(ctx,
1754 conn,
1755 req->flags2 & FLAGS2_DFS_PATHNAMES,
1756 fname,
1757 0,
1758 NULL,
1759 &smb_fname);
1760 if (!NT_STATUS_IS_OK(status)) {
1761 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1762 reply_botherror(req,
1763 NT_STATUS_PATH_NOT_COVERED,
1764 ERRSRV, ERRbadpath);
1765 goto out;
1766 }
1767 reply_nterror(req, status);
1768 goto out;
1769 }
1770
1771 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1772 OPENX_FILE_EXISTS_OPEN, &access_mask,
1773 &share_mode, &create_disposition,
1774 &create_options, &private_flags)) {
1775 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1776 goto out;
1777 }
1778
1779 status = SMB_VFS_CREATE_FILE(
1780 conn, /* conn */
1781 req, /* req */
1782 0, /* root_dir_fid */
1783 smb_fname, /* fname */
1784 access_mask, /* access_mask */
1785 share_mode, /* share_access */
1786 create_disposition, /* create_disposition*/
1787 create_options, /* create_options */
1788 dos_attr, /* file_attributes */
1789 oplock_request, /* oplock_request */
1790 0, /* allocation_size */
1791 private_flags,
1792 NULL, /* sd */
1793 NULL, /* ea_list */
1794 &fsp, /* result */
1795 &info); /* pinfo */
1796
1797 if (!NT_STATUS_IS_OK(status)) {
1798 if (open_was_deferred(req->sconn, req->mid)) {
1799 /* We have re-scheduled this call. */
1800 goto out;
1801 }
1802 reply_openerror(req, status);
1803 goto out;
1804 }
1805
1806 size = smb_fname->st.st_ex_size;
1807 fattr = dos_mode(conn, smb_fname);
1808
1809 /* Deal with other possible opens having a modified
1810 write time. JRA. */
1811 if (ask_sharemode) {
1812 struct timespec write_time_ts;
1813
1814 ZERO_STRUCT(write_time_ts);
1815 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1816 if (!null_timespec(write_time_ts)) {
1817 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1818 }
1819 }
1820
1821 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1822
1823 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1824 DEBUG(3,("attempt to open a directory %s\n",
1825 fsp_str_dbg(fsp)));
1826 close_file(req, fsp, ERROR_CLOSE);
1827 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1828 ERRDOS, ERRnoaccess);
1829 goto out;
1830 }
1831
1832 reply_outbuf(req, 7, 0);
1833 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1834 SSVAL(req->outbuf,smb_vwv1,fattr);
1835 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1836 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1837 } else {
1838 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1839 }
1840 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1841 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1842
1843 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1844 SCVAL(req->outbuf,smb_flg,
1845 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1846 }
1847
1848 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1849 SCVAL(req->outbuf,smb_flg,
1850 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1851 }
1852 out:
1853 TALLOC_FREE(smb_fname);
1854 END_PROFILE(SMBopen);
1855 return;
1856 }
1857
1858 /****************************************************************************
1859 Reply to an open and X.
1860 ****************************************************************************/
1861
1862 void reply_open_and_X(struct smb_request *req)
1863 {
1864 connection_struct *conn = req->conn;
1865 struct smb_filename *smb_fname = NULL;
1866 char *fname = NULL;
1867 uint16 open_flags;
1868 int deny_mode;
1869 uint32 smb_attr;
1870 /* Breakout the oplock request bits so we can set the
1871 reply bits separately. */
1872 int ex_oplock_request;
1873 int core_oplock_request;
1874 int oplock_request;
1875 #if 0
1876 int smb_sattr = SVAL(req->vwv+4, 0);
1877 uint32 smb_time = make_unix_date3(req->vwv+6);
1878 #endif
1879 int smb_ofun;
1880 uint32 fattr=0;
1881 int mtime=0;
1882 int smb_action = 0;
1883 files_struct *fsp;
1884 NTSTATUS status;
1885 uint64_t allocation_size;
1886 ssize_t retval = -1;
1887 uint32 access_mask;
1888 uint32 share_mode;
1889 uint32 create_disposition;
1890 uint32 create_options = 0;
1891 uint32_t private_flags = 0;
1892 TALLOC_CTX *ctx = talloc_tos();
1893
1894 START_PROFILE(SMBopenX);
1895
1896 if (req->wct < 15) {
1897 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1898 goto out;
1899 }
1900
1901 open_flags = SVAL(req->vwv+2, 0);
1902 deny_mode = SVAL(req->vwv+3, 0);
1903 smb_attr = SVAL(req->vwv+5, 0);
1904 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1905 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1906 oplock_request = ex_oplock_request | core_oplock_request;
1907 smb_ofun = SVAL(req->vwv+8, 0);
1908 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1909
1910 /* If it's an IPC, pass off the pipe handler. */
1911 if (IS_IPC(conn)) {
1912 if (lp_nt_pipe_support()) {
1913 reply_open_pipe_and_X(conn, req);
1914 } else {
1915 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1916 }
1917 goto out;
1918 }
1919
1920 /* XXXX we need to handle passed times, sattr and flags */
1921 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1922 STR_TERMINATE, &status);
1923 if (!NT_STATUS_IS_OK(status)) {
1924 reply_nterror(req, status);
1925 goto out;
1926 }
1927
1928 status = filename_convert(ctx,
1929 conn,
1930 req->flags2 & FLAGS2_DFS_PATHNAMES,
1931 fname,
1932 0,
1933 NULL,
1934 &smb_fname);
1935 if (!NT_STATUS_IS_OK(status)) {
1936 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1937 reply_botherror(req,
1938 NT_STATUS_PATH_NOT_COVERED,
1939 ERRSRV, ERRbadpath);
1940 goto out;
1941 }
1942 reply_nterror(req, status);
1943 goto out;
1944 }
1945
1946 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1947 smb_ofun,
1948 &access_mask, &share_mode,
1949 &create_disposition,
1950 &create_options,
1951 &private_flags)) {
1952 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1953 goto out;
1954 }
1955
1956 status = SMB_VFS_CREATE_FILE(
1957 conn, /* conn */
1958 req, /* req */
1959 0, /* root_dir_fid */
1960 smb_fname, /* fname */
1961 access_mask, /* access_mask */
1962 share_mode, /* share_access */
1963 create_disposition, /* create_disposition*/
1964 create_options, /* create_options */
1965 smb_attr, /* file_attributes */
1966 oplock_request, /* oplock_request */
1967 0, /* allocation_size */
1968 private_flags,
1969 NULL, /* sd */
1970 NULL, /* ea_list */
1971 &fsp, /* result */
1972 &smb_action); /* pinfo */
1973
1974 if (!NT_STATUS_IS_OK(status)) {
1975 if (open_was_deferred(req->sconn, req->mid)) {
1976 /* We have re-scheduled this call. */
1977 goto out;
1978 }
1979 reply_openerror(req, status);
1980 goto out;
1981 }
1982
1983 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1984 if the file is truncated or created. */
1985 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1986 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1987 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1988 close_file(req, fsp, ERROR_CLOSE);
1989 reply_nterror(req, NT_STATUS_DISK_FULL);
1990 goto out;
1991 }
1992 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1993 if (retval < 0) {
1994 close_file(req, fsp, ERROR_CLOSE);
1995 reply_nterror(req, NT_STATUS_DISK_FULL);
1996 goto out;
1997 }
1998 status = vfs_stat_fsp(fsp);
1999 if (!NT_STATUS_IS_OK(status)) {
2000 close_file(req, fsp, ERROR_CLOSE);
2001 reply_nterror(req, status);
2002 goto out;
2003 }
2004 }
2005
2006 fattr = dos_mode(conn, fsp->fsp_name);
2007 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2008 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2009 close_file(req, fsp, ERROR_CLOSE);
2010 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2011 goto out;
2012 }
2013
2014 /* If the caller set the extended oplock request bit
2015 and we granted one (by whatever means) - set the
2016 correct bit for extended oplock reply.
2017 */
2018
2019 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2020 smb_action |= EXTENDED_OPLOCK_GRANTED;
2021 }
2022
2023 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2024 smb_action |= EXTENDED_OPLOCK_GRANTED;
2025 }
2026
2027 /* If the caller set the core oplock request bit
2028 and we granted one (by whatever means) - set the
2029 correct bit for core oplock reply.
2030 */
2031
2032 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2033 reply_outbuf(req, 19, 0);
2034 } else {
2035 reply_outbuf(req, 15, 0);
2036 }
2037
2038 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2039 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2040
2041 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2042 SCVAL(req->outbuf, smb_flg,
2043 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2044 }
2045
2046 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2047 SCVAL(req->outbuf, smb_flg,
2048 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2049 }
2050
2051 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2052 SSVAL(req->outbuf,smb_vwv3,fattr);
2053 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2054 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2055 } else {
2056 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2057 }
2058 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2059 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2060 SSVAL(req->outbuf,smb_vwv11,smb_action);
2061
2062 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2063 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2064 }
2065
2066 out:
2067 TALLOC_FREE(smb_fname);
2068 END_PROFILE(SMBopenX);
2069 return;
2070 }
2071
2072 /****************************************************************************
2073 Reply to a SMBulogoffX.
2074 ****************************************************************************/
2075
2076 void reply_ulogoffX(struct smb_request *req)
2077 {
2078 struct smbd_server_connection *sconn = req->sconn;
2079 user_struct *vuser;
2080
2081 START_PROFILE(SMBulogoffX);
2082
2083 vuser = get_valid_user_struct(sconn, req->vuid);
2084
2085 if(vuser == NULL) {
2086 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2087 req->vuid));
2088 }
2089
2090 /* in user level security we are supposed to close any files
2091 open by this user */
2092 if (vuser != NULL) {
2093 file_close_user(sconn, req->vuid);
2094 }
2095
2096 invalidate_vuid(sconn, req->vuid);
2097
2098 reply_outbuf(req, 2, 0);
2099 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2100 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2101
2102 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2103
2104 END_PROFILE(SMBulogoffX);
2105 req->vuid = UID_FIELD_INVALID;
2106 }
2107
2108 /****************************************************************************
2109 Reply to a mknew or a create.
2110 ****************************************************************************/
2111
2112 void reply_mknew(struct smb_request *req)
2113 {
2114 connection_struct *conn = req->conn;
2115 struct smb_filename *smb_fname = NULL;
2116 char *fname = NULL;
2117 uint32 fattr = 0;
2118 struct smb_file_time ft;
2119 files_struct *fsp;
2120 int oplock_request = 0;
2121 NTSTATUS status;
2122 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2123 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2124 uint32 create_disposition;
2125 uint32 create_options = 0;
2126 TALLOC_CTX *ctx = talloc_tos();
2127
2128 START_PROFILE(SMBcreate);
2129 ZERO_STRUCT(ft);
2130
2131 if (req->wct < 3) {
2132 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2133 goto out;
2134 }
2135
2136 fattr = SVAL(req->vwv+0, 0);
2137 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2138
2139 /* mtime. */
2140 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2141
2142 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2143 STR_TERMINATE, &status);
2144 if (!NT_STATUS_IS_OK(status)) {
2145 reply_nterror(req, status);
2146 goto out;
2147 }
2148
2149 status = filename_convert(ctx,
2150 conn,
2151 req->flags2 & FLAGS2_DFS_PATHNAMES,
2152 fname,
2153 0,
2154 NULL,
2155 &smb_fname);
2156 if (!NT_STATUS_IS_OK(status)) {
2157 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2158 reply_botherror(req,
2159 NT_STATUS_PATH_NOT_COVERED,
2160 ERRSRV, ERRbadpath);
2161 goto out;
2162 }
2163 reply_nterror(req, status);
2164 goto out;
2165 }
2166
2167 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2168 DEBUG(0,("Attempt to create file (%s) with volid set - "
2169 "please report this\n",
2170 smb_fname_str_dbg(smb_fname)));
2171 }
2172
2173 if(req->cmd == SMBmknew) {
2174 /* We should fail if file exists. */
2175 create_disposition = FILE_CREATE;
2176 } else {
2177 /* Create if file doesn't exist, truncate if it does. */
2178 create_disposition = FILE_OVERWRITE_IF;
2179 }
2180
2181 status = SMB_VFS_CREATE_FILE(
2182 conn, /* conn */
2183 req, /* req */
2184 0, /* root_dir_fid */
2185 smb_fname, /* fname */
2186 access_mask, /* access_mask */
2187 share_mode, /* share_access */
2188 create_disposition, /* create_disposition*/
2189 create_options, /* create_options */
2190 fattr, /* file_attributes */
2191 oplock_request, /* oplock_request */
2192 0, /* allocation_size */
2193 0, /* private_flags */
2194 NULL, /* sd */
2195 NULL, /* ea_list */
2196 &fsp, /* result */
2197 NULL); /* pinfo */
2198
2199 if (!NT_STATUS_IS_OK(status)) {
2200 if (open_was_deferred(req->sconn, req->mid)) {
2201 /* We have re-scheduled this call. */
2202 goto out;
2203 }
2204 reply_openerror(req, status);
2205 goto out;
2206 }
2207
2208 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2209 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2210 if (!NT_STATUS_IS_OK(status)) {
2211 END_PROFILE(SMBcreate);
2212 goto out;
2213 }
2214
2215 reply_outbuf(req, 1, 0);
2216 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2217
2218 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2219 SCVAL(req->outbuf,smb_flg,
2220 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2221 }
2222
2223 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2224 SCVAL(req->outbuf,smb_flg,
2225 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2226 }
2227
2228 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2229 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2230 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2231 (unsigned int)fattr));
2232
2233 out:
2234 TALLOC_FREE(smb_fname);
2235 END_PROFILE(SMBcreate);
2236 return;
2237 }
2238
2239 /****************************************************************************
2240 Reply to a create temporary file.
2241 ****************************************************************************/
2242
2243 void reply_ctemp(struct smb_request *req)
2244 {
2245 connection_struct *conn = req->conn;
2246 struct smb_filename *smb_fname = NULL;
2247 char *fname = NULL;
2248 uint32 fattr;
2249 files_struct *fsp;
2250 int oplock_request;
2251 int tmpfd;
2252 char *s;
2253 NTSTATUS status;
2254 TALLOC_CTX *ctx = talloc_tos();
2255
2256 START_PROFILE(SMBctemp);
2257
2258 if (req->wct < 3) {
2259 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2260 goto out;
2261 }
2262
2263 fattr = SVAL(req->vwv+0, 0);
2264 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2265
2266 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2267 STR_TERMINATE, &status);
2268 if (!NT_STATUS_IS_OK(status)) {
2269 reply_nterror(req, status);
2270 goto out;
2271 }
2272 if (*fname) {
2273 fname = talloc_asprintf(ctx,
2274 "%s/TMXXXXXX",
2275 fname);
2276 } else {
2277 fname = talloc_strdup(ctx, "TMXXXXXX");
2278 }
2279
2280 if (!fname) {
2281 reply_nterror(req, NT_STATUS_NO_MEMORY);
2282 goto out;
2283 }
2284
2285 status = filename_convert(ctx, conn,
2286 req->flags2 & FLAGS2_DFS_PATHNAMES,
2287 fname,
2288 0,
2289 NULL,
2290 &smb_fname);
2291 if (!NT_STATUS_IS_OK(status)) {
2292 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2293 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2294 ERRSRV, ERRbadpath);
2295 goto out;
2296 }
2297 reply_nterror(req, status);
2298 goto out;
2299 }
2300
2301 tmpfd = mkstemp(smb_fname->base_name);
2302 if (tmpfd == -1) {
2303 reply_nterror(req, map_nt_error_from_unix(errno));
2304 goto out;
2305 }
2306
2307 SMB_VFS_STAT(conn, smb_fname);
2308
2309 /* We should fail if file does not exist. */
2310 status = SMB_VFS_CREATE_FILE(
2311 conn, /* conn */
2312 req, /* req */
2313 0, /* root_dir_fid */
2314 smb_fname, /* fname */
2315 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2316 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2317 FILE_OPEN, /* create_disposition*/
2318 0, /* create_options */
2319 fattr, /* file_attributes */
2320 oplock_request, /* oplock_request */
2321 0, /* allocation_size */
2322 0, /* private_flags */
2323 NULL, /* sd */
2324 NULL, /* ea_list */
2325 &fsp, /* result */
2326 NULL); /* pinfo */
2327
2328 /* close fd from mkstemp() */
2329 close(tmpfd);
2330
2331 if (!NT_STATUS_IS_OK(status)) {
2332 if (open_was_deferred(req->sconn, req->mid)) {
2333 /* We have re-scheduled this call. */
2334 goto out;
2335 }
2336 reply_openerror(req, status);
2337 goto out;
2338 }
2339
2340 reply_outbuf(req, 1, 0);
2341 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2342
2343 /* the returned filename is relative to the directory */
2344 s = strrchr_m(fsp->fsp_name->base_name, '/');
2345 if (!s) {
2346 s = fsp->fsp_name->base_name;
2347 } else {
2348 s++;
2349 }
2350
2351 #if 0
2352 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2353 thing in the byte section. JRA */
2354 SSVALS(p, 0, -1); /* what is this? not in spec */
2355 #endif
2356 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2357 == -1) {
2358 reply_nterror(req, NT_STATUS_NO_MEMORY);
2359 goto out;
2360 }
2361
2362 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2363 SCVAL(req->outbuf, smb_flg,
2364 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2365 }
2366
2367 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2368 SCVAL(req->outbuf, smb_flg,
2369 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2370 }
2371
2372 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2373 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2374 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2375 out:
2376 TALLOC_FREE(smb_fname);
2377 END_PROFILE(SMBctemp);
2378 return;
2379 }
2380
2381 /*******************************************************************
2382 Check if a user is allowed to rename a file.
2383 ********************************************************************/
2384
2385 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2386 uint16 dirtype)
2387 {
2388 if (!CAN_WRITE(conn)) {
2389 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2390 }
2391
2392 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2393 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2394 /* Only bother to read the DOS attribute if we might deny the
2395 rename on the grounds of attribute missmatch. */
2396 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2397 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2398 return NT_STATUS_NO_SUCH_FILE;
2399 }
2400 }
2401
2402 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2403 if (fsp->posix_open) {
2404 return NT_STATUS_OK;
2405 }
2406
2407 /* If no pathnames are open below this
2408 directory, allow the rename. */
2409
2410 if (file_find_subpath(fsp)) {
2411 return NT_STATUS_ACCESS_DENIED;
2412 }
2413 return NT_STATUS_OK;
2414 }
2415
2416 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2417 return NT_STATUS_OK;
2418 }
2419
2420 return NT_STATUS_ACCESS_DENIED;
2421 }
2422
2423 /*******************************************************************
2424 * unlink a file with all relevant access checks
2425 *******************************************************************/
2426
2427 static NTSTATUS do_unlink(connection_struct *conn,
2428 struct smb_request *req,
2429 struct smb_filename *smb_fname,
2430 uint32 dirtype)
2431 {
2432 uint32 fattr;
2433 files_struct *fsp;
2434 uint32 dirtype_orig = dirtype;
2435 NTSTATUS status;
2436 int ret;
2437 bool posix_paths = lp_posix_pathnames();
2438
2439 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2440 smb_fname_str_dbg(smb_fname),
2441 dirtype));
2442
2443 if (!CAN_WRITE(conn)) {
2444 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2445 }
2446
2447 if (posix_paths) {
2448 ret = SMB_VFS_LSTAT(conn, smb_fname);
2449 } else {
2450 ret = SMB_VFS_STAT(conn, smb_fname);
2451 }
2452 if (ret != 0) {
2453 return map_nt_error_from_unix(errno);
2454 }
2455
2456 fattr = dos_mode(conn, smb_fname);
2457
2458 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2459 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2460 }
2461
2462 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2463 if (!dirtype) {
2464 return NT_STATUS_NO_SUCH_FILE;
2465 }
2466
2467 if (!dir_check_ftype(conn, fattr, dirtype)) {
2468 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2469 return NT_STATUS_FILE_IS_A_DIRECTORY;
2470 }
2471 return NT_STATUS_NO_SUCH_FILE;
2472 }
2473
2474 if (dirtype_orig & 0x8000) {
2475 /* These will never be set for POSIX. */
2476 return NT_STATUS_NO_SUCH_FILE;
2477 }
2478
2479 #if 0
2480 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2481 return NT_STATUS_FILE_IS_A_DIRECTORY;
2482 }
2483
2484 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2485 return NT_STATUS_NO_SUCH_FILE;
2486 }
2487
2488 if (dirtype & 0xFF00) {
2489 /* These will never be set for POSIX. */
2490 return NT_STATUS_NO_SUCH_FILE;
2491 }
2492
2493 dirtype &= 0xFF;
2494 if (!dirtype) {
2495 return NT_STATUS_NO_SUCH_FILE;
2496 }
2497
2498 /* Can't delete a directory. */
2499 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2500 return NT_STATUS_FILE_IS_A_DIRECTORY;
2501 }
2502 #endif
2503
2504 #if 0 /* JRATEST */
2505 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2506 return NT_STATUS_OBJECT_NAME_INVALID;
2507 #endif /* JRATEST */
2508
2509 /* On open checks the open itself will check the share mode, so
2510 don't do it here as we'll get it wrong. */
2511
2512 status = SMB_VFS_CREATE_FILE
2513 (conn, /* conn */
2514 req, /* req */
2515 0, /* root_dir_fid */
2516 smb_fname, /* fname */
2517 DELETE_ACCESS, /* access_mask */
2518 FILE_SHARE_NONE, /* share_access */
2519 FILE_OPEN, /* create_disposition*/
2520 FILE_NON_DIRECTORY_FILE, /* create_options */
2521 /* file_attributes */
2522 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2523 FILE_ATTRIBUTE_NORMAL,
2524 0, /* oplock_request */
2525 0, /* allocation_size */
2526 0, /* private_flags */
2527 NULL, /* sd */
2528 NULL, /* ea_list */
2529 &fsp, /* result */
2530 NULL); /* pinfo */
2531
2532 if (!NT_STATUS_IS_OK(status)) {
2533 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2534 nt_errstr(status)));
2535 return status;
2536 }
2537
2538 status = can_set_delete_on_close(fsp, fattr);
2539 if (!NT_STATUS_IS_OK(status)) {
2540 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2541 "(%s)\n",
2542 smb_fname_str_dbg(smb_fname),
2543 nt_errstr(status)));
2544 close_file(req, fsp, NORMAL_CLOSE);
2545 return status;
2546 }
2547
2548 /* The set is across all open files on this dev/inode pair. */
2549 if (!set_delete_on_close(fsp, True, conn->session_info->unix_token)) {
2550 close_file(req, fsp, NORMAL_CLOSE);
2551 return NT_STATUS_ACCESS_DENIED;
2552 }
2553
2554 return close_file(req, fsp, NORMAL_CLOSE);
2555 }
2556
2557 /****************************************************************************
2558 The guts of the unlink command, split out so it may be called by the NT SMB
2559 code.
