?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
dnsp: Parse TXT records
[Samba/gebeck_regimport.git] / source3 / smbd / reply.c
blobc84c077d581b968ab9f35987c9c70b351934cad5
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "printing.h"
29 #include "smbd/globals.h"
30 #include "fake_file.h"
31 #include "../librpc/gen_ndr/cli_spoolss.h"
32 #include "rpc_client/cli_spoolss.h"
33 #include "rpc_client/init_spoolss.h"
34 #include "rpc_server/rpc_ncacn_np.h"
35
36 /****************************************************************************
37 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
38 path or anything including wildcards.
39 We're assuming here that '/' is not the second byte in any multibyte char
40 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
41 set.
42 ****************************************************************************/
43
44 /* Custom version for processing POSIX paths. */
45 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
46
47 static NTSTATUS check_path_syntax_internal(char *path,
48 bool posix_path,
49 bool *p_last_component_contains_wcard)
50 {
51 char *d = path;
52 const char *s = path;
53 NTSTATUS ret = NT_STATUS_OK;
54 bool start_of_name_component = True;
55 bool stream_started = false;
56
57 *p_last_component_contains_wcard = False;
58
59 while (*s) {
60 if (stream_started) {
61 switch (*s) {
62 case '/':
63 case '\\':
64 return NT_STATUS_OBJECT_NAME_INVALID;
65 case ':':
66 if (s[1] == '\0') {
67 return NT_STATUS_OBJECT_NAME_INVALID;
68 }
69 if (strchr_m(&s[1], ':')) {
70 return NT_STATUS_OBJECT_NAME_INVALID;
71 }
72 break;
73 }
74 }
75
76 if ((*s == ':') && !posix_path && !stream_started) {
77 if (*p_last_component_contains_wcard) {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 /* Stream names allow more characters than file names.
81 We're overloading posix_path here to allow a wider
82 range of characters. If stream_started is true this
83 is still a Windows path even if posix_path is true.
84 JRA.
85 */
86 stream_started = true;
87 start_of_name_component = false;
88 posix_path = true;
89
90 if (s[1] == '\0') {
91 return NT_STATUS_OBJECT_NAME_INVALID;
92 }
93 }
94
95 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
96 /*
97 * Safe to assume is not the second part of a mb char
98 * as this is handled below.
99 */
100 /* Eat multiple '/' or '\\' */
101 while (IS_PATH_SEP(*s,posix_path)) {
102 s++;
103 }
104 if ((d != path) && (*s != '\0')) {
105 /* We only care about non-leading or trailing '/' or '\\' */
106 *d++ = '/';
107 }
108
109 start_of_name_component = True;
110 /* New component. */
111 *p_last_component_contains_wcard = False;
112 continue;
113 }
114
115 if (start_of_name_component) {
116 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
117 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
118
119 /*
120 * No mb char starts with '.' so we're safe checking the directory separator here.
121 */
122
123 /* If we just added a '/' - delete it */
124 if ((d > path) && (*(d-1) == '/')) {
125 *(d-1) = '\0';
126 d--;
127 }
128
129 /* Are we at the start ? Can't go back further if so. */
130 if (d <= path) {
131 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
132 break;
133 }
134 /* Go back one level... */
135 /* We know this is safe as '/' cannot be part of a mb sequence. */
136 /* NOTE - if this assumption is invalid we are not in good shape... */
137 /* Decrement d first as d points to the *next* char to write into. */
138 for (d--; d > path; d--) {
139 if (*d == '/')
140 break;
141 }
142 s += 2; /* Else go past the .. */
143 /* We're still at the start of a name component, just the previous one. */
144 continue;
145
146 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
147 if (posix_path) {
148 /* Eat the '.' */
149 s++;
150 continue;
151 }
152 }
153
154 }
155
156 if (!(*s & 0x80)) {
157 if (!posix_path) {
158 if (*s <= 0x1f || *s == '|') {
159 return NT_STATUS_OBJECT_NAME_INVALID;
160 }
161 switch (*s) {
162 case '*':
163 case '?':
164 case '<':
165 case '>':
166 case '"':
167 *p_last_component_contains_wcard = True;
168 break;
169 default:
170 break;
171 }
172 }
173 *d++ = *s++;
174 } else {
175 size_t siz;
176 /* Get the size of the next MB character. */
177 next_codepoint(s,&siz);
178 switch(siz) {
179 case 5:
180 *d++ = *s++;
181 /*fall through*/
182 case 4:
183 *d++ = *s++;
184 /*fall through*/
185 case 3:
186 *d++ = *s++;
187 /*fall through*/
188 case 2:
189 *d++ = *s++;
190 /*fall through*/
191 case 1:
192 *d++ = *s++;
193 break;
194 default:
195 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
196 *d = '\0';
197 return NT_STATUS_INVALID_PARAMETER;
198 }
199 }
200 start_of_name_component = False;
201 }
202
203 *d = '\0';
204
205 return ret;
206 }
207
208 /****************************************************************************
209 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
210 No wildcards allowed.
211 ****************************************************************************/
212
213 NTSTATUS check_path_syntax(char *path)
214 {
215 bool ignore;
216 return check_path_syntax_internal(path, False, &ignore);
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 Wildcards allowed - p_contains_wcard returns true if the last component contained
222 a wildcard.
223 ****************************************************************************/
224
225 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
226 {
227 return check_path_syntax_internal(path, False, p_contains_wcard);
228 }
229
230 /****************************************************************************
231 Check the path for a POSIX client.
232 We're assuming here that '/' is not the second byte in any multibyte char
233 set (a safe assumption).
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_posix(char *path)
237 {
238 bool ignore;
239 return check_path_syntax_internal(path, True, &ignore);
240 }
241
242 /****************************************************************************
243 Pull a string and check the path allowing a wilcard - provide for error return.
244 ****************************************************************************/
245
246 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
247 const char *base_ptr,
248 uint16 smb_flags2,
249 char **pp_dest,
250 const char *src,
251 size_t src_len,
252 int flags,
253 NTSTATUS *err,
254 bool *contains_wcard)
255 {
256 size_t ret;
257
258 *pp_dest = NULL;
259
260 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
261 src_len, flags);
262
263 if (!*pp_dest) {
264 *err = NT_STATUS_INVALID_PARAMETER;
265 return ret;
266 }
267
268 *contains_wcard = False;
269
270 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
271 /*
272 * For a DFS path the function parse_dfs_path()
273 * will do the path processing, just make a copy.
274 */
275 *err = NT_STATUS_OK;
276 return ret;
277 }
278
279 if (lp_posix_pathnames()) {
280 *err = check_path_syntax_posix(*pp_dest);
281 } else {
282 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
283 }
284
285 return ret;
286 }
287
288 /****************************************************************************
289 Pull a string and check the path - provide for error return.
290 ****************************************************************************/
291
292 size_t srvstr_get_path(TALLOC_CTX *ctx,
293 const char *base_ptr,
294 uint16 smb_flags2,
295 char **pp_dest,
296 const char *src,
297 size_t src_len,
298 int flags,
299 NTSTATUS *err)
300 {
301 bool ignore;
302 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
303 src_len, flags, err, &ignore);
304 }
305
306 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
307 char **pp_dest, const char *src, int flags,
308 NTSTATUS *err, bool *contains_wcard)
309 {
310 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
311 pp_dest, src, smbreq_bufrem(req, src),
312 flags, err, contains_wcard);
313 }
314
315 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
316 char **pp_dest, const char *src, int flags,
317 NTSTATUS *err)
318 {
319 bool ignore;
320 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
321 flags, err, &ignore);
322 }
323
324 /****************************************************************************
325 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
326 ****************************************************************************/
327
328 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
329 files_struct *fsp)
330 {
331 if ((fsp == NULL) || (conn == NULL)) {
332 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
333 return False;
334 }
335 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
336 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
337 return False;
338 }
339 return True;
340 }
341
342 /****************************************************************************
343 Check if we have a correct fsp pointing to a file.
344 ****************************************************************************/
345
346 bool check_fsp(connection_struct *conn, struct smb_request *req,
347 files_struct *fsp)
348 {
349 if (!check_fsp_open(conn, req, fsp)) {
350 return False;
351 }
352 if (fsp->is_directory) {
353 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
354 return False;
355 }
356 if (fsp->fh->fd == -1) {
357 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
358 return False;
359 }
360 fsp->num_smb_operations++;
361 return True;
362 }
363
364 /****************************************************************************
365 Check if we have a correct fsp pointing to a quota fake file. Replacement for
366 the CHECK_NTQUOTA_HANDLE_OK macro.
367 ****************************************************************************/
368
369 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
370 files_struct *fsp)
371 {
372 if (!check_fsp_open(conn, req, fsp)) {
373 return false;
374 }
375
376 if (fsp->is_directory) {
377 return false;
378 }
379
380 if (fsp->fake_file_handle == NULL) {
381 return false;
382 }
383
384 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
385 return false;
386 }
387
388 if (fsp->fake_file_handle->private_data == NULL) {
389 return false;
390 }
391
392 return true;
393 }
394
395 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
396 const char *name, int name_type)
397 {
398 char *trim_name;
399 char *trim_name_type;
400 const char *retarget_parm;
401 char *retarget;
402 char *p;
403 int retarget_type = 0x20;
404 int retarget_port = 139;
405 struct sockaddr_storage retarget_addr;
406 struct sockaddr_in *in_addr;
407 bool ret = false;
408 uint8_t outbuf[10];
409
410 if (get_socket_port(sconn->sock) != 139) {
411 return false;
412 }
413
414 trim_name = talloc_strdup(talloc_tos(), name);
415 if (trim_name == NULL) {
416 goto fail;
417 }
418 trim_char(trim_name, ' ', ' ');
419
420 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
421 name_type);
422 if (trim_name_type == NULL) {
423 goto fail;
424 }
425
426 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
427 trim_name_type, NULL);
428 if (retarget_parm == NULL) {
429 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
430 trim_name, NULL);
431 }
432 if (retarget_parm == NULL) {
433 goto fail;
434 }
435
436 retarget = talloc_strdup(trim_name, retarget_parm);
437 if (retarget == NULL) {
438 goto fail;
439 }
440
441 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
442
443 p = strchr(retarget, ':');
444 if (p != NULL) {
445 *p++ = '\0';
446 retarget_port = atoi(p);
447 }
448
449 p = strchr_m(retarget, '#');
450 if (p != NULL) {
451 *p++ = '\0';
452 sscanf(p, "%x", &retarget_type);
453 }
454
455 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
456 if (!ret) {
457 DEBUG(10, ("could not resolve %s\n", retarget));
458 goto fail;
459 }
460
461 if (retarget_addr.ss_family != AF_INET) {
462 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
463 goto fail;
464 }
465
466 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
467
468 _smb_setlen(outbuf, 6);
469 SCVAL(outbuf, 0, 0x84);
470 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
471 *(uint16_t *)(outbuf+8) = htons(retarget_port);
472
473 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
474 NULL)) {
475 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
476 "failed.");
477 }
478
479 ret = true;
480 fail:
481 TALLOC_FREE(trim_name);
482 return ret;
483 }
484
485 /****************************************************************************
486 Reply to a (netbios-level) special message.
487 ****************************************************************************/
488
489 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
490 {
491 int msg_type = CVAL(inbuf,0);
492 int msg_flags = CVAL(inbuf,1);
493 /*
494 * We only really use 4 bytes of the outbuf, but for the smb_setlen
495 * calculation & friends (srv_send_smb uses that) we need the full smb
496 * header.
497 */
498 char outbuf[smb_size];
499
500 memset(outbuf, '\0', sizeof(outbuf));
501
502 smb_setlen(outbuf,0);
503
504 switch (msg_type) {
505 case 0x81: /* session request */
506 {
507 /* inbuf_size is guarenteed to be at least 4. */
508 fstring name1,name2;
509 int name_type1, name_type2;
510 int name_len1, name_len2;
511
512 *name1 = *name2 = 0;
513
514 if (sconn->nbt.got_session) {
515 exit_server_cleanly("multiple session request not permitted");
516 }
517
518 SCVAL(outbuf,0,0x82);
519 SCVAL(outbuf,3,0);
520
521 /* inbuf_size is guaranteed to be at least 4. */
522 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
523 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
524 DEBUG(0,("Invalid name length in session request\n"));
525 break;
526 }
527 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
528 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
529 DEBUG(0,("Invalid name length in session request\n"));
530 break;
531 }
532
533 name_type1 = name_extract((unsigned char *)inbuf,
534 inbuf_size,(unsigned int)4,name1);
535 name_type2 = name_extract((unsigned char *)inbuf,
536 inbuf_size,(unsigned int)(4 + name_len1),name2);
537
538 if (name_type1 == -1 || name_type2 == -1) {
539 DEBUG(0,("Invalid name type in session request\n"));
540 break;
541 }
542
543 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
544 name1, name_type1, name2, name_type2));
545
546 if (netbios_session_retarget(sconn, name1, name_type1)) {
547 exit_server_cleanly("retargeted client");
548 }
549
550 /*
551 * Windows NT/2k uses "*SMBSERVER" and XP uses
552 * "*SMBSERV" arrggg!!!
553 */
554 if (strequal(name1, "*SMBSERVER ")
555 || strequal(name1, "*SMBSERV ")) {
556 fstrcpy(name1, sconn->client_id.addr);
557 }
558
559 set_local_machine_name(name1, True);
560 set_remote_machine_name(name2, True);
561
562 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
563 get_local_machine_name(), get_remote_machine_name(),
564 name_type2));
565
566 if (name_type2 == 'R') {
567 /* We are being asked for a pathworks session ---
568 no thanks! */
569 SCVAL(outbuf, 0,0x83);
570 break;
571 }
572
573 /* only add the client's machine name to the list
574 of possibly valid usernames if we are operating
575 in share mode security */
576 if (lp_security() == SEC_SHARE) {
577 add_session_user(sconn, get_remote_machine_name());
578 }
579
580 reload_services(sconn->msg_ctx, sconn->sock, True);
581 reopen_logs();
582
583 sconn->nbt.got_session = true;
584 break;
585 }
586
587 case 0x89: /* session keepalive request
588 (some old clients produce this?) */
589 SCVAL(outbuf,0,SMBkeepalive);
590 SCVAL(outbuf,3,0);
591 break;
592
593 case 0x82: /* positive session response */
594 case 0x83: /* negative session response */
595 case 0x84: /* retarget session response */
596 DEBUG(0,("Unexpected session response\n"));
597 break;
598
599 case SMBkeepalive: /* session keepalive */
600 default:
601 return;
602 }
603
604 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
605 msg_type, msg_flags));
606
607 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
608 return;
609 }
610
611 /****************************************************************************
612 Reply to a tcon.
613 conn POINTER CAN BE NULL HERE !
614 ****************************************************************************/
615
616 void reply_tcon(struct smb_request *req)
617 {
618 connection_struct *conn = req->conn;
619 const char *service;
620 char *service_buf = NULL;
621 char *password = NULL;
622 char *dev = NULL;
623 int pwlen=0;
624 NTSTATUS nt_status;
625 const char *p;
626 DATA_BLOB password_blob;
627 TALLOC_CTX *ctx = talloc_tos();
628 struct smbd_server_connection *sconn = req->sconn;
629
630 START_PROFILE(SMBtcon);
631
632 if (req->buflen < 4) {
633 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
634 END_PROFILE(SMBtcon);
635 return;
636 }
637
638 p = (const char *)req->buf + 1;
639 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
640 p += 1;
641 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
642 p += pwlen+1;
643 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
644 p += 1;
645
646 if (service_buf == NULL || password == NULL || dev == NULL) {
647 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
648 END_PROFILE(SMBtcon);
649 return;
650 }
651 p = strrchr_m(service_buf,'\\');
652 if (p) {
653 service = p+1;
654 } else {
655 service = service_buf;
656 }
657
658 password_blob = data_blob(password, pwlen+1);
659
660 conn = make_connection(sconn,service,password_blob,dev,
661 req->vuid,&nt_status);
662 req->conn = conn;
663
664 data_blob_clear_free(&password_blob);
665
666 if (!conn) {
667 reply_nterror(req, nt_status);
668 END_PROFILE(SMBtcon);
669 return;
670 }
671
672 reply_outbuf(req, 2, 0);
673 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
674 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
675 SSVAL(req->outbuf,smb_tid,conn->cnum);
676
677 DEBUG(3,("tcon service=%s cnum=%d\n",
678 service, conn->cnum));
679
680 END_PROFILE(SMBtcon);
681 return;
682 }
683
684 /****************************************************************************
685 Reply to a tcon and X.
686 conn POINTER CAN BE NULL HERE !
687 ****************************************************************************/
688
689 void reply_tcon_and_X(struct smb_request *req)
690 {
691 connection_struct *conn = req->conn;
692 const char *service = NULL;
693 DATA_BLOB password;
694 TALLOC_CTX *ctx = talloc_tos();
695 /* what the cleint thinks the device is */
696 char *client_devicetype = NULL;
697 /* what the server tells the client the share represents */
698 const char *server_devicetype;
699 NTSTATUS nt_status;
700 int passlen;
701 char *path = NULL;
702 const char *p, *q;
703 uint16 tcon_flags;
704 struct smbd_server_connection *sconn = req->sconn;
705
706 START_PROFILE(SMBtconX);
707
708 if (req->wct < 4) {
709 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
710 END_PROFILE(SMBtconX);
711 return;
712 }
713
714 passlen = SVAL(req->vwv+3, 0);
715 tcon_flags = SVAL(req->vwv+2, 0);
716
717 /* we might have to close an old one */
718 if ((tcon_flags & 0x1) && conn) {
719 close_cnum(conn,req->vuid);
720 req->conn = NULL;
721 conn = NULL;
722 }
723
724 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
725 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
726 END_PROFILE(SMBtconX);
727 return;
728 }
729
730 if (sconn->smb1.negprot.encrypted_passwords) {
731 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
732 if (lp_security() == SEC_SHARE) {
733 /*
734 * Security = share always has a pad byte
735 * after the password.
736 */
737 p = (const char *)req->buf + passlen + 1;
738 } else {
739 p = (const char *)req->buf + passlen;
740 }
741 } else {
742 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
743 /* Ensure correct termination */
744 password.data[passlen]=0;
745 p = (const char *)req->buf + passlen + 1;
746 }
747
748 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
749
750 if (path == NULL) {
751 data_blob_clear_free(&password);
752 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
753 END_PROFILE(SMBtconX);
754 return;
755 }
756
757 /*
758 * the service name can be either: \\server\share
759 * or share directly like on the DELL PowerVault 705
760 */
761 if (*path=='\\') {
762 q = strchr_m(path+2,'\\');
763 if (!q) {
764 data_blob_clear_free(&password);
765 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
766 END_PROFILE(SMBtconX);
767 return;
768 }
769 service = q+1;
770 } else {
771 service = path;
772 }
773
774 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
775 &client_devicetype, p,
776 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
777
778 if (client_devicetype == NULL) {
779 data_blob_clear_free(&password);
780 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
781 END_PROFILE(SMBtconX);
782 return;
783 }
784
785 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
786
787 conn = make_connection(sconn, service, password, client_devicetype,
788 req->vuid, &nt_status);
789 req->conn =conn;
790
791 data_blob_clear_free(&password);
792
793 if (!conn) {
794 reply_nterror(req, nt_status);
795 END_PROFILE(SMBtconX);
796 return;
797 }
798
799 if ( IS_IPC(conn) )
800 server_devicetype = "IPC";
801 else if ( IS_PRINT(conn) )
802 server_devicetype = "LPT1:";
803 else
804 server_devicetype = "A:";
805
806 if (get_Protocol() < PROTOCOL_NT1) {
807 reply_outbuf(req, 2, 0);
808 if (message_push_string(&req->outbuf, server_devicetype,
809 STR_TERMINATE|STR_ASCII) == -1) {
810 reply_nterror(req, NT_STATUS_NO_MEMORY);
811 END_PROFILE(SMBtconX);
812 return;
813 }
814 } else {
815 /* NT sets the fstype of IPC$ to the null string */
816 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
817
818 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
819 /* Return permissions. */
820 uint32 perm1 = 0;
821 uint32 perm2 = 0;
822
823 reply_outbuf(req, 7, 0);
824
825 if (IS_IPC(conn)) {
826 perm1 = FILE_ALL_ACCESS;
827 perm2 = FILE_ALL_ACCESS;
828 } else {
829 perm1 = CAN_WRITE(conn) ?
830 SHARE_ALL_ACCESS :
831 SHARE_READ_ONLY;
832 }
833
834 SIVAL(req->outbuf, smb_vwv3, perm1);
835 SIVAL(req->outbuf, smb_vwv5, perm2);
836 } else {
837 reply_outbuf(req, 3, 0);
838 }
839
840 if ((message_push_string(&req->outbuf, server_devicetype,
841 STR_TERMINATE|STR_ASCII) == -1)
842 || (message_push_string(&req->outbuf, fstype,
843 STR_TERMINATE) == -1)) {
844 reply_nterror(req, NT_STATUS_NO_MEMORY);
845 END_PROFILE(SMBtconX);
846 return;
847 }
848
849 /* what does setting this bit do? It is set by NT4 and
850 may affect the ability to autorun mounted cdroms */
851 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
852 (lp_csc_policy(SNUM(conn)) << 2));
853
854 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
855 DEBUG(2,("Serving %s as a Dfs root\n",
856 lp_servicename(SNUM(conn)) ));
857 SSVAL(req->outbuf, smb_vwv2,
858 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
859 }
860 }
861
862
863 DEBUG(3,("tconX service=%s \n",
864 service));
865
866 /* set the incoming and outgoing tid to the just created one */
867 SSVAL(req->inbuf,smb_tid,conn->cnum);
868 SSVAL(req->outbuf,smb_tid,conn->cnum);
869
870 END_PROFILE(SMBtconX);
871
872 req->tid = conn->cnum;
873 chain_reply(req);
874 return;
875 }
876
877 /****************************************************************************
878 Reply to an unknown type.
879 ****************************************************************************/
880
881 void reply_unknown_new(struct smb_request *req, uint8 type)
882 {
883 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
884 smb_fn_name(type), type, type));
885 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
886 return;
887 }
888
889 /****************************************************************************
890 Reply to an ioctl.
891 conn POINTER CAN BE NULL HERE !
892 ****************************************************************************/
893
894 void reply_ioctl(struct smb_request *req)
895 {
896 connection_struct *conn = req->conn;
897 uint16 device;
898 uint16 function;
899 uint32 ioctl_code;
900 int replysize;
901 char *p;
902
903 START_PROFILE(SMBioctl);
904
905 if (req->wct < 3) {
906 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
907 END_PROFILE(SMBioctl);
908 return;
909 }
910
911 device = SVAL(req->vwv+1, 0);
912 function = SVAL(req->vwv+2, 0);
913 ioctl_code = (device << 16) + function;
914
915 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
916
917 switch (ioctl_code) {
918 case IOCTL_QUERY_JOB_INFO:
919 replysize = 32;
920 break;
921 default:
922 reply_force_doserror(req, ERRSRV, ERRnosupport);
923 END_PROFILE(SMBioctl);
924 return;
925 }
926
927 reply_outbuf(req, 8, replysize+1);
928 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
929 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
930 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
931 p = smb_buf(req->outbuf);
932 memset(p, '\0', replysize+1); /* valgrind-safe. */
933 p += 1; /* Allow for alignment */
934
935 switch (ioctl_code) {
936 case IOCTL_QUERY_JOB_INFO:
937 {
938 files_struct *fsp = file_fsp(
939 req, SVAL(req->vwv+0, 0));
940 if (!fsp) {
941 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
942 END_PROFILE(SMBioctl);
943 return;
944 }
945 /* Job number */
946 if (fsp->print_file) {
947 SSVAL(p, 0, fsp->print_file->rap_jobid);
948 } else {
949 SSVAL(p, 0, 0);
950 }
951 srvstr_push((char *)req->outbuf, req->flags2, p+2,
952 global_myname(), 15,
953 STR_TERMINATE|STR_ASCII);
954 if (conn) {
955 srvstr_push((char *)req->outbuf, req->flags2,
956 p+18, lp_servicename(SNUM(conn)),
957 13, STR_TERMINATE|STR_ASCII);
958 } else {
959 memset(p+18, 0, 13);
960 }
961 break;
962 }
963 }
964
965 END_PROFILE(SMBioctl);
966 return;
967 }
968
969 /****************************************************************************
970 Strange checkpath NTSTATUS mapping.
971 ****************************************************************************/
972
973 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
974 {
975 /* Strange DOS error code semantics only for checkpath... */
976 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
977 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
978 /* We need to map to ERRbadpath */
979 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
980 }
981 }
982 return status;
983 }
984
985 /****************************************************************************
986 Reply to a checkpath.
987 ****************************************************************************/
988
989 void reply_checkpath(struct smb_request *req)
990 {
991 connection_struct *conn = req->conn;
992 struct smb_filename *smb_fname = NULL;
993 char *name = NULL;
994 NTSTATUS status;
995 TALLOC_CTX *ctx = talloc_tos();
996
997 START_PROFILE(SMBcheckpath);
998
999 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1000 STR_TERMINATE, &status);
1001
1002 if (!NT_STATUS_IS_OK(status)) {
1003 status = map_checkpath_error(req->flags2, status);
1004 reply_nterror(req, status);
1005 END_PROFILE(SMBcheckpath);
1006 return;
1007 }
1008
1009 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1010
1011 status = filename_convert(ctx,
1012 conn,
1013 req->flags2 & FLAGS2_DFS_PATHNAMES,
1014 name,
1015 0,
1016 NULL,
1017 &smb_fname);
1018
1019 if (!NT_STATUS_IS_OK(status)) {
1020 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1021 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1022 ERRSRV, ERRbadpath);
1023 END_PROFILE(SMBcheckpath);
1024 return;
1025 }
1026 goto path_err;
1027 }
1028
1029 if (!VALID_STAT(smb_fname->st) &&
1030 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1031 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1032 smb_fname_str_dbg(smb_fname), strerror(errno)));
1033 status = map_nt_error_from_unix(errno);
1034 goto path_err;
1035 }
1036
1037 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1038 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1039 ERRDOS, ERRbadpath);
1040 goto out;
1041 }
1042
1043 reply_outbuf(req, 0, 0);
1044
1045 path_err:
1046 /* We special case this - as when a Windows machine
1047 is parsing a path is steps through the components
1048 one at a time - if a component fails it expects
1049 ERRbadpath, not ERRbadfile.
1050 */
1051 status = map_checkpath_error(req->flags2, status);
1052 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1053 /*
1054 * Windows returns different error codes if
1055 * the parent directory is valid but not the
1056 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1057 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1058 * if the path is invalid.