2560 ****************************************************************************/
2561
2562 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2563 uint32 dirtype, struct smb_filename *smb_fname,
2564 bool has_wild)
2565 {
2566 char *fname_dir = NULL;
2567 char *fname_mask = NULL;
2568 int count=0;
2569 NTSTATUS status = NT_STATUS_OK;
2570 TALLOC_CTX *ctx = talloc_tos();
2571
2572 /* Split up the directory from the filename/mask. */
2573 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2574 &fname_dir, &fname_mask);
2575 if (!NT_STATUS_IS_OK(status)) {
2576 goto out;
2577 }
2578
2579 /*
2580 * We should only check the mangled cache
2581 * here if unix_convert failed. This means
2582 * that the path in 'mask' doesn't exist
2583 * on the file system and so we need to look
2584 * for a possible mangle. This patch from
2585 * Tine Smukavec <valentin.smukavec@hermes.si>.
2586 */
2587
2588 if (!VALID_STAT(smb_fname->st) &&
2589 mangle_is_mangled(fname_mask, conn->params)) {
2590 char *new_mask = NULL;
2591 mangle_lookup_name_from_8_3(ctx, fname_mask,
2592 &new_mask, conn->params);
2593 if (new_mask) {
2594 TALLOC_FREE(fname_mask);
2595 fname_mask = new_mask;
2596 }
2597 }
2598
2599 if (!has_wild) {
2600
2601 /*
2602 * Only one file needs to be unlinked. Append the mask back
2603 * onto the directory.
2604 */
2605 TALLOC_FREE(smb_fname->base_name);
2606 if (ISDOT(fname_dir)) {
2607 /* Ensure we use canonical names on open. */
2608 smb_fname->base_name = talloc_asprintf(smb_fname,
2609 "%s",
2610 fname_mask);
2611 } else {
2612 smb_fname->base_name = talloc_asprintf(smb_fname,
2613 "%s/%s",
2614 fname_dir,
2615 fname_mask);
2616 }
2617 if (!smb_fname->base_name) {
2618 status = NT_STATUS_NO_MEMORY;
2619 goto out;
2620 }
2621 if (dirtype == 0) {
2622 dirtype = FILE_ATTRIBUTE_NORMAL;
2623 }
2624
2625 status = check_name(conn, smb_fname->base_name);
2626 if (!NT_STATUS_IS_OK(status)) {
2627 goto out;
2628 }
2629
2630 status = do_unlink(conn, req, smb_fname, dirtype);
2631 if (!NT_STATUS_IS_OK(status)) {
2632 goto out;
2633 }
2634
2635 count++;
2636 } else {
2637 struct smb_Dir *dir_hnd = NULL;
2638 long offset = 0;
2639 const char *dname = NULL;
2640 char *talloced = NULL;
2641
2642 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2643 status = NT_STATUS_OBJECT_NAME_INVALID;
2644 goto out;
2645 }
2646
2647 if (strequal(fname_mask,"????????.???")) {
2648 TALLOC_FREE(fname_mask);
2649 fname_mask = talloc_strdup(ctx, "*");
2650 if (!fname_mask) {
2651 status = NT_STATUS_NO_MEMORY;
2652 goto out;
2653 }
2654 }
2655
2656 status = check_name(conn, fname_dir);
2657 if (!NT_STATUS_IS_OK(status)) {
2658 goto out;
2659 }
2660
2661 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2662 dirtype);
2663 if (dir_hnd == NULL) {
2664 status = map_nt_error_from_unix(errno);
2665 goto out;
2666 }
2667
2668 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2669 the pattern matches against the long name, otherwise the short name
2670 We don't implement this yet XXXX
2671 */
2672
2673 status = NT_STATUS_NO_SUCH_FILE;
2674
2675 while ((dname = ReadDirName(dir_hnd, &offset,
2676 &smb_fname->st, &talloced))) {
2677 TALLOC_CTX *frame = talloc_stackframe();
2678
2679 if (!is_visible_file(conn, fname_dir, dname,
2680 &smb_fname->st, true)) {
2681 TALLOC_FREE(frame);
2682 TALLOC_FREE(talloced);
2683 continue;
2684 }
2685
2686 /* Quick check for "." and ".." */
2687 if (ISDOT(dname) || ISDOTDOT(dname)) {
2688 TALLOC_FREE(frame);
2689 TALLOC_FREE(talloced);
2690 continue;
2691 }
2692
2693 if(!mask_match(dname, fname_mask,
2694 conn->case_sensitive)) {
2695 TALLOC_FREE(frame);
2696 TALLOC_FREE(talloced);
2697 continue;
2698 }
2699
2700 TALLOC_FREE(smb_fname->base_name);
2701 if (ISDOT(fname_dir)) {
2702 /* Ensure we use canonical names on open. */
2703 smb_fname->base_name =
2704 talloc_asprintf(smb_fname, "%s",
2705 dname);
2706 } else {
2707 smb_fname->base_name =
2708 talloc_asprintf(smb_fname, "%s/%s",
2709 fname_dir, dname);
2710 }
2711
2712 if (!smb_fname->base_name) {
2713 TALLOC_FREE(dir_hnd);
2714 status = NT_STATUS_NO_MEMORY;
2715 TALLOC_FREE(frame);
2716 TALLOC_FREE(talloced);
2717 goto out;
2718 }
2719
2720 status = check_name(conn, smb_fname->base_name);
2721 if (!NT_STATUS_IS_OK(status)) {
2722 TALLOC_FREE(dir_hnd);
2723 TALLOC_FREE(frame);
2724 TALLOC_FREE(talloced);
2725 goto out;
2726 }
2727
2728 status = do_unlink(conn, req, smb_fname, dirtype);
2729 if (!NT_STATUS_IS_OK(status)) {
2730 TALLOC_FREE(frame);
2731 TALLOC_FREE(talloced);
2732 continue;
2733 }
2734
2735 count++;
2736 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2737 smb_fname->base_name));
2738
2739 TALLOC_FREE(frame);
2740 TALLOC_FREE(talloced);
2741 }
2742 TALLOC_FREE(dir_hnd);
2743 }
2744
2745 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2746 status = map_nt_error_from_unix(errno);
2747 }
2748
2749 out:
2750 TALLOC_FREE(fname_dir);
2751 TALLOC_FREE(fname_mask);
2752 return status;
2753 }
2754
2755 /****************************************************************************
2756 Reply to a unlink
2757 ****************************************************************************/
2758
2759 void reply_unlink(struct smb_request *req)
2760 {
2761 connection_struct *conn = req->conn;
2762 char *name = NULL;
2763 struct smb_filename *smb_fname = NULL;
2764 uint32 dirtype;
2765 NTSTATUS status;
2766 bool path_contains_wcard = False;
2767 TALLOC_CTX *ctx = talloc_tos();
2768
2769 START_PROFILE(SMBunlink);
2770
2771 if (req->wct < 1) {
2772 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2773 goto out;
2774 }
2775
2776 dirtype = SVAL(req->vwv+0, 0);
2777
2778 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2779 STR_TERMINATE, &status,
2780 &path_contains_wcard);
2781 if (!NT_STATUS_IS_OK(status)) {
2782 reply_nterror(req, status);
2783 goto out;
2784 }
2785
2786 status = filename_convert(ctx, conn,
2787 req->flags2 & FLAGS2_DFS_PATHNAMES,
2788 name,
2789 UCF_COND_ALLOW_WCARD_LCOMP,
2790 &path_contains_wcard,
2791 &smb_fname);
2792 if (!NT_STATUS_IS_OK(status)) {
2793 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2794 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2795 ERRSRV, ERRbadpath);
2796 goto out;
2797 }
2798 reply_nterror(req, status);
2799 goto out;
2800 }
2801
2802 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2803
2804 status = unlink_internals(conn, req, dirtype, smb_fname,
2805 path_contains_wcard);
2806 if (!NT_STATUS_IS_OK(status)) {
2807 if (open_was_deferred(req->sconn, req->mid)) {
2808 /* We have re-scheduled this call. */
2809 goto out;
2810 }
2811 reply_nterror(req, status);
2812 goto out;
2813 }
2814
2815 reply_outbuf(req, 0, 0);
2816 out:
2817 TALLOC_FREE(smb_fname);
2818 END_PROFILE(SMBunlink);
2819 return;
2820 }
2821
2822 /****************************************************************************
2823 Fail for readbraw.
2824 ****************************************************************************/
2825
2826 static void fail_readraw(void)
2827 {
2828 const char *errstr = talloc_asprintf(talloc_tos(),
2829 "FAIL ! reply_readbraw: socket write fail (%s)",
2830 strerror(errno));
2831 if (!errstr) {
2832 errstr = "";
2833 }
2834 exit_server_cleanly(errstr);
2835 }
2836
2837 /****************************************************************************
2838 Fake (read/write) sendfile. Returns -1 on read or write fail.
2839 ****************************************************************************/
2840
2841 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2842 {
2843 size_t bufsize;
2844 size_t tosend = nread;
2845 char *buf;
2846
2847 if (nread == 0) {
2848 return 0;
2849 }
2850
2851 bufsize = MIN(nread, 65536);
2852
2853 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2854 return -1;
2855 }
2856
2857 while (tosend > 0) {
2858 ssize_t ret;
2859 size_t cur_read;
2860
2861 if (tosend > bufsize) {
2862 cur_read = bufsize;
2863 } else {
2864 cur_read = tosend;
2865 }
2866 ret = read_file(fsp,buf,startpos,cur_read);
2867 if (ret == -1) {
2868 SAFE_FREE(buf);
2869 return -1;
2870 }
2871
2872 /* If we had a short read, fill with zeros. */
2873 if (ret < cur_read) {
2874 memset(buf + ret, '\0', cur_read - ret);
2875 }
2876
2877 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2878 != cur_read) {
2879 char addr[INET6_ADDRSTRLEN];
2880 /*
2881 * Try and give an error message saying what
2882 * client failed.
2883 */
2884 DEBUG(0, ("write_data failed for client %s. "
2885 "Error %s\n",
2886 get_peer_addr(fsp->conn->sconn->sock, addr,
2887 sizeof(addr)),
2888 strerror(errno)));
2889 SAFE_FREE(buf);
2890 return -1;
2891 }
2892 tosend -= cur_read;
2893 startpos += cur_read;
2894 }
2895
2896 SAFE_FREE(buf);
2897 return (ssize_t)nread;
2898 }
2899
2900 /****************************************************************************
2901 Deal with the case of sendfile reading less bytes from the file than
2902 requested. Fill with zeros (all we can do).
2903 ****************************************************************************/
2904
2905 void sendfile_short_send(files_struct *fsp,
2906 ssize_t nread,
2907 size_t headersize,
2908 size_t smb_maxcnt)
2909 {
2910 #define SHORT_SEND_BUFSIZE 1024
2911 if (nread < headersize) {
2912 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2913 "header for file %s (%s). Terminating\n",
2914 fsp_str_dbg(fsp), strerror(errno)));
2915 exit_server_cleanly("sendfile_short_send failed");
2916 }
2917
2918 nread -= headersize;
2919
2920 if (nread < smb_maxcnt) {
2921 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2922 if (!buf) {
2923 exit_server_cleanly("sendfile_short_send: "
2924 "malloc failed");
2925 }
2926
2927 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2928 "with zeros !\n", fsp_str_dbg(fsp)));
2929
2930 while (nread < smb_maxcnt) {
2931 /*
2932 * We asked for the real file size and told sendfile
2933 * to not go beyond the end of the file. But it can
2934 * happen that in between our fstat call and the
2935 * sendfile call the file was truncated. This is very
2936 * bad because we have already announced the larger
2937 * number of bytes to the client.
2938 *
2939 * The best we can do now is to send 0-bytes, just as
2940 * a read from a hole in a sparse file would do.
2941 *
2942 * This should happen rarely enough that I don't care
2943 * about efficiency here :-)
2944 */
2945 size_t to_write;
2946
2947 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2948 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2949 != to_write) {
2950 char addr[INET6_ADDRSTRLEN];
2951 /*
2952 * Try and give an error message saying what
2953 * client failed.
2954 */
2955 DEBUG(0, ("write_data failed for client %s. "
2956 "Error %s\n",
2957 get_peer_addr(
2958 fsp->conn->sconn->sock, addr,
2959 sizeof(addr)),
2960 strerror(errno)));
2961 exit_server_cleanly("sendfile_short_send: "
2962 "write_data failed");
2963 }
2964 nread += to_write;
2965 }
2966 SAFE_FREE(buf);
2967 }
2968 }
2969
2970 /****************************************************************************
2971 Return a readbraw error (4 bytes of zero).
2972 ****************************************************************************/
2973
2974 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2975 {
2976 char header[4];
2977
2978 SIVAL(header,0,0);
2979
2980 smbd_lock_socket(sconn);
2981 if (write_data(sconn->sock,header,4) != 4) {
2982 char addr[INET6_ADDRSTRLEN];
2983 /*
2984 * Try and give an error message saying what
2985 * client failed.
2986 */
2987 DEBUG(0, ("write_data failed for client %s. "
2988 "Error %s\n",
2989 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2990 strerror(errno)));
2991
2992 fail_readraw();
2993 }
2994 smbd_unlock_socket(sconn);
2995 }
2996
2997 /****************************************************************************
2998 Use sendfile in readbraw.
2999 ****************************************************************************/
3000
3001 static void send_file_readbraw(connection_struct *conn,
3002 struct smb_request *req,
3003 files_struct *fsp,
3004 SMB_OFF_T startpos,
3005 size_t nread,
3006 ssize_t mincount)
3007 {
3008 struct smbd_server_connection *sconn = req->sconn;
3009 char *outbuf = NULL;
3010 ssize_t ret=0;
3011
3012 /*
3013 * We can only use sendfile on a non-chained packet
3014 * but we can use on a non-oplocked file. tridge proved this
3015 * on a train in Germany :-). JRA.
3016 * reply_readbraw has already checked the length.
3017 */
3018
3019 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3020 (fsp->wcp == NULL) &&
3021 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3022 ssize_t sendfile_read = -1;
3023 char header[4];
3024 DATA_BLOB header_blob;
3025
3026 _smb_setlen(header,nread);
3027 header_blob = data_blob_const(header, 4);
3028
3029 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3030 &header_blob, startpos,
3031 nread);
3032 if (sendfile_read == -1) {
3033 /* Returning ENOSYS means no data at all was sent.
3034 * Do this as a normal read. */
3035 if (errno == ENOSYS) {
3036 goto normal_readbraw;
3037 }
3038
3039 /*
3040 * Special hack for broken Linux with no working sendfile. If we
3041 * return EINTR we sent the header but not the rest of the data.
3042 * Fake this up by doing read/write calls.
3043 */
3044 if (errno == EINTR) {
3045 /* Ensure we don't do this again. */
3046 set_use_sendfile(SNUM(conn), False);
3047 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3048
3049 if (fake_sendfile(fsp, startpos, nread) == -1) {
3050 DEBUG(0,("send_file_readbraw: "
3051 "fake_sendfile failed for "
3052 "file %s (%s).\n",
3053 fsp_str_dbg(fsp),
3054 strerror(errno)));
3055 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3056 }
3057 return;
3058 }
3059
3060 DEBUG(0,("send_file_readbraw: sendfile failed for "
3061 "file %s (%s). Terminating\n",
3062 fsp_str_dbg(fsp), strerror(errno)));
3063 exit_server_cleanly("send_file_readbraw sendfile failed");
3064 } else if (sendfile_read == 0) {
3065 /*
3066 * Some sendfile implementations return 0 to indicate
3067 * that there was a short read, but nothing was
3068 * actually written to the socket. In this case,
3069 * fallback to the normal read path so the header gets
3070 * the correct byte count.
3071 */
3072 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3073 "bytes falling back to the normal read: "
3074 "%s\n", fsp_str_dbg(fsp)));
3075 goto normal_readbraw;
3076 }
3077
3078 /* Deal with possible short send. */
3079 if (sendfile_read != 4+nread) {
3080 sendfile_short_send(fsp, sendfile_read, 4, nread);
3081 }
3082 return;
3083 }
3084
3085 normal_readbraw:
3086
3087 outbuf = talloc_array(NULL, char, nread+4);
3088 if (!outbuf) {
3089 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3090 (unsigned)(nread+4)));
3091 reply_readbraw_error(sconn);
3092 return;
3093 }
3094
3095 if (nread > 0) {
3096 ret = read_file(fsp,outbuf+4,startpos,nread);
3097 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3098 if (ret < mincount)
3099 ret = 0;
3100 #else
3101 if (ret < nread)
3102 ret = 0;
3103 #endif
3104 }
3105
3106 _smb_setlen(outbuf,ret);
3107 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3108 char addr[INET6_ADDRSTRLEN];
3109 /*
3110 * Try and give an error message saying what
3111 * client failed.
3112 */
3113 DEBUG(0, ("write_data failed for client %s. "
3114 "Error %s\n",
3115 get_peer_addr(fsp->conn->sconn->sock, addr,
3116 sizeof(addr)),
3117 strerror(errno)));
3118
3119 fail_readraw();
3120 }
3121
3122 TALLOC_FREE(outbuf);
3123 }
3124
3125 /****************************************************************************
3126 Reply to a readbraw (core+ protocol).
3127 ****************************************************************************/
3128
3129 void reply_readbraw(struct smb_request *req)
3130 {
3131 connection_struct *conn = req->conn;
3132 struct smbd_server_connection *sconn = req->sconn;
3133 ssize_t maxcount,mincount;
3134 size_t nread = 0;
3135 SMB_OFF_T startpos;
3136 files_struct *fsp;
3137 struct lock_struct lock;
3138 SMB_OFF_T size = 0;
3139
3140 START_PROFILE(SMBreadbraw);
3141
3142 if (srv_is_signing_active(sconn) ||
3143 is_encrypted_packet(sconn, req->inbuf)) {
3144 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3145 "raw reads/writes are disallowed.");
3146 }
3147
3148 if (req->wct < 8) {
3149 reply_readbraw_error(sconn);
3150 END_PROFILE(SMBreadbraw);
3151 return;
3152 }
3153
3154 if (sconn->smb1.echo_handler.trusted_fde) {
3155 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3156 "'async smb echo handler = yes'\n"));
3157 reply_readbraw_error(sconn);
3158 END_PROFILE(SMBreadbraw);
3159 return;
3160 }
3161
3162 /*
3163 * Special check if an oplock break has been issued
3164 * and the readraw request croses on the wire, we must
3165 * return a zero length response here.
3166 */
3167
3168 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3169
3170 /*
3171 * We have to do a check_fsp by hand here, as
3172 * we must always return 4 zero bytes on error,
3173 * not a NTSTATUS.
3174 */
3175
3176 if (!fsp || !conn || conn != fsp->conn ||
3177 req->vuid != fsp->vuid ||
3178 fsp->is_directory || fsp->fh->fd == -1) {
3179 /*
3180 * fsp could be NULL here so use the value from the packet. JRA.
3181 */
3182 DEBUG(3,("reply_readbraw: fnum %d not valid "
3183 "- cache prime?\n",
3184 (int)SVAL(req->vwv+0, 0)));
3185 reply_readbraw_error(sconn);
3186 END_PROFILE(SMBreadbraw);
3187 return;
3188 }
3189
3190 /* Do a "by hand" version of CHECK_READ. */
3191 if (!(fsp->can_read ||
3192 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3193 (fsp->access_mask & FILE_EXECUTE)))) {
3194 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3195 (int)SVAL(req->vwv+0, 0)));
3196 reply_readbraw_error(sconn);
3197 END_PROFILE(SMBreadbraw);
3198 return;
3199 }
3200
3201 flush_write_cache(fsp, READRAW_FLUSH);
3202
3203 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3204 if(req->wct == 10) {
3205 /*
3206 * This is a large offset (64 bit) read.
3207 */
3208 #ifdef LARGE_SMB_OFF_T
3209
3210 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3211
3212 #else /* !LARGE_SMB_OFF_T */
3213
3214 /*
3215 * Ensure we haven't been sent a >32 bit offset.
3216 */
3217
3218 if(IVAL(req->vwv+8, 0) != 0) {
3219 DEBUG(0,("reply_readbraw: large offset "
3220 "(%x << 32) used and we don't support "
3221 "64 bit offsets.\n",
3222 (unsigned int)IVAL(req->vwv+8, 0) ));
3223 reply_readbraw_error(sconn);
3224 END_PROFILE(SMBreadbraw);
3225 return;
3226 }
3227
3228 #endif /* LARGE_SMB_OFF_T */
3229
3230 if(startpos < 0) {
3231 DEBUG(0,("reply_readbraw: negative 64 bit "
3232 "readraw offset (%.0f) !\n",
3233 (double)startpos ));
3234 reply_readbraw_error(sconn);
3235 END_PROFILE(SMBreadbraw);
3236 return;
3237 }
3238 }
3239
3240 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3241 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3242
3243 /* ensure we don't overrun the packet size */
3244 maxcount = MIN(65535,maxcount);
3245
3246 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3247 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3248 &lock);
3249
3250 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3251 reply_readbraw_error(sconn);
3252 END_PROFILE(SMBreadbraw);
3253 return;
3254 }
3255
3256 if (fsp_stat(fsp) == 0) {
3257 size = fsp->fsp_name->st.st_ex_size;
3258 }
3259
3260 if (startpos >= size) {
3261 nread = 0;
3262 } else {
3263 nread = MIN(maxcount,(size - startpos));
3264 }
3265
3266 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3267 if (nread < mincount)
3268 nread = 0;
3269 #endif
3270
3271 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3272 "min=%lu nread=%lu\n",
3273 fsp->fnum, (double)startpos,
3274 (unsigned long)maxcount,
3275 (unsigned long)mincount,
3276 (unsigned long)nread ) );
3277
3278 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3279
3280 DEBUG(5,("reply_readbraw finished\n"));
3281
3282 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3283
3284 END_PROFILE(SMBreadbraw);
3285 return;
3286 }
3287
3288 #undef DBGC_CLASS
3289 #define DBGC_CLASS DBGC_LOCKING
3290
3291 /****************************************************************************
3292 Reply to a lockread (core+ protocol).
3293 ****************************************************************************/
3294
3295 void reply_lockread(struct smb_request *req)
3296 {
3297 connection_struct *conn = req->conn;
3298 ssize_t nread = -1;
3299 char *data;
3300 SMB_OFF_T startpos;
3301 size_t numtoread;
3302 NTSTATUS status;
3303 files_struct *fsp;
3304 struct byte_range_lock *br_lck = NULL;
3305 char *p = NULL;
3306 struct smbd_server_connection *sconn = req->sconn;
3307
3308 START_PROFILE(SMBlockread);
3309
3310 if (req->wct < 5) {
3311 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3312 END_PROFILE(SMBlockread);
3313 return;
3314 }
3315
3316 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3317
3318 if (!check_fsp(conn, req, fsp)) {
3319 END_PROFILE(SMBlockread);
3320 return;
3321 }
3322
3323 if (!CHECK_READ(fsp,req)) {
3324 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3325 END_PROFILE(SMBlockread);
3326 return;
3327 }
3328
3329 numtoread = SVAL(req->vwv+1, 0);
3330 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3331
3332 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3333
3334 reply_outbuf(req, 5, numtoread + 3);
3335
3336 data = smb_buf(req->outbuf) + 3;
3337
3338 /*
3339 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3340 * protocol request that predates the read/write lock concept.
3341 * Thus instead of asking for a read lock here we need to ask
3342 * for a write lock. JRA.
3343 * Note that the requested lock size is unaffected by max_recv.
3344 */
3345
3346 br_lck = do_lock(req->sconn->msg_ctx,
3347 fsp,
3348 (uint64_t)req->smbpid,
3349 (uint64_t)numtoread,
3350 (uint64_t)startpos,
3351 WRITE_LOCK,
3352 WINDOWS_LOCK,
3353 False, /* Non-blocking lock. */
3354 &status,
3355 NULL,
3356 NULL);
3357 TALLOC_FREE(br_lck);
3358
3359 if (NT_STATUS_V(status)) {
3360 reply_nterror(req, status);
3361 END_PROFILE(SMBlockread);
3362 return;
3363 }
3364
3365 /*
3366 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3367 */
3368
3369 if (numtoread > sconn->smb1.negprot.max_recv) {
3370 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3371 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3372 (unsigned int)numtoread,
3373 (unsigned int)sconn->smb1.negprot.max_recv));
3374 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3375 }
3376 nread = read_file(fsp,data,startpos,numtoread);
3377
3378 if (nread < 0) {
3379 reply_nterror(req, map_nt_error_from_unix(errno));
3380 END_PROFILE(SMBlockread);
3381 return;
3382 }
3383
3384 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3385
3386 SSVAL(req->outbuf,smb_vwv0,nread);
3387 SSVAL(req->outbuf,smb_vwv5,nread+3);
3388 p = smb_buf(req->outbuf);
3389 SCVAL(p,0,0); /* pad byte. */
3390 SSVAL(p,1,nread);
3391
3392 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3393 fsp->fnum, (int)numtoread, (int)nread));
3394
3395 END_PROFILE(SMBlockread);
3396 return;
3397 }
3398
3399 #undef DBGC_CLASS
3400 #define DBGC_CLASS DBGC_ALL
3401
3402 /****************************************************************************
3403 Reply to a read.
3404 ****************************************************************************/
3405
3406 void reply_read(struct smb_request *req)
3407 {
3408 connection_struct *conn = req->conn;
3409 size_t numtoread;
3410 ssize_t nread = 0;
3411 char *data;
3412 SMB_OFF_T startpos;
3413 int outsize = 0;
3414 files_struct *fsp;
3415 struct lock_struct lock;
3416 struct smbd_server_connection *sconn = req->sconn;
3417
3418 START_PROFILE(SMBread);
3419
3420 if (req->wct < 3) {
3421 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3422 END_PROFILE(SMBread);
3423 return;
3424 }
3425
3426 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3427
3428 if (!check_fsp(conn, req, fsp)) {
3429 END_PROFILE(SMBread);
3430 return;
3431 }
3432
3433 if (!CHECK_READ(fsp,req)) {
3434 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3435 END_PROFILE(SMBread);
3436 return;
3437 }
3438
3439 numtoread = SVAL(req->vwv+1, 0);
3440 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3441
3442 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3443
3444 /*
3445 * The requested read size cannot be greater than max_recv. JRA.
3446 */
3447 if (numtoread > sconn->smb1.negprot.max_recv) {
3448 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3449 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3450 (unsigned int)numtoread,
3451 (unsigned int)sconn->smb1.negprot.max_recv));
3452 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3453 }
3454
3455 reply_outbuf(req, 5, numtoread+3);
3456
3457 data = smb_buf(req->outbuf) + 3;
3458
3459 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3460 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3461 &lock);
3462
3463 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3464 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3465 END_PROFILE(SMBread);
3466 return;
3467 }
3468
3469 if (numtoread > 0)
3470 nread = read_file(fsp,data,startpos,numtoread);
3471
3472 if (nread < 0) {
3473 reply_nterror(req, map_nt_error_from_unix(errno));
3474 goto strict_unlock;
3475 }
3476
3477 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3478
3479 SSVAL(req->outbuf,smb_vwv0,nread);
3480 SSVAL(req->outbuf,smb_vwv5,nread+3);
3481 SCVAL(smb_buf(req->outbuf),0,1);
3482 SSVAL(smb_buf(req->outbuf),1,nread);
3483
3484 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3485 fsp->fnum, (int)numtoread, (int)nread ) );
3486
3487 strict_unlock:
3488 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3489
3490 END_PROFILE(SMBread);
3491 return;
3492 }
3493
3494 /****************************************************************************
3495 Setup readX header.
3496 ****************************************************************************/
3497
3498 static int setup_readX_header(struct smb_request *req, char *outbuf,
3499 size_t smb_maxcnt)
3500 {
3501 int outsize;
3502
3503 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3504
3505 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3506
3507 SCVAL(outbuf,smb_vwv0,0xFF);
3508 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3509 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3510 SSVAL(outbuf,smb_vwv6,
3511 (smb_wct - 4) /* offset from smb header to wct */
3512 + 1 /* the wct field */
3513 + 12 * sizeof(uint16_t) /* vwv */
3514 + 2); /* the buflen field */
3515 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3516 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3517 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3518 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3519 return outsize;
3520 }
3521
3522 /****************************************************************************
3523 Reply to a read and X - possibly using sendfile.
3524 ****************************************************************************/
3525
3526 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3527 files_struct *fsp, SMB_OFF_T startpos,
3528 size_t smb_maxcnt)
3529 {
3530 ssize_t nread = -1;
3531 struct lock_struct lock;
3532 int saved_errno = 0;
3533
3534 if(fsp_stat(fsp) == -1) {
3535 reply_nterror(req, map_nt_error_from_unix(errno));
3536 return;
3537 }
3538
3539 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3540 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3541 &lock);
3542
3543 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3544 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3545 return;
3546 }
3547
3548 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3549 (startpos > fsp->fsp_name->st.st_ex_size)
3550 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3551 /*
3552 * We already know that we would do a short read, so don't
3553 * try the sendfile() path.
3554 */
3555 goto nosendfile_read;
3556 }
3557
3558 /*
3559 * We can only use sendfile on a non-chained packet
3560 * but we can use on a non-oplocked file. tridge proved this
3561 * on a train in Germany :-). JRA.
3562 */
3563
3564 if (!req_is_in_chain(req) &&
3565 !is_encrypted_packet(req->sconn, req->inbuf) &&
3566 (fsp->base_fsp == NULL) &&
3567 (fsp->wcp == NULL) &&
3568 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3569 uint8 headerbuf[smb_size + 12 * 2];
3570 DATA_BLOB header;
3571
3572 /*
3573 * Set up the packet header before send. We
3574 * assume here the sendfile will work (get the
3575 * correct amount of data).
3576 */
3577
3578 header = data_blob_const(headerbuf, sizeof(headerbuf));
3579
3580 construct_reply_common_req(req, (char *)headerbuf);
3581 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3582
3583 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3584 startpos, smb_maxcnt);
3585 if (nread == -1) {
3586 /* Returning ENOSYS means no data at all was sent.
3587 Do this as a normal read. */
3588 if (errno == ENOSYS) {
3589 goto normal_read;
3590 }
3591
3592 /*
3593 * Special hack for broken Linux with no working sendfile. If we
3594 * return EINTR we sent the header but not the rest of the data.
3595 * Fake this up by doing read/write calls.
3596 */
3597
3598 if (errno == EINTR) {
3599 /* Ensure we don't do this again. */
3600 set_use_sendfile(SNUM(conn), False);
3601 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3602 nread = fake_sendfile(fsp, startpos,
3603 smb_maxcnt);
3604 if (nread == -1) {
3605 DEBUG(0,("send_file_readX: "
3606 "fake_sendfile failed for "
3607 "file %s (%s).\n",
3608 fsp_str_dbg(fsp),
3609 strerror(errno)));
3610 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3611 }
3612 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3613 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3614 /* No outbuf here means successful sendfile. */
3615 goto strict_unlock;
3616 }
3617
3618 DEBUG(0,("send_file_readX: sendfile failed for file "
3619 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3620 strerror(errno)));
3621 exit_server_cleanly("send_file_readX sendfile failed");
3622 } else if (nread == 0) {
3623 /*
3624 * Some sendfile implementations return 0 to indicate
3625 * that there was a short read, but nothing was
3626 * actually written to the socket. In this case,
3627 * fallback to the normal read path so the header gets
3628 * the correct byte count.
3629 */
3630 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3631 "falling back to the normal read: %s\n",
3632 fsp_str_dbg(fsp)));
3633 goto normal_read;
3634 }
3635
3636 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3637 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3638
3639 /* Deal with possible short send. */
3640 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3641 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3642 }
3643 /* No outbuf here means successful sendfile. */
3644 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3645 SMB_PERFCOUNT_END(&req->pcd);
3646 goto strict_unlock;
3647 }
3648
3649 normal_read:
3650
3651 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3652 uint8 headerbuf[smb_size + 2*12];
3653
3654 construct_reply_common_req(req, (char *)headerbuf);
3655 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3656
3657 /* Send out the header. */
3658 if (write_data(req->sconn->sock, (char *)headerbuf,
3659 sizeof(headerbuf)) != sizeof(headerbuf)) {
3660
3661 char addr[INET6_ADDRSTRLEN];
3662 /*
3663 * Try and give an error message saying what
3664 * client failed.
3665 */
3666 DEBUG(0, ("write_data failed for client %s. "
3667 "Error %s\n",
3668 get_peer_addr(req->sconn->sock, addr,
3669 sizeof(addr)),
3670 strerror(errno)));
3671
3672 DEBUG(0,("send_file_readX: write_data failed for file "
3673 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3674 strerror(errno)));
3675 exit_server_cleanly("send_file_readX sendfile failed");
3676 }
3677 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3678 if (nread == -1) {
3679 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3680 "file %s (%s).\n", fsp_str_dbg(fsp),
3681 strerror(errno)));
3682 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3683 }
3684 goto strict_unlock;
3685 }
3686
3687 nosendfile_read:
3688
3689 reply_outbuf(req, 12, smb_maxcnt);
3690 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3691 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3692
3693 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3694 saved_errno = errno;
3695
3696 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3697
3698 if (nread < 0) {
3699 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3700 return;
3701 }
3702
3703 setup_readX_header(req, (char *)req->outbuf, nread);
3704
3705 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3706 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3707 return;
3708
3709 strict_unlock:
3710 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3711 TALLOC_FREE(req->outbuf);
3712 return;
3713 }
3714
3715 /****************************************************************************
3716 Reply to a read and X.
3717 ****************************************************************************/
3718
3719 void reply_read_and_X(struct smb_request *req)
3720 {
3721 struct smbd_server_connection *sconn = req->sconn;
3722 connection_struct *conn = req->conn;
3723 files_struct *fsp;
3724 SMB_OFF_T startpos;
3725 size_t smb_maxcnt;
3726 bool big_readX = False;
3727 #if 0
3728 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3729 #endif
3730
3731 START_PROFILE(SMBreadX);
3732
3733 if ((req->wct != 10) && (req->wct != 12)) {
3734 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3735 return;
3736 }
3737
3738 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3739 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3740 smb_maxcnt = SVAL(req->vwv+5, 0);
3741
3742 /* If it's an IPC, pass off the pipe handler. */
3743 if (IS_IPC(conn)) {
3744 reply_pipe_read_and_X(req);
3745 END_PROFILE(SMBreadX);
3746 return;
3747 }
3748
3749 if (!check_fsp(conn, req, fsp)) {
3750 END_PROFILE(SMBreadX);
3751 return;
3752 }
3753
3754 if (!CHECK_READ(fsp,req)) {
3755 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3756 END_PROFILE(SMBreadX);
3757 return;
3758 }
3759
3760 if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3761 (get_remote_arch() == RA_SAMBA)) {
3762 /*
3763 * This is Samba only behavior (up to Samba 3.6)!
3764 *
3765 * Windows 2008 R2 ignores the upper_size,
3766 * so we do unless unix extentions are active
3767 * or "smbclient" is talking to us.
3768 */
3769 size_t upper_size = SVAL(req->vwv+7, 0);
3770 smb_maxcnt |= (upper_size<<16);
3771 if (upper_size > 1) {
3772 /* Can't do this on a chained packet. */
3773 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3774 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3775 END_PROFILE(SMBreadX);
3776 return;
3777 }
3778 /* We currently don't do this on signed or sealed data. */
3779 if (srv_is_signing_active(req->sconn) ||
3780 is_encrypted_packet(req->sconn, req->inbuf)) {
3781 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3782 END_PROFILE(SMBreadX);
3783 return;
3784 }
3785 /* Is there room in the reply for this data ? */
3786 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3787 reply_nterror(req,
3788 NT_STATUS_INVALID_PARAMETER);
3789 END_PROFILE(SMBreadX);
3790 return;
3791 }
3792 big_readX = True;
3793 }
3794 }
3795
3796 if (req->wct == 12) {
3797 #ifdef LARGE_SMB_OFF_T
3798 /*
3799 * This is a large offset (64 bit) read.
3800 */
3801 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3802
3803 #else /* !LARGE_SMB_OFF_T */
3804
3805 /*
3806 * Ensure we haven't been sent a >32 bit offset.
3807 */
3808
3809 if(IVAL(req->vwv+10, 0) != 0) {
3810 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3811 "used and we don't support 64 bit offsets.\n",
3812 (unsigned int)IVAL(req->vwv+10, 0) ));
3813 END_PROFILE(SMBreadX);
3814 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3815 return;
3816 }
3817
3818 #endif /* LARGE_SMB_OFF_T */
3819
3820 }
3821
3822 if (!big_readX) {
3823 NTSTATUS status = schedule_aio_read_and_X(conn,
3824 req,
3825 fsp,
3826 startpos,
3827 smb_maxcnt);
3828 if (NT_STATUS_IS_OK(status)) {
3829 /* Read scheduled - we're done. */
3830 goto out;
3831 }
3832 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3833 /* Real error - report to client. */
3834 END_PROFILE(SMBreadX);
3835 reply_nterror(req, status);
3836 return;
3837 }
3838 /* NT_STATUS_RETRY - fall back to sync read. */
3839 }
3840
3841 smbd_lock_socket(req->sconn);
3842 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3843 smbd_unlock_socket(req->sconn);
3844
3845 out:
3846 END_PROFILE(SMBreadX);
3847 return;
3848 }
3849
3850 /****************************************************************************
3851 Error replies to writebraw must have smb_wct == 1. Fix this up.
3852 ****************************************************************************/
3853
3854 void error_to_writebrawerr(struct smb_request *req)
3855 {
3856 uint8 *old_outbuf = req->outbuf;
3857
3858 reply_outbuf(req, 1, 0);
3859
3860 memcpy(req->outbuf, old_outbuf, smb_size);
3861 TALLOC_FREE(old_outbuf);
3862 }
3863
3864 /****************************************************************************
3865 Read 4 bytes of a smb packet and return the smb length of the packet.
3866 Store the result in the buffer. This version of the function will
3867 never return a session keepalive (length of zero).
3868 Timeout is in milliseconds.
3869 ****************************************************************************/
3870
3871 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3872 size_t *len)
3873 {
3874 uint8_t msgtype = NBSSkeepalive;
3875
3876 while (msgtype == NBSSkeepalive) {
3877 NTSTATUS status;
3878
3879 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3880 len);
3881 if (!NT_STATUS_IS_OK(status)) {
3882 char addr[INET6_ADDRSTRLEN];
3883 /* Try and give an error message
3884 * saying what client failed. */
3885 DEBUG(0, ("read_fd_with_timeout failed for "
3886 "client %s read error = %s.\n",
3887 get_peer_addr(fd,addr,sizeof(addr)),
3888 nt_errstr(status)));
3889 return status;
3890 }
3891
3892 msgtype = CVAL(inbuf, 0);
3893 }
3894
3895 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3896 (unsigned long)len));
3897
3898 return NT_STATUS_OK;
3899 }
3900
3901 /****************************************************************************
3902 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3903 ****************************************************************************/
3904
3905 void reply_writebraw(struct smb_request *req)
3906 {
3907 connection_struct *conn = req->conn;
3908 char *buf = NULL;
3909 ssize_t nwritten=0;
3910 ssize_t total_written=0;
3911 size_t numtowrite=0;
3912 size_t tcount;
3913 SMB_OFF_T startpos;
3914 const char *data=NULL;
3915 bool write_through;
3916 files_struct *fsp;
3917 struct lock_struct lock;
3918 NTSTATUS status;
3919
3920 START_PROFILE(SMBwritebraw);
3921
3922 /*
3923 * If we ever reply with an error, it must have the SMB command
3924 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3925 * we're finished.
3926 */
3927 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3928
3929 if (srv_is_signing_active(req->sconn)) {
3930 END_PROFILE(SMBwritebraw);
3931 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3932 "raw reads/writes are disallowed.");
3933 }
3934
3935 if (req->wct < 12) {
3936 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3937 error_to_writebrawerr(req);
3938 END_PROFILE(SMBwritebraw);
3939 return;
3940 }
3941
3942 if (req->sconn->smb1.echo_handler.trusted_fde) {
3943 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3944 "'async smb echo handler = yes'\n"));
3945 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3946 error_to_writebrawerr(req);
3947 END_PROFILE(SMBwritebraw);
3948 return;
3949 }
3950
3951 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3952 if (!check_fsp(conn, req, fsp)) {
3953 error_to_writebrawerr(req);
3954 END_PROFILE(SMBwritebraw);
3955 return;
3956 }
3957
3958 if (!CHECK_WRITE(fsp)) {
3959 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3960 error_to_writebrawerr(req);
3961 END_PROFILE(SMBwritebraw);
3962 return;
3963 }
3964
3965 tcount = IVAL(req->vwv+1, 0);
3966 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3967 write_through = BITSETW(req->vwv+7,0);
3968
3969 /* We have to deal with slightly different formats depending
3970 on whether we are using the core+ or lanman1.0 protocol */
3971
3972 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3973 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
3974 data = smb_buf_const(req->inbuf);
3975 } else {
3976 numtowrite = SVAL(req->vwv+10, 0);
3977 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3978 }
3979
3980 /* Ensure we don't write bytes past the end of this packet. */
3981 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3982 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3983 error_to_writebrawerr(req);
3984 END_PROFILE(SMBwritebraw);
3985 return;
3986 }
3987
3988 if (!fsp->print_file) {
3989 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3990 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3991 &lock);
3992
3993 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3994 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3995 error_to_writebrawerr(req);
3996 END_PROFILE(SMBwritebraw);
3997 return;
3998 }
3999 }
4000
4001 if (numtowrite>0) {
4002 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4003 }
4004
4005 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4006 "wrote=%d sync=%d\n",
4007 fsp->fnum, (double)startpos, (int)numtowrite,
4008 (int)nwritten, (int)write_through));
4009
4010 if (nwritten < (ssize_t)numtowrite) {
4011 reply_nterror(req, NT_STATUS_DISK_FULL);
4012 error_to_writebrawerr(req);
4013 goto strict_unlock;
4014 }
4015
4016 total_written = nwritten;
4017
4018 /* Allocate a buffer of 64k + length. */
4019 buf = talloc_array(NULL, char, 65540);
4020 if (!buf) {
4021 reply_nterror(req, NT_STATUS_NO_MEMORY);
4022 error_to_writebrawerr(req);
4023 goto strict_unlock;
4024 }
4025
4026 /* Return a SMBwritebraw message to the redirector to tell
4027 * it to send more bytes */
4028
4029 memcpy(buf, req->inbuf, smb_size);
4030 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4031 SCVAL(buf,smb_com,SMBwritebraw);
4032 SSVALS(buf,smb_vwv0,0xFFFF);
4033 show_msg(buf);
4034 if (!srv_send_smb(req->sconn,
4035 buf,
4036 false, 0, /* no signing */
4037 IS_CONN_ENCRYPTED(conn),
4038 &req->pcd)) {
4039 exit_server_cleanly("reply_writebraw: srv_send_smb "
4040 "failed.");
4041 }
4042
4043 /* Now read the raw data into the buffer and write it */
4044 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4045 &numtowrite);
4046 if (!NT_STATUS_IS_OK(status)) {
4047 exit_server_cleanly("secondary writebraw failed");
4048 }
4049
4050 /* Set up outbuf to return the correct size */
4051 reply_outbuf(req, 1, 0);
4052
4053 if (numtowrite != 0) {
4054
4055 if (numtowrite > 0xFFFF) {
4056 DEBUG(0,("reply_writebraw: Oversize secondary write "
4057 "raw requested (%u). Terminating\n",
4058 (unsigned int)numtowrite ));
4059 exit_server_cleanly("secondary writebraw failed");
4060 }
4061
4062 if (tcount > nwritten+numtowrite) {
4063 DEBUG(3,("reply_writebraw: Client overestimated the "
4064 "write %d %d %d\n",
4065 (int)tcount,(int)nwritten,(int)numtowrite));
4066 }
4067
4068 status = read_data(req->sconn->sock, buf+4, numtowrite);
4069
4070 if (!NT_STATUS_IS_OK(status)) {
4071 char addr[INET6_ADDRSTRLEN];
4072 /* Try and give an error message
4073 * saying what client failed. */
4074 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4075 "raw read failed (%s) for client %s. "
4076 "Terminating\n", nt_errstr(status),
4077 get_peer_addr(req->sconn->sock, addr,
4078 sizeof(addr))));
4079 exit_server_cleanly("secondary writebraw failed");
4080 }
4081
4082 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4083 if (nwritten == -1) {
4084 TALLOC_FREE(buf);
4085 reply_nterror(req, map_nt_error_from_unix(errno));
4086 error_to_writebrawerr(req);
4087 goto strict_unlock;
4088 }
4089
4090 if (nwritten < (ssize_t)numtowrite) {
4091 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4092 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4093 }
4094
4095 if (nwritten > 0) {
4096 total_written += nwritten;
4097 }
4098 }
4099
4100 TALLOC_FREE(buf);
4101 SSVAL(req->outbuf,smb_vwv0,total_written);
4102
4103 status = sync_file(conn, fsp, write_through);
4104 if (!NT_STATUS_IS_OK(status)) {
4105 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4106 fsp_str_dbg(fsp), nt_errstr(status)));
4107 reply_nterror(req, status);
4108 error_to_writebrawerr(req);
4109 goto strict_unlock;
4110 }
4111
4112 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4113 "wrote=%d\n",
4114 fsp->fnum, (double)startpos, (int)numtowrite,
4115 (int)total_written));
4116
4117 if (!fsp->print_file) {
4118 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4119 }
4120
4121 /* We won't return a status if write through is not selected - this
4122 * follows what WfWg does */
4123 END_PROFILE(SMBwritebraw);
4124
4125 if (!write_through && total_written==tcount) {
4126
4127 #if RABBIT_PELLET_FIX
4128 /*
4129 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4130 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4131 * JRA.