1059 */
1060 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1061 ERRDOS, ERRbadpath);
1062 goto out;
1063 }
1064
1065 reply_nterror(req, status);
1066
1067 out:
1068 TALLOC_FREE(smb_fname);
1069 END_PROFILE(SMBcheckpath);
1070 return;
1071 }
1072
1073 /****************************************************************************
1074 Reply to a getatr.
1075 ****************************************************************************/
1076
1077 void reply_getatr(struct smb_request *req)
1078 {
1079 connection_struct *conn = req->conn;
1080 struct smb_filename *smb_fname = NULL;
1081 char *fname = NULL;
1082 int mode=0;
1083 SMB_OFF_T size=0;
1084 time_t mtime=0;
1085 const char *p;
1086 NTSTATUS status;
1087 TALLOC_CTX *ctx = talloc_tos();
1088 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1089
1090 START_PROFILE(SMBgetatr);
1091
1092 p = (const char *)req->buf + 1;
1093 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 reply_nterror(req, status);
1096 goto out;
1097 }
1098
1099 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1100 under WfWg - weird! */
1101 if (*fname == '\0') {
1102 mode = aHIDDEN | aDIR;
1103 if (!CAN_WRITE(conn)) {
1104 mode |= aRONLY;
1105 }
1106 size = 0;
1107 mtime = 0;
1108 } else {
1109 status = filename_convert(ctx,
1110 conn,
1111 req->flags2 & FLAGS2_DFS_PATHNAMES,
1112 fname,
1113 0,
1114 NULL,
1115 &smb_fname);
1116 if (!NT_STATUS_IS_OK(status)) {
1117 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1118 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1119 ERRSRV, ERRbadpath);
1120 goto out;
1121 }
1122 reply_nterror(req, status);
1123 goto out;
1124 }
1125 if (!VALID_STAT(smb_fname->st) &&
1126 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1127 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1128 smb_fname_str_dbg(smb_fname),
1129 strerror(errno)));
1130 reply_nterror(req, map_nt_error_from_unix(errno));
1131 goto out;
1132 }
1133
1134 mode = dos_mode(conn, smb_fname);
1135 size = smb_fname->st.st_ex_size;
1136
1137 if (ask_sharemode) {
1138 struct timespec write_time_ts;
1139 struct file_id fileid;
1140
1141 ZERO_STRUCT(write_time_ts);
1142 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1143 get_file_infos(fileid, NULL, &write_time_ts);
1144 if (!null_timespec(write_time_ts)) {
1145 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1146 }
1147 }
1148
1149 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1150 if (mode & aDIR) {
1151 size = 0;
1152 }
1153 }
1154
1155 reply_outbuf(req, 10, 0);
1156
1157 SSVAL(req->outbuf,smb_vwv0,mode);
1158 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1159 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1160 } else {
1161 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1162 }
1163 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1164
1165 if (get_Protocol() >= PROTOCOL_NT1) {
1166 SSVAL(req->outbuf, smb_flg2,
1167 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1168 }
1169
1170 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1171 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1172
1173 out:
1174 TALLOC_FREE(smb_fname);
1175 TALLOC_FREE(fname);
1176 END_PROFILE(SMBgetatr);
1177 return;
1178 }
1179
1180 /****************************************************************************
1181 Reply to a setatr.
1182 ****************************************************************************/
1183
1184 void reply_setatr(struct smb_request *req)
1185 {
1186 struct smb_file_time ft;
1187 connection_struct *conn = req->conn;
1188 struct smb_filename *smb_fname = NULL;
1189 char *fname = NULL;
1190 int mode;
1191 time_t mtime;
1192 const char *p;
1193 NTSTATUS status;
1194 TALLOC_CTX *ctx = talloc_tos();
1195
1196 START_PROFILE(SMBsetatr);
1197
1198 ZERO_STRUCT(ft);
1199
1200 if (req->wct < 2) {
1201 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1202 goto out;
1203 }
1204
1205 p = (const char *)req->buf + 1;
1206 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1207 if (!NT_STATUS_IS_OK(status)) {
1208 reply_nterror(req, status);
1209 goto out;
1210 }
1211
1212 status = filename_convert(ctx,
1213 conn,
1214 req->flags2 & FLAGS2_DFS_PATHNAMES,
1215 fname,
1216 0,
1217 NULL,
1218 &smb_fname);
1219 if (!NT_STATUS_IS_OK(status)) {
1220 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1221 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1222 ERRSRV, ERRbadpath);
1223 goto out;
1224 }
1225 reply_nterror(req, status);
1226 goto out;
1227 }
1228
1229 if (smb_fname->base_name[0] == '.' &&
1230 smb_fname->base_name[1] == '\0') {
1231 /*
1232 * Not sure here is the right place to catch this
1233 * condition. Might be moved to somewhere else later -- vl
1234 */
1235 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1236 goto out;
1237 }
1238
1239 mode = SVAL(req->vwv+0, 0);
1240 mtime = srv_make_unix_date3(req->vwv+1);
1241
1242 ft.mtime = convert_time_t_to_timespec(mtime);
1243 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1244 if (!NT_STATUS_IS_OK(status)) {
1245 reply_nterror(req, status);
1246 goto out;
1247 }
1248
1249 if (mode != FILE_ATTRIBUTE_NORMAL) {
1250 if (VALID_STAT_OF_DIR(smb_fname->st))
1251 mode |= aDIR;
1252 else
1253 mode &= ~aDIR;
1254
1255 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1256 false) != 0) {
1257 reply_nterror(req, map_nt_error_from_unix(errno));
1258 goto out;
1259 }
1260 }
1261
1262 reply_outbuf(req, 0, 0);
1263
1264 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1265 mode));
1266 out:
1267 TALLOC_FREE(smb_fname);
1268 END_PROFILE(SMBsetatr);
1269 return;
1270 }
1271
1272 /****************************************************************************
1273 Reply to a dskattr.
1274 ****************************************************************************/
1275
1276 void reply_dskattr(struct smb_request *req)
1277 {
1278 connection_struct *conn = req->conn;
1279 uint64_t dfree,dsize,bsize;
1280 START_PROFILE(SMBdskattr);
1281
1282 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1283 reply_nterror(req, map_nt_error_from_unix(errno));
1284 END_PROFILE(SMBdskattr);
1285 return;
1286 }
1287
1288 reply_outbuf(req, 5, 0);
1289
1290 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1291 double total_space, free_space;
1292 /* we need to scale this to a number that DOS6 can handle. We
1293 use floating point so we can handle large drives on systems
1294 that don't have 64 bit integers
1295
1296 we end up displaying a maximum of 2G to DOS systems
1297 */
1298 total_space = dsize * (double)bsize;
1299 free_space = dfree * (double)bsize;
1300
1301 dsize = (uint64_t)((total_space+63*512) / (64*512));
1302 dfree = (uint64_t)((free_space+63*512) / (64*512));
1303
1304 if (dsize > 0xFFFF) dsize = 0xFFFF;
1305 if (dfree > 0xFFFF) dfree = 0xFFFF;
1306
1307 SSVAL(req->outbuf,smb_vwv0,dsize);
1308 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1309 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1310 SSVAL(req->outbuf,smb_vwv3,dfree);
1311 } else {
1312 SSVAL(req->outbuf,smb_vwv0,dsize);
1313 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1314 SSVAL(req->outbuf,smb_vwv2,512);
1315 SSVAL(req->outbuf,smb_vwv3,dfree);
1316 }
1317
1318 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1319
1320 END_PROFILE(SMBdskattr);
1321 return;
1322 }
1323
1324 /*
1325 * Utility function to split the filename from the directory.
1326 */
1327 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1328 char **fname_dir_out,
1329 char **fname_mask_out)
1330 {
1331 const char *p = NULL;
1332 char *fname_dir = NULL;
1333 char *fname_mask = NULL;
1334
1335 p = strrchr_m(fname_in, '/');
1336 if (!p) {
1337 fname_dir = talloc_strdup(ctx, ".");
1338 fname_mask = talloc_strdup(ctx, fname_in);
1339 } else {
1340 fname_dir = talloc_strndup(ctx, fname_in,
1341 PTR_DIFF(p, fname_in));
1342 fname_mask = talloc_strdup(ctx, p+1);
1343 }
1344
1345 if (!fname_dir || !fname_mask) {
1346 TALLOC_FREE(fname_dir);
1347 TALLOC_FREE(fname_mask);
1348 return NT_STATUS_NO_MEMORY;
1349 }
1350
1351 *fname_dir_out = fname_dir;
1352 *fname_mask_out = fname_mask;
1353 return NT_STATUS_OK;
1354 }
1355
1356 /****************************************************************************
1357 Reply to a search.
1358 Can be called from SMBsearch, SMBffirst or SMBfunique.
1359 ****************************************************************************/
1360
1361 void reply_search(struct smb_request *req)
1362 {
1363 connection_struct *conn = req->conn;
1364 char *path = NULL;
1365 const char *mask = NULL;
1366 char *directory = NULL;
1367 struct smb_filename *smb_fname = NULL;
1368 char *fname = NULL;
1369 SMB_OFF_T size;
1370 uint32 mode;
1371 struct timespec date;
1372 uint32 dirtype;
1373 unsigned int numentries = 0;
1374 unsigned int maxentries = 0;
1375 bool finished = False;
1376 const char *p;
1377 int status_len;
1378 char status[21];
1379 int dptr_num= -1;
1380 bool check_descend = False;
1381 bool expect_close = False;
1382 NTSTATUS nt_status;
1383 bool mask_contains_wcard = False;
1384 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1385 TALLOC_CTX *ctx = talloc_tos();
1386 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1387 struct dptr_struct *dirptr = NULL;
1388 struct smbd_server_connection *sconn = req->sconn;
1389
1390 START_PROFILE(SMBsearch);
1391
1392 if (req->wct < 2) {
1393 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1394 goto out;
1395 }
1396
1397 if (lp_posix_pathnames()) {
1398 reply_unknown_new(req, req->cmd);
1399 goto out;
1400 }
1401
1402 /* If we were called as SMBffirst then we must expect close. */
1403 if(req->cmd == SMBffirst) {
1404 expect_close = True;
1405 }
1406
1407 reply_outbuf(req, 1, 3);
1408 maxentries = SVAL(req->vwv+0, 0);
1409 dirtype = SVAL(req->vwv+1, 0);
1410 p = (const char *)req->buf + 1;
1411 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1412 &nt_status, &mask_contains_wcard);
1413 if (!NT_STATUS_IS_OK(nt_status)) {
1414 reply_nterror(req, nt_status);
1415 goto out;
1416 }
1417
1418 p++;
1419 status_len = SVAL(p, 0);
1420 p += 2;
1421
1422 /* dirtype &= ~aDIR; */
1423
1424 if (status_len == 0) {
1425 nt_status = filename_convert(ctx, conn,
1426 req->flags2 & FLAGS2_DFS_PATHNAMES,
1427 path,
1428 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1429 &mask_contains_wcard,
1430 &smb_fname);
1431 if (!NT_STATUS_IS_OK(nt_status)) {
1432 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1433 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1434 ERRSRV, ERRbadpath);
1435 goto out;
1436 }
1437 reply_nterror(req, nt_status);
1438 goto out;
1439 }
1440
1441 directory = smb_fname->base_name;
1442
1443 p = strrchr_m(directory,'/');
1444 if ((p != NULL) && (*directory != '/')) {
1445 mask = p + 1;
1446 directory = talloc_strndup(ctx, directory,
1447 PTR_DIFF(p, directory));
1448 } else {
1449 mask = directory;
1450 directory = talloc_strdup(ctx,".");
1451 }
1452
1453 if (!directory) {
1454 reply_nterror(req, NT_STATUS_NO_MEMORY);
1455 goto out;
1456 }
1457
1458 memset((char *)status,'\0',21);
1459 SCVAL(status,0,(dirtype & 0x1F));
1460
1461 nt_status = dptr_create(conn,
1462 directory,
1463 True,
1464 expect_close,
1465 req->smbpid,
1466 mask,
1467 mask_contains_wcard,
1468 dirtype,
1469 &dirptr);
1470 if (!NT_STATUS_IS_OK(nt_status)) {
1471 reply_nterror(req, nt_status);
1472 goto out;
1473 }
1474 dptr_num = dptr_dnum(dirptr);
1475 } else {
1476 int status_dirtype;
1477 const char *dirpath;
1478
1479 memcpy(status,p,21);
1480 status_dirtype = CVAL(status,0) & 0x1F;
1481 if (status_dirtype != (dirtype & 0x1F)) {
1482 dirtype = status_dirtype;
1483 }
1484
1485 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1486 if (!dirptr) {
1487 goto SearchEmpty;
1488 }
1489 dirpath = dptr_path(sconn, dptr_num);
1490 directory = talloc_strdup(ctx, dirpath);
1491 if (!directory) {
1492 reply_nterror(req, NT_STATUS_NO_MEMORY);
1493 goto out;
1494 }
1495
1496 mask = dptr_wcard(sconn, dptr_num);
1497 if (!mask) {
1498 goto SearchEmpty;
1499 }
1500 /*
1501 * For a 'continue' search we have no string. So
1502 * check from the initial saved string.
1503 */
1504 mask_contains_wcard = ms_has_wild(mask);
1505 dirtype = dptr_attr(sconn, dptr_num);
1506 }
1507
1508 DEBUG(4,("dptr_num is %d\n",dptr_num));
1509
1510 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1511 dptr_init_search_op(dirptr);
1512
1513 if ((dirtype&0x1F) == aVOLID) {
1514 char buf[DIR_STRUCT_SIZE];
1515 memcpy(buf,status,21);
1516 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1517 0,aVOLID,0,!allow_long_path_components)) {
1518 reply_nterror(req, NT_STATUS_NO_MEMORY);
1519 goto out;
1520 }
1521 dptr_fill(sconn, buf+12,dptr_num);
1522 if (dptr_zero(buf+12) && (status_len==0)) {
1523 numentries = 1;
1524 } else {
1525 numentries = 0;
1526 }
1527 if (message_push_blob(&req->outbuf,
1528 data_blob_const(buf, sizeof(buf)))
1529 == -1) {
1530 reply_nterror(req, NT_STATUS_NO_MEMORY);
1531 goto out;
1532 }
1533 } else {
1534 unsigned int i;
1535 maxentries = MIN(
1536 maxentries,
1537 ((BUFFER_SIZE -
1538 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1539 /DIR_STRUCT_SIZE));
1540
1541 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1542 directory,lp_dontdescend(SNUM(conn))));
1543 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1544 check_descend = True;
1545 }
1546
1547 for (i=numentries;(i<maxentries) && !finished;i++) {
1548 finished = !get_dir_entry(ctx,
1549 dirptr,
1550 mask,
1551 dirtype,
1552 &fname,
1553 &size,
1554 &mode,
1555 &date,
1556 check_descend,
1557 ask_sharemode);
1558 if (!finished) {
1559 char buf[DIR_STRUCT_SIZE];
1560 memcpy(buf,status,21);
1561 if (!make_dir_struct(ctx,
1562 buf,
1563 mask,
1564 fname,
1565 size,
1566 mode,
1567 convert_timespec_to_time_t(date),
1568 !allow_long_path_components)) {
1569 reply_nterror(req, NT_STATUS_NO_MEMORY);
1570 goto out;
1571 }
1572 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1573 break;
1574 }
1575 if (message_push_blob(&req->outbuf,
1576 data_blob_const(buf, sizeof(buf)))
1577 == -1) {
1578 reply_nterror(req, NT_STATUS_NO_MEMORY);
1579 goto out;
1580 }
1581 numentries++;
1582 }
1583 }
1584 }
1585
1586 SearchEmpty:
1587
1588 /* If we were called as SMBffirst with smb_search_id == NULL
1589 and no entries were found then return error and close dirptr
1590 (X/Open spec) */
1591
1592 if (numentries == 0) {
1593 dptr_close(sconn, &dptr_num);
1594 } else if(expect_close && status_len == 0) {
1595 /* Close the dptr - we know it's gone */
1596 dptr_close(sconn, &dptr_num);
1597 }
1598
1599 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1600 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1601 dptr_close(sconn, &dptr_num);
1602 }
1603
1604 if ((numentries == 0) && !mask_contains_wcard) {
1605 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1606 goto out;
1607 }
1608
1609 SSVAL(req->outbuf,smb_vwv0,numentries);
1610 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1611 SCVAL(smb_buf(req->outbuf),0,5);
1612 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1613
1614 /* The replies here are never long name. */
1615 SSVAL(req->outbuf, smb_flg2,
1616 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1617 if (!allow_long_path_components) {
1618 SSVAL(req->outbuf, smb_flg2,
1619 SVAL(req->outbuf, smb_flg2)
1620 & (~FLAGS2_LONG_PATH_COMPONENTS));
1621 }
1622
1623 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1624 SSVAL(req->outbuf, smb_flg2,
1625 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1626
1627 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1628 smb_fn_name(req->cmd),
1629 mask,
1630 directory,
1631 dirtype,
1632 numentries,
1633 maxentries ));
1634 out:
1635 TALLOC_FREE(directory);
1636 TALLOC_FREE(smb_fname);
1637 END_PROFILE(SMBsearch);
1638 return;
1639 }
1640
1641 /****************************************************************************
1642 Reply to a fclose (stop directory search).
1643 ****************************************************************************/
1644
1645 void reply_fclose(struct smb_request *req)
1646 {
1647 int status_len;
1648 char status[21];
1649 int dptr_num= -2;
1650 const char *p;
1651 char *path = NULL;
1652 NTSTATUS err;
1653 bool path_contains_wcard = False;
1654 TALLOC_CTX *ctx = talloc_tos();
1655 struct smbd_server_connection *sconn = req->sconn;
1656
1657 START_PROFILE(SMBfclose);
1658
1659 if (lp_posix_pathnames()) {
1660 reply_unknown_new(req, req->cmd);
1661 END_PROFILE(SMBfclose);
1662 return;
1663 }
1664
1665 p = (const char *)req->buf + 1;
1666 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1667 &err, &path_contains_wcard);
1668 if (!NT_STATUS_IS_OK(err)) {
1669 reply_nterror(req, err);
1670 END_PROFILE(SMBfclose);
1671 return;
1672 }
1673 p++;
1674 status_len = SVAL(p,0);
1675 p += 2;
1676
1677 if (status_len == 0) {
1678 reply_force_doserror(req, ERRSRV, ERRsrverror);
1679 END_PROFILE(SMBfclose);
1680 return;
1681 }
1682
1683 memcpy(status,p,21);
1684
1685 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1686 /* Close the dptr - we know it's gone */
1687 dptr_close(sconn, &dptr_num);
1688 }
1689
1690 reply_outbuf(req, 1, 0);
1691 SSVAL(req->outbuf,smb_vwv0,0);
1692
1693 DEBUG(3,("search close\n"));
1694
1695 END_PROFILE(SMBfclose);
1696 return;
1697 }
1698
1699 /****************************************************************************
1700 Reply to an open.
1701 ****************************************************************************/
1702
1703 void reply_open(struct smb_request *req)
1704 {
1705 connection_struct *conn = req->conn;
1706 struct smb_filename *smb_fname = NULL;
1707 char *fname = NULL;
1708 uint32 fattr=0;
1709 SMB_OFF_T size = 0;
1710 time_t mtime=0;
1711 int info;
1712 files_struct *fsp;
1713 int oplock_request;
1714 int deny_mode;
1715 uint32 dos_attr;
1716 uint32 access_mask;
1717 uint32 share_mode;
1718 uint32 create_disposition;
1719 uint32 create_options = 0;
1720 uint32_t private_flags = 0;
1721 NTSTATUS status;
1722 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1723 TALLOC_CTX *ctx = talloc_tos();
1724
1725 START_PROFILE(SMBopen);
1726
1727 if (req->wct < 2) {
1728 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1729 goto out;
1730 }
1731
1732 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1733 deny_mode = SVAL(req->vwv+0, 0);
1734 dos_attr = SVAL(req->vwv+1, 0);
1735
1736 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1737 STR_TERMINATE, &status);
1738 if (!NT_STATUS_IS_OK(status)) {
1739 reply_nterror(req, status);
1740 goto out;
1741 }
1742
1743 status = filename_convert(ctx,
1744 conn,
1745 req->flags2 & FLAGS2_DFS_PATHNAMES,
1746 fname,
1747 0,
1748 NULL,
1749 &smb_fname);
1750 if (!NT_STATUS_IS_OK(status)) {
1751 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1752 reply_botherror(req,
1753 NT_STATUS_PATH_NOT_COVERED,
1754 ERRSRV, ERRbadpath);
1755 goto out;
1756 }
1757 reply_nterror(req, status);
1758 goto out;
1759 }
1760
1761 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1762 OPENX_FILE_EXISTS_OPEN, &access_mask,
1763 &share_mode, &create_disposition,
1764 &create_options, &private_flags)) {
1765 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1766 goto out;
1767 }
1768
1769 status = SMB_VFS_CREATE_FILE(
1770 conn, /* conn */
1771 req, /* req */
1772 0, /* root_dir_fid */
1773 smb_fname, /* fname */
1774 access_mask, /* access_mask */
1775 share_mode, /* share_access */
1776 create_disposition, /* create_disposition*/
1777 create_options, /* create_options */
1778 dos_attr, /* file_attributes */
1779 oplock_request, /* oplock_request */
1780 0, /* allocation_size */
1781 private_flags,
1782 NULL, /* sd */
1783 NULL, /* ea_list */
1784 &fsp, /* result */
1785 &info); /* pinfo */
1786
1787 if (!NT_STATUS_IS_OK(status)) {
1788 if (open_was_deferred(req->mid)) {
1789 /* We have re-scheduled this call. */
1790 goto out;
1791 }
1792 reply_openerror(req, status);
1793 goto out;
1794 }
1795
1796 size = smb_fname->st.st_ex_size;
1797 fattr = dos_mode(conn, smb_fname);
1798
1799 /* Deal with other possible opens having a modified
1800 write time. JRA. */
1801 if (ask_sharemode) {
1802 struct timespec write_time_ts;
1803
1804 ZERO_STRUCT(write_time_ts);
1805 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1806 if (!null_timespec(write_time_ts)) {
1807 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1808 }
1809 }
1810
1811 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1812
1813 if (fattr & aDIR) {
1814 DEBUG(3,("attempt to open a directory %s\n",
1815 fsp_str_dbg(fsp)));
1816 close_file(req, fsp, ERROR_CLOSE);
1817 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1818 ERRDOS, ERRnoaccess);
1819 goto out;
1820 }
1821
1822 reply_outbuf(req, 7, 0);
1823 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1824 SSVAL(req->outbuf,smb_vwv1,fattr);
1825 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1826 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1827 } else {
1828 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1829 }
1830 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1831 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1832
1833 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1834 SCVAL(req->outbuf,smb_flg,
1835 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1836 }
1837
1838 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1839 SCVAL(req->outbuf,smb_flg,
1840 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1841 }
1842 out:
1843 TALLOC_FREE(smb_fname);
1844 END_PROFILE(SMBopen);
1845 return;
1846 }
1847
1848 /****************************************************************************