4132 */
4133 if (!send_keepalive(req->sconn->sock)) {
4134 exit_server_cleanly("reply_writebraw: send of "
4135 "keepalive failed");
4136 }
4137 #endif
4138 TALLOC_FREE(req->outbuf);
4139 }
4140 return;
4141
4142 strict_unlock:
4143 if (!fsp->print_file) {
4144 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4145 }
4146
4147 END_PROFILE(SMBwritebraw);
4148 return;
4149 }
4150
4151 #undef DBGC_CLASS
4152 #define DBGC_CLASS DBGC_LOCKING
4153
4154 /****************************************************************************
4155 Reply to a writeunlock (core+).
4156 ****************************************************************************/
4157
4158 void reply_writeunlock(struct smb_request *req)
4159 {
4160 connection_struct *conn = req->conn;
4161 ssize_t nwritten = -1;
4162 size_t numtowrite;
4163 SMB_OFF_T startpos;
4164 const char *data;
4165 NTSTATUS status = NT_STATUS_OK;
4166 files_struct *fsp;
4167 struct lock_struct lock;
4168 int saved_errno = 0;
4169
4170 START_PROFILE(SMBwriteunlock);
4171
4172 if (req->wct < 5) {
4173 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4174 END_PROFILE(SMBwriteunlock);
4175 return;
4176 }
4177
4178 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4179
4180 if (!check_fsp(conn, req, fsp)) {
4181 END_PROFILE(SMBwriteunlock);
4182 return;
4183 }
4184
4185 if (!CHECK_WRITE(fsp)) {
4186 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4187 END_PROFILE(SMBwriteunlock);
4188 return;
4189 }
4190
4191 numtowrite = SVAL(req->vwv+1, 0);
4192 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4193 data = (const char *)req->buf + 3;
4194
4195 if (!fsp->print_file && numtowrite > 0) {
4196 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4197 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4198 &lock);
4199
4200 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4201 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4202 END_PROFILE(SMBwriteunlock);
4203 return;
4204 }
4205 }
4206
4207 /* The special X/Open SMB protocol handling of
4208 zero length writes is *NOT* done for
4209 this call */
4210 if(numtowrite == 0) {
4211 nwritten = 0;
4212 } else {
4213 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4214 saved_errno = errno;
4215 }
4216
4217 status = sync_file(conn, fsp, False /* write through */);
4218 if (!NT_STATUS_IS_OK(status)) {
4219 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4220 fsp_str_dbg(fsp), nt_errstr(status)));
4221 reply_nterror(req, status);
4222 goto strict_unlock;
4223 }
4224
4225 if(nwritten < 0) {
4226 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4227 goto strict_unlock;
4228 }
4229
4230 if((nwritten < numtowrite) && (numtowrite != 0)) {
4231 reply_nterror(req, NT_STATUS_DISK_FULL);
4232 goto strict_unlock;
4233 }
4234
4235 if (numtowrite && !fsp->print_file) {
4236 status = do_unlock(req->sconn->msg_ctx,
4237 fsp,
4238 (uint64_t)req->smbpid,
4239 (uint64_t)numtowrite,
4240 (uint64_t)startpos,
4241 WINDOWS_LOCK);
4242
4243 if (NT_STATUS_V(status)) {
4244 reply_nterror(req, status);
4245 goto strict_unlock;
4246 }
4247 }
4248
4249 reply_outbuf(req, 1, 0);
4250
4251 SSVAL(req->outbuf,smb_vwv0,nwritten);
4252
4253 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4254 fsp->fnum, (int)numtowrite, (int)nwritten));
4255
4256 strict_unlock:
4257 if (numtowrite && !fsp->print_file) {
4258 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4259 }
4260
4261 END_PROFILE(SMBwriteunlock);
4262 return;
4263 }
4264
4265 #undef DBGC_CLASS
4266 #define DBGC_CLASS DBGC_ALL
4267
4268 /****************************************************************************
4269 Reply to a write.
4270 ****************************************************************************/
4271
4272 void reply_write(struct smb_request *req)
4273 {
4274 connection_struct *conn = req->conn;
4275 size_t numtowrite;
4276 ssize_t nwritten = -1;
4277 SMB_OFF_T startpos;
4278 const char *data;
4279 files_struct *fsp;
4280 struct lock_struct lock;
4281 NTSTATUS status;
4282 int saved_errno = 0;
4283
4284 START_PROFILE(SMBwrite);
4285
4286 if (req->wct < 5) {
4287 END_PROFILE(SMBwrite);
4288 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4289 return;
4290 }
4291
4292 /* If it's an IPC, pass off the pipe handler. */
4293 if (IS_IPC(conn)) {
4294 reply_pipe_write(req);
4295 END_PROFILE(SMBwrite);
4296 return;
4297 }
4298
4299 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4300
4301 if (!check_fsp(conn, req, fsp)) {
4302 END_PROFILE(SMBwrite);
4303 return;
4304 }
4305
4306 if (!CHECK_WRITE(fsp)) {
4307 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4308 END_PROFILE(SMBwrite);
4309 return;
4310 }
4311
4312 numtowrite = SVAL(req->vwv+1, 0);
4313 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4314 data = (const char *)req->buf + 3;
4315
4316 if (!fsp->print_file) {
4317 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4318 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4319 &lock);
4320
4321 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4322 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4323 END_PROFILE(SMBwrite);
4324 return;
4325 }
4326 }
4327
4328 /*
4329 * X/Open SMB protocol says that if smb_vwv1 is
4330 * zero then the file size should be extended or
4331 * truncated to the size given in smb_vwv[2-3].
4332 */
4333
4334 if(numtowrite == 0) {
4335 /*
4336 * This is actually an allocate call, and set EOF. JRA.
4337 */
4338 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4339 if (nwritten < 0) {
4340 reply_nterror(req, NT_STATUS_DISK_FULL);
4341 goto strict_unlock;
4342 }
4343 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4344 if (nwritten < 0) {
4345 reply_nterror(req, NT_STATUS_DISK_FULL);
4346 goto strict_unlock;
4347 }
4348 trigger_write_time_update_immediate(fsp);
4349 } else {
4350 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4351 }
4352
4353 status = sync_file(conn, fsp, False);
4354 if (!NT_STATUS_IS_OK(status)) {
4355 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4356 fsp_str_dbg(fsp), nt_errstr(status)));
4357 reply_nterror(req, status);
4358 goto strict_unlock;
4359 }
4360
4361 if(nwritten < 0) {
4362 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4363 goto strict_unlock;
4364 }
4365
4366 if((nwritten == 0) && (numtowrite != 0)) {
4367 reply_nterror(req, NT_STATUS_DISK_FULL);
4368 goto strict_unlock;
4369 }
4370
4371 reply_outbuf(req, 1, 0);
4372
4373 SSVAL(req->outbuf,smb_vwv0,nwritten);
4374
4375 if (nwritten < (ssize_t)numtowrite) {
4376 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4377 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4378 }
4379
4380 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4381
4382 strict_unlock:
4383 if (!fsp->print_file) {
4384 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4385 }
4386
4387 END_PROFILE(SMBwrite);
4388 return;
4389 }
4390
4391 /****************************************************************************
4392 Ensure a buffer is a valid writeX for recvfile purposes.
4393 ****************************************************************************/
4394
4395 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4396 (2*14) + /* word count (including bcc) */ \
4397 1 /* pad byte */)
4398
4399 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4400 const uint8_t *inbuf)
4401 {
4402 size_t numtowrite;
4403 connection_struct *conn = NULL;
4404 unsigned int doff = 0;
4405 size_t len = smb_len_large(inbuf);
4406
4407 if (is_encrypted_packet(sconn, inbuf)) {
4408 /* Can't do this on encrypted
4409 * connections. */
4410 return false;
4411 }
4412
4413 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4414 return false;
4415 }
4416
4417 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4418 CVAL(inbuf,smb_wct) != 14) {
4419 DEBUG(10,("is_valid_writeX_buffer: chained or "
4420 "invalid word length.\n"));
4421 return false;
4422 }
4423
4424 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4425 if (conn == NULL) {
4426 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4427 return false;
4428 }
4429 if (IS_IPC(conn)) {
4430 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4431 return false;
4432 }
4433 if (IS_PRINT(conn)) {
4434 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4435 return false;
4436 }
4437 doff = SVAL(inbuf,smb_vwv11);
4438
4439 numtowrite = SVAL(inbuf,smb_vwv10);
4440
4441 if (len > doff && len - doff > 0xFFFF) {
4442 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4443 }
4444
4445 if (numtowrite == 0) {
4446 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4447 return false;
4448 }
4449
4450 /* Ensure the sizes match up. */
4451 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4452 /* no pad byte...old smbclient :-( */
4453 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4454 (unsigned int)doff,
4455 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4456 return false;
4457 }
4458
4459 if (len - doff != numtowrite) {
4460 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4461 "len = %u, doff = %u, numtowrite = %u\n",
4462 (unsigned int)len,
4463 (unsigned int)doff,
4464 (unsigned int)numtowrite ));
4465 return false;
4466 }
4467
4468 DEBUG(10,("is_valid_writeX_buffer: true "
4469 "len = %u, doff = %u, numtowrite = %u\n",
4470 (unsigned int)len,
4471 (unsigned int)doff,
4472 (unsigned int)numtowrite ));
4473
4474 return true;
4475 }
4476
4477 /****************************************************************************
4478 Reply to a write and X.
4479 ****************************************************************************/
4480
4481 void reply_write_and_X(struct smb_request *req)
4482 {
4483 connection_struct *conn = req->conn;
4484 files_struct *fsp;
4485 struct lock_struct lock;
4486 SMB_OFF_T startpos;
4487 size_t numtowrite;
4488 bool write_through;
4489 ssize_t nwritten;
4490 unsigned int smb_doff;
4491 unsigned int smblen;
4492 const char *data;
4493 NTSTATUS status;
4494 int saved_errno = 0;
4495
4496 START_PROFILE(SMBwriteX);
4497
4498 if ((req->wct != 12) && (req->wct != 14)) {
4499 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4500 goto out;
4501 }
4502
4503 numtowrite = SVAL(req->vwv+10, 0);
4504 smb_doff = SVAL(req->vwv+11, 0);
4505 smblen = smb_len(req->inbuf);
4506
4507 if (req->unread_bytes > 0xFFFF ||
4508 (smblen > smb_doff &&
4509 smblen - smb_doff > 0xFFFF)) {
4510 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4511 }
4512
4513 if (req->unread_bytes) {
4514 /* Can't do a recvfile write on IPC$ */
4515 if (IS_IPC(conn)) {
4516 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4517 goto out;
4518 }
4519 if (numtowrite != req->unread_bytes) {
4520 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4521 goto out;
4522 }
4523 } else {
4524 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4525 smb_doff + numtowrite > smblen) {
4526 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4527 goto out;
4528 }
4529 }
4530
4531 /* If it's an IPC, pass off the pipe handler. */
4532 if (IS_IPC(conn)) {
4533 if (req->unread_bytes) {
4534 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4535 goto out;
4536 }
4537 reply_pipe_write_and_X(req);
4538 goto out;
4539 }
4540
4541 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4542 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4543 write_through = BITSETW(req->vwv+7,0);
4544
4545 if (!check_fsp(conn, req, fsp)) {
4546 goto out;
4547 }
4548
4549 if (!CHECK_WRITE(fsp)) {
4550 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4551 goto out;
4552 }
4553
4554 data = smb_base(req->inbuf) + smb_doff;
4555
4556 if(req->wct == 14) {
4557 #ifdef LARGE_SMB_OFF_T
4558 /*
4559 * This is a large offset (64 bit) write.
4560 */
4561 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4562
4563 #else /* !LARGE_SMB_OFF_T */
4564
4565 /*
4566 * Ensure we haven't been sent a >32 bit offset.
4567 */
4568
4569 if(IVAL(req->vwv+12, 0) != 0) {
4570 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4571 "used and we don't support 64 bit offsets.\n",
4572 (unsigned int)IVAL(req->vwv+12, 0) ));
4573 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4574 goto out;
4575 }
4576
4577 #endif /* LARGE_SMB_OFF_T */
4578 }
4579
4580 /* X/Open SMB protocol says that, unlike SMBwrite
4581 if the length is zero then NO truncation is
4582 done, just a write of zero. To truncate a file,
4583 use SMBwrite. */
4584
4585 if(numtowrite == 0) {
4586 nwritten = 0;
4587 } else {
4588 if (req->unread_bytes == 0) {
4589 status = schedule_aio_write_and_X(conn,
4590 req,
4591 fsp,
4592 data,
4593 startpos,
4594 numtowrite);
4595
4596 if (NT_STATUS_IS_OK(status)) {
4597 /* write scheduled - we're done. */
4598 goto out;
4599 }
4600 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4601 /* Real error - report to client. */
4602 reply_nterror(req, status);
4603 goto out;
4604 }
4605 /* NT_STATUS_RETRY - fall through to sync write. */
4606 }
4607
4608 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4609 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4610 &lock);
4611
4612 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4613 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4614 goto out;
4615 }
4616
4617 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4618 saved_errno = errno;
4619
4620 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4621 }
4622
4623 if(nwritten < 0) {
4624 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4625 goto out;
4626 }
4627
4628 if((nwritten == 0) && (numtowrite != 0)) {
4629 reply_nterror(req, NT_STATUS_DISK_FULL);
4630 goto out;
4631 }
4632
4633 reply_outbuf(req, 6, 0);
4634 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4635 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4636 SSVAL(req->outbuf,smb_vwv2,nwritten);
4637 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4638
4639 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4640 fsp->fnum, (int)numtowrite, (int)nwritten));
4641
4642 status = sync_file(conn, fsp, write_through);
4643 if (!NT_STATUS_IS_OK(status)) {
4644 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4645 fsp_str_dbg(fsp), nt_errstr(status)));
4646 reply_nterror(req, status);
4647 goto out;
4648 }
4649
4650 END_PROFILE(SMBwriteX);
4651 return;
4652
4653 out:
4654 if (req->unread_bytes) {
4655 /* writeX failed. drain socket. */
4656 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4657 req->unread_bytes) {
4658 smb_panic("failed to drain pending bytes");
4659 }
4660 req->unread_bytes = 0;
4661 }
4662
4663 END_PROFILE(SMBwriteX);
4664 return;
4665 }
4666
4667 /****************************************************************************
4668 Reply to a lseek.
4669 ****************************************************************************/
4670
4671 void reply_lseek(struct smb_request *req)
4672 {
4673 connection_struct *conn = req->conn;
4674 SMB_OFF_T startpos;
4675 SMB_OFF_T res= -1;
4676 int mode,umode;
4677 files_struct *fsp;
4678
4679 START_PROFILE(SMBlseek);
4680
4681 if (req->wct < 4) {
4682 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4683 END_PROFILE(SMBlseek);
4684 return;
4685 }
4686
4687 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4688
4689 if (!check_fsp(conn, req, fsp)) {
4690 return;
4691 }
4692
4693 flush_write_cache(fsp, SEEK_FLUSH);
4694
4695 mode = SVAL(req->vwv+1, 0) & 3;
4696 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4697 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4698
4699 switch (mode) {
4700 case 0:
4701 umode = SEEK_SET;
4702 res = startpos;
4703 break;
4704 case 1:
4705 umode = SEEK_CUR;
4706 res = fsp->fh->pos + startpos;
4707 break;
4708 case 2:
4709 umode = SEEK_END;
4710 break;
4711 default:
4712 umode = SEEK_SET;
4713 res = startpos;
4714 break;
4715 }
4716
4717 if (umode == SEEK_END) {
4718 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4719 if(errno == EINVAL) {
4720 SMB_OFF_T current_pos = startpos;
4721
4722 if(fsp_stat(fsp) == -1) {
4723 reply_nterror(req,
4724 map_nt_error_from_unix(errno));
4725 END_PROFILE(SMBlseek);
4726 return;
4727 }
4728
4729 current_pos += fsp->fsp_name->st.st_ex_size;
4730 if(current_pos < 0)
4731 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4732 }
4733 }
4734
4735 if(res == -1) {
4736 reply_nterror(req, map_nt_error_from_unix(errno));
4737 END_PROFILE(SMBlseek);
4738 return;
4739 }
4740 }
4741
4742 fsp->fh->pos = res;
4743
4744 reply_outbuf(req, 2, 0);
4745 SIVAL(req->outbuf,smb_vwv0,res);
4746
4747 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4748 fsp->fnum, (double)startpos, (double)res, mode));
4749
4750 END_PROFILE(SMBlseek);
4751 return;
4752 }
4753
4754 /****************************************************************************
4755 Reply to a flush.
4756 ****************************************************************************/
4757
4758 void reply_flush(struct smb_request *req)
4759 {
4760 connection_struct *conn = req->conn;
4761 uint16 fnum;
4762 files_struct *fsp;
4763
4764 START_PROFILE(SMBflush);
4765
4766 if (req->wct < 1) {
4767 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4768 return;
4769 }
4770
4771 fnum = SVAL(req->vwv+0, 0);
4772 fsp = file_fsp(req, fnum);
4773
4774 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4775 return;
4776 }
4777
4778 if (!fsp) {
4779 file_sync_all(conn);
4780 } else {
4781 NTSTATUS status = sync_file(conn, fsp, True);
4782 if (!NT_STATUS_IS_OK(status)) {
4783 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4784 fsp_str_dbg(fsp), nt_errstr(status)));
4785 reply_nterror(req, status);
4786 END_PROFILE(SMBflush);
4787 return;
4788 }
4789 }
4790
4791 reply_outbuf(req, 0, 0);
4792
4793 DEBUG(3,("flush\n"));
4794 END_PROFILE(SMBflush);
4795 return;
4796 }
4797
4798 /****************************************************************************
4799 Reply to a exit.
4800 conn POINTER CAN BE NULL HERE !
4801 ****************************************************************************/
4802
4803 void reply_exit(struct smb_request *req)
4804 {
4805 START_PROFILE(SMBexit);
4806
4807 file_close_pid(req->sconn, req->smbpid, req->vuid);
4808
4809 reply_outbuf(req, 0, 0);
4810
4811 DEBUG(3,("exit\n"));
4812
4813 END_PROFILE(SMBexit);
4814 return;
4815 }
4816
4817 /****************************************************************************
4818 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4819 ****************************************************************************/
4820
4821 void reply_close(struct smb_request *req)
4822 {
4823 connection_struct *conn = req->conn;
4824 NTSTATUS status = NT_STATUS_OK;
4825 files_struct *fsp = NULL;
4826 START_PROFILE(SMBclose);
4827
4828 if (req->wct < 3) {
4829 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4830 END_PROFILE(SMBclose);
4831 return;
4832 }
4833
4834 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4835
4836 /*
4837 * We can only use check_fsp if we know it's not a directory.
4838 */
4839
4840 if (!check_fsp_open(conn, req, fsp)) {
4841 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4842 END_PROFILE(SMBclose);
4843 return;
4844 }
4845
4846 if(fsp->is_directory) {
4847 /*
4848 * Special case - close NT SMB directory handle.
4849 */
4850 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4851 status = close_file(req, fsp, NORMAL_CLOSE);
4852 } else {
4853 time_t t;
4854 /*
4855 * Close ordinary file.
4856 */
4857
4858 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4859 fsp->fh->fd, fsp->fnum,
4860 conn->num_files_open));
4861
4862 /*
4863 * Take care of any time sent in the close.
4864 */
4865
4866 t = srv_make_unix_date3(req->vwv+1);
4867 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4868
4869 /*
4870 * close_file() returns the unix errno if an error
4871 * was detected on close - normally this is due to
4872 * a disk full error. If not then it was probably an I/O error.
4873 */
4874
4875 status = close_file(req, fsp, NORMAL_CLOSE);
4876 }
4877
4878 if (!NT_STATUS_IS_OK(status)) {
4879 reply_nterror(req, status);
4880 END_PROFILE(SMBclose);
4881 return;
4882 }
4883
4884 reply_outbuf(req, 0, 0);
4885 END_PROFILE(SMBclose);
4886 return;
4887 }
4888
4889 /****************************************************************************
4890 Reply to a writeclose (Core+ protocol).
4891 ****************************************************************************/
4892
4893 void reply_writeclose(struct smb_request *req)
4894 {
4895 connection_struct *conn = req->conn;
4896 size_t numtowrite;
4897 ssize_t nwritten = -1;
4898 NTSTATUS close_status = NT_STATUS_OK;
4899 SMB_OFF_T startpos;
4900 const char *data;
4901 struct timespec mtime;
4902 files_struct *fsp;
4903 struct lock_struct lock;
4904
4905 START_PROFILE(SMBwriteclose);
4906
4907 if (req->wct < 6) {
4908 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4909 END_PROFILE(SMBwriteclose);
4910 return;
4911 }
4912
4913 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4914
4915 if (!check_fsp(conn, req, fsp)) {
4916 END_PROFILE(SMBwriteclose);
4917 return;
4918 }
4919 if (!CHECK_WRITE(fsp)) {
4920 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4921 END_PROFILE(SMBwriteclose);
4922 return;
4923 }
4924
4925 numtowrite = SVAL(req->vwv+1, 0);
4926 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4927 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4928 data = (const char *)req->buf + 1;
4929
4930 if (!fsp->print_file) {
4931 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4932 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4933 &lock);
4934
4935 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4936 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4937 END_PROFILE(SMBwriteclose);
4938 return;
4939 }
4940 }
4941
4942 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4943
4944 set_close_write_time(fsp, mtime);
4945
4946 /*
4947 * More insanity. W2K only closes the file if writelen > 0.
4948 * JRA.
4949 */
4950
4951 if (numtowrite) {
4952 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4953 "file %s\n", fsp_str_dbg(fsp)));
4954 close_status = close_file(req, fsp, NORMAL_CLOSE);
4955 }
4956
4957 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4958 fsp->fnum, (int)numtowrite, (int)nwritten,
4959 conn->num_files_open));
4960
4961 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4962 reply_nterror(req, NT_STATUS_DISK_FULL);
4963 goto strict_unlock;
4964 }
4965
4966 if(!NT_STATUS_IS_OK(close_status)) {
4967 reply_nterror(req, close_status);
4968 goto strict_unlock;
4969 }
4970
4971 reply_outbuf(req, 1, 0);
4972
4973 SSVAL(req->outbuf,smb_vwv0,nwritten);
4974
4975 strict_unlock:
4976 if (numtowrite && !fsp->print_file) {
4977 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4978 }
4979
4980 END_PROFILE(SMBwriteclose);
4981 return;
4982 }
4983
4984 #undef DBGC_CLASS
4985 #define DBGC_CLASS DBGC_LOCKING
4986
4987 /****************************************************************************
4988 Reply to a lock.
4989 ****************************************************************************/
4990
4991 void reply_lock(struct smb_request *req)
4992 {
4993 connection_struct *conn = req->conn;
4994 uint64_t count,offset;
4995 NTSTATUS status;
4996 files_struct *fsp;
4997 struct byte_range_lock *br_lck = NULL;
4998
4999 START_PROFILE(SMBlock);
5000
5001 if (req->wct < 5) {
5002 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5003 END_PROFILE(SMBlock);
5004 return;
5005 }
5006
5007 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5008
5009 if (!check_fsp(conn, req, fsp)) {
5010 END_PROFILE(SMBlock);
5011 return;
5012 }
5013
5014 count = (uint64_t)IVAL(req->vwv+1, 0);
5015 offset = (uint64_t)IVAL(req->vwv+3, 0);
5016
5017 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5018 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5019
5020 br_lck = do_lock(req->sconn->msg_ctx,
5021 fsp,
5022 (uint64_t)req->smbpid,
5023 count,
5024 offset,
5025 WRITE_LOCK,
5026 WINDOWS_LOCK,
5027 False, /* Non-blocking lock. */
5028 &status,
5029 NULL,
5030 NULL);
5031
5032 TALLOC_FREE(br_lck);
5033
5034 if (NT_STATUS_V(status)) {
5035 reply_nterror(req, status);
5036 END_PROFILE(SMBlock);
5037 return;
5038 }
5039
5040 reply_outbuf(req, 0, 0);
5041
5042 END_PROFILE(SMBlock);
5043 return;
5044 }
5045
5046 /****************************************************************************
5047 Reply to a unlock.
5048 ****************************************************************************/
5049
5050 void reply_unlock(struct smb_request *req)
5051 {
5052 connection_struct *conn = req->conn;
5053 uint64_t count,offset;
5054 NTSTATUS status;
5055 files_struct *fsp;
5056
5057 START_PROFILE(SMBunlock);
5058
5059 if (req->wct < 5) {
5060 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5061 END_PROFILE(SMBunlock);
5062 return;
5063 }
5064
5065 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5066
5067 if (!check_fsp(conn, req, fsp)) {
5068 END_PROFILE(SMBunlock);
5069 return;
5070 }
5071
5072 count = (uint64_t)IVAL(req->vwv+1, 0);
5073 offset = (uint64_t)IVAL(req->vwv+3, 0);
5074
5075 status = do_unlock(req->sconn->msg_ctx,
5076 fsp,
5077 (uint64_t)req->smbpid,
5078 count,
5079 offset,
5080 WINDOWS_LOCK);
5081
5082 if (NT_STATUS_V(status)) {
5083 reply_nterror(req, status);
5084 END_PROFILE(SMBunlock);
5085 return;
5086 }
5087
5088 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5089 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5090
5091 reply_outbuf(req, 0, 0);
5092
5093 END_PROFILE(SMBunlock);
5094 return;
5095 }
5096
5097 #undef DBGC_CLASS
5098 #define DBGC_CLASS DBGC_ALL
5099
5100 /****************************************************************************
5101 Reply to a tdis.
5102 conn POINTER CAN BE NULL HERE !
5103 ****************************************************************************/
5104
5105 void reply_tdis(struct smb_request *req)
5106 {
5107 connection_struct *conn = req->conn;
5108 START_PROFILE(SMBtdis);
5109
5110 if (!conn) {
5111 DEBUG(4,("Invalid connection in tdis\n"));
5112 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5113 END_PROFILE(SMBtdis);
5114 return;
5115 }
5116
5117 conn->used = False;
5118
5119 close_cnum(conn,req->vuid);
5120 req->conn = NULL;
5121
5122 reply_outbuf(req, 0, 0);
5123 END_PROFILE(SMBtdis);
5124 return;
5125 }
5126
5127 /****************************************************************************
5128 Reply to a echo.
5129 conn POINTER CAN BE NULL HERE !
5130 ****************************************************************************/
5131
5132 void reply_echo(struct smb_request *req)
5133 {
5134 connection_struct *conn = req->conn;
5135 struct smb_perfcount_data local_pcd;
5136 struct smb_perfcount_data *cur_pcd;
5137 int smb_reverb;
5138 int seq_num;
5139
5140 START_PROFILE(SMBecho);
5141
5142 smb_init_perfcount_data(&local_pcd);
5143
5144 if (req->wct < 1) {
5145 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5146 END_PROFILE(SMBecho);
5147 return;
5148 }
5149
5150 smb_reverb = SVAL(req->vwv+0, 0);
5151
5152 reply_outbuf(req, 1, req->buflen);
5153
5154 /* copy any incoming data back out */
5155 if (req->buflen > 0) {
5156 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5157 }
5158
5159 if (smb_reverb > 100) {
5160 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5161 smb_reverb = 100;
5162 }
5163
5164 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5165
5166 /* this makes sure we catch the request pcd */
5167 if (seq_num == smb_reverb) {
5168 cur_pcd = &req->pcd;
5169 } else {
5170 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5171 cur_pcd = &local_pcd;
5172 }
5173
5174 SSVAL(req->outbuf,smb_vwv0,seq_num);
5175
5176 show_msg((char *)req->outbuf);
5177 if (!srv_send_smb(req->sconn,
5178 (char *)req->outbuf,
5179 true, req->seqnum+1,
5180 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5181 cur_pcd))
5182 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5183 }
5184
5185 DEBUG(3,("echo %d times\n", smb_reverb));
5186
5187 TALLOC_FREE(req->outbuf);
5188
5189 END_PROFILE(SMBecho);
5190 return;
5191 }
5192
5193 /****************************************************************************
5194 Reply to a printopen.
5195 ****************************************************************************/
5196
5197 void reply_printopen(struct smb_request *req)
5198 {
5199 connection_struct *conn = req->conn;
5200 files_struct *fsp;
5201 NTSTATUS status;
5202
5203 START_PROFILE(SMBsplopen);
5204
5205 if (req->wct < 2) {
5206 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5207 END_PROFILE(SMBsplopen);
5208 return;
5209 }
5210
5211 if (!CAN_PRINT(conn)) {
5212 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5213 END_PROFILE(SMBsplopen);
5214 return;
5215 }
5216
5217 status = file_new(req, conn, &fsp);
5218 if(!NT_STATUS_IS_OK(status)) {
5219 reply_nterror(req, status);
5220 END_PROFILE(SMBsplopen);
5221 return;
5222 }
5223
5224 /* Open for exclusive use, write only. */
5225 status = print_spool_open(fsp, NULL, req->vuid);
5226
5227 if (!NT_STATUS_IS_OK(status)) {
5228 file_free(req, fsp);
5229 reply_nterror(req, status);
5230 END_PROFILE(SMBsplopen);
5231 return;
5232 }
5233
5234 reply_outbuf(req, 1, 0);
5235 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5236
5237 DEBUG(3,("openprint fd=%d fnum=%d\n",
5238 fsp->fh->fd, fsp->fnum));
5239
5240 END_PROFILE(SMBsplopen);
5241 return;
5242 }
5243
5244 /****************************************************************************
5245 Reply to a printclose.
5246 ****************************************************************************/
5247
5248 void reply_printclose(struct smb_request *req)
5249 {
5250 connection_struct *conn = req->conn;
5251 files_struct *fsp;
5252 NTSTATUS status;
5253
5254 START_PROFILE(SMBsplclose);
5255
5256 if (req->wct < 1) {
5257 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5258 END_PROFILE(SMBsplclose);
5259 return;
5260 }
5261
5262 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5263
5264 if (!check_fsp(conn, req, fsp)) {
5265 END_PROFILE(SMBsplclose);
5266 return;
5267 }
5268
5269 if (!CAN_PRINT(conn)) {
5270 reply_force_doserror(req, ERRSRV, ERRerror);
5271 END_PROFILE(SMBsplclose);
5272 return;
5273 }
5274
5275 DEBUG(3,("printclose fd=%d fnum=%d\n",
5276 fsp->fh->fd,fsp->fnum));
5277
5278 status = close_file(req, fsp, NORMAL_CLOSE);
5279
5280 if(!NT_STATUS_IS_OK(status)) {
5281 reply_nterror(req, status);
5282 END_PROFILE(SMBsplclose);
5283 return;
5284 }
5285
5286 reply_outbuf(req, 0, 0);
5287
5288 END_PROFILE(SMBsplclose);
5289 return;
5290 }
5291
5292 /****************************************************************************
5293 Reply to a printqueue.
5294 ****************************************************************************/
5295
5296 void reply_printqueue(struct smb_request *req)
5297 {
5298 connection_struct *conn = req->conn;
5299 int max_count;
5300 int start_index;
5301
5302 START_PROFILE(SMBsplretq);
5303
5304 if (req->wct < 2) {
5305 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5306 END_PROFILE(SMBsplretq);
5307 return;
5308 }
5309
5310 max_count = SVAL(req->vwv+0, 0);
5311 start_index = SVAL(req->vwv+1, 0);
5312
5313 /* we used to allow the client to get the cnum wrong, but that
5314 is really quite gross and only worked when there was only
5315 one printer - I think we should now only accept it if they
5316 get it right (tridge) */
5317 if (!CAN_PRINT(conn)) {
5318 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5319 END_PROFILE(SMBsplretq);
5320 return;
5321 }
5322
5323 reply_outbuf(req, 2, 3);
5324 SSVAL(req->outbuf,smb_vwv0,0);
5325 SSVAL(req->outbuf,smb_vwv1,0);
5326 SCVAL(smb_buf(req->outbuf),0,1);
5327 SSVAL(smb_buf(req->outbuf),1,0);
5328
5329 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5330 start_index, max_count));
5331
5332 {
5333 TALLOC_CTX *mem_ctx = talloc_tos();
5334 NTSTATUS status;
5335 WERROR werr;
5336 const char *sharename = lp_servicename(SNUM(conn));
5337 struct rpc_pipe_client *cli = NULL;
5338 struct dcerpc_binding_handle *b = NULL;
5339 struct policy_handle handle;
5340 struct spoolss_DevmodeContainer devmode_ctr;
5341 union spoolss_JobInfo *info;
5342 uint32_t count;
5343 uint32_t num_to_get;
5344 uint32_t first;
5345 uint32_t i;
5346
5347 ZERO_STRUCT(handle);
5348
5349 status = rpc_pipe_open_interface(conn,
5350 &ndr_table_spoolss.syntax_id,
5351 conn->session_info,
5352 conn->sconn->remote_address,
5353 conn->sconn->msg_ctx,
5354 &cli);
5355 if (!NT_STATUS_IS_OK(status)) {
5356 DEBUG(0, ("reply_printqueue: "
5357 "could not connect to spoolss: %s\n",
5358 nt_errstr(status)));
5359 reply_nterror(req, status);
5360 goto out;
5361 }
5362 b = cli->binding_handle;
5363
5364 ZERO_STRUCT(devmode_ctr);
5365
5366 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5367 sharename,
5368 NULL, devmode_ctr,
5369 SEC_FLAG_MAXIMUM_ALLOWED,
5370 &handle,
5371 &werr);
5372 if (!NT_STATUS_IS_OK(status)) {
5373 reply_nterror(req, status);
5374 goto out;
5375 }
5376 if (!W_ERROR_IS_OK(werr)) {
5377 reply_nterror(req, werror_to_ntstatus(werr));
5378 goto out;
5379 }
5380
5381 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5382 &handle,
5383 0, /* firstjob */
5384 0xff, /* numjobs */
5385 2, /* level */
5386 0, /* offered */
5387 &count,
5388 &info);
5389 if (!W_ERROR_IS_OK(werr)) {
5390 reply_nterror(req, werror_to_ntstatus(werr));
5391 goto out;
5392 }
5393
5394 if (max_count > 0) {
5395 first = start_index;
5396 } else {
5397 first = start_index + max_count + 1;
5398 }
5399
5400 if (first >= count) {
5401 num_to_get = first;
5402 } else {
5403 num_to_get = first + MIN(ABS(max_count), count - first);
5404 }
5405
5406 for (i = first; i < num_to_get; i++) {
5407 char blob[28];
5408 char *p = blob;
5409 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5410 int qstatus;
5411 uint16_t qrapjobid = pjobid_to_rap(sharename,
5412 info[i].info2.job_id);
5413
5414 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5415 qstatus = 2;
5416 } else {
5417 qstatus = 3;
5418 }
5419
5420 srv_put_dos_date2(p, 0, qtime);
5421 SCVAL(p, 4, qstatus);
5422 SSVAL(p, 5, qrapjobid);
5423 SIVAL(p, 7, info[i].info2.size);
5424 SCVAL(p, 11, 0);
5425 srvstr_push(blob, req->flags2, p+12,
5426 info[i].info2.notify_name, 16, STR_ASCII);
5427
5428 if (message_push_blob(
5429 &req->outbuf,
5430 data_blob_const(
5431 blob, sizeof(blob))) == -1) {
5432 reply_nterror(req, NT_STATUS_NO_MEMORY);
5433 goto out;
5434 }
5435 }
5436
5437 if (count > 0) {
5438 SSVAL(req->outbuf,smb_vwv0,count);
5439 SSVAL(req->outbuf,smb_vwv1,
5440 (max_count>0?first+count:first-1));
5441 SCVAL(smb_buf(req->outbuf),0,1);
5442 SSVAL(smb_buf(req->outbuf),1,28*count);
5443 }
5444
5445
5446 DEBUG(3, ("%u entries returned in queue\n",
5447 (unsigned)count));
5448
5449 out:
5450 if (b && is_valid_policy_hnd(&handle)) {
5451 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5452 }
5453
5454 }
5455
5456 END_PROFILE(SMBsplretq);
5457 return;
5458 }
5459
5460 /****************************************************************************
5461 Reply to a printwrite.
5462 ****************************************************************************/
5463
5464 void reply_printwrite(struct smb_request *req)
5465 {
5466 connection_struct *conn = req->conn;
5467 int numtowrite;
5468 const char *data;
5469 files_struct *fsp;
5470
5471 START_PROFILE(SMBsplwr);
5472
5473 if (req->wct < 1) {
5474 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5475 END_PROFILE(SMBsplwr);
5476 return;
5477 }
5478
5479 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5480
5481 if (!check_fsp(conn, req, fsp)) {
5482 END_PROFILE(SMBsplwr);
5483 return;
5484 }
5485
5486 if (!fsp->print_file) {
5487 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5488 END_PROFILE(SMBsplwr);
5489 return;
5490 }
5491
5492 if (!CHECK_WRITE(fsp)) {
5493 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5494 END_PROFILE(SMBsplwr);
5495 return;
5496 }
5497
5498 numtowrite = SVAL(req->buf, 1);
5499
5500 if (req->buflen < numtowrite + 3) {
5501 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5502 END_PROFILE(SMBsplwr);
5503 return;
5504 }
5505
5506 data = (const char *)req->buf + 3;
5507
5508 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5509 reply_nterror(req, map_nt_error_from_unix(errno));
5510 END_PROFILE(SMBsplwr);
5511 return;
5512 }
5513
5514 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5515
5516 END_PROFILE(SMBsplwr);
5517 return;
5518 }
5519
5520 /****************************************************************************
5521 Reply to a mkdir.
5522 ****************************************************************************/
5523
5524 void reply_mkdir(struct smb_request *req)
5525 {
5526 connection_struct *conn = req->conn;
5527 struct smb_filename *smb_dname = NULL;
5528 char *directory = NULL;
5529 NTSTATUS status;
5530 TALLOC_CTX *ctx = talloc_tos();
5531
5532 START_PROFILE(SMBmkdir);
5533
5534 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5535 STR_TERMINATE, &status);
5536 if (!NT_STATUS_IS_OK(status)) {
5537 reply_nterror(req, status);
5538 goto out;
5539 }
5540
5541 status = filename_convert(ctx, conn,
5542 req->flags2 & FLAGS2_DFS_PATHNAMES,
5543 directory,
5544 0,
5545 NULL,
5546 &smb_dname);
5547 if (!NT_STATUS_IS_OK(status)) {
5548 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5549 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5550 ERRSRV, ERRbadpath);
5551 goto out;
5552 }
5553 reply_nterror(req, status);
5554 goto out;
5555 }
5556
5557 status = create_directory(conn, req, smb_dname);
5558
5559 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5560
5561 if (!NT_STATUS_IS_OK(status)) {
5562
5563 if (!use_nt_status()
5564 && NT_STATUS_EQUAL(status,
5565 NT_STATUS_OBJECT_NAME_COLLISION)) {
5566 /*
5567 * Yes, in the DOS error code case we get a
5568 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5569 * samba4 torture test.
5570 */
5571 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5572 }
5573
5574 reply_nterror(req, status);
5575 goto out;
5576 }
5577
5578 reply_outbuf(req, 0, 0);
5579
5580 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5581 out:
5582 TALLOC_FREE(smb_dname);
5583 END_PROFILE(SMBmkdir);
5584 return;
5585 }
5586
5587 /****************************************************************************
5588 Reply to a rmdir.
5589 ****************************************************************************/
5590
5591 void reply_rmdir(struct smb_request *req)
5592 {
5593 connection_struct *conn = req->conn;
5594 struct smb_filename *smb_dname = NULL;
5595 char *directory = NULL;
5596 NTSTATUS status;
5597 TALLOC_CTX *ctx = talloc_tos();
5598 files_struct *fsp = NULL;
5599 int info = 0;
5600 struct smbd_server_connection *sconn = req->sconn;
5601
5602 START_PROFILE(SMBrmdir);
5603
5604 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5605 STR_TERMINATE, &status);
5606 if (!NT_STATUS_IS_OK(status)) {
5607 reply_nterror(req, status);
5608 goto out;
5609 }
5610
5611 status = filename_convert(ctx, conn,
5612 req->flags2 & FLAGS2_DFS_PATHNAMES,
5613 directory,
5614 0,
5615 NULL,
5616 &smb_dname);
5617 if (!NT_STATUS_IS_OK(status)) {
5618 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5619 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5620 ERRSRV, ERRbadpath);
5621 goto out;
5622 }
5623 reply_nterror(req, status);
5624 goto out;
5625 }
5626
5627 if (is_ntfs_stream_smb_fname(smb_dname)) {
5628 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5629 goto out;
5630 }
5631
5632 status = SMB_VFS_CREATE_FILE(
5633 conn, /* conn */
5634 req, /* req */
5635 0, /* root_dir_fid */
5636 smb_dname, /* fname */
5637 DELETE_ACCESS, /* access_mask */
5638 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5639 FILE_SHARE_DELETE),
5640 FILE_OPEN, /* create_disposition*/
5641 FILE_DIRECTORY_FILE, /* create_options */
5642 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5643 0, /* oplock_request */
5644 0, /* allocation_size */
5645 0, /* private_flags */
5646 NULL, /* sd */
5647 NULL, /* ea_list */
5648 &fsp, /* result */
5649 &info); /* pinfo */
5650
5651 if (!NT_STATUS_IS_OK(status)) {
5652 if (open_was_deferred(req->sconn, req->mid)) {
5653 /* We have re-scheduled this call. */
5654 goto out;
5655 }
5656 reply_nterror(req, status);
5657 goto out;
5658 }
5659
5660 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5661 if (!NT_STATUS_IS_OK(status)) {
5662 close_file(req, fsp, ERROR_CLOSE);
5663 reply_nterror(req, status);
5664 goto out;
5665 }
5666
5667 if (!set_delete_on_close(fsp, true, conn->session_info->unix_token)) {
5668 close_file(req, fsp, ERROR_CLOSE);
5669 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5670 goto out;
5671 }
5672
5673 status = close_file(req, fsp, NORMAL_CLOSE);
5674 if (!NT_STATUS_IS_OK(status)) {
5675 reply_nterror(req, status);
5676 } else {
5677 reply_outbuf(req, 0, 0);
5678 }
5679
5680 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5681
5682 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5683 out:
5684 TALLOC_FREE(smb_dname);
5685 END_PROFILE(SMBrmdir);
5686 return;
5687 }
5688
5689 /*******************************************************************
5690 Resolve wildcards in a filename rename.
5691 ********************************************************************/
5692
5693 static bool resolve_wildcards(TALLOC_CTX *ctx,
5694 const char *name1,
5695 const char *name2,
5696 char **pp_newname)
5697 {
5698 char *name2_copy = NULL;
5699 char *root1 = NULL;
5700 char *root2 = NULL;
5701 char *ext1 = NULL;
5702 char *ext2 = NULL;
5703 char *p,*p2, *pname1, *pname2;
5704
5705 name2_copy = talloc_strdup(ctx, name2);
5706 if (!name2_copy) {
5707 return False;
5708 }
5709
5710 pname1 = strrchr_m(name1,'/');
5711 pname2 = strrchr_m(name2_copy,'/');
5712
5713 if (!pname1 || !pname2) {
5714 return False;
5715 }
5716
5717 /* Truncate the copy of name2 at the last '/' */
5718 *pname2 = '\0';
5719
5720 /* Now go past the '/' */
5721 pname1++;
5722 pname2++;
5723
5724 root1 = talloc_strdup(ctx, pname1);
5725 root2 = talloc_strdup(ctx, pname2);
5726
5727 if (!root1 || !root2) {
5728 return False;
5729 }
5730
5731 p = strrchr_m(root1,'.');
5732 if (p) {
5733 *p = 0;
5734 ext1 = talloc_strdup(ctx, p+1);
5735 } else {
5736 ext1 = talloc_strdup(ctx, "");
5737 }
5738 p = strrchr_m(root2,'.');
5739 if (p) {
5740 *p = 0;
5741 ext2 = talloc_strdup(ctx, p+1);
5742 } else {
5743 ext2 = talloc_strdup(ctx, "");
5744 }
5745
5746 if (!ext1 || !ext2) {
5747 return False;
5748 }
5749
5750 p = root1;
5751 p2 = root2;
5752 while (*p2) {
5753 if (*p2 == '?') {
5754 /* Hmmm. Should this be mb-aware ? */
5755 *p2 = *p;
5756 p2++;
5757 } else if (*p2 == '*') {
5758 *p2 = '\0';
5759 root2 = talloc_asprintf(ctx, "%s%s",
5760 root2,
5761 p);
5762 if (!root2) {
5763 return False;
5764 }
5765 break;
5766 } else {
5767 p2++;
5768 }
5769 if (*p) {
5770 p++;
5771 }
5772 }
5773
5774 p = ext1;
5775 p2 = ext2;
5776 while (*p2) {
5777 if (*p2 == '?') {
5778 /* Hmmm. Should this be mb-aware ? */
5779 *p2 = *p;
5780 p2++;
5781 } else if (*p2 == '*') {
5782 *p2 = '\0';
5783 ext2 = talloc_asprintf(ctx, "%s%s",
5784 ext2,
5785 p);
5786 if (!ext2) {
5787 return False;
5788 }
5789 break;
5790 } else {
5791 p2++;
5792 }
5793 if (*p) {
5794 p++;
5795 }
5796 }
5797
5798 if (*ext2) {
5799 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5800 name2_copy,
5801 root2,
5802 ext2);
5803 } else {
5804 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5805 name2_copy,
5806 root2);
5807 }
5808
5809 if (!*pp_newname) {
5810 return False;
5811 }
5812
5813 return True;
5814 }
5815
5816 /****************************************************************************
5817 Ensure open files have their names updated. Updated to notify other smbd's
5818 asynchronously.