1849 Reply to an open and X.
1850 ****************************************************************************/
1851
1852 void reply_open_and_X(struct smb_request *req)
1853 {
1854 connection_struct *conn = req->conn;
1855 struct smb_filename *smb_fname = NULL;
1856 char *fname = NULL;
1857 uint16 open_flags;
1858 int deny_mode;
1859 uint32 smb_attr;
1860 /* Breakout the oplock request bits so we can set the
1861 reply bits separately. */
1862 int ex_oplock_request;
1863 int core_oplock_request;
1864 int oplock_request;
1865 #if 0
1866 int smb_sattr = SVAL(req->vwv+4, 0);
1867 uint32 smb_time = make_unix_date3(req->vwv+6);
1868 #endif
1869 int smb_ofun;
1870 uint32 fattr=0;
1871 int mtime=0;
1872 int smb_action = 0;
1873 files_struct *fsp;
1874 NTSTATUS status;
1875 uint64_t allocation_size;
1876 ssize_t retval = -1;
1877 uint32 access_mask;
1878 uint32 share_mode;
1879 uint32 create_disposition;
1880 uint32 create_options = 0;
1881 uint32_t private_flags = 0;
1882 TALLOC_CTX *ctx = talloc_tos();
1883
1884 START_PROFILE(SMBopenX);
1885
1886 if (req->wct < 15) {
1887 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1888 goto out;
1889 }
1890
1891 open_flags = SVAL(req->vwv+2, 0);
1892 deny_mode = SVAL(req->vwv+3, 0);
1893 smb_attr = SVAL(req->vwv+5, 0);
1894 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1895 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1896 oplock_request = ex_oplock_request | core_oplock_request;
1897 smb_ofun = SVAL(req->vwv+8, 0);
1898 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1899
1900 /* If it's an IPC, pass off the pipe handler. */
1901 if (IS_IPC(conn)) {
1902 if (lp_nt_pipe_support()) {
1903 reply_open_pipe_and_X(conn, req);
1904 } else {
1905 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1906 }
1907 goto out;
1908 }
1909
1910 /* XXXX we need to handle passed times, sattr and flags */
1911 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1912 STR_TERMINATE, &status);
1913 if (!NT_STATUS_IS_OK(status)) {
1914 reply_nterror(req, status);
1915 goto out;
1916 }
1917
1918 status = filename_convert(ctx,
1919 conn,
1920 req->flags2 & FLAGS2_DFS_PATHNAMES,
1921 fname,
1922 0,
1923 NULL,
1924 &smb_fname);
1925 if (!NT_STATUS_IS_OK(status)) {
1926 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1927 reply_botherror(req,
1928 NT_STATUS_PATH_NOT_COVERED,
1929 ERRSRV, ERRbadpath);
1930 goto out;
1931 }
1932 reply_nterror(req, status);
1933 goto out;
1934 }
1935
1936 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1937 &access_mask, &share_mode,
1938 &create_disposition,
1939 &create_options,
1940 &private_flags)) {
1941 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1942 goto out;
1943 }
1944
1945 status = SMB_VFS_CREATE_FILE(
1946 conn, /* conn */
1947 req, /* req */
1948 0, /* root_dir_fid */
1949 smb_fname, /* fname */
1950 access_mask, /* access_mask */
1951 share_mode, /* share_access */
1952 create_disposition, /* create_disposition*/
1953 create_options, /* create_options */
1954 smb_attr, /* file_attributes */
1955 oplock_request, /* oplock_request */
1956 0, /* allocation_size */
1957 private_flags,
1958 NULL, /* sd */
1959 NULL, /* ea_list */
1960 &fsp, /* result */
1961 &smb_action); /* pinfo */
1962
1963 if (!NT_STATUS_IS_OK(status)) {
1964 if (open_was_deferred(req->mid)) {
1965 /* We have re-scheduled this call. */
1966 goto out;
1967 }
1968 reply_openerror(req, status);
1969 goto out;
1970 }
1971
1972 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1973 if the file is truncated or created. */
1974 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1975 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1976 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1977 close_file(req, fsp, ERROR_CLOSE);
1978 reply_nterror(req, NT_STATUS_DISK_FULL);
1979 goto out;
1980 }
1981 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1982 if (retval < 0) {
1983 close_file(req, fsp, ERROR_CLOSE);
1984 reply_nterror(req, NT_STATUS_DISK_FULL);
1985 goto out;
1986 }
1987 smb_fname->st.st_ex_size =
1988 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1989 }
1990
1991 fattr = dos_mode(conn, smb_fname);
1992 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1993 if (fattr & aDIR) {
1994 close_file(req, fsp, ERROR_CLOSE);
1995 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1996 goto out;
1997 }
1998
1999 /* If the caller set the extended oplock request bit
2000 and we granted one (by whatever means) - set the
2001 correct bit for extended oplock reply.
2002 */
2003
2004 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2005 smb_action |= EXTENDED_OPLOCK_GRANTED;
2006 }
2007
2008 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2009 smb_action |= EXTENDED_OPLOCK_GRANTED;
2010 }
2011
2012 /* If the caller set the core oplock request bit
2013 and we granted one (by whatever means) - set the
2014 correct bit for core oplock reply.
2015 */
2016
2017 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2018 reply_outbuf(req, 19, 0);
2019 } else {
2020 reply_outbuf(req, 15, 0);
2021 }
2022
2023 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2024 SCVAL(req->outbuf, smb_flg,
2025 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2026 }
2027
2028 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2029 SCVAL(req->outbuf, smb_flg,
2030 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2031 }
2032
2033 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2034 SSVAL(req->outbuf,smb_vwv3,fattr);
2035 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2036 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2037 } else {
2038 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2039 }
2040 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2041 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2042 SSVAL(req->outbuf,smb_vwv11,smb_action);
2043
2044 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2045 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2046 }
2047
2048 chain_reply(req);
2049 out:
2050 TALLOC_FREE(smb_fname);
2051 END_PROFILE(SMBopenX);
2052 return;
2053 }
2054
2055 /****************************************************************************
2056 Reply to a SMBulogoffX.
2057 ****************************************************************************/
2058
2059 void reply_ulogoffX(struct smb_request *req)
2060 {
2061 struct smbd_server_connection *sconn = req->sconn;
2062 user_struct *vuser;
2063
2064 START_PROFILE(SMBulogoffX);
2065
2066 vuser = get_valid_user_struct(sconn, req->vuid);
2067
2068 if(vuser == NULL) {
2069 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2070 req->vuid));
2071 }
2072
2073 /* in user level security we are supposed to close any files
2074 open by this user */
2075 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2076 file_close_user(sconn, req->vuid);
2077 }
2078
2079 invalidate_vuid(sconn, req->vuid);
2080
2081 reply_outbuf(req, 2, 0);
2082
2083 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2084
2085 END_PROFILE(SMBulogoffX);
2086 req->vuid = UID_FIELD_INVALID;
2087 chain_reply(req);
2088 }
2089
2090 /****************************************************************************
2091 Reply to a mknew or a create.
2092 ****************************************************************************/
2093
2094 void reply_mknew(struct smb_request *req)
2095 {
2096 connection_struct *conn = req->conn;
2097 struct smb_filename *smb_fname = NULL;
2098 char *fname = NULL;
2099 uint32 fattr = 0;
2100 struct smb_file_time ft;
2101 files_struct *fsp;
2102 int oplock_request = 0;
2103 NTSTATUS status;
2104 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2105 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2106 uint32 create_disposition;
2107 uint32 create_options = 0;
2108 TALLOC_CTX *ctx = talloc_tos();
2109
2110 START_PROFILE(SMBcreate);
2111 ZERO_STRUCT(ft);
2112
2113 if (req->wct < 3) {
2114 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2115 goto out;
2116 }
2117
2118 fattr = SVAL(req->vwv+0, 0);
2119 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2120
2121 /* mtime. */
2122 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2123
2124 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2125 STR_TERMINATE, &status);
2126 if (!NT_STATUS_IS_OK(status)) {
2127 reply_nterror(req, status);
2128 goto out;
2129 }
2130
2131 status = filename_convert(ctx,
2132 conn,
2133 req->flags2 & FLAGS2_DFS_PATHNAMES,
2134 fname,
2135 0,
2136 NULL,
2137 &smb_fname);
2138 if (!NT_STATUS_IS_OK(status)) {
2139 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2140 reply_botherror(req,
2141 NT_STATUS_PATH_NOT_COVERED,
2142 ERRSRV, ERRbadpath);
2143 goto out;
2144 }
2145 reply_nterror(req, status);
2146 goto out;
2147 }
2148
2149 if (fattr & aVOLID) {
2150 DEBUG(0,("Attempt to create file (%s) with volid set - "
2151 "please report this\n",
2152 smb_fname_str_dbg(smb_fname)));
2153 }
2154
2155 if(req->cmd == SMBmknew) {
2156 /* We should fail if file exists. */
2157 create_disposition = FILE_CREATE;
2158 } else {
2159 /* Create if file doesn't exist, truncate if it does. */
2160 create_disposition = FILE_OVERWRITE_IF;
2161 }
2162
2163 status = SMB_VFS_CREATE_FILE(
2164 conn, /* conn */
2165 req, /* req */
2166 0, /* root_dir_fid */
2167 smb_fname, /* fname */
2168 access_mask, /* access_mask */
2169 share_mode, /* share_access */
2170 create_disposition, /* create_disposition*/
2171 create_options, /* create_options */
2172 fattr, /* file_attributes */
2173 oplock_request, /* oplock_request */
2174 0, /* allocation_size */
2175 0, /* private_flags */
2176 NULL, /* sd */
2177 NULL, /* ea_list */
2178 &fsp, /* result */
2179 NULL); /* pinfo */
2180
2181 if (!NT_STATUS_IS_OK(status)) {
2182 if (open_was_deferred(req->mid)) {
2183 /* We have re-scheduled this call. */
2184 goto out;
2185 }
2186 reply_openerror(req, status);
2187 goto out;
2188 }
2189
2190 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2191 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2192 if (!NT_STATUS_IS_OK(status)) {
2193 END_PROFILE(SMBcreate);
2194 goto out;
2195 }
2196
2197 reply_outbuf(req, 1, 0);
2198 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2199
2200 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2201 SCVAL(req->outbuf,smb_flg,
2202 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2203 }
2204
2205 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2206 SCVAL(req->outbuf,smb_flg,
2207 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2208 }
2209
2210 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2211 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2212 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2213 (unsigned int)fattr));
2214
2215 out:
2216 TALLOC_FREE(smb_fname);
2217 END_PROFILE(SMBcreate);
2218 return;
2219 }
2220
2221 /****************************************************************************
2222 Reply to a create temporary file.
2223 ****************************************************************************/
2224
2225 void reply_ctemp(struct smb_request *req)
2226 {
2227 connection_struct *conn = req->conn;
2228 struct smb_filename *smb_fname = NULL;
2229 char *fname = NULL;
2230 uint32 fattr;
2231 files_struct *fsp;
2232 int oplock_request;
2233 int tmpfd;
2234 char *s;
2235 NTSTATUS status;
2236 TALLOC_CTX *ctx = talloc_tos();
2237
2238 START_PROFILE(SMBctemp);
2239
2240 if (req->wct < 3) {
2241 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2242 goto out;
2243 }
2244
2245 fattr = SVAL(req->vwv+0, 0);
2246 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2247
2248 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2249 STR_TERMINATE, &status);
2250 if (!NT_STATUS_IS_OK(status)) {
2251 reply_nterror(req, status);
2252 goto out;
2253 }
2254 if (*fname) {
2255 fname = talloc_asprintf(ctx,
2256 "%s/TMXXXXXX",
2257 fname);
2258 } else {
2259 fname = talloc_strdup(ctx, "TMXXXXXX");
2260 }
2261
2262 if (!fname) {
2263 reply_nterror(req, NT_STATUS_NO_MEMORY);
2264 goto out;
2265 }
2266
2267 status = filename_convert(ctx, conn,
2268 req->flags2 & FLAGS2_DFS_PATHNAMES,
2269 fname,
2270 0,
2271 NULL,
2272 &smb_fname);
2273 if (!NT_STATUS_IS_OK(status)) {
2274 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2275 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2276 ERRSRV, ERRbadpath);
2277 goto out;
2278 }
2279 reply_nterror(req, status);
2280 goto out;
2281 }
2282
2283 tmpfd = mkstemp(smb_fname->base_name);
2284 if (tmpfd == -1) {
2285 reply_nterror(req, map_nt_error_from_unix(errno));
2286 goto out;
2287 }
2288
2289 SMB_VFS_STAT(conn, smb_fname);
2290
2291 /* We should fail if file does not exist. */
2292 status = SMB_VFS_CREATE_FILE(
2293 conn, /* conn */
2294 req, /* req */
2295 0, /* root_dir_fid */
2296 smb_fname, /* fname */
2297 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2298 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2299 FILE_OPEN, /* create_disposition*/
2300 0, /* create_options */
2301 fattr, /* file_attributes */
2302 oplock_request, /* oplock_request */
2303 0, /* allocation_size */
2304 0, /* private_flags */
2305 NULL, /* sd */
2306 NULL, /* ea_list */
2307 &fsp, /* result */
2308 NULL); /* pinfo */
2309
2310 /* close fd from mkstemp() */
2311 close(tmpfd);
2312
2313 if (!NT_STATUS_IS_OK(status)) {
2314 if (open_was_deferred(req->mid)) {
2315 /* We have re-scheduled this call. */
2316 goto out;
2317 }
2318 reply_openerror(req, status);
2319 goto out;
2320 }
2321
2322 reply_outbuf(req, 1, 0);
2323 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2324
2325 /* the returned filename is relative to the directory */
2326 s = strrchr_m(fsp->fsp_name->base_name, '/');
2327 if (!s) {
2328 s = fsp->fsp_name->base_name;
2329 } else {
2330 s++;
2331 }
2332
2333 #if 0
2334 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2335 thing in the byte section. JRA */
2336 SSVALS(p, 0, -1); /* what is this? not in spec */
2337 #endif
2338 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2339 == -1) {
2340 reply_nterror(req, NT_STATUS_NO_MEMORY);
2341 goto out;
2342 }
2343
2344 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2345 SCVAL(req->outbuf, smb_flg,
2346 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2347 }
2348
2349 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2350 SCVAL(req->outbuf, smb_flg,
2351 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2352 }
2353
2354 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2355 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2356 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2357 out:
2358 TALLOC_FREE(smb_fname);
2359 END_PROFILE(SMBctemp);
2360 return;
2361 }
2362
2363 /*******************************************************************
2364 Check if a user is allowed to rename a file.
2365 ********************************************************************/
2366
2367 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2368 uint16 dirtype)
2369 {
2370 uint32 fmode;
2371
2372 if (!CAN_WRITE(conn)) {
2373 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2374 }
2375
2376 fmode = dos_mode(conn, fsp->fsp_name);
2377 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2378 return NT_STATUS_NO_SUCH_FILE;
2379 }
2380
2381 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2382 if (fsp->posix_open) {
2383 return NT_STATUS_OK;
2384 }
2385
2386 /* If no pathnames are open below this
2387 directory, allow the rename. */
2388
2389 if (file_find_subpath(fsp)) {
2390 return NT_STATUS_ACCESS_DENIED;
2391 }
2392 return NT_STATUS_OK;
2393 }
2394
2395 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2396 return NT_STATUS_OK;
2397 }
2398
2399 return NT_STATUS_ACCESS_DENIED;
2400 }
2401
2402 /*******************************************************************
2403 * unlink a file with all relevant access checks
2404 *******************************************************************/
2405
2406 static NTSTATUS do_unlink(connection_struct *conn,
2407 struct smb_request *req,
2408 struct smb_filename *smb_fname,
2409 uint32 dirtype)
2410 {
2411 uint32 fattr;
2412 files_struct *fsp;
2413 uint32 dirtype_orig = dirtype;
2414 NTSTATUS status;
2415 int ret;
2416 bool posix_paths = lp_posix_pathnames();
2417
2418 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2419 smb_fname_str_dbg(smb_fname),
2420 dirtype));
2421
2422 if (!CAN_WRITE(conn)) {
2423 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2424 }
2425
2426 if (posix_paths) {
2427 ret = SMB_VFS_LSTAT(conn, smb_fname);
2428 } else {
2429 ret = SMB_VFS_STAT(conn, smb_fname);
2430 }
2431 if (ret != 0) {
2432 return map_nt_error_from_unix(errno);
2433 }
2434
2435 fattr = dos_mode(conn, smb_fname);
2436
2437 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2438 dirtype = aDIR|aARCH|aRONLY;
2439 }
2440
2441 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2442 if (!dirtype) {
2443 return NT_STATUS_NO_SUCH_FILE;
2444 }
2445
2446 if (!dir_check_ftype(conn, fattr, dirtype)) {
2447 if (fattr & aDIR) {
2448 return NT_STATUS_FILE_IS_A_DIRECTORY;
2449 }
2450 return NT_STATUS_NO_SUCH_FILE;
2451 }
2452
2453 if (dirtype_orig & 0x8000) {
2454 /* These will never be set for POSIX. */
2455 return NT_STATUS_NO_SUCH_FILE;
2456 }
2457
2458 #if 0
2459 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2460 return NT_STATUS_FILE_IS_A_DIRECTORY;
2461 }
2462
2463 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2464 return NT_STATUS_NO_SUCH_FILE;
2465 }
2466
2467 if (dirtype & 0xFF00) {
2468 /* These will never be set for POSIX. */
2469 return NT_STATUS_NO_SUCH_FILE;
2470 }
2471
2472 dirtype &= 0xFF;
2473 if (!dirtype) {
2474 return NT_STATUS_NO_SUCH_FILE;
2475 }
2476
2477 /* Can't delete a directory. */
2478 if (fattr & aDIR) {
2479 return NT_STATUS_FILE_IS_A_DIRECTORY;
2480 }
2481 #endif
2482
2483 #if 0 /* JRATEST */
2484 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2485 return NT_STATUS_OBJECT_NAME_INVALID;
2486 #endif /* JRATEST */
2487
2488 /* On open checks the open itself will check the share mode, so
2489 don't do it here as we'll get it wrong. */
2490
2491 status = SMB_VFS_CREATE_FILE
2492 (conn, /* conn */
2493 req, /* req */
2494 0, /* root_dir_fid */
2495 smb_fname, /* fname */
2496 DELETE_ACCESS, /* access_mask */
2497 FILE_SHARE_NONE, /* share_access */
2498 FILE_OPEN, /* create_disposition*/
2499 FILE_NON_DIRECTORY_FILE, /* create_options */
2500 /* file_attributes */
2501 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2502 FILE_ATTRIBUTE_NORMAL,
2503 0, /* oplock_request */
2504 0, /* allocation_size */
2505 0, /* private_flags */
2506 NULL, /* sd */
2507 NULL, /* ea_list */
2508 &fsp, /* result */
2509 NULL); /* pinfo */
2510
2511 if (!NT_STATUS_IS_OK(status)) {
2512 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2513 nt_errstr(status)));
2514 return status;
2515 }
2516
2517 status = can_set_delete_on_close(fsp, fattr);
2518 if (!NT_STATUS_IS_OK(status)) {
2519 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2520 "(%s)\n",
2521 smb_fname_str_dbg(smb_fname),
2522 nt_errstr(status)));
2523 close_file(req, fsp, NORMAL_CLOSE);
2524 return status;
2525 }
2526
2527 /* The set is across all open files on this dev/inode pair. */
2528 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2529 close_file(req, fsp, NORMAL_CLOSE);
2530 return NT_STATUS_ACCESS_DENIED;
2531 }
2532
2533 return close_file(req, fsp, NORMAL_CLOSE);
2534 }
2535
2536 /****************************************************************************
2537 The guts of the unlink command, split out so it may be called by the NT SMB
2538 code.
2539 ****************************************************************************/
2540
2541 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2542 uint32 dirtype, struct smb_filename *smb_fname,
2543 bool has_wild)
2544 {
2545 char *fname_dir = NULL;
2546 char *fname_mask = NULL;
2547 int count=0;
2548 NTSTATUS status = NT_STATUS_OK;
2549 TALLOC_CTX *ctx = talloc_tos();
2550
2551 /* Split up the directory from the filename/mask. */
2552 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2553 &fname_dir, &fname_mask);
2554 if (!NT_STATUS_IS_OK(status)) {
2555 goto out;
2556 }
2557
2558 /*
2559 * We should only check the mangled cache
2560 * here if unix_convert failed. This means
2561 * that the path in 'mask' doesn't exist
2562 * on the file system and so we need to look
2563 * for a possible mangle. This patch from
2564 * Tine Smukavec <valentin.smukavec@hermes.si>.
2565 */
2566
2567 if (!VALID_STAT(smb_fname->st) &&
2568 mangle_is_mangled(fname_mask, conn->params)) {
2569 char *new_mask = NULL;
2570 mangle_lookup_name_from_8_3(ctx, fname_mask,
2571 &new_mask, conn->params);
2572 if (new_mask) {
2573 TALLOC_FREE(fname_mask);
2574 fname_mask = new_mask;
2575 }
2576 }
2577
2578 if (!has_wild) {
2579
2580 /*
2581 * Only one file needs to be unlinked. Append the mask back
2582 * onto the directory.