5819 ****************************************************************************/
5820
5821 static void rename_open_files(connection_struct *conn,
5822 struct share_mode_lock *lck,
5823 uint32_t orig_name_hash,
5824 const struct smb_filename *smb_fname_dst)
5825 {
5826 files_struct *fsp;
5827 bool did_rename = False;
5828 NTSTATUS status;
5829 uint32_t new_name_hash = 0;
5830
5831 for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
5832 fsp = file_find_di_next(fsp)) {
5833 /* fsp_name is a relative path under the fsp. To change this for other
5834 sharepaths we need to manipulate relative paths. */
5835 /* TODO - create the absolute path and manipulate the newname
5836 relative to the sharepath. */
5837 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5838 continue;
5839 }
5840 if (fsp->name_hash != orig_name_hash) {
5841 continue;
5842 }
5843 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5844 "(file_id %s) from %s -> %s\n", fsp->fnum,
5845 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5846 smb_fname_str_dbg(smb_fname_dst)));
5847
5848 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5849 if (NT_STATUS_IS_OK(status)) {
5850 did_rename = True;
5851 new_name_hash = fsp->name_hash;
5852 }
5853 }
5854
5855 if (!did_rename) {
5856 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5857 "for %s\n", file_id_string_tos(&lck->data->id),
5858 smb_fname_str_dbg(smb_fname_dst)));
5859 }
5860
5861 /* Send messages to all smbd's (not ourself) that the name has changed. */
5862 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5863 orig_name_hash, new_name_hash,
5864 smb_fname_dst);
5865
5866 }
5867
5868 /****************************************************************************
5869 We need to check if the source path is a parent directory of the destination
5870 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5871 refuse the rename with a sharing violation. Under UNIX the above call can
5872 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5873 probably need to check that the client is a Windows one before disallowing
5874 this as a UNIX client (one with UNIX extensions) can know the source is a
5875 symlink and make this decision intelligently. Found by an excellent bug
5876 report from <AndyLiebman@aol.com>.
5877 ****************************************************************************/
5878
5879 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5880 const struct smb_filename *smb_fname_dst)
5881 {
5882 const char *psrc = smb_fname_src->base_name;
5883 const char *pdst = smb_fname_dst->base_name;
5884 size_t slen;
5885
5886 if (psrc[0] == '.' && psrc[1] == '/') {
5887 psrc += 2;
5888 }
5889 if (pdst[0] == '.' && pdst[1] == '/') {
5890 pdst += 2;
5891 }
5892 if ((slen = strlen(psrc)) > strlen(pdst)) {
5893 return False;
5894 }
5895 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5896 }
5897
5898 /*
5899 * Do the notify calls from a rename
5900 */
5901
5902 static void notify_rename(connection_struct *conn, bool is_dir,
5903 const struct smb_filename *smb_fname_src,
5904 const struct smb_filename *smb_fname_dst)
5905 {
5906 char *parent_dir_src = NULL;
5907 char *parent_dir_dst = NULL;
5908 uint32 mask;
5909
5910 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5911 : FILE_NOTIFY_CHANGE_FILE_NAME;
5912
5913 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5914 &parent_dir_src, NULL) ||
5915 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5916 &parent_dir_dst, NULL)) {
5917 goto out;
5918 }
5919
5920 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5921 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5922 smb_fname_src->base_name);
5923 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5924 smb_fname_dst->base_name);
5925 }
5926 else {
5927 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5928 smb_fname_src->base_name);
5929 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5930 smb_fname_dst->base_name);
5931 }
5932
5933 /* this is a strange one. w2k3 gives an additional event for
5934 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5935 files, but not directories */
5936 if (!is_dir) {
5937 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5938 FILE_NOTIFY_CHANGE_ATTRIBUTES
5939 |FILE_NOTIFY_CHANGE_CREATION,
5940 smb_fname_dst->base_name);
5941 }
5942 out:
5943 TALLOC_FREE(parent_dir_src);
5944 TALLOC_FREE(parent_dir_dst);
5945 }
5946
5947 /****************************************************************************
5948 Returns an error if the parent directory for a filename is open in an
5949 incompatible way.
5950 ****************************************************************************/
5951
5952 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5953 const struct smb_filename *smb_fname_dst_in)
5954 {
5955 char *parent_dir = NULL;
5956 struct smb_filename smb_fname_parent;
5957 struct file_id id;
5958 files_struct *fsp = NULL;
5959 int ret;
5960
5961 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5962 &parent_dir, NULL)) {
5963 return NT_STATUS_NO_MEMORY;
5964 }
5965 ZERO_STRUCT(smb_fname_parent);
5966 smb_fname_parent.base_name = parent_dir;
5967
5968 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
5969 if (ret == -1) {
5970 return map_nt_error_from_unix(errno);
5971 }
5972
5973 /*
5974 * We're only checking on this smbd here, mostly good
5975 * enough.. and will pass tests.
5976 */
5977
5978 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
5979 for (fsp = file_find_di_first(conn->sconn, id); fsp;
5980 fsp = file_find_di_next(fsp)) {
5981 if (fsp->access_mask & DELETE_ACCESS) {
5982 return NT_STATUS_SHARING_VIOLATION;
5983 }
5984 }
5985 return NT_STATUS_OK;
5986 }
5987
5988 /****************************************************************************
5989 Rename an open file - given an fsp.
5990 ****************************************************************************/
5991
5992 NTSTATUS rename_internals_fsp(connection_struct *conn,
5993 files_struct *fsp,
5994 const struct smb_filename *smb_fname_dst_in,
5995 uint32 attrs,
5996 bool replace_if_exists)
5997 {
5998 TALLOC_CTX *ctx = talloc_tos();
5999 struct smb_filename *smb_fname_dst = NULL;
6000 NTSTATUS status = NT_STATUS_OK;
6001 struct share_mode_lock *lck = NULL;
6002 bool dst_exists, old_is_stream, new_is_stream;
6003
6004 status = check_name(conn, smb_fname_dst_in->base_name);
6005 if (!NT_STATUS_IS_OK(status)) {
6006 return status;
6007 }
6008
6009 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6010 if (!NT_STATUS_IS_OK(status)) {
6011 return status;
6012 }
6013
6014 /* Make a copy of the dst smb_fname structs */
6015
6016 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6017 if (!NT_STATUS_IS_OK(status)) {
6018 goto out;
6019 }
6020
6021 /*
6022 * Check for special case with case preserving and not
6023 * case sensitive. If the old last component differs from the original
6024 * last component only by case, then we should allow
6025 * the rename (user is trying to change the case of the
6026 * filename).
6027 */
6028 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6029 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6030 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6031 char *last_slash;
6032 char *fname_dst_lcomp_base_mod = NULL;
6033 struct smb_filename *smb_fname_orig_lcomp = NULL;
6034
6035 /*
6036 * Get the last component of the destination name.
6037 */
6038 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6039 if (last_slash) {
6040 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6041 } else {
6042 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6043 }
6044 if (!fname_dst_lcomp_base_mod) {
6045 status = NT_STATUS_NO_MEMORY;
6046 goto out;
6047 }
6048
6049 /*
6050 * Create an smb_filename struct using the original last
6051 * component of the destination.
6052 */
6053 status = create_synthetic_smb_fname_split(ctx,
6054 smb_fname_dst->original_lcomp, NULL,
6055 &smb_fname_orig_lcomp);
6056 if (!NT_STATUS_IS_OK(status)) {
6057 TALLOC_FREE(fname_dst_lcomp_base_mod);
6058 goto out;
6059 }
6060
6061 /* If the base names only differ by case, use original. */
6062 if(!strcsequal(fname_dst_lcomp_base_mod,
6063 smb_fname_orig_lcomp->base_name)) {
6064 char *tmp;
6065 /*
6066 * Replace the modified last component with the
6067 * original.
6068 */
6069 if (last_slash) {
6070 *last_slash = '\0'; /* Truncate at the '/' */
6071 tmp = talloc_asprintf(smb_fname_dst,
6072 "%s/%s",
6073 smb_fname_dst->base_name,
6074 smb_fname_orig_lcomp->base_name);
6075 } else {
6076 tmp = talloc_asprintf(smb_fname_dst,
6077 "%s",
6078 smb_fname_orig_lcomp->base_name);
6079 }
6080 if (tmp == NULL) {
6081 status = NT_STATUS_NO_MEMORY;
6082 TALLOC_FREE(fname_dst_lcomp_base_mod);
6083 TALLOC_FREE(smb_fname_orig_lcomp);
6084 goto out;
6085 }
6086 TALLOC_FREE(smb_fname_dst->base_name);
6087 smb_fname_dst->base_name = tmp;
6088 }
6089
6090 /* If the stream_names only differ by case, use original. */
6091 if(!strcsequal(smb_fname_dst->stream_name,
6092 smb_fname_orig_lcomp->stream_name)) {
6093 char *tmp = NULL;
6094 /* Use the original stream. */
6095 tmp = talloc_strdup(smb_fname_dst,
6096 smb_fname_orig_lcomp->stream_name);
6097 if (tmp == NULL) {
6098 status = NT_STATUS_NO_MEMORY;
6099 TALLOC_FREE(fname_dst_lcomp_base_mod);
6100 TALLOC_FREE(smb_fname_orig_lcomp);
6101 goto out;
6102 }
6103 TALLOC_FREE(smb_fname_dst->stream_name);
6104 smb_fname_dst->stream_name = tmp;
6105 }
6106 TALLOC_FREE(fname_dst_lcomp_base_mod);
6107 TALLOC_FREE(smb_fname_orig_lcomp);
6108 }
6109
6110 /*
6111 * If the src and dest names are identical - including case,
6112 * don't do the rename, just return success.
6113 */
6114
6115 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6116 strcsequal(fsp->fsp_name->stream_name,
6117 smb_fname_dst->stream_name)) {
6118 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6119 "- returning success\n",
6120 smb_fname_str_dbg(smb_fname_dst)));
6121 status = NT_STATUS_OK;
6122 goto out;
6123 }
6124
6125 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6126 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6127
6128 /* Return the correct error code if both names aren't streams. */
6129 if (!old_is_stream && new_is_stream) {
6130 status = NT_STATUS_OBJECT_NAME_INVALID;
6131 goto out;
6132 }
6133
6134 if (old_is_stream && !new_is_stream) {
6135 status = NT_STATUS_INVALID_PARAMETER;
6136 goto out;
6137 }
6138
6139 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6140
6141 if(!replace_if_exists && dst_exists) {
6142 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6143 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6144 smb_fname_str_dbg(smb_fname_dst)));
6145 status = NT_STATUS_OBJECT_NAME_COLLISION;
6146 goto out;
6147 }
6148
6149 if (dst_exists) {
6150 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6151 &smb_fname_dst->st);
6152 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6153 fileid);
6154 /* The file can be open when renaming a stream */
6155 if (dst_fsp && !new_is_stream) {
6156 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6157 status = NT_STATUS_ACCESS_DENIED;
6158 goto out;
6159 }
6160 }
6161
6162 /* Ensure we have a valid stat struct for the source. */
6163 status = vfs_stat_fsp(fsp);
6164 if (!NT_STATUS_IS_OK(status)) {
6165 goto out;
6166 }
6167
6168 status = can_rename(conn, fsp, attrs);
6169
6170 if (!NT_STATUS_IS_OK(status)) {
6171 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6172 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6173 smb_fname_str_dbg(smb_fname_dst)));
6174 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6175 status = NT_STATUS_ACCESS_DENIED;
6176 goto out;
6177 }
6178
6179 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6180 status = NT_STATUS_ACCESS_DENIED;
6181 }
6182
6183 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6184
6185 /*
6186 * We have the file open ourselves, so not being able to get the
6187 * corresponding share mode lock is a fatal error.
6188 */
6189
6190 SMB_ASSERT(lck != NULL);
6191
6192 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6193 uint32 create_options = fsp->fh->private_options;
6194
6195 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6196 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6197 smb_fname_str_dbg(smb_fname_dst)));
6198
6199 if (!lp_posix_pathnames() &&
6200 (lp_map_archive(SNUM(conn)) ||
6201 lp_store_dos_attributes(SNUM(conn)))) {
6202 /* We must set the archive bit on the newly
6203 renamed file. */
6204 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6205 uint32_t old_dosmode = dos_mode(conn,
6206 smb_fname_dst);
6207 file_set_dosmode(conn,
6208 smb_fname_dst,
6209 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6210 NULL,
6211 true);
6212 }
6213 }
6214
6215 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6216 smb_fname_dst);
6217
6218 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6219
6220 /*
6221 * A rename acts as a new file create w.r.t. allowing an initial delete
6222 * on close, probably because in Windows there is a new handle to the
6223 * new file. If initial delete on close was requested but not
6224 * originally set, we need to set it here. This is probably not 100% correct,
6225 * but will work for the CIFSFS client which in non-posix mode
6226 * depends on these semantics. JRA.
6227 */
6228
6229 if (create_options & FILE_DELETE_ON_CLOSE) {
6230 status = can_set_delete_on_close(fsp, 0);
6231
6232 if (NT_STATUS_IS_OK(status)) {
6233 /* Note that here we set the *inital* delete on close flag,
6234 * not the regular one. The magic gets handled in close. */
6235 fsp->initial_delete_on_close = True;
6236 }
6237 }
6238 TALLOC_FREE(lck);
6239 status = NT_STATUS_OK;
6240 goto out;
6241 }
6242
6243 TALLOC_FREE(lck);
6244
6245 if (errno == ENOTDIR || errno == EISDIR) {
6246 status = NT_STATUS_OBJECT_NAME_COLLISION;
6247 } else {
6248 status = map_nt_error_from_unix(errno);
6249 }
6250
6251 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6252 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6253 smb_fname_str_dbg(smb_fname_dst)));
6254
6255 out:
6256 TALLOC_FREE(smb_fname_dst);
6257
6258 return status;
6259 }
6260
6261 /****************************************************************************
6262 The guts of the rename command, split out so it may be called by the NT SMB
6263 code.
6264 ****************************************************************************/
6265
6266 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6267 connection_struct *conn,
6268 struct smb_request *req,
6269 struct smb_filename *smb_fname_src,
6270 struct smb_filename *smb_fname_dst,
6271 uint32 attrs,
6272 bool replace_if_exists,
6273 bool src_has_wild,
6274 bool dest_has_wild,
6275 uint32_t access_mask)
6276 {
6277 char *fname_src_dir = NULL;
6278 char *fname_src_mask = NULL;
6279 int count=0;
6280 NTSTATUS status = NT_STATUS_OK;
6281 struct smb_Dir *dir_hnd = NULL;
6282 const char *dname = NULL;
6283 char *talloced = NULL;
6284 long offset = 0;
6285 int create_options = 0;
6286 bool posix_pathnames = lp_posix_pathnames();
6287
6288 /*
6289 * Split the old name into directory and last component
6290 * strings. Note that unix_convert may have stripped off a
6291 * leading ./ from both name and newname if the rename is
6292 * at the root of the share. We need to make sure either both
6293 * name and newname contain a / character or neither of them do
6294 * as this is checked in resolve_wildcards().
6295 */
6296
6297 /* Split up the directory from the filename/mask. */
6298 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6299 &fname_src_dir, &fname_src_mask);
6300 if (!NT_STATUS_IS_OK(status)) {
6301 status = NT_STATUS_NO_MEMORY;
6302 goto out;
6303 }
6304
6305 /*
6306 * We should only check the mangled cache
6307 * here if unix_convert failed. This means
6308 * that the path in 'mask' doesn't exist
6309 * on the file system and so we need to look
6310 * for a possible mangle. This patch from
6311 * Tine Smukavec <valentin.smukavec@hermes.si>.
6312 */
6313
6314 if (!VALID_STAT(smb_fname_src->st) &&
6315 mangle_is_mangled(fname_src_mask, conn->params)) {
6316 char *new_mask = NULL;
6317 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6318 conn->params);
6319 if (new_mask) {
6320 TALLOC_FREE(fname_src_mask);
6321 fname_src_mask = new_mask;
6322 }
6323 }
6324
6325 if (!src_has_wild) {
6326 files_struct *fsp;
6327
6328 /*
6329 * Only one file needs to be renamed. Append the mask back
6330 * onto the directory.
6331 */
6332 TALLOC_FREE(smb_fname_src->base_name);
6333 if (ISDOT(fname_src_dir)) {
6334 /* Ensure we use canonical names on open. */
6335 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6336 "%s",
6337 fname_src_mask);
6338 } else {
6339 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6340 "%s/%s",
6341 fname_src_dir,
6342 fname_src_mask);
6343 }
6344 if (!smb_fname_src->base_name) {
6345 status = NT_STATUS_NO_MEMORY;
6346 goto out;
6347 }
6348
6349 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6350 "case_preserve = %d, short case preserve = %d, "
6351 "directory = %s, newname = %s, "
6352 "last_component_dest = %s\n",
6353 conn->case_sensitive, conn->case_preserve,
6354 conn->short_case_preserve,
6355 smb_fname_str_dbg(smb_fname_src),
6356 smb_fname_str_dbg(smb_fname_dst),
6357 smb_fname_dst->original_lcomp));
6358
6359 /* The dest name still may have wildcards. */
6360 if (dest_has_wild) {
6361 char *fname_dst_mod = NULL;
6362 if (!resolve_wildcards(smb_fname_dst,
6363 smb_fname_src->base_name,
6364 smb_fname_dst->base_name,
6365 &fname_dst_mod)) {
6366 DEBUG(6, ("rename_internals: resolve_wildcards "
6367 "%s %s failed\n",
6368 smb_fname_src->base_name,
6369 smb_fname_dst->base_name));
6370 status = NT_STATUS_NO_MEMORY;
6371 goto out;
6372 }
6373 TALLOC_FREE(smb_fname_dst->base_name);
6374 smb_fname_dst->base_name = fname_dst_mod;
6375 }
6376
6377 ZERO_STRUCT(smb_fname_src->st);
6378 if (posix_pathnames) {
6379 SMB_VFS_LSTAT(conn, smb_fname_src);
6380 } else {
6381 SMB_VFS_STAT(conn, smb_fname_src);
6382 }
6383
6384 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6385 create_options |= FILE_DIRECTORY_FILE;
6386 }
6387
6388 status = SMB_VFS_CREATE_FILE(
6389 conn, /* conn */
6390 req, /* req */
6391 0, /* root_dir_fid */
6392 smb_fname_src, /* fname */
6393 access_mask, /* access_mask */
6394 (FILE_SHARE_READ | /* share_access */
6395 FILE_SHARE_WRITE),
6396 FILE_OPEN, /* create_disposition*/
6397 create_options, /* create_options */
6398 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6399 0, /* oplock_request */
6400 0, /* allocation_size */
6401 0, /* private_flags */
6402 NULL, /* sd */
6403 NULL, /* ea_list */
6404 &fsp, /* result */
6405 NULL); /* pinfo */
6406
6407 if (!NT_STATUS_IS_OK(status)) {
6408 DEBUG(3, ("Could not open rename source %s: %s\n",
6409 smb_fname_str_dbg(smb_fname_src),
6410 nt_errstr(status)));
6411 goto out;
6412 }
6413
6414 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6415 attrs, replace_if_exists);
6416
6417 close_file(req, fsp, NORMAL_CLOSE);
6418
6419 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6420 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6421 smb_fname_str_dbg(smb_fname_dst)));
6422
6423 goto out;
6424 }
6425
6426 /*
6427 * Wildcards - process each file that matches.