2583 */
2584 TALLOC_FREE(smb_fname->base_name);
2585 smb_fname->base_name = talloc_asprintf(smb_fname,
2586 "%s/%s",
2587 fname_dir,
2588 fname_mask);
2589 if (!smb_fname->base_name) {
2590 status = NT_STATUS_NO_MEMORY;
2591 goto out;
2592 }
2593 if (dirtype == 0) {
2594 dirtype = FILE_ATTRIBUTE_NORMAL;
2595 }
2596
2597 status = check_name(conn, smb_fname->base_name);
2598 if (!NT_STATUS_IS_OK(status)) {
2599 goto out;
2600 }
2601
2602 status = do_unlink(conn, req, smb_fname, dirtype);
2603 if (!NT_STATUS_IS_OK(status)) {
2604 goto out;
2605 }
2606
2607 count++;
2608 } else {
2609 struct smb_Dir *dir_hnd = NULL;
2610 long offset = 0;
2611 const char *dname = NULL;
2612 char *talloced = NULL;
2613
2614 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2615 status = NT_STATUS_OBJECT_NAME_INVALID;
2616 goto out;
2617 }
2618
2619 if (strequal(fname_mask,"????????.???")) {
2620 TALLOC_FREE(fname_mask);
2621 fname_mask = talloc_strdup(ctx, "*");
2622 if (!fname_mask) {
2623 status = NT_STATUS_NO_MEMORY;
2624 goto out;
2625 }
2626 }
2627
2628 status = check_name(conn, fname_dir);
2629 if (!NT_STATUS_IS_OK(status)) {
2630 goto out;
2631 }
2632
2633 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2634 dirtype);
2635 if (dir_hnd == NULL) {
2636 status = map_nt_error_from_unix(errno);
2637 goto out;
2638 }
2639
2640 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2641 the pattern matches against the long name, otherwise the short name
2642 We don't implement this yet XXXX
2643 */
2644
2645 status = NT_STATUS_NO_SUCH_FILE;
2646
2647 while ((dname = ReadDirName(dir_hnd, &offset,
2648 &smb_fname->st, &talloced))) {
2649 TALLOC_CTX *frame = talloc_stackframe();
2650
2651 if (!is_visible_file(conn, fname_dir, dname,
2652 &smb_fname->st, true)) {
2653 TALLOC_FREE(frame);
2654 TALLOC_FREE(talloced);
2655 continue;
2656 }
2657
2658 /* Quick check for "." and ".." */
2659 if (ISDOT(dname) || ISDOTDOT(dname)) {
2660 TALLOC_FREE(frame);
2661 TALLOC_FREE(talloced);
2662 continue;
2663 }
2664
2665 if(!mask_match(dname, fname_mask,
2666 conn->case_sensitive)) {
2667 TALLOC_FREE(frame);
2668 TALLOC_FREE(talloced);
2669 continue;
2670 }
2671
2672 TALLOC_FREE(smb_fname->base_name);
2673 smb_fname->base_name =
2674 talloc_asprintf(smb_fname, "%s/%s",
2675 fname_dir, dname);
2676
2677 if (!smb_fname->base_name) {
2678 TALLOC_FREE(dir_hnd);
2679 status = NT_STATUS_NO_MEMORY;
2680 TALLOC_FREE(frame);
2681 TALLOC_FREE(talloced);
2682 goto out;
2683 }
2684
2685 status = check_name(conn, smb_fname->base_name);
2686 if (!NT_STATUS_IS_OK(status)) {
2687 TALLOC_FREE(dir_hnd);
2688 TALLOC_FREE(frame);
2689 TALLOC_FREE(talloced);
2690 goto out;
2691 }
2692
2693 status = do_unlink(conn, req, smb_fname, dirtype);
2694 if (!NT_STATUS_IS_OK(status)) {
2695 TALLOC_FREE(frame);
2696 TALLOC_FREE(talloced);
2697 continue;
2698 }
2699
2700 count++;
2701 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2702 smb_fname->base_name));
2703
2704 TALLOC_FREE(frame);
2705 TALLOC_FREE(talloced);
2706 }
2707 TALLOC_FREE(dir_hnd);
2708 }
2709
2710 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2711 status = map_nt_error_from_unix(errno);
2712 }
2713
2714 out:
2715 TALLOC_FREE(fname_dir);
2716 TALLOC_FREE(fname_mask);
2717 return status;
2718 }
2719
2720 /****************************************************************************
2721 Reply to a unlink
2722 ****************************************************************************/
2723
2724 void reply_unlink(struct smb_request *req)
2725 {
2726 connection_struct *conn = req->conn;
2727 char *name = NULL;
2728 struct smb_filename *smb_fname = NULL;
2729 uint32 dirtype;
2730 NTSTATUS status;
2731 bool path_contains_wcard = False;
2732 TALLOC_CTX *ctx = talloc_tos();
2733
2734 START_PROFILE(SMBunlink);
2735
2736 if (req->wct < 1) {
2737 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2738 goto out;
2739 }
2740
2741 dirtype = SVAL(req->vwv+0, 0);
2742
2743 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2744 STR_TERMINATE, &status,
2745 &path_contains_wcard);
2746 if (!NT_STATUS_IS_OK(status)) {
2747 reply_nterror(req, status);
2748 goto out;
2749 }
2750
2751 status = filename_convert(ctx, conn,
2752 req->flags2 & FLAGS2_DFS_PATHNAMES,
2753 name,
2754 UCF_COND_ALLOW_WCARD_LCOMP,
2755 &path_contains_wcard,
2756 &smb_fname);
2757 if (!NT_STATUS_IS_OK(status)) {
2758 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2759 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2760 ERRSRV, ERRbadpath);
2761 goto out;
2762 }
2763 reply_nterror(req, status);
2764 goto out;
2765 }
2766
2767 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2768
2769 status = unlink_internals(conn, req, dirtype, smb_fname,
2770 path_contains_wcard);
2771 if (!NT_STATUS_IS_OK(status)) {
2772 if (open_was_deferred(req->mid)) {
2773 /* We have re-scheduled this call. */
2774 goto out;
2775 }
2776 reply_nterror(req, status);
2777 goto out;
2778 }
2779
2780 reply_outbuf(req, 0, 0);
2781 out:
2782 TALLOC_FREE(smb_fname);
2783 END_PROFILE(SMBunlink);
2784 return;
2785 }
2786
2787 /****************************************************************************
2788 Fail for readbraw.
2789 ****************************************************************************/
2790
2791 static void fail_readraw(void)
2792 {
2793 const char *errstr = talloc_asprintf(talloc_tos(),
2794 "FAIL ! reply_readbraw: socket write fail (%s)",
2795 strerror(errno));
2796 if (!errstr) {
2797 errstr = "";
2798 }
2799 exit_server_cleanly(errstr);
2800 }
2801
2802 /****************************************************************************
2803 Fake (read/write) sendfile. Returns -1 on read or write fail.
2804 ****************************************************************************/
2805
2806 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2807 size_t nread)
2808 {
2809 size_t bufsize;
2810 size_t tosend = nread;
2811 char *buf;
2812
2813 if (nread == 0) {
2814 return 0;
2815 }
2816
2817 bufsize = MIN(nread, 65536);
2818
2819 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2820 return -1;
2821 }
2822
2823 while (tosend > 0) {
2824 ssize_t ret;
2825 size_t cur_read;
2826
2827 if (tosend > bufsize) {
2828 cur_read = bufsize;
2829 } else {
2830 cur_read = tosend;
2831 }
2832 ret = read_file(fsp,buf,startpos,cur_read);
2833 if (ret == -1) {
2834 SAFE_FREE(buf);
2835 return -1;
2836 }
2837
2838 /* If we had a short read, fill with zeros. */
2839 if (ret < cur_read) {
2840 memset(buf + ret, '\0', cur_read - ret);
2841 }
2842
2843 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2844 != cur_read) {
2845 char addr[INET6_ADDRSTRLEN];
2846 /*
2847 * Try and give an error message saying what
2848 * client failed.
2849 */
2850 DEBUG(0, ("write_data failed for client %s. "
2851 "Error %s\n",
2852 get_peer_addr(fsp->conn->sconn->sock, addr,
2853 sizeof(addr)),
2854 strerror(errno)));
2855 SAFE_FREE(buf);
2856 return -1;
2857 }
2858 tosend -= cur_read;
2859 startpos += cur_read;
2860 }
2861
2862 SAFE_FREE(buf);
2863 return (ssize_t)nread;
2864 }
2865
2866 #if defined(WITH_SENDFILE)
2867 /****************************************************************************
2868 Deal with the case of sendfile reading less bytes from the file than
2869 requested. Fill with zeros (all we can do).
2870 ****************************************************************************/
2871
2872 static void sendfile_short_send(files_struct *fsp,
2873 ssize_t nread,
2874 size_t headersize,
2875 size_t smb_maxcnt)
2876 {
2877 #define SHORT_SEND_BUFSIZE 1024
2878 if (nread < headersize) {
2879 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2880 "header for file %s (%s). Terminating\n",
2881 fsp_str_dbg(fsp), strerror(errno)));
2882 exit_server_cleanly("sendfile_short_send failed");
2883 }
2884
2885 nread -= headersize;
2886
2887 if (nread < smb_maxcnt) {
2888 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2889 if (!buf) {
2890 exit_server_cleanly("sendfile_short_send: "
2891 "malloc failed");
2892 }
2893
2894 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2895 "with zeros !\n", fsp_str_dbg(fsp)));
2896
2897 while (nread < smb_maxcnt) {
2898 /*
2899 * We asked for the real file size and told sendfile
2900 * to not go beyond the end of the file. But it can
2901 * happen that in between our fstat call and the
2902 * sendfile call the file was truncated. This is very
2903 * bad because we have already announced the larger
2904 * number of bytes to the client.
2905 *
2906 * The best we can do now is to send 0-bytes, just as
2907 * a read from a hole in a sparse file would do.
2908 *
2909 * This should happen rarely enough that I don't care
2910 * about efficiency here :-)
2911 */
2912 size_t to_write;
2913
2914 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2915 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2916 != to_write) {
2917 char addr[INET6_ADDRSTRLEN];
2918 /*
2919 * Try and give an error message saying what
2920 * client failed.
2921 */
2922 DEBUG(0, ("write_data failed for client %s. "
2923 "Error %s\n",
2924 get_peer_addr(
2925 fsp->conn->sconn->sock, addr,
2926 sizeof(addr)),
2927 strerror(errno)));
2928 exit_server_cleanly("sendfile_short_send: "
2929 "write_data failed");
2930 }
2931 nread += to_write;
2932 }
2933 SAFE_FREE(buf);
2934 }
2935 }
2936 #endif /* defined WITH_SENDFILE */
2937
2938 /****************************************************************************
2939 Return a readbraw error (4 bytes of zero).
2940 ****************************************************************************/
2941
2942 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2943 {
2944 char header[4];
2945
2946 SIVAL(header,0,0);
2947
2948 smbd_lock_socket(sconn);
2949 if (write_data(sconn->sock,header,4) != 4) {
2950 char addr[INET6_ADDRSTRLEN];
2951 /*
2952 * Try and give an error message saying what
2953 * client failed.
2954 */
2955 DEBUG(0, ("write_data failed for client %s. "
2956 "Error %s\n",
2957 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2958 strerror(errno)));
2959
2960 fail_readraw();
2961 }
2962 smbd_unlock_socket(sconn);
2963 }
2964
2965 /****************************************************************************
2966 Use sendfile in readbraw.
2967 ****************************************************************************/
2968
2969 static void send_file_readbraw(connection_struct *conn,
2970 struct smb_request *req,
2971 files_struct *fsp,
2972 SMB_OFF_T startpos,
2973 size_t nread,
2974 ssize_t mincount)
2975 {
2976 struct smbd_server_connection *sconn = req->sconn;
2977 char *outbuf = NULL;
2978 ssize_t ret=0;
2979
2980 #if defined(WITH_SENDFILE)
2981 /*
2982 * We can only use sendfile on a non-chained packet
2983 * but we can use on a non-oplocked file. tridge proved this
2984 * on a train in Germany :-). JRA.
2985 * reply_readbraw has already checked the length.
2986 */
2987
2988 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2989 (fsp->wcp == NULL) &&
2990 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
2991 ssize_t sendfile_read = -1;
2992 char header[4];
2993 DATA_BLOB header_blob;
2994
2995 _smb_setlen(header,nread);
2996 header_blob = data_blob_const(header, 4);
2997
2998 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
2999 &header_blob, startpos,
3000 nread);
3001 if (sendfile_read == -1) {
3002 /* Returning ENOSYS means no data at all was sent.
3003 * Do this as a normal read. */
3004 if (errno == ENOSYS) {
3005 goto normal_readbraw;
3006 }
3007
3008 /*
3009 * Special hack for broken Linux with no working sendfile. If we
3010 * return EINTR we sent the header but not the rest of the data.
3011 * Fake this up by doing read/write calls.
3012 */
3013 if (errno == EINTR) {
3014 /* Ensure we don't do this again. */
3015 set_use_sendfile(SNUM(conn), False);
3016 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3017
3018 if (fake_sendfile(fsp, startpos, nread) == -1) {
3019 DEBUG(0,("send_file_readbraw: "
3020 "fake_sendfile failed for "
3021 "file %s (%s).\n",
3022 fsp_str_dbg(fsp),
3023 strerror(errno)));
3024 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3025 }
3026 return;
3027 }
3028
3029 DEBUG(0,("send_file_readbraw: sendfile failed for "
3030 "file %s (%s). Terminating\n",
3031 fsp_str_dbg(fsp), strerror(errno)));
3032 exit_server_cleanly("send_file_readbraw sendfile failed");
3033 } else if (sendfile_read == 0) {
3034 /*
3035 * Some sendfile implementations return 0 to indicate
3036 * that there was a short read, but nothing was
3037 * actually written to the socket. In this case,
3038 * fallback to the normal read path so the header gets
3039 * the correct byte count.
3040 */
3041 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3042 "bytes falling back to the normal read: "
3043 "%s\n", fsp_str_dbg(fsp)));
3044 goto normal_readbraw;
3045 }
3046
3047 /* Deal with possible short send. */
3048 if (sendfile_read != 4+nread) {
3049 sendfile_short_send(fsp, sendfile_read, 4, nread);
3050 }
3051 return;
3052 }
3053
3054 normal_readbraw:
3055 #endif
3056
3057 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3058 if (!outbuf) {
3059 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3060 (unsigned)(nread+4)));
3061 reply_readbraw_error(sconn);
3062 return;
3063 }
3064
3065 if (nread > 0) {
3066 ret = read_file(fsp,outbuf+4,startpos,nread);
3067 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3068 if (ret < mincount)
3069 ret = 0;
3070 #else
3071 if (ret < nread)
3072 ret = 0;
3073 #endif
3074 }
3075
3076 _smb_setlen(outbuf,ret);
3077 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3078 char addr[INET6_ADDRSTRLEN];
3079 /*
3080 * Try and give an error message saying what
3081 * client failed.
3082 */
3083 DEBUG(0, ("write_data failed for client %s. "
3084 "Error %s\n",
3085 get_peer_addr(fsp->conn->sconn->sock, addr,
3086 sizeof(addr)),
3087 strerror(errno)));
3088
3089 fail_readraw();
3090 }
3091
3092 TALLOC_FREE(outbuf);
3093 }
3094
3095 /****************************************************************************
3096 Reply to a readbraw (core+ protocol).
3097 ****************************************************************************/
3098
3099 void reply_readbraw(struct smb_request *req)
3100 {
3101 connection_struct *conn = req->conn;
3102 struct smbd_server_connection *sconn = req->sconn;
3103 ssize_t maxcount,mincount;
3104 size_t nread = 0;
3105 SMB_OFF_T startpos;
3106 files_struct *fsp;
3107 struct lock_struct lock;
3108 SMB_OFF_T size = 0;
3109
3110 START_PROFILE(SMBreadbraw);
3111
3112 if (srv_is_signing_active(sconn) ||
3113 is_encrypted_packet(req->inbuf)) {
3114 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3115 "raw reads/writes are disallowed.");
3116 }
3117
3118 if (req->wct < 8) {
3119 reply_readbraw_error(sconn);
3120 END_PROFILE(SMBreadbraw);
3121 return;
3122 }
3123
3124 if (sconn->smb1.echo_handler.trusted_fde) {
3125 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3126 "'async smb echo handler = yes'\n"));
3127 reply_readbraw_error(sconn);
3128 END_PROFILE(SMBreadbraw);
3129 return;
3130 }
3131
3132 /*
3133 * Special check if an oplock break has been issued
3134 * and the readraw request croses on the wire, we must
3135 * return a zero length response here.
3136 */
3137
3138 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3139
3140 /*
3141 * We have to do a check_fsp by hand here, as
3142 * we must always return 4 zero bytes on error,
3143 * not a NTSTATUS.
3144 */
3145
3146 if (!fsp || !conn || conn != fsp->conn ||
3147 req->vuid != fsp->vuid ||
3148 fsp->is_directory || fsp->fh->fd == -1) {
3149 /*
3150 * fsp could be NULL here so use the value from the packet. JRA.
3151 */
3152 DEBUG(3,("reply_readbraw: fnum %d not valid "
3153 "- cache prime?\n",
3154 (int)SVAL(req->vwv+0, 0)));
3155 reply_readbraw_error(sconn);
3156 END_PROFILE(SMBreadbraw);
3157 return;
3158 }
3159
3160 /* Do a "by hand" version of CHECK_READ. */
3161 if (!(fsp->can_read ||
3162 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3163 (fsp->access_mask & FILE_EXECUTE)))) {
3164 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3165 (int)SVAL(req->vwv+0, 0)));
3166 reply_readbraw_error(sconn);
3167 END_PROFILE(SMBreadbraw);
3168 return;
3169 }
3170
3171 flush_write_cache(fsp, READRAW_FLUSH);
3172
3173 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3174 if(req->wct == 10) {
3175 /*
3176 * This is a large offset (64 bit) read.
3177 */
3178 #ifdef LARGE_SMB_OFF_T
3179
3180 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3181
3182 #else /* !LARGE_SMB_OFF_T */
3183
3184 /*
3185 * Ensure we haven't been sent a >32 bit offset.
3186 */
3187
3188 if(IVAL(req->vwv+8, 0) != 0) {
3189 DEBUG(0,("reply_readbraw: large offset "
3190 "(%x << 32) used and we don't support "
3191 "64 bit offsets.\n",
3192 (unsigned int)IVAL(req->vwv+8, 0) ));
3193 reply_readbraw_error();
3194 END_PROFILE(SMBreadbraw);
3195 return;
3196 }
3197
3198 #endif /* LARGE_SMB_OFF_T */
3199
3200 if(startpos < 0) {
3201 DEBUG(0,("reply_readbraw: negative 64 bit "
3202 "readraw offset (%.0f) !\n",
3203 (double)startpos ));
3204 reply_readbraw_error(sconn);
3205 END_PROFILE(SMBreadbraw);
3206 return;
3207 }
3208 }
3209
3210 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3211 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3212
3213 /* ensure we don't overrun the packet size */
3214 maxcount = MIN(65535,maxcount);
3215
3216 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3217 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3218 &lock);
3219
3220 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3221 reply_readbraw_error(sconn);
3222 END_PROFILE(SMBreadbraw);
3223 return;
3224 }
3225
3226 if (fsp_stat(fsp) == 0) {
3227 size = fsp->fsp_name->st.st_ex_size;
3228 }
3229
3230 if (startpos >= size) {
3231 nread = 0;
3232 } else {
3233 nread = MIN(maxcount,(size - startpos));
3234 }
3235
3236 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3237 if (nread < mincount)
3238 nread = 0;
3239 #endif
3240
3241 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3242 "min=%lu nread=%lu\n",
3243 fsp->fnum, (double)startpos,
3244 (unsigned long)maxcount,
3245 (unsigned long)mincount,
3246 (unsigned long)nread ) );
3247
3248 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3249
3250 DEBUG(5,("reply_readbraw finished\n"));
3251
3252 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3253
3254 END_PROFILE(SMBreadbraw);
3255 return;
3256 }
3257
3258 #undef DBGC_CLASS
3259 #define DBGC_CLASS DBGC_LOCKING
3260
3261 /****************************************************************************
3262 Reply to a lockread (core+ protocol).
3263 ****************************************************************************/
3264
3265 void reply_lockread(struct smb_request *req)
3266 {
3267 connection_struct *conn = req->conn;
3268 ssize_t nread = -1;
3269 char *data;
3270 SMB_OFF_T startpos;
3271 size_t numtoread;
3272 NTSTATUS status;
3273 files_struct *fsp;
3274 struct byte_range_lock *br_lck = NULL;
3275 char *p = NULL;
3276 struct smbd_server_connection *sconn = req->sconn;
3277
3278 START_PROFILE(SMBlockread);
3279
3280 if (req->wct < 5) {
3281 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3282 END_PROFILE(SMBlockread);
3283 return;
3284 }
3285
3286 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3287
3288 if (!check_fsp(conn, req, fsp)) {
3289 END_PROFILE(SMBlockread);
3290 return;
3291 }
3292
3293 if (!CHECK_READ(fsp,req)) {
3294 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3295 END_PROFILE(SMBlockread);
3296 return;
3297 }
3298
3299 numtoread = SVAL(req->vwv+1, 0);
3300 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3301
3302 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3303
3304 reply_outbuf(req, 5, numtoread + 3);
3305
3306 data = smb_buf(req->outbuf) + 3;
3307
3308 /*
3309 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3310 * protocol request that predates the read/write lock concept.
3311 * Thus instead of asking for a read lock here we need to ask
3312 * for a write lock. JRA.
3313 * Note that the requested lock size is unaffected by max_recv.
3314 */
3315
3316 br_lck = do_lock(req->sconn->msg_ctx,
3317 fsp,
3318 (uint64_t)req->smbpid,
3319 (uint64_t)numtoread,
3320 (uint64_t)startpos,
3321 WRITE_LOCK,
3322 WINDOWS_LOCK,
3323 False, /* Non-blocking lock. */
3324 &status,
3325 NULL,
3326 NULL);
3327 TALLOC_FREE(br_lck);
3328
3329 if (NT_STATUS_V(status)) {
3330 reply_nterror(req, status);
3331 END_PROFILE(SMBlockread);
3332 return;
3333 }
3334
3335 /*
3336 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3337 */
3338
3339 if (numtoread > sconn->smb1.negprot.max_recv) {
3340 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3341 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3342 (unsigned int)numtoread,
3343 (unsigned int)sconn->smb1.negprot.max_recv));
3344 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3345 }
3346 nread = read_file(fsp,data,startpos,numtoread);
3347
3348 if (nread < 0) {
3349 reply_nterror(req, map_nt_error_from_unix(errno));
3350 END_PROFILE(SMBlockread);
3351 return;
3352 }
3353
3354 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3355
3356 SSVAL(req->outbuf,smb_vwv0,nread);
3357 SSVAL(req->outbuf,smb_vwv5,nread+3);
3358 p = smb_buf(req->outbuf);
3359 SCVAL(p,0,0); /* pad byte. */
3360 SSVAL(p,1,nread);
3361
3362 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3363 fsp->fnum, (int)numtoread, (int)nread));
3364
3365 END_PROFILE(SMBlockread);
3366 return;
3367 }
3368
3369 #undef DBGC_CLASS
3370 #define DBGC_CLASS DBGC_ALL
3371
3372 /****************************************************************************
3373 Reply to a read.
3374 ****************************************************************************/
3375
3376 void reply_read(struct smb_request *req)
3377 {
3378 connection_struct *conn = req->conn;
3379 size_t numtoread;
3380 ssize_t nread = 0;
3381 char *data;
3382 SMB_OFF_T startpos;
3383 int outsize = 0;
3384 files_struct *fsp;
3385 struct lock_struct lock;
3386 struct smbd_server_connection *sconn = req->sconn;
3387
3388 START_PROFILE(SMBread);
3389
3390 if (req->wct < 3) {
3391 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3392 END_PROFILE(SMBread);
3393 return;
3394 }
3395
3396 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3397
3398 if (!check_fsp(conn, req, fsp)) {
3399 END_PROFILE(SMBread);
3400 return;
3401 }
3402
3403 if (!CHECK_READ(fsp,req)) {
3404 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3405 END_PROFILE(SMBread);
3406 return;
3407 }
3408
3409 numtoread = SVAL(req->vwv+1, 0);
3410 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3411
3412 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3413
3414 /*
3415 * The requested read size cannot be greater than max_recv. JRA.
3416 */
3417 if (numtoread > sconn->smb1.negprot.max_recv) {
3418 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3419 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3420 (unsigned int)numtoread,
3421 (unsigned int)sconn->smb1.negprot.max_recv));
3422 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3423 }
3424
3425 reply_outbuf(req, 5, numtoread+3);
3426
3427 data = smb_buf(req->outbuf) + 3;
3428
3429 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3430 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3431 &lock);
3432
3433 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3434 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3435 END_PROFILE(SMBread);
3436 return;
3437 }
3438
3439 if (numtoread > 0)
3440 nread = read_file(fsp,data,startpos,numtoread);
3441
3442 if (nread < 0) {
3443 reply_nterror(req, map_nt_error_from_unix(errno));
3444 goto strict_unlock;
3445 }
3446
3447 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3448
3449 SSVAL(req->outbuf,smb_vwv0,nread);
3450 SSVAL(req->outbuf,smb_vwv5,nread+3);
3451 SCVAL(smb_buf(req->outbuf),0,1);
3452 SSVAL(smb_buf(req->outbuf),1,nread);
3453
3454 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3455 fsp->fnum, (int)numtoread, (int)nread ) );
3456
3457 strict_unlock:
3458 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3459
3460 END_PROFILE(SMBread);
3461 return;
3462 }
3463
3464 /****************************************************************************
3465 Setup readX header.
3466 ****************************************************************************/
3467
3468 static int setup_readX_header(struct smb_request *req, char *outbuf,
3469 size_t smb_maxcnt)
3470 {
3471 int outsize;
3472 char *data;
3473
3474 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3475 data = smb_buf(outbuf);
3476
3477 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3478
3479 SCVAL(outbuf,smb_vwv0,0xFF);
3480 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3481 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3482 SSVAL(outbuf,smb_vwv6,
3483 req_wct_ofs(req)
3484 + 1 /* the wct field */
3485 + 12 * sizeof(uint16_t) /* vwv */
3486 + 2); /* the buflen field */
3487 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3488 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3489 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3490 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3491 return outsize;
3492 }
3493
3494 /****************************************************************************
3495 Reply to a read and X - possibly using sendfile.
3496 ****************************************************************************/
3497
3498 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3499 files_struct *fsp, SMB_OFF_T startpos,
3500 size_t smb_maxcnt)
3501 {
3502 ssize_t nread = -1;
3503 struct lock_struct lock;
3504 int saved_errno = 0;
3505
3506 if(fsp_stat(fsp) == -1) {
3507 reply_nterror(req, map_nt_error_from_unix(errno));
3508 return;
3509 }
3510
3511 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3512 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3513 &lock);
3514
3515 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3516 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3517 return;
3518 }
3519
3520 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3521 (startpos > fsp->fsp_name->st.st_ex_size)
3522 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3523 /*
3524 * We already know that we would do a short read, so don't
3525 * try the sendfile() path.