6428 */
6429 if (strequal(fname_src_mask, "????????.???")) {
6430 TALLOC_FREE(fname_src_mask);
6431 fname_src_mask = talloc_strdup(ctx, "*");
6432 if (!fname_src_mask) {
6433 status = NT_STATUS_NO_MEMORY;
6434 goto out;
6435 }
6436 }
6437
6438 status = check_name(conn, fname_src_dir);
6439 if (!NT_STATUS_IS_OK(status)) {
6440 goto out;
6441 }
6442
6443 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6444 attrs);
6445 if (dir_hnd == NULL) {
6446 status = map_nt_error_from_unix(errno);
6447 goto out;
6448 }
6449
6450 status = NT_STATUS_NO_SUCH_FILE;
6451 /*
6452 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6453 * - gentest fix. JRA
6454 */
6455
6456 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6457 &talloced))) {
6458 files_struct *fsp = NULL;
6459 char *destname = NULL;
6460 bool sysdir_entry = False;
6461
6462 /* Quick check for "." and ".." */
6463 if (ISDOT(dname) || ISDOTDOT(dname)) {
6464 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6465 sysdir_entry = True;
6466 } else {
6467 TALLOC_FREE(talloced);
6468 continue;
6469 }
6470 }
6471
6472 if (!is_visible_file(conn, fname_src_dir, dname,
6473 &smb_fname_src->st, false)) {
6474 TALLOC_FREE(talloced);
6475 continue;
6476 }
6477
6478 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6479 TALLOC_FREE(talloced);
6480 continue;
6481 }
6482
6483 if (sysdir_entry) {
6484 status = NT_STATUS_OBJECT_NAME_INVALID;
6485 break;
6486 }
6487
6488 TALLOC_FREE(smb_fname_src->base_name);
6489 if (ISDOT(fname_src_dir)) {
6490 /* Ensure we use canonical names on open. */
6491 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6492 "%s",
6493 dname);
6494 } else {
6495 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6496 "%s/%s",
6497 fname_src_dir,
6498 dname);
6499 }
6500 if (!smb_fname_src->base_name) {
6501 status = NT_STATUS_NO_MEMORY;
6502 goto out;
6503 }
6504
6505 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6506 smb_fname_dst->base_name,
6507 &destname)) {
6508 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6509 smb_fname_src->base_name, destname));
6510 TALLOC_FREE(talloced);
6511 continue;
6512 }
6513 if (!destname) {
6514 status = NT_STATUS_NO_MEMORY;
6515 goto out;
6516 }
6517
6518 TALLOC_FREE(smb_fname_dst->base_name);
6519 smb_fname_dst->base_name = destname;
6520
6521 ZERO_STRUCT(smb_fname_src->st);
6522 if (posix_pathnames) {
6523 SMB_VFS_LSTAT(conn, smb_fname_src);
6524 } else {
6525 SMB_VFS_STAT(conn, smb_fname_src);
6526 }
6527
6528 create_options = 0;
6529
6530 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6531 create_options |= FILE_DIRECTORY_FILE;
6532 }
6533
6534 status = SMB_VFS_CREATE_FILE(
6535 conn, /* conn */
6536 req, /* req */
6537 0, /* root_dir_fid */
6538 smb_fname_src, /* fname */
6539 access_mask, /* access_mask */
6540 (FILE_SHARE_READ | /* share_access */
6541 FILE_SHARE_WRITE),
6542 FILE_OPEN, /* create_disposition*/
6543 create_options, /* create_options */
6544 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6545 0, /* oplock_request */
6546 0, /* allocation_size */
6547 0, /* private_flags */
6548 NULL, /* sd */
6549 NULL, /* ea_list */
6550 &fsp, /* result */
6551 NULL); /* pinfo */
6552
6553 if (!NT_STATUS_IS_OK(status)) {
6554 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6555 "returned %s rename %s -> %s\n",
6556 nt_errstr(status),
6557 smb_fname_str_dbg(smb_fname_src),
6558 smb_fname_str_dbg(smb_fname_dst)));
6559 break;
6560 }
6561
6562 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6563 dname);
6564 if (!smb_fname_dst->original_lcomp) {
6565 status = NT_STATUS_NO_MEMORY;
6566 goto out;
6567 }
6568
6569 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6570 attrs, replace_if_exists);
6571
6572 close_file(req, fsp, NORMAL_CLOSE);
6573
6574 if (!NT_STATUS_IS_OK(status)) {
6575 DEBUG(3, ("rename_internals_fsp returned %s for "
6576 "rename %s -> %s\n", nt_errstr(status),
6577 smb_fname_str_dbg(smb_fname_src),
6578 smb_fname_str_dbg(smb_fname_dst)));
6579 break;
6580 }
6581
6582 count++;
6583
6584 DEBUG(3,("rename_internals: doing rename on %s -> "
6585 "%s\n", smb_fname_str_dbg(smb_fname_src),
6586 smb_fname_str_dbg(smb_fname_src)));
6587 TALLOC_FREE(talloced);
6588 }
6589 TALLOC_FREE(dir_hnd);
6590
6591 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6592 status = map_nt_error_from_unix(errno);
6593 }
6594
6595 out:
6596 TALLOC_FREE(talloced);
6597 TALLOC_FREE(fname_src_dir);
6598 TALLOC_FREE(fname_src_mask);
6599 return status;
6600 }
6601
6602 /****************************************************************************
6603 Reply to a mv.
6604 ****************************************************************************/
6605
6606 void reply_mv(struct smb_request *req)
6607 {
6608 connection_struct *conn = req->conn;
6609 char *name = NULL;
6610 char *newname = NULL;
6611 const char *p;
6612 uint32 attrs;
6613 NTSTATUS status;
6614 bool src_has_wcard = False;
6615 bool dest_has_wcard = False;
6616 TALLOC_CTX *ctx = talloc_tos();
6617 struct smb_filename *smb_fname_src = NULL;
6618 struct smb_filename *smb_fname_dst = NULL;
6619 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6620 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6621 bool stream_rename = false;
6622
6623 START_PROFILE(SMBmv);
6624
6625 if (req->wct < 1) {
6626 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6627 goto out;
6628 }
6629
6630 attrs = SVAL(req->vwv+0, 0);
6631
6632 p = (const char *)req->buf + 1;
6633 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6634 &status, &src_has_wcard);
6635 if (!NT_STATUS_IS_OK(status)) {
6636 reply_nterror(req, status);
6637 goto out;
6638 }
6639 p++;
6640 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6641 &status, &dest_has_wcard);
6642 if (!NT_STATUS_IS_OK(status)) {
6643 reply_nterror(req, status);
6644 goto out;
6645 }
6646
6647 if (!lp_posix_pathnames()) {
6648 /* The newname must begin with a ':' if the
6649 name contains a ':'. */
6650 if (strchr_m(name, ':')) {
6651 if (newname[0] != ':') {
6652 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6653 goto out;
6654 }
6655 stream_rename = true;
6656 }
6657 }
6658
6659 status = filename_convert(ctx,
6660 conn,
6661 req->flags2 & FLAGS2_DFS_PATHNAMES,
6662 name,
6663 src_ucf_flags,
6664 &src_has_wcard,
6665 &smb_fname_src);
6666
6667 if (!NT_STATUS_IS_OK(status)) {
6668 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6669 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6670 ERRSRV, ERRbadpath);
6671 goto out;
6672 }
6673 reply_nterror(req, status);
6674 goto out;
6675 }
6676
6677 status = filename_convert(ctx,
6678 conn,
6679 req->flags2 & FLAGS2_DFS_PATHNAMES,
6680 newname,
6681 dst_ucf_flags,
6682 &dest_has_wcard,
6683 &smb_fname_dst);
6684
6685 if (!NT_STATUS_IS_OK(status)) {
6686 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6687 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6688 ERRSRV, ERRbadpath);
6689 goto out;
6690 }
6691 reply_nterror(req, status);
6692 goto out;
6693 }
6694
6695 if (stream_rename) {
6696 /* smb_fname_dst->base_name must be the same as
6697 smb_fname_src->base_name. */
6698 TALLOC_FREE(smb_fname_dst->base_name);
6699 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6700 smb_fname_src->base_name);
6701 if (!smb_fname_dst->base_name) {
6702 reply_nterror(req, NT_STATUS_NO_MEMORY);
6703 goto out;
6704 }
6705 }
6706
6707 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6708 smb_fname_str_dbg(smb_fname_dst)));
6709
6710 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6711 attrs, False, src_has_wcard, dest_has_wcard,
6712 DELETE_ACCESS);
6713 if (!NT_STATUS_IS_OK(status)) {
6714 if (open_was_deferred(req->sconn, req->mid)) {
6715 /* We have re-scheduled this call. */
6716 goto out;
6717 }
6718 reply_nterror(req, status);
6719 goto out;
6720 }
6721
6722 reply_outbuf(req, 0, 0);
6723 out:
6724 TALLOC_FREE(smb_fname_src);
6725 TALLOC_FREE(smb_fname_dst);
6726 END_PROFILE(SMBmv);
6727 return;
6728 }
6729
6730 /*******************************************************************
6731 Copy a file as part of a reply_copy.
6732 ******************************************************************/
6733
6734 /*
6735 * TODO: check error codes on all callers
6736 */
6737
6738 NTSTATUS copy_file(TALLOC_CTX *ctx,
6739 connection_struct *conn,
6740 struct smb_filename *smb_fname_src,
6741 struct smb_filename *smb_fname_dst,
6742 int ofun,
6743 int count,
6744 bool target_is_directory)
6745 {
6746 struct smb_filename *smb_fname_dst_tmp = NULL;
6747 SMB_OFF_T ret=-1;
6748 files_struct *fsp1,*fsp2;
6749 uint32 dosattrs;
6750 uint32 new_create_disposition;
6751 NTSTATUS status;
6752
6753
6754 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6755 if (!NT_STATUS_IS_OK(status)) {
6756 return status;
6757 }
6758
6759 /*
6760 * If the target is a directory, extract the last component from the
6761 * src filename and append it to the dst filename
6762 */
6763 if (target_is_directory) {
6764 const char *p;
6765
6766 /* dest/target can't be a stream if it's a directory. */
6767 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6768
6769 p = strrchr_m(smb_fname_src->base_name,'/');
6770 if (p) {
6771 p++;
6772 } else {
6773 p = smb_fname_src->base_name;
6774 }
6775 smb_fname_dst_tmp->base_name =
6776 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6777 p);
6778 if (!smb_fname_dst_tmp->base_name) {
6779 status = NT_STATUS_NO_MEMORY;
6780 goto out;
6781 }
6782 }
6783
6784 status = vfs_file_exist(conn, smb_fname_src);
6785 if (!NT_STATUS_IS_OK(status)) {
6786 goto out;
6787 }
6788
6789 if (!target_is_directory && count) {
6790 new_create_disposition = FILE_OPEN;
6791 } else {
6792 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6793 0, ofun,
6794 NULL, NULL,
6795 &new_create_disposition,
6796 NULL,
6797 NULL)) {
6798 status = NT_STATUS_INVALID_PARAMETER;
6799 goto out;
6800 }
6801 }
6802
6803 /* Open the src file for reading. */
6804 status = SMB_VFS_CREATE_FILE(
6805 conn, /* conn */
6806 NULL, /* req */
6807 0, /* root_dir_fid */
6808 smb_fname_src, /* fname */
6809 FILE_GENERIC_READ, /* access_mask */
6810 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6811 FILE_OPEN, /* create_disposition*/
6812 0, /* create_options */
6813 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6814 INTERNAL_OPEN_ONLY, /* oplock_request */
6815 0, /* allocation_size */
6816 0, /* private_flags */
6817 NULL, /* sd */
6818 NULL, /* ea_list */
6819 &fsp1, /* result */
6820 NULL); /* psbuf */
6821
6822 if (!NT_STATUS_IS_OK(status)) {
6823 goto out;
6824 }
6825
6826 dosattrs = dos_mode(conn, smb_fname_src);
6827
6828 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6829 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6830 }
6831
6832 /* Open the dst file for writing. */
6833 status = SMB_VFS_CREATE_FILE(
6834 conn, /* conn */
6835 NULL, /* req */
6836 0, /* root_dir_fid */
6837 smb_fname_dst, /* fname */
6838 FILE_GENERIC_WRITE, /* access_mask */
6839 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6840 new_create_disposition, /* create_disposition*/
6841 0, /* create_options */
6842 dosattrs, /* file_attributes */
6843 INTERNAL_OPEN_ONLY, /* oplock_request */
6844 0, /* allocation_size */
6845 0, /* private_flags */
6846 NULL, /* sd */
6847 NULL, /* ea_list */
6848 &fsp2, /* result */
6849 NULL); /* psbuf */
6850
6851 if (!NT_STATUS_IS_OK(status)) {
6852 close_file(NULL, fsp1, ERROR_CLOSE);
6853 goto out;
6854 }
6855
6856 if (ofun & OPENX_FILE_EXISTS_OPEN) {
6857 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6858 if (ret == -1) {
6859 DEBUG(0, ("error - vfs lseek returned error %s\n",
6860 strerror(errno)));
6861 status = map_nt_error_from_unix(errno);
6862 close_file(NULL, fsp1, ERROR_CLOSE);
6863 close_file(NULL, fsp2, ERROR_CLOSE);
6864 goto out;
6865 }
6866 }
6867
6868 /* Do the actual copy. */
6869 if (smb_fname_src->st.st_ex_size) {
6870 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6871 } else {
6872 ret = 0;
6873 }
6874
6875 close_file(NULL, fsp1, NORMAL_CLOSE);
6876
6877 /* Ensure the modtime is set correctly on the destination file. */
6878 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6879
6880 /*
6881 * As we are opening fsp1 read-only we only expect
6882 * an error on close on fsp2 if we are out of space.
6883 * Thus we don't look at the error return from the
6884 * close of fsp1.
6885 */
6886 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6887
6888 if (!NT_STATUS_IS_OK(status)) {
6889 goto out;
6890 }
6891
6892 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6893 status = NT_STATUS_DISK_FULL;
6894 goto out;
6895 }
6896
6897 status = NT_STATUS_OK;
6898
6899 out:
6900 TALLOC_FREE(smb_fname_dst_tmp);
6901 return status;
6902 }
6903
6904 /****************************************************************************
6905 Reply to a file copy.
6906 ****************************************************************************/
6907
6908 void reply_copy(struct smb_request *req)
6909 {
6910 connection_struct *conn = req->conn;
6911 struct smb_filename *smb_fname_src = NULL;
6912 struct smb_filename *smb_fname_dst = NULL;
6913 char *fname_src = NULL;
6914 char *fname_dst = NULL;
6915 char *fname_src_mask = NULL;
6916 char *fname_src_dir = NULL;
6917 const char *p;
6918 int count=0;
6919 int error = ERRnoaccess;
6920 int tid2;
6921 int ofun;
6922 int flags;
6923 bool target_is_directory=False;
6924 bool source_has_wild = False;
6925 bool dest_has_wild = False;
6926 NTSTATUS status;
6927 TALLOC_CTX *ctx = talloc_tos();
6928
6929 START_PROFILE(SMBcopy);
6930
6931 if (req->wct < 3) {
6932 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6933 goto out;
6934 }
6935
6936 tid2 = SVAL(req->vwv+0, 0);
6937 ofun = SVAL(req->vwv+1, 0);
6938 flags = SVAL(req->vwv+2, 0);
6939
6940 p = (const char *)req->buf;
6941 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6942 &status, &source_has_wild);
6943 if (!NT_STATUS_IS_OK(status)) {
6944 reply_nterror(req, status);
6945 goto out;
6946 }
6947 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6948 &status, &dest_has_wild);
6949 if (!NT_STATUS_IS_OK(status)) {
6950 reply_nterror(req, status);
6951 goto out;
6952 }
6953
6954 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6955
6956 if (tid2 != conn->cnum) {
6957 /* can't currently handle inter share copies XXXX */
6958 DEBUG(3,("Rejecting inter-share copy\n"));
6959 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6960 goto out;
6961 }
6962
6963 status = filename_convert(ctx, conn,
6964 req->flags2 & FLAGS2_DFS_PATHNAMES,
6965 fname_src,
6966 UCF_COND_ALLOW_WCARD_LCOMP,
6967 &source_has_wild,
6968 &smb_fname_src);
6969 if (!NT_STATUS_IS_OK(status)) {
6970 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6971 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6972 ERRSRV, ERRbadpath);
6973 goto out;
6974 }
6975 reply_nterror(req, status);
6976 goto out;
6977 }
6978
6979 status = filename_convert(ctx, conn,
6980 req->flags2 & FLAGS2_DFS_PATHNAMES,
6981 fname_dst,
6982 UCF_COND_ALLOW_WCARD_LCOMP,
6983 &dest_has_wild,
6984 &smb_fname_dst);
6985 if (!NT_STATUS_IS_OK(status)) {
6986 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6987 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6988 ERRSRV, ERRbadpath);
6989 goto out;
6990 }
6991 reply_nterror(req, status);
6992 goto out;
6993 }
6994
6995 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6996
6997 if ((flags&1) && target_is_directory) {
6998 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6999 goto out;
7000 }
7001
7002 if ((flags&2) && !target_is_directory) {
7003 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7004 goto out;
7005 }
7006
7007 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7008 /* wants a tree copy! XXXX */
7009 DEBUG(3,("Rejecting tree copy\n"));
7010 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7011 goto out;
7012 }
7013
7014 /* Split up the directory from the filename/mask. */
7015 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7016 &fname_src_dir, &fname_src_mask);
7017 if (!NT_STATUS_IS_OK(status)) {
7018 reply_nterror(req, NT_STATUS_NO_MEMORY);
7019 goto out;
7020 }
7021
7022 /*
7023 * We should only check the mangled cache
7024 * here if unix_convert failed. This means
7025 * that the path in 'mask' doesn't exist
7026 * on the file system and so we need to look
7027 * for a possible mangle. This patch from
7028 * Tine Smukavec <valentin.smukavec@hermes.si>.
7029 */
7030 if (!VALID_STAT(smb_fname_src->st) &&
7031 mangle_is_mangled(fname_src_mask, conn->params)) {
7032 char *new_mask = NULL;
7033 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7034 &new_mask, conn->params);
7035
7036 /* Use demangled name if one was successfully found. */
7037 if (new_mask) {
7038 TALLOC_FREE(fname_src_mask);
7039 fname_src_mask = new_mask;
7040 }
7041 }
7042
7043 if (!source_has_wild) {
7044
7045 /*
7046 * Only one file needs to be copied. Append the mask back onto
7047 * the directory.
7048 */
7049 TALLOC_FREE(smb_fname_src->base_name);
7050 if (ISDOT(fname_src_dir)) {
7051 /* Ensure we use canonical names on open. */
7052 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7053 "%s",
7054 fname_src_mask);
7055 } else {
7056 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7057 "%s/%s",
7058 fname_src_dir,
7059 fname_src_mask);
7060 }
7061 if (!smb_fname_src->base_name) {
7062 reply_nterror(req, NT_STATUS_NO_MEMORY);
7063 goto out;
7064 }
7065
7066 if (dest_has_wild) {
7067 char *fname_dst_mod = NULL;
7068 if (!resolve_wildcards(smb_fname_dst,
7069 smb_fname_src->base_name,
7070 smb_fname_dst->base_name,
7071 &fname_dst_mod)) {
7072 reply_nterror(req, NT_STATUS_NO_MEMORY);
7073 goto out;
7074 }
7075 TALLOC_FREE(smb_fname_dst->base_name);
7076 smb_fname_dst->base_name = fname_dst_mod;
7077 }
7078
7079 status = check_name(conn, smb_fname_src->base_name);
7080 if (!NT_STATUS_IS_OK(status)) {
7081 reply_nterror(req, status);
7082 goto out;
7083 }
7084
7085 status = check_name(conn, smb_fname_dst->base_name);
7086 if (!NT_STATUS_IS_OK(status)) {
7087 reply_nterror(req, status);
7088 goto out;
7089 }
7090
7091 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7092 ofun, count, target_is_directory);
7093
7094 if(!NT_STATUS_IS_OK(status)) {
7095 reply_nterror(req, status);
7096 goto out;
7097 } else {
7098 count++;
7099 }
7100 } else {
7101 struct smb_Dir *dir_hnd = NULL;
7102 const char *dname = NULL;
7103 char *talloced = NULL;
7104 long offset = 0;
7105
7106 /*
7107 * There is a wildcard that requires us to actually read the
7108 * src dir and copy each file matching the mask to the dst.
7109 * Right now streams won't be copied, but this could
7110 * presumably be added with a nested loop for reach dir entry.
7111 */
7112 SMB_ASSERT(!smb_fname_src->stream_name);
7113 SMB_ASSERT(!smb_fname_dst->stream_name);
7114
7115 smb_fname_src->stream_name = NULL;
7116 smb_fname_dst->stream_name = NULL;
7117
7118 if (strequal(fname_src_mask,"????????.???")) {
7119 TALLOC_FREE(fname_src_mask);
7120 fname_src_mask = talloc_strdup(ctx, "*");
7121 if (!fname_src_mask) {
7122 reply_nterror(req, NT_STATUS_NO_MEMORY);
7123 goto out;
7124 }
7125 }
7126
7127 status = check_name(conn, fname_src_dir);
7128 if (!NT_STATUS_IS_OK(status)) {
7129 reply_nterror(req, status);
7130 goto out;
7131 }
7132
7133 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7134 if (dir_hnd == NULL) {
7135 status = map_nt_error_from_unix(errno);
7136 reply_nterror(req, status);
7137 goto out;
7138 }
7139
7140 error = ERRbadfile;
7141
7142 /* Iterate over the src dir copying each entry to the dst. */
7143 while ((dname = ReadDirName(dir_hnd, &offset,
7144 &smb_fname_src->st, &talloced))) {
7145 char *destname = NULL;
7146
7147 if (ISDOT(dname) || ISDOTDOT(dname)) {
7148 TALLOC_FREE(talloced);
7149 continue;
7150 }
7151
7152 if (!is_visible_file(conn, fname_src_dir, dname,
7153 &smb_fname_src->st, false)) {
7154 TALLOC_FREE(talloced);
7155 continue;
7156 }
7157
7158 if(!mask_match(dname, fname_src_mask,
7159 conn->case_sensitive)) {
7160 TALLOC_FREE(talloced);
7161 continue;
7162 }
7163
7164 error = ERRnoaccess;
7165
7166 /* Get the src smb_fname struct setup. */
7167 TALLOC_FREE(smb_fname_src->base_name);
7168 if (ISDOT(fname_src_dir)) {
7169 /* Ensure we use canonical names on open. */
7170 smb_fname_src->base_name =
7171 talloc_asprintf(smb_fname_src, "%s",
7172 dname);
7173 } else {
7174 smb_fname_src->base_name =
7175 talloc_asprintf(smb_fname_src, "%s/%s",
7176 fname_src_dir, dname);
7177 }
7178
7179 if (!smb_fname_src->base_name) {
7180 TALLOC_FREE(dir_hnd);
7181 TALLOC_FREE(talloced);
7182 reply_nterror(req, NT_STATUS_NO_MEMORY);
7183 goto out;
7184 }
7185
7186 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7187 smb_fname_dst->base_name,
7188 &destname)) {
7189 TALLOC_FREE(talloced);
7190 continue;
7191 }
7192 if (!destname) {
7193 TALLOC_FREE(dir_hnd);
7194 TALLOC_FREE(talloced);
7195 reply_nterror(req, NT_STATUS_NO_MEMORY);
7196 goto out;
7197 }
7198
7199 TALLOC_FREE(smb_fname_dst->base_name);
7200 smb_fname_dst->base_name = destname;
7201
7202 status = check_name(conn, smb_fname_src->base_name);
7203 if (!NT_STATUS_IS_OK(status)) {
7204 TALLOC_FREE(dir_hnd);
7205 TALLOC_FREE(talloced);
7206 reply_nterror(req, status);
7207 goto out;
7208 }
7209
7210 status = check_name(conn, smb_fname_dst->base_name);
7211 if (!NT_STATUS_IS_OK(status)) {
7212 TALLOC_FREE(dir_hnd);
7213 TALLOC_FREE(talloced);
7214 reply_nterror(req, status);
7215 goto out;
7216 }
7217
7218 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7219 smb_fname_src->base_name,
7220 smb_fname_dst->base_name));
7221
7222 status = copy_file(ctx, conn, smb_fname_src,
7223 smb_fname_dst, ofun, count,
7224 target_is_directory);
7225 if (NT_STATUS_IS_OK(status)) {
7226 count++;
7227 }
7228
7229 TALLOC_FREE(talloced);
7230 }
7231 TALLOC_FREE(dir_hnd);
7232 }
7233
7234 if (count == 0) {
7235 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7236 goto out;
7237 }
7238
7239 reply_outbuf(req, 1, 0);
7240 SSVAL(req->outbuf,smb_vwv0,count);
7241 out:
7242 TALLOC_FREE(smb_fname_src);
7243 TALLOC_FREE(smb_fname_dst);
7244 TALLOC_FREE(fname_src);
7245 TALLOC_FREE(fname_dst);
7246 TALLOC_FREE(fname_src_mask);
7247 TALLOC_FREE(fname_src_dir);
7248
7249 END_PROFILE(SMBcopy);
7250 return;
7251 }
7252
7253 #undef DBGC_CLASS
7254 #define DBGC_CLASS DBGC_LOCKING
7255
7256 /****************************************************************************
7257 Get a lock pid, dealing with large count requests.
7258 ****************************************************************************/
7259
7260 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7261 bool large_file_format)
7262 {
7263 if(!large_file_format)
7264 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7265 else
7266 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7267 }
7268
7269 /****************************************************************************
7270 Get a lock count, dealing with large count requests.
7271 ****************************************************************************/
7272
7273 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7274 bool large_file_format)
7275 {
7276 uint64_t count = 0;
7277
7278 if(!large_file_format) {
7279 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7280 } else {
7281
7282 #if defined(HAVE_LONGLONG)
7283 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7284 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7285 #else /* HAVE_LONGLONG */
7286
7287 /*
7288 * NT4.x seems to be broken in that it sends large file (64 bit)
7289 * lockingX calls even if the CAP_LARGE_FILES was *not*
7290 * negotiated. For boxes without large unsigned ints truncate the
7291 * lock count by dropping the top 32 bits.