3526 */
3527 goto nosendfile_read;
3528 }
3529
3530 #if defined(WITH_SENDFILE)
3531 /*
3532 * We can only use sendfile on a non-chained packet
3533 * but we can use on a non-oplocked file. tridge proved this
3534 * on a train in Germany :-). JRA.
3535 */
3536
3537 if (!req_is_in_chain(req) &&
3538 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3539 (fsp->wcp == NULL) &&
3540 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3541 uint8 headerbuf[smb_size + 12 * 2];
3542 DATA_BLOB header;
3543
3544 /*
3545 * Set up the packet header before send. We
3546 * assume here the sendfile will work (get the
3547 * correct amount of data).
3548 */
3549
3550 header = data_blob_const(headerbuf, sizeof(headerbuf));
3551
3552 construct_reply_common_req(req, (char *)headerbuf);
3553 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3554
3555 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3556 startpos, smb_maxcnt);
3557 if (nread == -1) {
3558 /* Returning ENOSYS means no data at all was sent.
3559 Do this as a normal read. */
3560 if (errno == ENOSYS) {
3561 goto normal_read;
3562 }
3563
3564 /*
3565 * Special hack for broken Linux with no working sendfile. If we
3566 * return EINTR we sent the header but not the rest of the data.
3567 * Fake this up by doing read/write calls.
3568 */
3569
3570 if (errno == EINTR) {
3571 /* Ensure we don't do this again. */
3572 set_use_sendfile(SNUM(conn), False);
3573 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3574 nread = fake_sendfile(fsp, startpos,
3575 smb_maxcnt);
3576 if (nread == -1) {
3577 DEBUG(0,("send_file_readX: "
3578 "fake_sendfile failed for "
3579 "file %s (%s).\n",
3580 fsp_str_dbg(fsp),
3581 strerror(errno)));
3582 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3583 }
3584 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3585 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3586 /* No outbuf here means successful sendfile. */
3587 goto strict_unlock;
3588 }
3589
3590 DEBUG(0,("send_file_readX: sendfile failed for file "
3591 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3592 strerror(errno)));
3593 exit_server_cleanly("send_file_readX sendfile failed");
3594 } else if (nread == 0) {
3595 /*
3596 * Some sendfile implementations return 0 to indicate
3597 * that there was a short read, but nothing was
3598 * actually written to the socket. In this case,
3599 * fallback to the normal read path so the header gets
3600 * the correct byte count.
3601 */
3602 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3603 "falling back to the normal read: %s\n",
3604 fsp_str_dbg(fsp)));
3605 goto normal_read;
3606 }
3607
3608 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3609 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3610
3611 /* Deal with possible short send. */
3612 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3613 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3614 }
3615 /* No outbuf here means successful sendfile. */
3616 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3617 SMB_PERFCOUNT_END(&req->pcd);
3618 goto strict_unlock;
3619 }
3620
3621 normal_read:
3622
3623 #endif
3624
3625 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3626 uint8 headerbuf[smb_size + 2*12];
3627
3628 construct_reply_common_req(req, (char *)headerbuf);
3629 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3630
3631 /* Send out the header. */
3632 if (write_data(req->sconn->sock, (char *)headerbuf,
3633 sizeof(headerbuf)) != sizeof(headerbuf)) {
3634
3635 char addr[INET6_ADDRSTRLEN];
3636 /*
3637 * Try and give an error message saying what
3638 * client failed.
3639 */
3640 DEBUG(0, ("write_data failed for client %s. "
3641 "Error %s\n",
3642 get_peer_addr(req->sconn->sock, addr,
3643 sizeof(addr)),
3644 strerror(errno)));
3645
3646 DEBUG(0,("send_file_readX: write_data failed for file "
3647 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3648 strerror(errno)));
3649 exit_server_cleanly("send_file_readX sendfile failed");
3650 }
3651 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3652 if (nread == -1) {
3653 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3654 "file %s (%s).\n", fsp_str_dbg(fsp),
3655 strerror(errno)));
3656 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3657 }
3658 goto strict_unlock;
3659 }
3660
3661 nosendfile_read:
3662
3663 reply_outbuf(req, 12, smb_maxcnt);
3664
3665 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3666 saved_errno = errno;
3667
3668 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3669
3670 if (nread < 0) {
3671 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3672 return;
3673 }
3674
3675 setup_readX_header(req, (char *)req->outbuf, nread);
3676
3677 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3678 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3679
3680 chain_reply(req);
3681 return;
3682
3683 strict_unlock:
3684 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3685 TALLOC_FREE(req->outbuf);
3686 return;
3687 }
3688
3689 /****************************************************************************
3690 Reply to a read and X.
3691 ****************************************************************************/
3692
3693 void reply_read_and_X(struct smb_request *req)
3694 {
3695 connection_struct *conn = req->conn;
3696 files_struct *fsp;
3697 SMB_OFF_T startpos;
3698 size_t smb_maxcnt;
3699 bool big_readX = False;
3700 #if 0
3701 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3702 #endif
3703
3704 START_PROFILE(SMBreadX);
3705
3706 if ((req->wct != 10) && (req->wct != 12)) {
3707 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3708 return;
3709 }
3710
3711 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3712 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3713 smb_maxcnt = SVAL(req->vwv+5, 0);
3714
3715 /* If it's an IPC, pass off the pipe handler. */
3716 if (IS_IPC(conn)) {
3717 reply_pipe_read_and_X(req);
3718 END_PROFILE(SMBreadX);
3719 return;
3720 }
3721
3722 if (!check_fsp(conn, req, fsp)) {
3723 END_PROFILE(SMBreadX);
3724 return;
3725 }
3726
3727 if (!CHECK_READ(fsp,req)) {
3728 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3729 END_PROFILE(SMBreadX);
3730 return;
3731 }
3732
3733 if (global_client_caps & CAP_LARGE_READX) {
3734 size_t upper_size = SVAL(req->vwv+7, 0);
3735 smb_maxcnt |= (upper_size<<16);
3736 if (upper_size > 1) {
3737 /* Can't do this on a chained packet. */
3738 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3739 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3740 END_PROFILE(SMBreadX);
3741 return;
3742 }
3743 /* We currently don't do this on signed or sealed data. */
3744 if (srv_is_signing_active(req->sconn) ||
3745 is_encrypted_packet(req->inbuf)) {
3746 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3747 END_PROFILE(SMBreadX);
3748 return;
3749 }
3750 /* Is there room in the reply for this data ? */
3751 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3752 reply_nterror(req,
3753 NT_STATUS_INVALID_PARAMETER);
3754 END_PROFILE(SMBreadX);
3755 return;
3756 }
3757 big_readX = True;
3758 }
3759 }
3760
3761 if (req->wct == 12) {
3762 #ifdef LARGE_SMB_OFF_T
3763 /*
3764 * This is a large offset (64 bit) read.
3765 */
3766 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3767
3768 #else /* !LARGE_SMB_OFF_T */
3769
3770 /*
3771 * Ensure we haven't been sent a >32 bit offset.
3772 */
3773
3774 if(IVAL(req->vwv+10, 0) != 0) {
3775 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3776 "used and we don't support 64 bit offsets.\n",
3777 (unsigned int)IVAL(req->vwv+10, 0) ));
3778 END_PROFILE(SMBreadX);
3779 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3780 return;
3781 }
3782
3783 #endif /* LARGE_SMB_OFF_T */
3784
3785 }
3786
3787 if (!big_readX) {
3788 NTSTATUS status = schedule_aio_read_and_X(conn,
3789 req,
3790 fsp,
3791 startpos,
3792 smb_maxcnt);
3793 if (NT_STATUS_IS_OK(status)) {
3794 /* Read scheduled - we're done. */
3795 goto out;
3796 }
3797 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3798 /* Real error - report to client. */
3799 END_PROFILE(SMBreadX);
3800 reply_nterror(req, status);
3801 return;
3802 }
3803 /* NT_STATUS_RETRY - fall back to sync read. */
3804 }
3805
3806 smbd_lock_socket(req->sconn);
3807 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3808 smbd_unlock_socket(req->sconn);
3809
3810 out:
3811 END_PROFILE(SMBreadX);
3812 return;
3813 }
3814
3815 /****************************************************************************
3816 Error replies to writebraw must have smb_wct == 1. Fix this up.
3817 ****************************************************************************/
3818
3819 void error_to_writebrawerr(struct smb_request *req)
3820 {
3821 uint8 *old_outbuf = req->outbuf;
3822
3823 reply_outbuf(req, 1, 0);
3824
3825 memcpy(req->outbuf, old_outbuf, smb_size);
3826 TALLOC_FREE(old_outbuf);
3827 }
3828
3829 /****************************************************************************
3830 Read 4 bytes of a smb packet and return the smb length of the packet.
3831 Store the result in the buffer. This version of the function will
3832 never return a session keepalive (length of zero).
3833 Timeout is in milliseconds.
3834 ****************************************************************************/
3835
3836 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3837 size_t *len)
3838 {
3839 uint8_t msgtype = SMBkeepalive;
3840
3841 while (msgtype == SMBkeepalive) {
3842 NTSTATUS status;
3843
3844 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3845 len);
3846 if (!NT_STATUS_IS_OK(status)) {
3847 char addr[INET6_ADDRSTRLEN];
3848 /* Try and give an error message
3849 * saying what client failed. */
3850 DEBUG(0, ("read_fd_with_timeout failed for "
3851 "client %s read error = %s.\n",
3852 get_peer_addr(fd,addr,sizeof(addr)),
3853 nt_errstr(status)));
3854 return status;
3855 }
3856
3857 msgtype = CVAL(inbuf, 0);
3858 }
3859
3860 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3861 (unsigned long)len));
3862
3863 return NT_STATUS_OK;
3864 }
3865
3866 /****************************************************************************
3867 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3868 ****************************************************************************/
3869
3870 void reply_writebraw(struct smb_request *req)
3871 {
3872 connection_struct *conn = req->conn;
3873 char *buf = NULL;
3874 ssize_t nwritten=0;
3875 ssize_t total_written=0;
3876 size_t numtowrite=0;
3877 size_t tcount;
3878 SMB_OFF_T startpos;
3879 char *data=NULL;
3880 bool write_through;
3881 files_struct *fsp;
3882 struct lock_struct lock;
3883 NTSTATUS status;
3884
3885 START_PROFILE(SMBwritebraw);
3886
3887 /*
3888 * If we ever reply with an error, it must have the SMB command
3889 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3890 * we're finished.
3891 */
3892 SCVAL(req->inbuf,smb_com,SMBwritec);
3893
3894 if (srv_is_signing_active(req->sconn)) {
3895 END_PROFILE(SMBwritebraw);
3896 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3897 "raw reads/writes are disallowed.");
3898 }
3899
3900 if (req->wct < 12) {
3901 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3902 error_to_writebrawerr(req);
3903 END_PROFILE(SMBwritebraw);
3904 return;
3905 }
3906
3907 if (req->sconn->smb1.echo_handler.trusted_fde) {
3908 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3909 "'async smb echo handler = yes'\n"));
3910 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3911 error_to_writebrawerr(req);
3912 END_PROFILE(SMBwritebraw);
3913 return;
3914 }
3915
3916 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3917 if (!check_fsp(conn, req, fsp)) {
3918 error_to_writebrawerr(req);
3919 END_PROFILE(SMBwritebraw);
3920 return;
3921 }
3922
3923 if (!CHECK_WRITE(fsp)) {
3924 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3925 error_to_writebrawerr(req);
3926 END_PROFILE(SMBwritebraw);
3927 return;
3928 }
3929
3930 tcount = IVAL(req->vwv+1, 0);
3931 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3932 write_through = BITSETW(req->vwv+7,0);
3933
3934 /* We have to deal with slightly different formats depending
3935 on whether we are using the core+ or lanman1.0 protocol */
3936
3937 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3938 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3939 data = smb_buf(req->inbuf);
3940 } else {
3941 numtowrite = SVAL(req->vwv+10, 0);
3942 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3943 }
3944
3945 /* Ensure we don't write bytes past the end of this packet. */
3946 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3947 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3948 error_to_writebrawerr(req);
3949 END_PROFILE(SMBwritebraw);
3950 return;
3951 }
3952
3953 if (!fsp->print_file) {
3954 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3955 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3956 &lock);
3957
3958 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3959 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3960 error_to_writebrawerr(req);
3961 END_PROFILE(SMBwritebraw);
3962 return;
3963 }
3964 }
3965
3966 if (numtowrite>0) {
3967 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3968 }
3969
3970 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3971 "wrote=%d sync=%d\n",
3972 fsp->fnum, (double)startpos, (int)numtowrite,
3973 (int)nwritten, (int)write_through));
3974
3975 if (nwritten < (ssize_t)numtowrite) {
3976 reply_nterror(req, NT_STATUS_DISK_FULL);
3977 error_to_writebrawerr(req);
3978 goto strict_unlock;
3979 }
3980
3981 total_written = nwritten;
3982
3983 /* Allocate a buffer of 64k + length. */
3984 buf = TALLOC_ARRAY(NULL, char, 65540);
3985 if (!buf) {
3986 reply_nterror(req, NT_STATUS_NO_MEMORY);
3987 error_to_writebrawerr(req);
3988 goto strict_unlock;
3989 }
3990
3991 /* Return a SMBwritebraw message to the redirector to tell
3992 * it to send more bytes */
3993
3994 memcpy(buf, req->inbuf, smb_size);
3995 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3996 SCVAL(buf,smb_com,SMBwritebraw);
3997 SSVALS(buf,smb_vwv0,0xFFFF);
3998 show_msg(buf);
3999 if (!srv_send_smb(req->sconn,
4000 buf,
4001 false, 0, /* no signing */
4002 IS_CONN_ENCRYPTED(conn),
4003 &req->pcd)) {
4004 exit_server_cleanly("reply_writebraw: srv_send_smb "
4005 "failed.");
4006 }
4007
4008 /* Now read the raw data into the buffer and write it */
4009 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4010 &numtowrite);
4011 if (!NT_STATUS_IS_OK(status)) {
4012 exit_server_cleanly("secondary writebraw failed");
4013 }
4014
4015 /* Set up outbuf to return the correct size */
4016 reply_outbuf(req, 1, 0);
4017
4018 if (numtowrite != 0) {
4019
4020 if (numtowrite > 0xFFFF) {
4021 DEBUG(0,("reply_writebraw: Oversize secondary write "
4022 "raw requested (%u). Terminating\n",
4023 (unsigned int)numtowrite ));
4024 exit_server_cleanly("secondary writebraw failed");
4025 }
4026
4027 if (tcount > nwritten+numtowrite) {
4028 DEBUG(3,("reply_writebraw: Client overestimated the "
4029 "write %d %d %d\n",
4030 (int)tcount,(int)nwritten,(int)numtowrite));
4031 }
4032
4033 status = read_data(req->sconn->sock, buf+4, numtowrite);
4034
4035 if (!NT_STATUS_IS_OK(status)) {
4036 char addr[INET6_ADDRSTRLEN];
4037 /* Try and give an error message
4038 * saying what client failed. */
4039 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4040 "raw read failed (%s) for client %s. "
4041 "Terminating\n", nt_errstr(status),
4042 get_peer_addr(req->sconn->sock, addr,
4043 sizeof(addr))));
4044 exit_server_cleanly("secondary writebraw failed");
4045 }
4046
4047 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4048 if (nwritten == -1) {
4049 TALLOC_FREE(buf);
4050 reply_nterror(req, map_nt_error_from_unix(errno));
4051 error_to_writebrawerr(req);
4052 goto strict_unlock;
4053 }
4054
4055 if (nwritten < (ssize_t)numtowrite) {
4056 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4057 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4058 }
4059
4060 if (nwritten > 0) {
4061 total_written += nwritten;
4062 }
4063 }
4064
4065 TALLOC_FREE(buf);
4066 SSVAL(req->outbuf,smb_vwv0,total_written);
4067
4068 status = sync_file(conn, fsp, write_through);
4069 if (!NT_STATUS_IS_OK(status)) {
4070 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4071 fsp_str_dbg(fsp), nt_errstr(status)));
4072 reply_nterror(req, status);
4073 error_to_writebrawerr(req);
4074 goto strict_unlock;
4075 }
4076
4077 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4078 "wrote=%d\n",
4079 fsp->fnum, (double)startpos, (int)numtowrite,
4080 (int)total_written));
4081
4082 if (!fsp->print_file) {
4083 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4084 }
4085
4086 /* We won't return a status if write through is not selected - this
4087 * follows what WfWg does */
4088 END_PROFILE(SMBwritebraw);
4089
4090 if (!write_through && total_written==tcount) {
4091
4092 #if RABBIT_PELLET_FIX
4093 /*
4094 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4095 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4096 * JRA.
4097 */
4098 if (!send_keepalive(req->sconn->sock)) {
4099 exit_server_cleanly("reply_writebraw: send of "
4100 "keepalive failed");
4101 }
4102 #endif
4103 TALLOC_FREE(req->outbuf);
4104 }
4105 return;
4106
4107 strict_unlock:
4108 if (!fsp->print_file) {
4109 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4110 }
4111
4112 END_PROFILE(SMBwritebraw);
4113 return;
4114 }
4115
4116 #undef DBGC_CLASS
4117 #define DBGC_CLASS DBGC_LOCKING
4118
4119 /****************************************************************************
4120 Reply to a writeunlock (core+).
4121 ****************************************************************************/
4122
4123 void reply_writeunlock(struct smb_request *req)
4124 {
4125 connection_struct *conn = req->conn;
4126 ssize_t nwritten = -1;
4127 size_t numtowrite;
4128 SMB_OFF_T startpos;
4129 const char *data;
4130 NTSTATUS status = NT_STATUS_OK;
4131 files_struct *fsp;
4132 struct lock_struct lock;
4133 int saved_errno = 0;
4134
4135 START_PROFILE(SMBwriteunlock);
4136
4137 if (req->wct < 5) {
4138 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4139 END_PROFILE(SMBwriteunlock);
4140 return;
4141 }
4142
4143 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4144
4145 if (!check_fsp(conn, req, fsp)) {
4146 END_PROFILE(SMBwriteunlock);
4147 return;
4148 }
4149
4150 if (!CHECK_WRITE(fsp)) {
4151 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4152 END_PROFILE(SMBwriteunlock);
4153 return;
4154 }
4155
4156 numtowrite = SVAL(req->vwv+1, 0);
4157 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4158 data = (const char *)req->buf + 3;
4159
4160 if (!fsp->print_file && numtowrite > 0) {
4161 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4162 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4163 &lock);
4164
4165 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4166 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4167 END_PROFILE(SMBwriteunlock);
4168 return;
4169 }
4170 }
4171
4172 /* The special X/Open SMB protocol handling of
4173 zero length writes is *NOT* done for
4174 this call */
4175 if(numtowrite == 0) {
4176 nwritten = 0;
4177 } else {
4178 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4179 saved_errno = errno;
4180 }
4181
4182 status = sync_file(conn, fsp, False /* write through */);
4183 if (!NT_STATUS_IS_OK(status)) {
4184 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4185 fsp_str_dbg(fsp), nt_errstr(status)));
4186 reply_nterror(req, status);
4187 goto strict_unlock;
4188 }
4189
4190 if(nwritten < 0) {
4191 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4192 goto strict_unlock;
4193 }
4194
4195 if((nwritten < numtowrite) && (numtowrite != 0)) {
4196 reply_nterror(req, NT_STATUS_DISK_FULL);
4197 goto strict_unlock;
4198 }
4199
4200 if (numtowrite && !fsp->print_file) {
4201 status = do_unlock(req->sconn->msg_ctx,
4202 fsp,
4203 (uint64_t)req->smbpid,
4204 (uint64_t)numtowrite,
4205 (uint64_t)startpos,
4206 WINDOWS_LOCK);
4207
4208 if (NT_STATUS_V(status)) {
4209 reply_nterror(req, status);
4210 goto strict_unlock;
4211 }
4212 }
4213
4214 reply_outbuf(req, 1, 0);
4215
4216 SSVAL(req->outbuf,smb_vwv0,nwritten);
4217
4218 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4219 fsp->fnum, (int)numtowrite, (int)nwritten));
4220
4221 strict_unlock:
4222 if (numtowrite && !fsp->print_file) {
4223 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4224 }
4225
4226 END_PROFILE(SMBwriteunlock);
4227 return;
4228 }
4229
4230 #undef DBGC_CLASS
4231 #define DBGC_CLASS DBGC_ALL
4232
4233 /****************************************************************************
4234 Reply to a write.
4235 ****************************************************************************/
4236
4237 void reply_write(struct smb_request *req)
4238 {
4239 connection_struct *conn = req->conn;
4240 size_t numtowrite;
4241 ssize_t nwritten = -1;
4242 SMB_OFF_T startpos;
4243 const char *data;
4244 files_struct *fsp;
4245 struct lock_struct lock;
4246 NTSTATUS status;
4247 int saved_errno = 0;
4248
4249 START_PROFILE(SMBwrite);
4250
4251 if (req->wct < 5) {
4252 END_PROFILE(SMBwrite);
4253 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4254 return;
4255 }
4256
4257 /* If it's an IPC, pass off the pipe handler. */
4258 if (IS_IPC(conn)) {
4259 reply_pipe_write(req);
4260 END_PROFILE(SMBwrite);
4261 return;
4262 }
4263
4264 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4265
4266 if (!check_fsp(conn, req, fsp)) {
4267 END_PROFILE(SMBwrite);
4268 return;
4269 }
4270
4271 if (!CHECK_WRITE(fsp)) {
4272 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4273 END_PROFILE(SMBwrite);
4274 return;
4275 }
4276
4277 numtowrite = SVAL(req->vwv+1, 0);
4278 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4279 data = (const char *)req->buf + 3;
4280
4281 if (!fsp->print_file) {
4282 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4283 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4284 &lock);
4285
4286 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4287 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4288 END_PROFILE(SMBwrite);
4289 return;
4290 }
4291 }
4292
4293 /*
4294 * X/Open SMB protocol says that if smb_vwv1 is
4295 * zero then the file size should be extended or
4296 * truncated to the size given in smb_vwv[2-3].
4297 */
4298
4299 if(numtowrite == 0) {
4300 /*
4301 * This is actually an allocate call, and set EOF. JRA.
4302 */
4303 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4304 if (nwritten < 0) {
4305 reply_nterror(req, NT_STATUS_DISK_FULL);
4306 goto strict_unlock;
4307 }
4308 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4309 if (nwritten < 0) {
4310 reply_nterror(req, NT_STATUS_DISK_FULL);
4311 goto strict_unlock;
4312 }
4313 trigger_write_time_update_immediate(fsp);
4314 } else {
4315 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4316 }
4317
4318 status = sync_file(conn, fsp, False);
4319 if (!NT_STATUS_IS_OK(status)) {
4320 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4321 fsp_str_dbg(fsp), nt_errstr(status)));
4322 reply_nterror(req, status);
4323 goto strict_unlock;
4324 }
4325
4326 if(nwritten < 0) {
4327 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4328 goto strict_unlock;
4329 }
4330
4331 if((nwritten == 0) && (numtowrite != 0)) {
4332 reply_nterror(req, NT_STATUS_DISK_FULL);
4333 goto strict_unlock;
4334 }
4335
4336 reply_outbuf(req, 1, 0);
4337
4338 SSVAL(req->outbuf,smb_vwv0,nwritten);
4339
4340 if (nwritten < (ssize_t)numtowrite) {
4341 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4342 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4343 }
4344
4345 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4346
4347 strict_unlock:
4348 if (!fsp->print_file) {
4349 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4350 }
4351
4352 END_PROFILE(SMBwrite);
4353 return;
4354 }
4355
4356 /****************************************************************************
4357 Ensure a buffer is a valid writeX for recvfile purposes.
4358 ****************************************************************************/
4359
4360 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4361 (2*14) + /* word count (including bcc) */ \
4362 1 /* pad byte */)
4363
4364 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4365 const uint8_t *inbuf)
4366 {
4367 size_t numtowrite;
4368 connection_struct *conn = NULL;
4369 unsigned int doff = 0;
4370 size_t len = smb_len_large(inbuf);
4371
4372 if (is_encrypted_packet(inbuf)) {
4373 /* Can't do this on encrypted
4374 * connections. */
4375 return false;
4376 }
4377
4378 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4379 return false;
4380 }
4381
4382 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4383 CVAL(inbuf,smb_wct) != 14) {
4384 DEBUG(10,("is_valid_writeX_buffer: chained or "
4385 "invalid word length.\n"));
4386 return false;
4387 }
4388
4389 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4390 if (conn == NULL) {
4391 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4392 return false;
4393 }
4394 if (IS_IPC(conn)) {
4395 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4396 return false;
4397 }
4398 if (IS_PRINT(conn)) {
4399 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4400 return false;
4401 }
4402 doff = SVAL(inbuf,smb_vwv11);
4403
4404 numtowrite = SVAL(inbuf,smb_vwv10);
4405
4406 if (len > doff && len - doff > 0xFFFF) {
4407 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4408 }
4409
4410 if (numtowrite == 0) {
4411 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4412 return false;
4413 }
4414
4415 /* Ensure the sizes match up. */
4416 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4417 /* no pad byte...old smbclient :-( */
4418 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4419 (unsigned int)doff,
4420 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4421 return false;
4422 }
4423
4424 if (len - doff != numtowrite) {
4425 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4426 "len = %u, doff = %u, numtowrite = %u\n",
4427 (unsigned int)len,
4428 (unsigned int)doff,
4429 (unsigned int)numtowrite ));
4430 return false;
4431 }
4432
4433 DEBUG(10,("is_valid_writeX_buffer: true "
4434 "len = %u, doff = %u, numtowrite = %u\n",
4435 (unsigned int)len,
4436 (unsigned int)doff,
4437 (unsigned int)numtowrite ));
4438
4439 return true;
4440 }
4441
4442 /****************************************************************************
4443 Reply to a write and X.
4444 ****************************************************************************/
4445
4446 void reply_write_and_X(struct smb_request *req)
4447 {
4448 connection_struct *conn = req->conn;
4449 files_struct *fsp;
4450 struct lock_struct lock;
4451 SMB_OFF_T startpos;
4452 size_t numtowrite;
4453 bool write_through;
4454 ssize_t nwritten;
4455 unsigned int smb_doff;
4456 unsigned int smblen;
4457 char *data;
4458 NTSTATUS status;
4459 int saved_errno = 0;
4460
4461 START_PROFILE(SMBwriteX);
4462
4463 if ((req->wct != 12) && (req->wct != 14)) {
4464 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4465 END_PROFILE(SMBwriteX);
4466 return;
4467 }
4468
4469 numtowrite = SVAL(req->vwv+10, 0);
4470 smb_doff = SVAL(req->vwv+11, 0);
4471 smblen = smb_len(req->inbuf);
4472
4473 if (req->unread_bytes > 0xFFFF ||
4474 (smblen > smb_doff &&
4475 smblen - smb_doff > 0xFFFF)) {
4476 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4477 }
4478
4479 if (req->unread_bytes) {
4480 /* Can't do a recvfile write on IPC$ */
4481 if (IS_IPC(conn)) {
4482 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4483 END_PROFILE(SMBwriteX);
4484 return;
4485 }
4486 if (numtowrite != req->unread_bytes) {
4487 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4488 END_PROFILE(SMBwriteX);
4489 return;
4490 }
4491 } else {
4492 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4493 smb_doff + numtowrite > smblen) {
4494 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4495 END_PROFILE(SMBwriteX);
4496 return;
4497 }
4498 }
4499
4500 /* If it's an IPC, pass off the pipe handler. */
4501 if (IS_IPC(conn)) {
4502 if (req->unread_bytes) {
4503 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4504 END_PROFILE(SMBwriteX);
4505 return;
4506 }
4507 reply_pipe_write_and_X(req);
4508 END_PROFILE(SMBwriteX);
4509 return;
4510 }
4511
4512 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4513 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4514 write_through = BITSETW(req->vwv+7,0);
4515
4516 if (!check_fsp(conn, req, fsp)) {
4517 END_PROFILE(SMBwriteX);
4518 return;
4519 }
4520
4521 if (!CHECK_WRITE(fsp)) {
4522 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4523 END_PROFILE(SMBwriteX);
4524 return;
4525 }
4526
4527 data = smb_base(req->inbuf) + smb_doff;
4528
4529 if(req->wct == 14) {
4530 #ifdef LARGE_SMB_OFF_T
4531 /*
4532 * This is a large offset (64 bit) write.
4533 */
4534 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4535
4536 #else /* !LARGE_SMB_OFF_T */
4537
4538 /*
4539 * Ensure we haven't been sent a >32 bit offset.
4540 */
4541
4542 if(IVAL(req->vwv+12, 0) != 0) {
4543 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4544 "used and we don't support 64 bit offsets.\n",
4545 (unsigned int)IVAL(req->vwv+12, 0) ));
4546 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4547 END_PROFILE(SMBwriteX);
4548 return;
4549 }
4550
4551 #endif /* LARGE_SMB_OFF_T */
4552 }
4553
4554 /* X/Open SMB protocol says that, unlike SMBwrite
4555 if the length is zero then NO truncation is
4556 done, just a write of zero. To truncate a file,
4557 use SMBwrite. */
4558
4559 if(numtowrite == 0) {
4560 nwritten = 0;
4561 } else {
4562 if (req->unread_bytes == 0) {
4563 status = schedule_aio_write_and_X(conn,
4564 req,
4565 fsp,
4566 data,
4567 startpos,
4568 numtowrite);
4569
4570 if (NT_STATUS_IS_OK(status)) {
4571 /* write scheduled - we're done. */
4572 goto out;
4573 }
4574 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4575 /* Real error - report to client. */
4576 reply_nterror(req, status);
4577 goto out;
4578 }
4579 /* NT_STATUS_RETRY - fall through to sync write. */
4580 }
4581
4582 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4583 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4584 &lock);
4585
4586 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4587 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4588 goto out;
4589 }
4590
4591 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4592 saved_errno = errno;
4593
4594 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4595 }
4596
4597 if(nwritten < 0) {
4598 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4599 goto out;
4600 }
4601
4602 if((nwritten == 0) && (numtowrite != 0)) {
4603 reply_nterror(req, NT_STATUS_DISK_FULL);
4604 goto out;
4605 }
4606
4607 reply_outbuf(req, 6, 0);
4608 SSVAL(req->outbuf,smb_vwv2,nwritten);
4609 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4610
4611 if (nwritten < (ssize_t)numtowrite) {
4612 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4613 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4614 }
4615
4616 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4617 fsp->fnum, (int)numtowrite, (int)nwritten));
4618
4619 status = sync_file(conn, fsp, write_through);
4620 if (!NT_STATUS_IS_OK(status)) {
4621 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4622 fsp_str_dbg(fsp), nt_errstr(status)));
4623 reply_nterror(req, status);
4624 goto out;
4625 }
4626
4627 END_PROFILE(SMBwriteX);
4628 chain_reply(req);
4629 return;
4630
4631 out:
4632 END_PROFILE(SMBwriteX);
4633 return;
4634 }
4635
4636 /****************************************************************************
4637 Reply to a lseek.
4638 ****************************************************************************/
4639
4640 void reply_lseek(struct smb_request *req)
4641 {
4642 connection_struct *conn = req->conn;
4643 SMB_OFF_T startpos;
4644 SMB_OFF_T res= -1;
4645 int mode,umode;
4646 files_struct *fsp;
4647
4648 START_PROFILE(SMBlseek);
4649
4650 if (req->wct < 4) {
4651 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4652 END_PROFILE(SMBlseek);
4653 return;
4654 }
4655
4656 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4657
4658 if (!check_fsp(conn, req, fsp)) {
4659 return;
4660 }
4661
4662 flush_write_cache(fsp, SEEK_FLUSH);
4663
4664 mode = SVAL(req->vwv+1, 0) & 3;
4665 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4666 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4667
4668 switch (mode) {
4669 case 0:
4670 umode = SEEK_SET;
4671 res = startpos;
4672 break;
4673 case 1:
4674 umode = SEEK_CUR;
4675 res = fsp->fh->pos + startpos;
4676 break;
4677 case 2:
4678 umode = SEEK_END;
4679 break;
4680 default:
4681 umode = SEEK_SET;
4682 res = startpos;
4683 break;
4684 }
4685
4686 if (umode == SEEK_END) {
4687 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4688 if(errno == EINVAL) {
4689 SMB_OFF_T current_pos = startpos;
4690
4691 if(fsp_stat(fsp) == -1) {
4692 reply_nterror(req,
4693 map_nt_error_from_unix(errno));
4694 END_PROFILE(SMBlseek);
4695 return;
4696 }
4697
4698 current_pos += fsp->fsp_name->st.st_ex_size;
4699 if(current_pos < 0)
4700 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4701 }
4702 }
4703
4704 if(res == -1) {
4705 reply_nterror(req, map_nt_error_from_unix(errno));
4706 END_PROFILE(SMBlseek);
4707 return;
4708 }
4709 }
4710
4711 fsp->fh->pos = res;
4712
4713 reply_outbuf(req, 2, 0);
4714 SIVAL(req->outbuf,smb_vwv0,res);
4715
4716 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4717 fsp->fnum, (double)startpos, (double)res, mode));
4718
4719 END_PROFILE(SMBlseek);
4720 return;
4721 }
4722
4723 /****************************************************************************
4724 Reply to a flush.
4725 ****************************************************************************/
4726
4727 void reply_flush(struct smb_request *req)
4728 {
4729 connection_struct *conn = req->conn;
4730 uint16 fnum;
4731 files_struct *fsp;
4732
4733 START_PROFILE(SMBflush);
4734
4735 if (req->wct < 1) {
4736 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4737 return;
4738 }
4739
4740 fnum = SVAL(req->vwv+0, 0);
4741 fsp = file_fsp(req, fnum);
4742
4743 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4744 return;
4745 }
4746
4747 if (!fsp) {
4748 file_sync_all(conn);
4749 } else {
4750 NTSTATUS status = sync_file(conn, fsp, True);
4751 if (!NT_STATUS_IS_OK(status)) {
4752 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4753 fsp_str_dbg(fsp), nt_errstr(status)));
4754 reply_nterror(req, status);
4755 END_PROFILE(SMBflush);
4756 return;
4757 }
4758 }
4759
4760 reply_outbuf(req, 0, 0);
4761
4762 DEBUG(3,("flush\n"));
4763 END_PROFILE(SMBflush);
4764 return;
4765 }
4766
4767 /****************************************************************************
4768 Reply to a exit.
4769 conn POINTER CAN BE NULL HERE !
4770 ****************************************************************************/
4771
4772 void reply_exit(struct smb_request *req)
4773 {
4774 START_PROFILE(SMBexit);
4775
4776 file_close_pid(req->sconn, req->smbpid, req->vuid);
4777
4778 reply_outbuf(req, 0, 0);
4779
4780 DEBUG(3,("exit\n"));
4781
4782 END_PROFILE(SMBexit);
4783 return;
4784 }
4785
4786 /****************************************************************************
4787 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4788 ****************************************************************************/
4789
4790 void reply_close(struct smb_request *req)
4791 {
4792 connection_struct *conn = req->conn;
4793 NTSTATUS status = NT_STATUS_OK;
4794 files_struct *fsp = NULL;
4795 START_PROFILE(SMBclose);
4796
4797 if (req->wct < 3) {
4798 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4799 END_PROFILE(SMBclose);
4800 return;
4801 }
4802
4803 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4804
4805 /*
4806 * We can only use check_fsp if we know it's not a directory.
4807 */
4808
4809 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4810 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4811 END_PROFILE(SMBclose);
4812 return;
4813 }
4814
4815 if(fsp->is_directory) {
4816 /*
4817 * Special case - close NT SMB directory handle.
4818 */
4819 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4820 status = close_file(req, fsp, NORMAL_CLOSE);
4821 } else {
4822 time_t t;
4823 /*
4824 * Close ordinary file.
4825 */
4826
4827 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4828 fsp->fh->fd, fsp->fnum,
4829 conn->num_files_open));
4830
4831 /*
4832 * Take care of any time sent in the close.
4833 */
4834
4835 t = srv_make_unix_date3(req->vwv+1);
4836 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4837
4838 /*
4839 * close_file() returns the unix errno if an error
4840 * was detected on close - normally this is due to
4841 * a disk full error. If not then it was probably an I/O error.
4842 */
4843
4844 status = close_file(req, fsp, NORMAL_CLOSE);
4845 }
4846
4847 if (!NT_STATUS_IS_OK(status)) {
4848 reply_nterror(req, status);
4849 END_PROFILE(SMBclose);
4850 return;
4851 }
4852
4853 reply_outbuf(req, 0, 0);
4854 END_PROFILE(SMBclose);
4855 return;
4856 }
4857
4858 /****************************************************************************
4859 Reply to a writeclose (Core+ protocol).
4860 ****************************************************************************/
4861
4862 void reply_writeclose(struct smb_request *req)
4863 {
4864 connection_struct *conn = req->conn;
4865 size_t numtowrite;
4866 ssize_t nwritten = -1;
4867 NTSTATUS close_status = NT_STATUS_OK;
4868 SMB_OFF_T startpos;
4869 const char *data;
4870 struct timespec mtime;
4871 files_struct *fsp;
4872 struct lock_struct lock;
4873
4874 START_PROFILE(SMBwriteclose);
4875
4876 if (req->wct < 6) {
4877 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4878 END_PROFILE(SMBwriteclose);
4879 return;
4880 }
4881
4882 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4883
4884 if (!check_fsp(conn, req, fsp)) {
4885 END_PROFILE(SMBwriteclose);
4886 return;
4887 }
4888 if (!CHECK_WRITE(fsp)) {
4889 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4890 END_PROFILE(SMBwriteclose);
4891 return;
4892 }
4893
4894 numtowrite = SVAL(req->vwv+1, 0);
4895 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4896 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4897 data = (const char *)req->buf + 1;
4898
4899 if (!fsp->print_file) {
4900 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4901 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4902 &lock);
4903
4904 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4905 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4906 END_PROFILE(SMBwriteclose);
4907 return;
4908 }
4909 }
4910
4911 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4912
4913 set_close_write_time(fsp, mtime);
4914
4915 /*
4916 * More insanity. W2K only closes the file if writelen > 0.
4917 * JRA.
4918 */
4919
4920 if (numtowrite) {
4921 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4922 "file %s\n", fsp_str_dbg(fsp)));
4923 close_status = close_file(req, fsp, NORMAL_CLOSE);
4924 }
4925
4926 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4927 fsp->fnum, (int)numtowrite, (int)nwritten,
4928 conn->num_files_open));
4929
4930 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4931 reply_nterror(req, NT_STATUS_DISK_FULL);
4932 goto strict_unlock;
4933 }
4934
4935 if(!NT_STATUS_IS_OK(close_status)) {
4936 reply_nterror(req, close_status);
4937 goto strict_unlock;
4938 }
4939
4940 reply_outbuf(req, 1, 0);
4941
4942 SSVAL(req->outbuf,smb_vwv0,nwritten);
4943
4944 strict_unlock:
4945 if (numtowrite && !fsp->print_file) {
4946 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4947 }
4948
4949 END_PROFILE(SMBwriteclose);
4950 return;
4951 }
4952
4953 #undef DBGC_CLASS
4954 #define DBGC_CLASS DBGC_LOCKING
4955
4956 /****************************************************************************
4957 Reply to a lock.
4958 ****************************************************************************/
4959
4960 void reply_lock(struct smb_request *req)
4961 {
4962 connection_struct *conn = req->conn;
4963 uint64_t count,offset;
4964 NTSTATUS status;
4965 files_struct *fsp;
4966 struct byte_range_lock *br_lck = NULL;
4967
4968 START_PROFILE(SMBlock);
4969
4970 if (req->wct < 5) {
4971 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4972 END_PROFILE(SMBlock);
4973 return;
4974 }
4975
4976 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4977
4978 if (!check_fsp(conn, req, fsp)) {
4979 END_PROFILE(SMBlock);
4980 return;
4981 }
4982
4983 count = (uint64_t)IVAL(req->vwv+1, 0);
4984 offset = (uint64_t)IVAL(req->vwv+3, 0);
4985
4986 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4987 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4988
4989 br_lck = do_lock(req->sconn->msg_ctx,
4990 fsp,
4991 (uint64_t)req->smbpid,
4992 count,
4993 offset,
4994 WRITE_LOCK,
4995 WINDOWS_LOCK,
4996 False, /* Non-blocking lock. */
4997 &status,
4998 NULL,
4999 NULL);
5000
5001 TALLOC_FREE(br_lck);
5002
5003 if (NT_STATUS_V(status)) {
5004 reply_nterror(req, status);
5005 END_PROFILE(SMBlock);
5006 return;
5007 }
5008
5009 reply_outbuf(req, 0, 0);
5010
5011 END_PROFILE(SMBlock);
5012 return;
5013 }
5014
5015 /****************************************************************************
5016 Reply to a unlock.
5017 ****************************************************************************/
5018
5019 void reply_unlock(struct smb_request *req)
5020 {
5021 connection_struct *conn = req->conn;
5022 uint64_t count,offset;
5023 NTSTATUS status;
5024 files_struct *fsp;
5025
5026 START_PROFILE(SMBunlock);
5027
5028 if (req->wct < 5) {
5029 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5030 END_PROFILE(SMBunlock);
5031 return;
5032 }
5033
5034 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5035
5036 if (!check_fsp(conn, req, fsp)) {
5037 END_PROFILE(SMBunlock);
5038 return;
5039 }
5040
5041 count = (uint64_t)IVAL(req->vwv+1, 0);
5042 offset = (uint64_t)IVAL(req->vwv+3, 0);
5043
5044 status = do_unlock(req->sconn->msg_ctx,
5045 fsp,
5046 (uint64_t)req->smbpid,
5047 count,
5048 offset,
5049 WINDOWS_LOCK);
5050
5051 if (NT_STATUS_V(status)) {
5052 reply_nterror(req, status);
5053 END_PROFILE(SMBunlock);
5054 return;
5055 }
5056
5057 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5058 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5059
5060 reply_outbuf(req, 0, 0);
5061
5062 END_PROFILE(SMBunlock);
5063 return;
5064 }
5065
5066 #undef DBGC_CLASS
5067 #define DBGC_CLASS DBGC_ALL
5068
5069 /****************************************************************************
5070 Reply to a tdis.
5071 conn POINTER CAN BE NULL HERE !
5072 ****************************************************************************/
5073
5074 void reply_tdis(struct smb_request *req)
5075 {
5076 connection_struct *conn = req->conn;
5077 START_PROFILE(SMBtdis);
5078
5079 if (!conn) {
5080 DEBUG(4,("Invalid connection in tdis\n"));
5081 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5082 END_PROFILE(SMBtdis);
5083 return;
5084 }
5085
5086 conn->used = False;
5087
5088 close_cnum(conn,req->vuid);
5089 req->conn = NULL;
5090
5091 reply_outbuf(req, 0, 0);
5092 END_PROFILE(SMBtdis);
5093 return;
5094 }
5095
5096 /****************************************************************************
5097 Reply to a echo.
5098 conn POINTER CAN BE NULL HERE !
5099 ****************************************************************************/
5100
5101 void reply_echo(struct smb_request *req)
5102 {
5103 connection_struct *conn = req->conn;
5104 struct smb_perfcount_data local_pcd;
5105 struct smb_perfcount_data *cur_pcd;
5106 int smb_reverb;
5107 int seq_num;
5108
5109 START_PROFILE(SMBecho);
5110
5111 smb_init_perfcount_data(&local_pcd);
5112
5113 if (req->wct < 1) {
5114 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5115 END_PROFILE(SMBecho);
5116 return;
5117 }
5118
5119 smb_reverb = SVAL(req->vwv+0, 0);
5120
5121 reply_outbuf(req, 1, req->buflen);
5122
5123 /* copy any incoming data back out */
5124 if (req->buflen > 0) {
5125 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5126 }
5127
5128 if (smb_reverb > 100) {
5129 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5130 smb_reverb = 100;
5131 }
5132
5133 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5134
5135 /* this makes sure we catch the request pcd */
5136 if (seq_num == smb_reverb) {
5137 cur_pcd = &req->pcd;
5138 } else {
5139 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5140 cur_pcd = &local_pcd;
5141 }
5142
5143 SSVAL(req->outbuf,smb_vwv0,seq_num);
5144
5145 show_msg((char *)req->outbuf);
5146 if (!srv_send_smb(req->sconn,
5147 (char *)req->outbuf,
5148 true, req->seqnum+1,
5149 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5150 cur_pcd))
5151 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5152 }
5153
5154 DEBUG(3,("echo %d times\n", smb_reverb));
5155
5156 TALLOC_FREE(req->outbuf);
5157
5158 END_PROFILE(SMBecho);
5159 return;
5160 }
5161
5162 /****************************************************************************
5163 Reply to a printopen.
5164 ****************************************************************************/
5165
5166 void reply_printopen(struct smb_request *req)
5167 {
5168 connection_struct *conn = req->conn;
5169 files_struct *fsp;
5170 NTSTATUS status;
5171
5172 START_PROFILE(SMBsplopen);
5173
5174 if (req->wct < 2) {
5175 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5176 END_PROFILE(SMBsplopen);
5177 return;
5178 }
5179
5180 if (!CAN_PRINT(conn)) {
5181 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5182 END_PROFILE(SMBsplopen);
5183 return;
5184 }
5185
5186 status = file_new(req, conn, &fsp);
5187 if(!NT_STATUS_IS_OK(status)) {
5188 reply_nterror(req, status);
5189 END_PROFILE(SMBsplopen);
5190 return;
5191 }
5192
5193 /* Open for exclusive use, write only. */
5194 status = print_spool_open(fsp, NULL, req->vuid);
5195
5196 if (!NT_STATUS_IS_OK(status)) {
5197 file_free(req, fsp);
5198 reply_nterror(req, status);
5199 END_PROFILE(SMBsplopen);
5200 return;
5201 }
5202
5203 reply_outbuf(req, 1, 0);
5204 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5205
5206 DEBUG(3,("openprint fd=%d fnum=%d\n",
5207 fsp->fh->fd, fsp->fnum));
5208
5209 END_PROFILE(SMBsplopen);
5210 return;
5211 }
5212
5213 /****************************************************************************
5214 Reply to a printclose.
5215 ****************************************************************************/
5216
5217 void reply_printclose(struct smb_request *req)
5218 {
5219 connection_struct *conn = req->conn;
5220 files_struct *fsp;
5221 NTSTATUS status;
5222
5223 START_PROFILE(SMBsplclose);
5224
5225 if (req->wct < 1) {
5226 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5227 END_PROFILE(SMBsplclose);
5228 return;
5229 }
5230
5231 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5232
5233 if (!check_fsp(conn, req, fsp)) {
5234 END_PROFILE(SMBsplclose);
5235 return;
5236 }
5237
5238 if (!CAN_PRINT(conn)) {
5239 reply_force_doserror(req, ERRSRV, ERRerror);
5240 END_PROFILE(SMBsplclose);
5241 return;
5242 }
5243
5244 DEBUG(3,("printclose fd=%d fnum=%d\n",
5245 fsp->fh->fd,fsp->fnum));
5246
5247 status = close_file(req, fsp, NORMAL_CLOSE);
5248
5249 if(!NT_STATUS_IS_OK(status)) {
5250 reply_nterror(req, status);
5251 END_PROFILE(SMBsplclose);
5252 return;
5253 }
5254
5255 reply_outbuf(req, 0, 0);
5256
5257 END_PROFILE(SMBsplclose);
5258 return;
5259 }
5260
5261 /****************************************************************************