7292 */
7293
7294 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7295 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7296 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7297 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7298 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7299 }
7300
7301 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7302 #endif /* HAVE_LONGLONG */
7303 }
7304
7305 return count;
7306 }
7307
7308 #if !defined(HAVE_LONGLONG)
7309 /****************************************************************************
7310 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7311 ****************************************************************************/
7312
7313 static uint32 map_lock_offset(uint32 high, uint32 low)
7314 {
7315 unsigned int i;
7316 uint32 mask = 0;
7317 uint32 highcopy = high;
7318
7319 /*
7320 * Try and find out how many significant bits there are in high.
7321 */
7322
7323 for(i = 0; highcopy; i++)
7324 highcopy >>= 1;
7325
7326 /*
7327 * We use 31 bits not 32 here as POSIX
7328 * lock offsets may not be negative.
7329 */
7330
7331 mask = (~0) << (31 - i);
7332
7333 if(low & mask)
7334 return 0; /* Fail. */
7335
7336 high <<= (31 - i);
7337
7338 return (high|low);
7339 }
7340 #endif /* !defined(HAVE_LONGLONG) */
7341
7342 /****************************************************************************
7343 Get a lock offset, dealing with large offset requests.
7344 ****************************************************************************/
7345
7346 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7347 bool large_file_format, bool *err)
7348 {
7349 uint64_t offset = 0;
7350
7351 *err = False;
7352
7353 if(!large_file_format) {
7354 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7355 } else {
7356
7357 #if defined(HAVE_LONGLONG)
7358 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7359 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7360 #else /* HAVE_LONGLONG */
7361
7362 /*
7363 * NT4.x seems to be broken in that it sends large file (64 bit)
7364 * lockingX calls even if the CAP_LARGE_FILES was *not*
7365 * negotiated. For boxes without large unsigned ints mangle the
7366 * lock offset by mapping the top 32 bits onto the lower 32.
7367 */
7368
7369 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7370 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7371 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7372 uint32 new_low = 0;
7373
7374 if((new_low = map_lock_offset(high, low)) == 0) {
7375 *err = True;
7376 return (uint64_t)-1;
7377 }
7378
7379 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7380 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7381 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7382 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7383 }
7384
7385 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7386 #endif /* HAVE_LONGLONG */
7387 }
7388
7389 return offset;
7390 }
7391
7392 NTSTATUS smbd_do_locking(struct smb_request *req,
7393 files_struct *fsp,
7394 uint8_t type,
7395 int32_t timeout,
7396 uint16_t num_ulocks,
7397 struct smbd_lock_element *ulocks,
7398 uint16_t num_locks,
7399 struct smbd_lock_element *locks,
7400 bool *async)
7401 {
7402 connection_struct *conn = req->conn;
7403 int i;
7404 NTSTATUS status = NT_STATUS_OK;
7405
7406 *async = false;
7407
7408 /* Data now points at the beginning of the list
7409 of smb_unlkrng structs */
7410 for(i = 0; i < (int)num_ulocks; i++) {
7411 struct smbd_lock_element *e = &ulocks[i];
7412
7413 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7414 "pid %u, file %s\n",
7415 (double)e->offset,
7416 (double)e->count,
7417 (unsigned int)e->smblctx,
7418 fsp_str_dbg(fsp)));
7419
7420 if (e->brltype != UNLOCK_LOCK) {
7421 /* this can only happen with SMB2 */
7422 return NT_STATUS_INVALID_PARAMETER;
7423 }
7424
7425 status = do_unlock(req->sconn->msg_ctx,
7426 fsp,
7427 e->smblctx,
7428 e->count,
7429 e->offset,
7430 WINDOWS_LOCK);
7431
7432 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7433 nt_errstr(status)));
7434
7435 if (!NT_STATUS_IS_OK(status)) {
7436 return status;
7437 }
7438 }
7439
7440 /* Setup the timeout in seconds. */
7441
7442 if (!lp_blocking_locks(SNUM(conn))) {
7443 timeout = 0;
7444 }
7445
7446 /* Data now points at the beginning of the list
7447 of smb_lkrng structs */
7448
7449 for(i = 0; i < (int)num_locks; i++) {
7450 struct smbd_lock_element *e = &locks[i];
7451
7452 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7453 "%llu, file %s timeout = %d\n",
7454 (double)e->offset,
7455 (double)e->count,
7456 (unsigned long long)e->smblctx,
7457 fsp_str_dbg(fsp),
7458 (int)timeout));
7459
7460 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7461 struct blocking_lock_record *blr = NULL;
7462
7463 if (num_locks > 1) {
7464 /*
7465 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7466 * if the lock vector contains one entry. When given mutliple cancel
7467 * requests in a single PDU we expect the server to return an
7468 * error. Windows servers seem to accept the request but only
7469 * cancel the first lock.
7470 * JRA - Do what Windows does (tm) :-).
7471 */
7472
7473 #if 0
7474 /* MS-CIFS (2.2.4.32.1) behavior. */
7475 return NT_STATUS_DOS(ERRDOS,
7476 ERRcancelviolation);
7477 #else
7478 /* Windows behavior. */
7479 if (i != 0) {
7480 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7481 "cancel request\n"));
7482 continue;
7483 }
7484 #endif
7485 }
7486
7487 if (lp_blocking_locks(SNUM(conn))) {
7488
7489 /* Schedule a message to ourselves to
7490 remove the blocking lock record and
7491 return the right error. */
7492
7493 blr = blocking_lock_cancel_smb1(fsp,
7494 e->smblctx,
7495 e->offset,
7496 e->count,
7497 WINDOWS_LOCK,
7498 type,
7499 NT_STATUS_FILE_LOCK_CONFLICT);
7500 if (blr == NULL) {
7501 return NT_STATUS_DOS(
7502 ERRDOS,
7503 ERRcancelviolation);
7504 }
7505 }
7506 /* Remove a matching pending lock. */
7507 status = do_lock_cancel(fsp,
7508 e->smblctx,
7509 e->count,
7510 e->offset,
7511 WINDOWS_LOCK,
7512 blr);
7513 } else {
7514 bool blocking_lock = timeout ? true : false;
7515 bool defer_lock = false;
7516 struct byte_range_lock *br_lck;
7517 uint64_t block_smblctx;
7518
7519 br_lck = do_lock(req->sconn->msg_ctx,
7520 fsp,
7521 e->smblctx,
7522 e->count,
7523 e->offset,
7524 e->brltype,
7525 WINDOWS_LOCK,
7526 blocking_lock,
7527 &status,
7528 &block_smblctx,
7529 NULL);
7530
7531 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7532 /* Windows internal resolution for blocking locks seems
7533 to be about 200ms... Don't wait for less than that. JRA. */
7534 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7535 timeout = lp_lock_spin_time();
7536 }
7537 defer_lock = true;
7538 }
7539
7540 /* If a lock sent with timeout of zero would fail, and
7541 * this lock has been requested multiple times,
7542 * according to brl_lock_failed() we convert this
7543 * request to a blocking lock with a timeout of between
7544 * 150 - 300 milliseconds.
7545 *
7546 * If lp_lock_spin_time() has been set to 0, we skip
7547 * this blocking retry and fail immediately.
7548 *
7549 * Replacement for do_lock_spin(). JRA. */
7550
7551 if (!req->sconn->using_smb2 &&
7552 br_lck && lp_blocking_locks(SNUM(conn)) &&
7553 lp_lock_spin_time() && !blocking_lock &&
7554 NT_STATUS_EQUAL((status),
7555 NT_STATUS_FILE_LOCK_CONFLICT))
7556 {
7557 defer_lock = true;
7558 timeout = lp_lock_spin_time();
7559 }
7560
7561 if (br_lck && defer_lock) {
7562 /*
7563 * A blocking lock was requested. Package up
7564 * this smb into a queued request and push it
7565 * onto the blocking lock queue.
7566 */
7567 if(push_blocking_lock_request(br_lck,
7568 req,
7569 fsp,
7570 timeout,
7571 i,
7572 e->smblctx,
7573 e->brltype,
7574 WINDOWS_LOCK,
7575 e->offset,
7576 e->count,
7577 block_smblctx)) {
7578 TALLOC_FREE(br_lck);
7579 *async = true;
7580 return NT_STATUS_OK;
7581 }
7582 }
7583
7584 TALLOC_FREE(br_lck);
7585 }
7586
7587 if (!NT_STATUS_IS_OK(status)) {
7588 break;
7589 }
7590 }
7591
7592 /* If any of the above locks failed, then we must unlock
7593 all of the previous locks (X/Open spec). */
7594
7595 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7596
7597 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7598 i = -1; /* we want to skip the for loop */
7599 }
7600
7601 /*
7602 * Ensure we don't do a remove on the lock that just failed,
7603 * as under POSIX rules, if we have a lock already there, we
7604 * will delete it (and we shouldn't) .....
7605 */
7606 for(i--; i >= 0; i--) {
7607 struct smbd_lock_element *e = &locks[i];
7608
7609 do_unlock(req->sconn->msg_ctx,
7610 fsp,
7611 e->smblctx,
7612 e->count,
7613 e->offset,
7614 WINDOWS_LOCK);
7615 }
7616 return status;
7617 }
7618
7619 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7620 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7621
7622 return NT_STATUS_OK;
7623 }
7624
7625 /****************************************************************************
7626 Reply to a lockingX request.
7627 ****************************************************************************/
7628
7629 void reply_lockingX(struct smb_request *req)
7630 {
7631 connection_struct *conn = req->conn;
7632 files_struct *fsp;
7633 unsigned char locktype;
7634 unsigned char oplocklevel;
7635 uint16 num_ulocks;
7636 uint16 num_locks;
7637 int32 lock_timeout;
7638 int i;
7639 const uint8_t *data;
7640 bool large_file_format;
7641 bool err;
7642 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7643 struct smbd_lock_element *ulocks;
7644 struct smbd_lock_element *locks;
7645 bool async = false;
7646
7647 START_PROFILE(SMBlockingX);
7648
7649 if (req->wct < 8) {
7650 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7651 END_PROFILE(SMBlockingX);
7652 return;
7653 }
7654
7655 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7656 locktype = CVAL(req->vwv+3, 0);
7657 oplocklevel = CVAL(req->vwv+3, 1);
7658 num_ulocks = SVAL(req->vwv+6, 0);
7659 num_locks = SVAL(req->vwv+7, 0);
7660 lock_timeout = IVAL(req->vwv+4, 0);
7661 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7662
7663 if (!check_fsp(conn, req, fsp)) {
7664 END_PROFILE(SMBlockingX);
7665 return;
7666 }
7667
7668 data = req->buf;
7669
7670 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7671 /* we don't support these - and CANCEL_LOCK makes w2k
7672 and XP reboot so I don't really want to be
7673 compatible! (tridge) */
7674 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7675 END_PROFILE(SMBlockingX);
7676 return;
7677 }
7678
7679 /* Check if this is an oplock break on a file
7680 we have granted an oplock on.
7681 */
7682 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7683 /* Client can insist on breaking to none. */
7684 bool break_to_none = (oplocklevel == 0);
7685 bool result;
7686
7687 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7688 "for fnum = %d\n", (unsigned int)oplocklevel,
7689 fsp->fnum ));
7690
7691 /*
7692 * Make sure we have granted an exclusive or batch oplock on
7693 * this file.
7694 */
7695
7696 if (fsp->oplock_type == 0) {
7697
7698 /* The Samba4 nbench simulator doesn't understand
7699 the difference between break to level2 and break
7700 to none from level2 - it sends oplock break
7701 replies in both cases. Don't keep logging an error
7702 message here - just ignore it. JRA. */
7703
7704 DEBUG(5,("reply_lockingX: Error : oplock break from "
7705 "client for fnum = %d (oplock=%d) and no "
7706 "oplock granted on this file (%s).\n",
7707 fsp->fnum, fsp->oplock_type,
7708 fsp_str_dbg(fsp)));
7709
7710 /* if this is a pure oplock break request then don't
7711 * send a reply */
7712 if (num_locks == 0 && num_ulocks == 0) {
7713 END_PROFILE(SMBlockingX);
7714 return;
7715 } else {
7716 END_PROFILE(SMBlockingX);
7717 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7718 return;
7719 }
7720 }
7721
7722 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7723 (break_to_none)) {
7724 result = remove_oplock(fsp);
7725 } else {
7726 result = downgrade_oplock(fsp);
7727 }
7728
7729 if (!result) {
7730 DEBUG(0, ("reply_lockingX: error in removing "
7731 "oplock on file %s\n", fsp_str_dbg(fsp)));
7732 /* Hmmm. Is this panic justified? */
7733 smb_panic("internal tdb error");
7734 }
7735
7736 reply_to_oplock_break_requests(fsp);
7737
7738 /* if this is a pure oplock break request then don't send a
7739 * reply */
7740 if (num_locks == 0 && num_ulocks == 0) {
7741 /* Sanity check - ensure a pure oplock break is not a
7742 chained request. */
7743 if(CVAL(req->vwv+0, 0) != 0xff)
7744 DEBUG(0,("reply_lockingX: Error : pure oplock "
7745 "break is a chained %d request !\n",
7746 (unsigned int)CVAL(req->vwv+0, 0)));
7747 END_PROFILE(SMBlockingX);
7748 return;
7749 }
7750 }
7751
7752 if (req->buflen <
7753 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7754 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7755 END_PROFILE(SMBlockingX);
7756 return;
7757 }
7758
7759 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7760 if (ulocks == NULL) {
7761 reply_nterror(req, NT_STATUS_NO_MEMORY);
7762 END_PROFILE(SMBlockingX);
7763 return;
7764 }
7765
7766 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7767 if (locks == NULL) {
7768 reply_nterror(req, NT_STATUS_NO_MEMORY);
7769 END_PROFILE(SMBlockingX);
7770 return;
7771 }
7772
7773 /* Data now points at the beginning of the list
7774 of smb_unlkrng structs */
7775 for(i = 0; i < (int)num_ulocks; i++) {
7776 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7777 ulocks[i].count = get_lock_count(data, i, large_file_format);
7778 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7779 ulocks[i].brltype = UNLOCK_LOCK;
7780
7781 /*
7782 * There is no error code marked "stupid client bug".... :-).
7783 */
7784 if(err) {
7785 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7786 END_PROFILE(SMBlockingX);
7787 return;
7788 }
7789 }
7790
7791 /* Now do any requested locks */
7792 data += ((large_file_format ? 20 : 10)*num_ulocks);
7793
7794 /* Data now points at the beginning of the list
7795 of smb_lkrng structs */
7796
7797 for(i = 0; i < (int)num_locks; i++) {
7798 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7799 locks[i].count = get_lock_count(data, i, large_file_format);
7800 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7801
7802 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7803 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7804 locks[i].brltype = PENDING_READ_LOCK;
7805 } else {
7806 locks[i].brltype = READ_LOCK;
7807 }
7808 } else {
7809 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7810 locks[i].brltype = PENDING_WRITE_LOCK;
7811 } else {
7812 locks[i].brltype = WRITE_LOCK;
7813 }
7814 }
7815
7816 /*
7817 * There is no error code marked "stupid client bug".... :-).
7818 */
7819 if(err) {
7820 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7821 END_PROFILE(SMBlockingX);
7822 return;
7823 }
7824 }
7825
7826 status = smbd_do_locking(req, fsp,
7827 locktype, lock_timeout,
7828 num_ulocks, ulocks,
7829 num_locks, locks,
7830 &async);
7831 if (!NT_STATUS_IS_OK(status)) {
7832 END_PROFILE(SMBlockingX);
7833 reply_nterror(req, status);
7834 return;
7835 }
7836 if (async) {
7837 END_PROFILE(SMBlockingX);
7838 return;
7839 }
7840
7841 reply_outbuf(req, 2, 0);
7842 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
7843 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
7844
7845 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7846 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7847
7848 END_PROFILE(SMBlockingX);
7849 }
7850
7851 #undef DBGC_CLASS
7852 #define DBGC_CLASS DBGC_ALL
7853
7854 /****************************************************************************
7855 Reply to a SMBreadbmpx (read block multiplex) request.
7856 Always reply with an error, if someone has a platform really needs this,
7857 please contact vl@samba.org
7858 ****************************************************************************/
7859
7860 void reply_readbmpx(struct smb_request *req)
7861 {
7862 START_PROFILE(SMBreadBmpx);
7863 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7864 END_PROFILE(SMBreadBmpx);
7865 return;
7866 }
7867
7868 /****************************************************************************
7869 Reply to a SMBreadbs (read block multiplex secondary) request.
7870 Always reply with an error, if someone has a platform really needs this,
7871 please contact vl@samba.org
7872 ****************************************************************************/
7873
7874 void reply_readbs(struct smb_request *req)
7875 {
7876 START_PROFILE(SMBreadBs);
7877 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7878 END_PROFILE(SMBreadBs);
7879 return;
7880 }
7881
7882 /****************************************************************************
7883 Reply to a SMBsetattrE.
7884 ****************************************************************************/
7885
7886 void reply_setattrE(struct smb_request *req)
7887 {
7888 connection_struct *conn = req->conn;
7889 struct smb_file_time ft;
7890 files_struct *fsp;
7891 NTSTATUS status;
7892
7893 START_PROFILE(SMBsetattrE);
7894 ZERO_STRUCT(ft);
7895
7896 if (req->wct < 7) {
7897 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7898 goto out;
7899 }
7900
7901 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7902
7903 if(!fsp || (fsp->conn != conn)) {
7904 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7905 goto out;
7906 }
7907
7908 /*
7909 * Convert the DOS times into unix times.
7910 */
7911
7912 ft.atime = convert_time_t_to_timespec(
7913 srv_make_unix_date2(req->vwv+3));
7914 ft.mtime = convert_time_t_to_timespec(
7915 srv_make_unix_date2(req->vwv+5));
7916 ft.create_time = convert_time_t_to_timespec(
7917 srv_make_unix_date2(req->vwv+1));
7918
7919 reply_outbuf(req, 0, 0);
7920
7921 /*
7922 * Patch from Ray Frush <frush@engr.colostate.edu>
7923 * Sometimes times are sent as zero - ignore them.
7924 */
7925
7926 /* Ensure we have a valid stat struct for the source. */
7927 status = vfs_stat_fsp(fsp);
7928 if (!NT_STATUS_IS_OK(status)) {
7929 reply_nterror(req, status);
7930 goto out;
7931 }
7932
7933 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
7934 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7935 goto out;
7936 }
7937
7938 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7939 if (!NT_STATUS_IS_OK(status)) {
7940 reply_nterror(req, status);
7941 goto out;
7942 }
7943
7944 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7945 " createtime=%u\n",
7946 fsp->fnum,
7947 (unsigned int)ft.atime.tv_sec,
7948 (unsigned int)ft.mtime.tv_sec,
7949 (unsigned int)ft.create_time.tv_sec
7950 ));
7951 out:
7952 END_PROFILE(SMBsetattrE);
7953 return;
7954 }
7955
7956
7957 /* Back from the dead for OS/2..... JRA. */
7958
7959 /****************************************************************************
7960 Reply to a SMBwritebmpx (write block multiplex primary) request.
7961 Always reply with an error, if someone has a platform really needs this,
7962 please contact vl@samba.org
7963 ****************************************************************************/
7964
7965 void reply_writebmpx(struct smb_request *req)
7966 {
7967 START_PROFILE(SMBwriteBmpx);
7968 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7969 END_PROFILE(SMBwriteBmpx);
7970 return;
7971 }
7972
7973 /****************************************************************************
7974 Reply to a SMBwritebs (write block multiplex secondary) request.
7975 Always reply with an error, if someone has a platform really needs this,
7976 please contact vl@samba.org
7977 ****************************************************************************/
7978
7979 void reply_writebs(struct smb_request *req)
7980 {
7981 START_PROFILE(SMBwriteBs);
7982 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7983 END_PROFILE(SMBwriteBs);
7984 return;
7985 }
7986
7987 /****************************************************************************
7988 Reply to a SMBgetattrE.
7989 ****************************************************************************/
7990
7991 void reply_getattrE(struct smb_request *req)
7992 {
7993 connection_struct *conn = req->conn;
7994 int mode;
7995 files_struct *fsp;
7996 struct timespec create_ts;
7997
7998 START_PROFILE(SMBgetattrE);
7999
8000 if (req->wct < 1) {
8001 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8002 END_PROFILE(SMBgetattrE);
8003 return;
8004 }
8005
8006 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8007
8008 if(!fsp || (fsp->conn != conn)) {
8009 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8010 END_PROFILE(SMBgetattrE);
8011 return;
8012 }
8013
8014 /* Do an fstat on this file */
8015 if(fsp_stat(fsp)) {
8016 reply_nterror(req, map_nt_error_from_unix(errno));
8017 END_PROFILE(SMBgetattrE);
8018 return;
8019 }
8020
8021 mode = dos_mode(conn, fsp->fsp_name);
8022
8023 /*
8024 * Convert the times into dos times. Set create
8025 * date to be last modify date as UNIX doesn't save
8026 * this.
8027 */
8028
8029 reply_outbuf(req, 11, 0);
8030
8031 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8032 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8033 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8034 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8035 /* Should we check pending modtime here ? JRA */
8036 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8037 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8038
8039 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8040 SIVAL(req->outbuf, smb_vwv6, 0);
8041 SIVAL(req->outbuf, smb_vwv8, 0);
8042 } else {
8043 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8044 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8045 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8046 }
8047 SSVAL(req->outbuf,smb_vwv10, mode);
8048
8049 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8050
8051 END_PROFILE(SMBgetattrE);
8052 return;
8053 }
reg import