5262 Reply to a printqueue.
5263 ****************************************************************************/
5264
5265 void reply_printqueue(struct smb_request *req)
5266 {
5267 connection_struct *conn = req->conn;
5268 int max_count;
5269 int start_index;
5270
5271 START_PROFILE(SMBsplretq);
5272
5273 if (req->wct < 2) {
5274 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5275 END_PROFILE(SMBsplretq);
5276 return;
5277 }
5278
5279 max_count = SVAL(req->vwv+0, 0);
5280 start_index = SVAL(req->vwv+1, 0);
5281
5282 /* we used to allow the client to get the cnum wrong, but that
5283 is really quite gross and only worked when there was only
5284 one printer - I think we should now only accept it if they
5285 get it right (tridge) */
5286 if (!CAN_PRINT(conn)) {
5287 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5288 END_PROFILE(SMBsplretq);
5289 return;
5290 }
5291
5292 reply_outbuf(req, 2, 3);
5293 SSVAL(req->outbuf,smb_vwv0,0);
5294 SSVAL(req->outbuf,smb_vwv1,0);
5295 SCVAL(smb_buf(req->outbuf),0,1);
5296 SSVAL(smb_buf(req->outbuf),1,0);
5297
5298 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5299 start_index, max_count));
5300
5301 {
5302 TALLOC_CTX *mem_ctx = talloc_tos();
5303 NTSTATUS status;
5304 WERROR werr;
5305 const char *sharename = lp_servicename(SNUM(conn));
5306 struct rpc_pipe_client *cli = NULL;
5307 struct policy_handle handle;
5308 struct spoolss_DevmodeContainer devmode_ctr;
5309 union spoolss_JobInfo *info;
5310 uint32_t count;
5311 uint32_t num_to_get;
5312 uint32_t first;
5313 uint32_t i;
5314
5315 ZERO_STRUCT(handle);
5316
5317 status = rpc_pipe_open_interface(conn,
5318 &ndr_table_spoolss.syntax_id,
5319 conn->server_info,
5320 &conn->sconn->client_id,
5321 conn->sconn->msg_ctx,
5322 &cli);
5323 if (!NT_STATUS_IS_OK(status)) {
5324 DEBUG(0, ("reply_printqueue: "
5325 "could not connect to spoolss: %s\n",
5326 nt_errstr(status)));
5327 reply_nterror(req, status);
5328 goto out;
5329 }
5330
5331 ZERO_STRUCT(devmode_ctr);
5332
5333 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
5334 sharename,
5335 NULL, devmode_ctr,
5336 SEC_FLAG_MAXIMUM_ALLOWED,
5337 &handle,
5338 &werr);
5339 if (!NT_STATUS_IS_OK(status)) {
5340 reply_nterror(req, status);
5341 goto out;
5342 }
5343 if (!W_ERROR_IS_OK(werr)) {
5344 reply_nterror(req, werror_to_ntstatus(werr));
5345 goto out;
5346 }
5347
5348 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5349 &handle,
5350 0, /* firstjob */
5351 0xff, /* numjobs */
5352 2, /* level */
5353 0, /* offered */
5354 &count,
5355 &info);
5356 if (!W_ERROR_IS_OK(werr)) {
5357 reply_nterror(req, werror_to_ntstatus(werr));
5358 goto out;
5359 }
5360
5361 if (max_count > 0) {
5362 first = start_index;
5363 } else {
5364 first = start_index + max_count + 1;
5365 }
5366
5367 if (first >= count) {
5368 num_to_get = first;
5369 } else {
5370 num_to_get = first + MIN(ABS(max_count), count - first);
5371 }
5372
5373 for (i = first; i < num_to_get; i++) {
5374 char blob[28];
5375 char *p = blob;
5376 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5377 int qstatus;
5378 uint16_t qrapjobid = pjobid_to_rap(sharename,
5379 info[i].info2.job_id);
5380
5381 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5382 qstatus = 2;
5383 } else {
5384 qstatus = 3;
5385 }
5386
5387 srv_put_dos_date2(p, 0, qtime);
5388 SCVAL(p, 4, qstatus);
5389 SSVAL(p, 5, qrapjobid);
5390 SIVAL(p, 7, info[i].info2.size);
5391 SCVAL(p, 11, 0);
5392 srvstr_push(blob, req->flags2, p+12,
5393 info[i].info2.notify_name, 16, STR_ASCII);
5394
5395 if (message_push_blob(
5396 &req->outbuf,
5397 data_blob_const(
5398 blob, sizeof(blob))) == -1) {
5399 reply_nterror(req, NT_STATUS_NO_MEMORY);
5400 goto out;
5401 }
5402 }
5403
5404 if (count > 0) {
5405 SSVAL(req->outbuf,smb_vwv0,count);
5406 SSVAL(req->outbuf,smb_vwv1,
5407 (max_count>0?first+count:first-1));
5408 SCVAL(smb_buf(req->outbuf),0,1);
5409 SSVAL(smb_buf(req->outbuf),1,28*count);
5410 }
5411
5412
5413 DEBUG(3, ("%u entries returned in queue\n",
5414 (unsigned)count));
5415
5416 out:
5417 if (cli && is_valid_policy_hnd(&handle)) {
5418 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
5419 }
5420
5421 }
5422
5423 END_PROFILE(SMBsplretq);
5424 return;
5425 }
5426
5427 /****************************************************************************
5428 Reply to a printwrite.
5429 ****************************************************************************/
5430
5431 void reply_printwrite(struct smb_request *req)
5432 {
5433 connection_struct *conn = req->conn;
5434 int numtowrite;
5435 const char *data;
5436 files_struct *fsp;
5437
5438 START_PROFILE(SMBsplwr);
5439
5440 if (req->wct < 1) {
5441 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5442 END_PROFILE(SMBsplwr);
5443 return;
5444 }
5445
5446 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5447
5448 if (!check_fsp(conn, req, fsp)) {
5449 END_PROFILE(SMBsplwr);
5450 return;
5451 }
5452
5453 if (!fsp->print_file) {
5454 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5455 END_PROFILE(SMBsplwr);
5456 return;
5457 }
5458
5459 if (!CHECK_WRITE(fsp)) {
5460 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5461 END_PROFILE(SMBsplwr);
5462 return;
5463 }
5464
5465 numtowrite = SVAL(req->buf, 1);
5466
5467 if (req->buflen < numtowrite + 3) {
5468 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5469 END_PROFILE(SMBsplwr);
5470 return;
5471 }
5472
5473 data = (const char *)req->buf + 3;
5474
5475 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5476 reply_nterror(req, map_nt_error_from_unix(errno));
5477 END_PROFILE(SMBsplwr);
5478 return;
5479 }
5480
5481 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5482
5483 END_PROFILE(SMBsplwr);
5484 return;
5485 }
5486
5487 /****************************************************************************
5488 Reply to a mkdir.
5489 ****************************************************************************/
5490
5491 void reply_mkdir(struct smb_request *req)
5492 {
5493 connection_struct *conn = req->conn;
5494 struct smb_filename *smb_dname = NULL;
5495 char *directory = NULL;
5496 NTSTATUS status;
5497 TALLOC_CTX *ctx = talloc_tos();
5498
5499 START_PROFILE(SMBmkdir);
5500
5501 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5502 STR_TERMINATE, &status);
5503 if (!NT_STATUS_IS_OK(status)) {
5504 reply_nterror(req, status);
5505 goto out;
5506 }
5507
5508 status = filename_convert(ctx, conn,
5509 req->flags2 & FLAGS2_DFS_PATHNAMES,
5510 directory,
5511 0,
5512 NULL,
5513 &smb_dname);
5514 if (!NT_STATUS_IS_OK(status)) {
5515 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5516 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5517 ERRSRV, ERRbadpath);
5518 goto out;
5519 }
5520 reply_nterror(req, status);
5521 goto out;
5522 }
5523
5524 status = create_directory(conn, req, smb_dname);
5525
5526 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5527
5528 if (!NT_STATUS_IS_OK(status)) {
5529
5530 if (!use_nt_status()
5531 && NT_STATUS_EQUAL(status,
5532 NT_STATUS_OBJECT_NAME_COLLISION)) {
5533 /*
5534 * Yes, in the DOS error code case we get a
5535 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5536 * samba4 torture test.
5537 */
5538 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5539 }
5540
5541 reply_nterror(req, status);
5542 goto out;
5543 }
5544
5545 reply_outbuf(req, 0, 0);
5546
5547 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5548 out:
5549 TALLOC_FREE(smb_dname);
5550 END_PROFILE(SMBmkdir);
5551 return;
5552 }
5553
5554 /****************************************************************************
5555 Reply to a rmdir.
5556 ****************************************************************************/
5557
5558 void reply_rmdir(struct smb_request *req)
5559 {
5560 connection_struct *conn = req->conn;
5561 struct smb_filename *smb_dname = NULL;
5562 char *directory = NULL;
5563 NTSTATUS status;
5564 TALLOC_CTX *ctx = talloc_tos();
5565 files_struct *fsp = NULL;
5566 int info = 0;
5567 struct smbd_server_connection *sconn = req->sconn;
5568
5569 START_PROFILE(SMBrmdir);
5570
5571 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5572 STR_TERMINATE, &status);
5573 if (!NT_STATUS_IS_OK(status)) {
5574 reply_nterror(req, status);
5575 goto out;
5576 }
5577
5578 status = filename_convert(ctx, conn,
5579 req->flags2 & FLAGS2_DFS_PATHNAMES,
5580 directory,
5581 0,
5582 NULL,
5583 &smb_dname);
5584 if (!NT_STATUS_IS_OK(status)) {
5585 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5586 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5587 ERRSRV, ERRbadpath);
5588 goto out;
5589 }
5590 reply_nterror(req, status);
5591 goto out;
5592 }
5593
5594 if (is_ntfs_stream_smb_fname(smb_dname)) {
5595 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5596 goto out;
5597 }
5598
5599 status = SMB_VFS_CREATE_FILE(
5600 conn, /* conn */
5601 req, /* req */
5602 0, /* root_dir_fid */
5603 smb_dname, /* fname */
5604 DELETE_ACCESS, /* access_mask */
5605 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5606 FILE_SHARE_DELETE),
5607 FILE_OPEN, /* create_disposition*/
5608 FILE_DIRECTORY_FILE, /* create_options */
5609 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5610 0, /* oplock_request */
5611 0, /* allocation_size */
5612 0, /* private_flags */
5613 NULL, /* sd */
5614 NULL, /* ea_list */
5615 &fsp, /* result */
5616 &info); /* pinfo */
5617
5618 if (!NT_STATUS_IS_OK(status)) {
5619 if (open_was_deferred(req->mid)) {
5620 /* We have re-scheduled this call. */
5621 goto out;
5622 }
5623 reply_nterror(req, status);
5624 goto out;
5625 }
5626
5627 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5628 if (!NT_STATUS_IS_OK(status)) {
5629 close_file(req, fsp, ERROR_CLOSE);
5630 reply_nterror(req, status);
5631 goto out;
5632 }
5633
5634 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5635 close_file(req, fsp, ERROR_CLOSE);
5636 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5637 goto out;
5638 }
5639
5640 status = close_file(req, fsp, NORMAL_CLOSE);
5641 if (!NT_STATUS_IS_OK(status)) {
5642 reply_nterror(req, status);
5643 } else {
5644 reply_outbuf(req, 0, 0);
5645 }
5646
5647 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5648
5649 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5650 out:
5651 TALLOC_FREE(smb_dname);
5652 END_PROFILE(SMBrmdir);
5653 return;
5654 }
5655
5656 /*******************************************************************
5657 Resolve wildcards in a filename rename.
5658 ********************************************************************/
5659
5660 static bool resolve_wildcards(TALLOC_CTX *ctx,
5661 const char *name1,
5662 const char *name2,
5663 char **pp_newname)
5664 {
5665 char *name2_copy = NULL;
5666 char *root1 = NULL;
5667 char *root2 = NULL;
5668 char *ext1 = NULL;
5669 char *ext2 = NULL;
5670 char *p,*p2, *pname1, *pname2;
5671
5672 name2_copy = talloc_strdup(ctx, name2);
5673 if (!name2_copy) {
5674 return False;
5675 }
5676
5677 pname1 = strrchr_m(name1,'/');
5678 pname2 = strrchr_m(name2_copy,'/');
5679
5680 if (!pname1 || !pname2) {
5681 return False;
5682 }
5683
5684 /* Truncate the copy of name2 at the last '/' */
5685 *pname2 = '\0';
5686
5687 /* Now go past the '/' */
5688 pname1++;
5689 pname2++;
5690
5691 root1 = talloc_strdup(ctx, pname1);
5692 root2 = talloc_strdup(ctx, pname2);
5693
5694 if (!root1 || !root2) {
5695 return False;
5696 }
5697
5698 p = strrchr_m(root1,'.');
5699 if (p) {
5700 *p = 0;
5701 ext1 = talloc_strdup(ctx, p+1);
5702 } else {
5703 ext1 = talloc_strdup(ctx, "");
5704 }
5705 p = strrchr_m(root2,'.');
5706 if (p) {
5707 *p = 0;
5708 ext2 = talloc_strdup(ctx, p+1);
5709 } else {
5710 ext2 = talloc_strdup(ctx, "");
5711 }
5712
5713 if (!ext1 || !ext2) {
5714 return False;
5715 }
5716
5717 p = root1;
5718 p2 = root2;
5719 while (*p2) {
5720 if (*p2 == '?') {
5721 /* Hmmm. Should this be mb-aware ? */
5722 *p2 = *p;
5723 p2++;
5724 } else if (*p2 == '*') {
5725 *p2 = '\0';
5726 root2 = talloc_asprintf(ctx, "%s%s",
5727 root2,
5728 p);
5729 if (!root2) {
5730 return False;
5731 }
5732 break;
5733 } else {
5734 p2++;
5735 }
5736 if (*p) {
5737 p++;
5738 }
5739 }
5740
5741 p = ext1;
5742 p2 = ext2;
5743 while (*p2) {
5744 if (*p2 == '?') {
5745 /* Hmmm. Should this be mb-aware ? */
5746 *p2 = *p;
5747 p2++;
5748 } else if (*p2 == '*') {
5749 *p2 = '\0';
5750 ext2 = talloc_asprintf(ctx, "%s%s",
5751 ext2,
5752 p);
5753 if (!ext2) {
5754 return False;
5755 }
5756 break;
5757 } else {
5758 p2++;
5759 }
5760 if (*p) {
5761 p++;
5762 }
5763 }
5764
5765 if (*ext2) {
5766 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5767 name2_copy,
5768 root2,
5769 ext2);
5770 } else {
5771 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5772 name2_copy,
5773 root2);
5774 }
5775
5776 if (!*pp_newname) {
5777 return False;
5778 }
5779
5780 return True;
5781 }
5782
5783 /****************************************************************************
5784 Ensure open files have their names updated. Updated to notify other smbd's
5785 asynchronously.
5786 ****************************************************************************/
5787
5788 static void rename_open_files(connection_struct *conn,
5789 struct share_mode_lock *lck,
5790 const struct smb_filename *smb_fname_dst)
5791 {
5792 files_struct *fsp;
5793 bool did_rename = False;
5794 NTSTATUS status;
5795
5796 for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5797 fsp = file_find_di_next(fsp)) {
5798 /* fsp_name is a relative path under the fsp. To change this for other
5799 sharepaths we need to manipulate relative paths. */
5800 /* TODO - create the absolute path and manipulate the newname
5801 relative to the sharepath. */
5802 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5803 continue;
5804 }
5805 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5806 "(file_id %s) from %s -> %s\n", fsp->fnum,
5807 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5808 smb_fname_str_dbg(smb_fname_dst)));
5809
5810 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5811 if (NT_STATUS_IS_OK(status)) {
5812 did_rename = True;
5813 }
5814 }
5815
5816 if (!did_rename) {
5817 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5818 "for %s\n", file_id_string_tos(&lck->id),
5819 smb_fname_str_dbg(smb_fname_dst)));
5820 }
5821
5822 /* Send messages to all smbd's (not ourself) that the name has changed. */
5823 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5824 smb_fname_dst);
5825
5826 }
5827
5828 /****************************************************************************
5829 We need to check if the source path is a parent directory of the destination
5830 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5831 refuse the rename with a sharing violation. Under UNIX the above call can
5832 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5833 probably need to check that the client is a Windows one before disallowing
5834 this as a UNIX client (one with UNIX extensions) can know the source is a
5835 symlink and make this decision intelligently. Found by an excellent bug
5836 report from <AndyLiebman@aol.com>.
5837 ****************************************************************************/
5838
5839 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5840 const struct smb_filename *smb_fname_dst)
5841 {
5842 const char *psrc = smb_fname_src->base_name;
5843 const char *pdst = smb_fname_dst->base_name;
5844 size_t slen;
5845
5846 if (psrc[0] == '.' && psrc[1] == '/') {
5847 psrc += 2;
5848 }
5849 if (pdst[0] == '.' && pdst[1] == '/') {
5850 pdst += 2;
5851 }
5852 if ((slen = strlen(psrc)) > strlen(pdst)) {
5853 return False;
5854 }
5855 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5856 }
5857
5858 /*
5859 * Do the notify calls from a rename
5860 */
5861
5862 static void notify_rename(connection_struct *conn, bool is_dir,
5863 const struct smb_filename *smb_fname_src,
5864 const struct smb_filename *smb_fname_dst)
5865 {
5866 char *parent_dir_src = NULL;
5867 char *parent_dir_dst = NULL;
5868 uint32 mask;
5869
5870 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5871 : FILE_NOTIFY_CHANGE_FILE_NAME;
5872
5873 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5874 &parent_dir_src, NULL) ||
5875 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5876 &parent_dir_dst, NULL)) {
5877 goto out;
5878 }
5879
5880 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5881 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5882 smb_fname_src->base_name);
5883 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5884 smb_fname_dst->base_name);
5885 }
5886 else {
5887 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5888 smb_fname_src->base_name);
5889 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5890 smb_fname_dst->base_name);
5891 }
5892
5893 /* this is a strange one. w2k3 gives an additional event for
5894 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5895 files, but not directories */
5896 if (!is_dir) {
5897 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5898 FILE_NOTIFY_CHANGE_ATTRIBUTES
5899 |FILE_NOTIFY_CHANGE_CREATION,
5900 smb_fname_dst->base_name);
5901 }
5902 out:
5903 TALLOC_FREE(parent_dir_src);
5904 TALLOC_FREE(parent_dir_dst);
5905 }
5906
5907 /****************************************************************************
5908 Rename an open file - given an fsp.
5909 ****************************************************************************/
5910
5911 NTSTATUS rename_internals_fsp(connection_struct *conn,
5912 files_struct *fsp,
5913 const struct smb_filename *smb_fname_dst_in,
5914 uint32 attrs,
5915 bool replace_if_exists)
5916 {
5917 TALLOC_CTX *ctx = talloc_tos();
5918 struct smb_filename *smb_fname_dst = NULL;
5919 NTSTATUS status = NT_STATUS_OK;
5920 struct share_mode_lock *lck = NULL;
5921 bool dst_exists, old_is_stream, new_is_stream;
5922
5923 status = check_name(conn, smb_fname_dst_in->base_name);
5924 if (!NT_STATUS_IS_OK(status)) {
5925 return status;
5926 }
5927
5928 /* Make a copy of the dst smb_fname structs */
5929
5930 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5931 if (!NT_STATUS_IS_OK(status)) {
5932 goto out;
5933 }
5934
5935 /* Ensure the dst smb_fname contains a '/' */
5936 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5937 char * tmp;
5938 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5939 smb_fname_dst->base_name);
5940 if (!tmp) {
5941 status = NT_STATUS_NO_MEMORY;
5942 goto out;
5943 }
5944 TALLOC_FREE(smb_fname_dst->base_name);
5945 smb_fname_dst->base_name = tmp;
5946 }
5947
5948 /*
5949 * Check for special case with case preserving and not
5950 * case sensitive. If the old last component differs from the original
5951 * last component only by case, then we should allow
5952 * the rename (user is trying to change the case of the
5953 * filename).
5954 */
5955 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5956 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5957 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5958 char *last_slash;
5959 char *fname_dst_lcomp_base_mod = NULL;
5960 struct smb_filename *smb_fname_orig_lcomp = NULL;
5961
5962 /*
5963 * Get the last component of the destination name. Note that
5964 * we guarantee that destination name contains a '/' character
5965 * above.
5966 */
5967 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5968 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5969 if (!fname_dst_lcomp_base_mod) {
5970 status = NT_STATUS_NO_MEMORY;
5971 goto out;
5972 }
5973
5974 /*
5975 * Create an smb_filename struct using the original last
5976 * component of the destination.
5977 */
5978 status = create_synthetic_smb_fname_split(ctx,
5979 smb_fname_dst->original_lcomp, NULL,
5980 &smb_fname_orig_lcomp);
5981 if (!NT_STATUS_IS_OK(status)) {
5982 TALLOC_FREE(fname_dst_lcomp_base_mod);
5983 goto out;
5984 }
5985
5986 /* If the base names only differ by case, use original. */
5987 if(!strcsequal(fname_dst_lcomp_base_mod,
5988 smb_fname_orig_lcomp->base_name)) {
5989 char *tmp;
5990 /*
5991 * Replace the modified last component with the
5992 * original.
5993 */
5994 *last_slash = '\0'; /* Truncate at the '/' */
5995 tmp = talloc_asprintf(smb_fname_dst,
5996 "%s/%s",
5997 smb_fname_dst->base_name,
5998 smb_fname_orig_lcomp->base_name);
5999 if (tmp == NULL) {
6000 status = NT_STATUS_NO_MEMORY;
6001 TALLOC_FREE(fname_dst_lcomp_base_mod);
6002 TALLOC_FREE(smb_fname_orig_lcomp);
6003 goto out;
6004 }
6005 TALLOC_FREE(smb_fname_dst->base_name);
6006 smb_fname_dst->base_name = tmp;
6007 }
6008
6009 /* If the stream_names only differ by case, use original. */
6010 if(!strcsequal(smb_fname_dst->stream_name,
6011 smb_fname_orig_lcomp->stream_name)) {
6012 char *tmp = NULL;
6013 /* Use the original stream. */
6014 tmp = talloc_strdup(smb_fname_dst,
6015 smb_fname_orig_lcomp->stream_name);
6016 if (tmp == NULL) {
6017 status = NT_STATUS_NO_MEMORY;
6018 TALLOC_FREE(fname_dst_lcomp_base_mod);
6019 TALLOC_FREE(smb_fname_orig_lcomp);
6020 goto out;
6021 }
6022 TALLOC_FREE(smb_fname_dst->stream_name);
6023 smb_fname_dst->stream_name = tmp;
6024 }
6025 TALLOC_FREE(fname_dst_lcomp_base_mod);
6026 TALLOC_FREE(smb_fname_orig_lcomp);
6027 }
6028
6029 /*
6030 * If the src and dest names are identical - including case,
6031 * don't do the rename, just return success.
6032 */
6033
6034 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6035 strcsequal(fsp->fsp_name->stream_name,
6036 smb_fname_dst->stream_name)) {
6037 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6038 "- returning success\n",
6039 smb_fname_str_dbg(smb_fname_dst)));
6040 status = NT_STATUS_OK;
6041 goto out;
6042 }
6043
6044 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6045 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6046
6047 /* Return the correct error code if both names aren't streams. */
6048 if (!old_is_stream && new_is_stream) {
6049 status = NT_STATUS_OBJECT_NAME_INVALID;
6050 goto out;
6051 }
6052
6053 if (old_is_stream && !new_is_stream) {
6054 status = NT_STATUS_INVALID_PARAMETER;
6055 goto out;
6056 }
6057
6058 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6059
6060 if(!replace_if_exists && dst_exists) {
6061 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6062 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6063 smb_fname_str_dbg(smb_fname_dst)));
6064 status = NT_STATUS_OBJECT_NAME_COLLISION;
6065 goto out;
6066 }
6067
6068 if (dst_exists) {
6069 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6070 &smb_fname_dst->st);
6071 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6072 fileid);
6073 /* The file can be open when renaming a stream */
6074 if (dst_fsp && !new_is_stream) {
6075 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6076 status = NT_STATUS_ACCESS_DENIED;
6077 goto out;
6078 }
6079 }
6080
6081 /* Ensure we have a valid stat struct for the source. */
6082 status = vfs_stat_fsp(fsp);
6083 if (!NT_STATUS_IS_OK(status)) {
6084 goto out;
6085 }
6086
6087 status = can_rename(conn, fsp, attrs);
6088
6089 if (!NT_STATUS_IS_OK(status)) {
6090 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6091 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6092 smb_fname_str_dbg(smb_fname_dst)));
6093 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6094 status = NT_STATUS_ACCESS_DENIED;
6095 goto out;
6096 }
6097
6098 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6099 status = NT_STATUS_ACCESS_DENIED;
6100 }
6101
6102 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6103 NULL);
6104
6105 /*
6106 * We have the file open ourselves, so not being able to get the
6107 * corresponding share mode lock is a fatal error.
6108 */
6109
6110 SMB_ASSERT(lck != NULL);
6111
6112 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6113 uint32 create_options = fsp->fh->private_options;
6114
6115 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6116 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6117 smb_fname_str_dbg(smb_fname_dst)));
6118
6119 if (!lp_posix_pathnames() &&
6120 (lp_map_archive(SNUM(conn)) ||
6121 lp_store_dos_attributes(SNUM(conn)))) {
6122 /* We must set the archive bit on the newly
6123 renamed file. */
6124 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6125 uint32_t old_dosmode = dos_mode(conn,
6126 smb_fname_dst);
6127 file_set_dosmode(conn,
6128 smb_fname_dst,
6129 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6130 NULL,
6131 true);
6132 }
6133 }
6134
6135 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6136 smb_fname_dst);
6137
6138 rename_open_files(conn, lck, smb_fname_dst);
6139
6140 /*
6141 * A rename acts as a new file create w.r.t. allowing an initial delete
6142 * on close, probably because in Windows there is a new handle to the
6143 * new file. If initial delete on close was requested but not
6144 * originally set, we need to set it here. This is probably not 100% correct,
6145 * but will work for the CIFSFS client which in non-posix mode
6146 * depends on these semantics. JRA.
6147 */
6148
6149 if (create_options & FILE_DELETE_ON_CLOSE) {
6150 status = can_set_delete_on_close(fsp, 0);
6151
6152 if (NT_STATUS_IS_OK(status)) {
6153 /* Note that here we set the *inital* delete on close flag,
6154 * not the regular one. The magic gets handled in close. */
6155 fsp->initial_delete_on_close = True;
6156 }
6157 }
6158 TALLOC_FREE(lck);
6159 status = NT_STATUS_OK;
6160 goto out;
6161 }
6162
6163 TALLOC_FREE(lck);
6164
6165 if (errno == ENOTDIR || errno == EISDIR) {
6166 status = NT_STATUS_OBJECT_NAME_COLLISION;
6167 } else {
6168 status = map_nt_error_from_unix(errno);
6169 }
6170
6171 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6172 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6173 smb_fname_str_dbg(smb_fname_dst)));
6174
6175 out:
6176 TALLOC_FREE(smb_fname_dst);
6177
6178 return status;
6179 }
6180
6181 /****************************************************************************
6182 The guts of the rename command, split out so it may be called by the NT SMB
6183 code.
6184 ****************************************************************************/
6185
6186 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6187 connection_struct *conn,
6188 struct smb_request *req,
6189 struct smb_filename *smb_fname_src,
6190 struct smb_filename *smb_fname_dst,
6191 uint32 attrs,
6192 bool replace_if_exists,
6193 bool src_has_wild,
6194 bool dest_has_wild,
6195 uint32_t access_mask)
6196 {
6197 char *fname_src_dir = NULL;
6198 char *fname_src_mask = NULL;
6199 int count=0;
6200 NTSTATUS status = NT_STATUS_OK;
6201 struct smb_Dir *dir_hnd = NULL;
6202 const char *dname = NULL;
6203 char *talloced = NULL;
6204 long offset = 0;
6205 int create_options = 0;
6206 bool posix_pathnames = lp_posix_pathnames();
6207
6208 /*
6209 * Split the old name into directory and last component
6210 * strings. Note that unix_convert may have stripped off a
6211 * leading ./ from both name and newname if the rename is
6212 * at the root of the share. We need to make sure either both
6213 * name and newname contain a / character or neither of them do
6214 * as this is checked in resolve_wildcards().
6215 */
6216
6217 /* Split up the directory from the filename/mask. */
6218 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6219 &fname_src_dir, &fname_src_mask);
6220 if (!NT_STATUS_IS_OK(status)) {
6221 status = NT_STATUS_NO_MEMORY;
6222 goto out;
6223 }
6224
6225 /*
6226 * We should only check the mangled cache
6227 * here if unix_convert failed. This means
6228 * that the path in 'mask' doesn't exist
6229 * on the file system and so we need to look
6230 * for a possible mangle. This patch from
6231 * Tine Smukavec <valentin.smukavec@hermes.si>.
6232 */
6233
6234 if (!VALID_STAT(smb_fname_src->st) &&
6235 mangle_is_mangled(fname_src_mask, conn->params)) {
6236 char *new_mask = NULL;
6237 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6238 conn->params);
6239 if (new_mask) {
6240 TALLOC_FREE(fname_src_mask);
6241 fname_src_mask = new_mask;
6242 }
6243 }
6244
6245 if (!src_has_wild) {
6246 files_struct *fsp;
6247
6248 /*
6249 * Only one file needs to be renamed. Append the mask back
6250 * onto the directory.
6251 */
6252 TALLOC_FREE(smb_fname_src->base_name);
6253 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6254 "%s/%s",
6255 fname_src_dir,
6256 fname_src_mask);
6257 if (!smb_fname_src->base_name) {
6258 status = NT_STATUS_NO_MEMORY;
6259 goto out;
6260 }
6261
6262 /* Ensure dst fname contains a '/' also */
6263 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6264 char *tmp;
6265 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6266 smb_fname_dst->base_name);
6267 if (!tmp) {
6268 status = NT_STATUS_NO_MEMORY;
6269 goto out;
6270 }
6271 TALLOC_FREE(smb_fname_dst->base_name);
6272 smb_fname_dst->base_name = tmp;
6273 }
6274
6275 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6276 "case_preserve = %d, short case preserve = %d, "
6277 "directory = %s, newname = %s, "
6278 "last_component_dest = %s\n",
6279 conn->case_sensitive, conn->case_preserve,
6280 conn->short_case_preserve,
6281 smb_fname_str_dbg(smb_fname_src),
6282 smb_fname_str_dbg(smb_fname_dst),
6283 smb_fname_dst->original_lcomp));
6284
6285 /* The dest name still may have wildcards. */
6286 if (dest_has_wild) {
6287 char *fname_dst_mod = NULL;
6288 if (!resolve_wildcards(smb_fname_dst,
6289 smb_fname_src->base_name,
6290 smb_fname_dst->base_name,
6291 &fname_dst_mod)) {
6292 DEBUG(6, ("rename_internals: resolve_wildcards "
6293 "%s %s failed\n",
6294 smb_fname_src->base_name,
6295 smb_fname_dst->base_name));
6296 status = NT_STATUS_NO_MEMORY;
6297 goto out;
6298 }
6299 TALLOC_FREE(smb_fname_dst->base_name);
6300 smb_fname_dst->base_name = fname_dst_mod;
6301 }
6302
6303 ZERO_STRUCT(smb_fname_src->st);
6304 if (posix_pathnames) {
6305 SMB_VFS_LSTAT(conn, smb_fname_src);
6306 } else {
6307 SMB_VFS_STAT(conn, smb_fname_src);
6308 }
6309
6310 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6311 create_options |= FILE_DIRECTORY_FILE;
6312 }
6313
6314 status = SMB_VFS_CREATE_FILE(
6315 conn, /* conn */
6316 req, /* req */
6317 0, /* root_dir_fid */
6318 smb_fname_src, /* fname */
6319 access_mask, /* access_mask */
6320 (FILE_SHARE_READ | /* share_access */
6321 FILE_SHARE_WRITE),
6322 FILE_OPEN, /* create_disposition*/
6323 create_options, /* create_options */
6324 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6325 0, /* oplock_request */
6326 0, /* allocation_size */
6327 0, /* private_flags */
6328 NULL, /* sd */
6329 NULL, /* ea_list */
6330 &fsp, /* result */
6331 NULL); /* pinfo */
6332
6333 if (!NT_STATUS_IS_OK(status)) {
6334 DEBUG(3, ("Could not open rename source %s: %s\n",
6335 smb_fname_str_dbg(smb_fname_src),
6336 nt_errstr(status)));
6337 goto out;
6338 }
6339
6340 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6341 attrs, replace_if_exists);
6342
6343 close_file(req, fsp, NORMAL_CLOSE);
6344
6345 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6346 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6347 smb_fname_str_dbg(smb_fname_dst)));
6348
6349 goto out;
6350 }
6351
6352 /*
6353 * Wildcards - process each file that matches.
6354 */
6355 if (strequal(fname_src_mask, "????????.???")) {
6356 TALLOC_FREE(fname_src_mask);
6357 fname_src_mask = talloc_strdup(ctx, "*");
6358 if (!fname_src_mask) {
6359 status = NT_STATUS_NO_MEMORY;
6360 goto out;
6361 }
6362 }
6363
6364 status = check_name(conn, fname_src_dir);
6365 if (!NT_STATUS_IS_OK(status)) {
6366 goto out;
6367 }
6368
6369 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6370 attrs);
6371 if (dir_hnd == NULL) {
6372 status = map_nt_error_from_unix(errno);
6373 goto out;
6374 }
6375
6376 status = NT_STATUS_NO_SUCH_FILE;
6377 /*
6378 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6379 * - gentest fix. JRA
6380 */
6381
6382 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6383 &talloced))) {
6384 files_struct *fsp = NULL;
6385 char *destname = NULL;
6386 bool sysdir_entry = False;
6387
6388 /* Quick check for "." and ".." */
6389 if (ISDOT(dname) || ISDOTDOT(dname)) {
6390 if (attrs & aDIR) {
6391 sysdir_entry = True;
6392 } else {
6393 TALLOC_FREE(talloced);
6394 continue;
6395 }
6396 }
6397
6398 if (!is_visible_file(conn, fname_src_dir, dname,
6399 &smb_fname_src->st, false)) {
6400 TALLOC_FREE(talloced);
6401 continue;
6402 }
6403
6404 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6405 TALLOC_FREE(talloced);
6406 continue;
6407 }
6408
6409 if (sysdir_entry) {
6410 status = NT_STATUS_OBJECT_NAME_INVALID;
6411 break;
6412 }
6413
6414 TALLOC_FREE(smb_fname_src->base_name);
6415 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6416 "%s/%s",
6417 fname_src_dir,
6418 dname);
6419 if (!smb_fname_src->base_name) {
6420 status = NT_STATUS_NO_MEMORY;
6421 goto out;
6422 }
6423
6424 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6425 smb_fname_dst->base_name,
6426 &destname)) {
6427 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6428 smb_fname_src->base_name, destname));
6429 TALLOC_FREE(talloced);
6430 continue;
6431 }
6432 if (!destname) {
6433 status = NT_STATUS_NO_MEMORY;
6434 goto out;
6435 }
6436
6437 TALLOC_FREE(smb_fname_dst->base_name);
6438 smb_fname_dst->base_name = destname;
6439
6440 ZERO_STRUCT(smb_fname_src->st);
6441 if (posix_pathnames) {
6442 SMB_VFS_LSTAT(conn, smb_fname_src);
6443 } else {
6444 SMB_VFS_STAT(conn, smb_fname_src);
6445 }
6446
6447 create_options = 0;
6448
6449 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6450 create_options |= FILE_DIRECTORY_FILE;
6451 }
6452
6453 status = SMB_VFS_CREATE_FILE(
6454 conn, /* conn */
6455 req, /* req */
6456 0, /* root_dir_fid */
6457 smb_fname_src, /* fname */
6458 access_mask, /* access_mask */
6459 (FILE_SHARE_READ | /* share_access */
6460 FILE_SHARE_WRITE),
6461 FILE_OPEN, /* create_disposition*/
6462 create_options, /* create_options */
6463 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6464 0, /* oplock_request */
6465 0, /* allocation_size */
6466 0, /* private_flags */
6467 NULL, /* sd */
6468 NULL, /* ea_list */
6469 &fsp, /* result */
6470 NULL); /* pinfo */
6471
6472 if (!NT_STATUS_IS_OK(status)) {
6473 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6474 "returned %s rename %s -> %s\n",
6475 nt_errstr(status),
6476 smb_fname_str_dbg(smb_fname_src),
6477 smb_fname_str_dbg(smb_fname_dst)));
6478 break;
6479 }
6480
6481 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6482 dname);
6483 if (!smb_fname_dst->original_lcomp) {
6484 status = NT_STATUS_NO_MEMORY;
6485 goto out;
6486 }
6487
6488 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6489 attrs, replace_if_exists);
6490
6491 close_file(req, fsp, NORMAL_CLOSE);
6492
6493 if (!NT_STATUS_IS_OK(status)) {
6494 DEBUG(3, ("rename_internals_fsp returned %s for "
6495 "rename %s -> %s\n", nt_errstr(status),
6496 smb_fname_str_dbg(smb_fname_src),
6497 smb_fname_str_dbg(smb_fname_dst)));
6498 break;
6499 }
6500
6501 count++;
6502
6503 DEBUG(3,("rename_internals: doing rename on %s -> "
6504 "%s\n", smb_fname_str_dbg(smb_fname_src),
6505 smb_fname_str_dbg(smb_fname_src)));
6506 TALLOC_FREE(talloced);
6507 }
6508 TALLOC_FREE(dir_hnd);
6509
6510 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6511 status = map_nt_error_from_unix(errno);
6512 }
6513
6514 out:
6515 TALLOC_FREE(talloced);
6516 TALLOC_FREE(fname_src_dir);
6517 TALLOC_FREE(fname_src_mask);
6518 return status;
6519 }
6520
6521 /****************************************************************************
6522 Reply to a mv.
6523 ****************************************************************************/
6524
6525 void reply_mv(struct smb_request *req)
6526 {
6527 connection_struct *conn = req->conn;
6528 char *name = NULL;
6529 char *newname = NULL;
6530 const char *p;
6531 uint32 attrs;
6532 NTSTATUS status;
6533 bool src_has_wcard = False;
6534 bool dest_has_wcard = False;
6535 TALLOC_CTX *ctx = talloc_tos();
6536 struct smb_filename *smb_fname_src = NULL;
6537 struct smb_filename *smb_fname_dst = NULL;
6538
6539 START_PROFILE(SMBmv);
6540
6541 if (req->wct < 1) {
6542 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6543 goto out;
6544 }
6545
6546 attrs = SVAL(req->vwv+0, 0);
6547
6548 p = (const char *)req->buf + 1;
6549 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6550 &status, &src_has_wcard);
6551 if (!NT_STATUS_IS_OK(status)) {
6552 reply_nterror(req, status);
6553 goto out;
6554 }
6555 p++;
6556 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6557 &status, &dest_has_wcard);
6558 if (!NT_STATUS_IS_OK(status)) {
6559 reply_nterror(req, status);
6560 goto out;
6561 }
6562
6563 status = filename_convert(ctx,
6564 conn,
6565 req->flags2 & FLAGS2_DFS_PATHNAMES,
6566 name,
6567 UCF_COND_ALLOW_WCARD_LCOMP,
6568 &src_has_wcard,
6569 &smb_fname_src);
6570
6571 if (!NT_STATUS_IS_OK(status)) {
6572 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6573 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6574 ERRSRV, ERRbadpath);
6575 goto out;
6576 }
6577 reply_nterror(req, status);
6578 goto out;
6579 }
6580
6581 status = filename_convert(ctx,
6582 conn,
6583 req->flags2 & FLAGS2_DFS_PATHNAMES,
6584 newname,
6585 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6586 &dest_has_wcard,
6587 &smb_fname_dst);
6588
6589 if (!NT_STATUS_IS_OK(status)) {
6590 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6591 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6592 ERRSRV, ERRbadpath);
6593 goto out;
6594 }
6595 reply_nterror(req, status);
6596 goto out;
6597 }
6598
6599 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6600 smb_fname_str_dbg(smb_fname_dst)));
6601
6602 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6603 attrs, False, src_has_wcard, dest_has_wcard,
6604 DELETE_ACCESS);
6605 if (!NT_STATUS_IS_OK(status)) {
6606 if (open_was_deferred(req->mid)) {
6607 /* We have re-scheduled this call. */
6608 goto out;
6609 }
6610 reply_nterror(req, status);
6611 goto out;
6612 }
6613
6614 reply_outbuf(req, 0, 0);
6615 out:
6616 TALLOC_FREE(smb_fname_src);
6617 TALLOC_FREE(smb_fname_dst);
6618 END_PROFILE(SMBmv);
6619 return;
6620 }
6621
6622 /*******************************************************************
6623 Copy a file as part of a reply_copy.
6624 ******************************************************************/
6625
6626 /*
6627 * TODO: check error codes on all callers
6628 */
6629
6630 NTSTATUS copy_file(TALLOC_CTX *ctx,
6631 connection_struct *conn,
6632 struct smb_filename *smb_fname_src,
6633 struct smb_filename *smb_fname_dst,
6634 int ofun,
6635 int count,
6636 bool target_is_directory)
6637 {
6638 struct smb_filename *smb_fname_dst_tmp = NULL;
6639 SMB_OFF_T ret=-1;
6640 files_struct *fsp1,*fsp2;
6641 uint32 dosattrs;
6642 uint32 new_create_disposition;
6643 NTSTATUS status;
6644
6645
6646 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6647 if (!NT_STATUS_IS_OK(status)) {
6648 return status;
6649 }
6650
6651 /*
6652 * If the target is a directory, extract the last component from the
6653 * src filename and append it to the dst filename
6654 */
6655 if (target_is_directory) {
6656 const char *p;
6657
6658 /* dest/target can't be a stream if it's a directory. */
6659 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6660
6661 p = strrchr_m(smb_fname_src->base_name,'/');
6662 if (p) {
6663 p++;
6664 } else {
6665 p = smb_fname_src->base_name;
6666 }
6667 smb_fname_dst_tmp->base_name =
6668 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6669 p);
6670 if (!smb_fname_dst_tmp->base_name) {
6671 status = NT_STATUS_NO_MEMORY;
6672 goto out;
6673 }
6674 }
6675
6676 status = vfs_file_exist(conn, smb_fname_src);
6677 if (!NT_STATUS_IS_OK(status)) {
6678 goto out;
6679 }
6680
6681 if (!target_is_directory && count) {
6682 new_create_disposition = FILE_OPEN;
6683 } else {
6684 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6685 NULL, NULL,
6686 &new_create_disposition,
6687 NULL,
6688 NULL)) {
6689 status = NT_STATUS_INVALID_PARAMETER;
6690 goto out;
6691 }
6692 }
6693
6694 /* Open the src file for reading. */
6695 status = SMB_VFS_CREATE_FILE(
6696 conn, /* conn */
6697 NULL, /* req */
6698 0, /* root_dir_fid */
6699 smb_fname_src, /* fname */
6700 FILE_GENERIC_READ, /* access_mask */
6701 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6702 FILE_OPEN, /* create_disposition*/
6703 0, /* create_options */
6704 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6705 INTERNAL_OPEN_ONLY, /* oplock_request */
6706 0, /* allocation_size */
6707 0, /* private_flags */
6708 NULL, /* sd */
6709 NULL, /* ea_list */
6710 &fsp1, /* result */
6711 NULL); /* psbuf */
6712
6713 if (!NT_STATUS_IS_OK(status)) {
6714 goto out;
6715 }
6716
6717 dosattrs = dos_mode(conn, smb_fname_src);
6718
6719 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6720 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6721 }
6722
6723 /* Open the dst file for writing. */
6724 status = SMB_VFS_CREATE_FILE(
6725 conn, /* conn */
6726 NULL, /* req */
6727 0, /* root_dir_fid */
6728 smb_fname_dst, /* fname */
6729 FILE_GENERIC_WRITE, /* access_mask */
6730 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6731 new_create_disposition, /* create_disposition*/
6732 0, /* create_options */
6733 dosattrs, /* file_attributes */
6734 INTERNAL_OPEN_ONLY, /* oplock_request */
6735 0, /* allocation_size */
6736 0, /* private_flags */
6737 NULL, /* sd */
6738 NULL, /* ea_list */
6739 &fsp2, /* result */
6740 NULL); /* psbuf */
6741
6742 if (!NT_STATUS_IS_OK(status)) {
6743 close_file(NULL, fsp1, ERROR_CLOSE);
6744 goto out;
6745 }
6746
6747 if ((ofun&3) == 1) {
6748 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6749 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6750 /*
6751 * Stop the copy from occurring.
6752 */
6753 ret = -1;
6754 smb_fname_src->st.st_ex_size = 0;
6755 }
6756 }
6757
6758 /* Do the actual copy. */
6759 if (smb_fname_src->st.st_ex_size) {
6760 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6761 }
6762
6763 close_file(NULL, fsp1, NORMAL_CLOSE);
6764
6765 /* Ensure the modtime is set correctly on the destination file. */
6766 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6767
6768 /*
6769 * As we are opening fsp1 read-only we only expect
6770 * an error on close on fsp2 if we are out of space.
6771 * Thus we don't look at the error return from the
6772 * close of fsp1.
6773 */
6774 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6775
6776 if (!NT_STATUS_IS_OK(status)) {
6777 goto out;
6778 }
6779
6780 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6781 status = NT_STATUS_DISK_FULL;
6782 goto out;
6783 }
6784
6785 status = NT_STATUS_OK;
6786
6787 out:
6788 TALLOC_FREE(smb_fname_dst_tmp);
6789 return status;
6790 }
6791
6792 /****************************************************************************
6793 Reply to a file copy.
6794 ****************************************************************************/
6795
6796 void reply_copy(struct smb_request *req)
6797 {
6798 connection_struct *conn = req->conn;
6799 struct smb_filename *smb_fname_src = NULL;
6800 struct smb_filename *smb_fname_dst = NULL;
6801 char *fname_src = NULL;
6802 char *fname_dst = NULL;
6803 char *fname_src_mask = NULL;
6804 char *fname_src_dir = NULL;
6805 const char *p;
6806 int count=0;
6807 int error = ERRnoaccess;
6808 int tid2;
6809 int ofun;
6810 int flags;
6811 bool target_is_directory=False;
6812 bool source_has_wild = False;
6813 bool dest_has_wild = False;
6814 NTSTATUS status;
6815 TALLOC_CTX *ctx = talloc_tos();
6816
6817 START_PROFILE(SMBcopy);
6818
6819 if (req->wct < 3) {
6820 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6821 goto out;
6822 }
6823
6824 tid2 = SVAL(req->vwv+0, 0);
6825 ofun = SVAL(req->vwv+1, 0);
6826 flags = SVAL(req->vwv+2, 0);
6827
6828 p = (const char *)req->buf;
6829 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6830 &status, &source_has_wild);
6831 if (!NT_STATUS_IS_OK(status)) {
6832 reply_nterror(req, status);
6833 goto out;
6834 }
6835 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6836 &status, &dest_has_wild);
6837 if (!NT_STATUS_IS_OK(status)) {
6838 reply_nterror(req, status);
6839 goto out;
6840 }
6841
6842 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6843
6844 if (tid2 != conn->cnum) {
6845 /* can't currently handle inter share copies XXXX */
6846 DEBUG(3,("Rejecting inter-share copy\n"));
6847 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6848 goto out;
6849 }
6850
6851 status = filename_convert(ctx, conn,
6852 req->flags2 & FLAGS2_DFS_PATHNAMES,
6853 fname_src,
6854 UCF_COND_ALLOW_WCARD_LCOMP,
6855 &source_has_wild,
6856 &smb_fname_src);
6857 if (!NT_STATUS_IS_OK(status)) {
6858 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6859 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6860 ERRSRV, ERRbadpath);
6861 goto out;
6862 }
6863 reply_nterror(req, status);
6864 goto out;
6865 }
6866
6867 status = filename_convert(ctx, conn,
6868 req->flags2 & FLAGS2_DFS_PATHNAMES,
6869 fname_dst,
6870 UCF_COND_ALLOW_WCARD_LCOMP,
6871 &dest_has_wild,
6872 &smb_fname_dst);
6873 if (!NT_STATUS_IS_OK(status)) {
6874 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6875 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6876 ERRSRV, ERRbadpath);
6877 goto out;
6878 }
6879 reply_nterror(req, status);
6880 goto out;
6881 }
6882
6883 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6884
6885 if ((flags&1) && target_is_directory) {
6886 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6887 goto out;
6888 }
6889
6890 if ((flags&2) && !target_is_directory) {
6891 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6892 goto out;
6893 }
6894
6895 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6896 /* wants a tree copy! XXXX */
6897 DEBUG(3,("Rejecting tree copy\n"));
6898 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6899 goto out;
6900 }
6901
6902 /* Split up the directory from the filename/mask. */
6903 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6904 &fname_src_dir, &fname_src_mask);
6905 if (!NT_STATUS_IS_OK(status)) {
6906 reply_nterror(req, NT_STATUS_NO_MEMORY);
6907 goto out;
6908 }
6909
6910 /*
6911 * We should only check the mangled cache
6912 * here if unix_convert failed. This means
6913 * that the path in 'mask' doesn't exist
6914 * on the file system and so we need to look
6915 * for a possible mangle. This patch from
6916 * Tine Smukavec <valentin.smukavec@hermes.si>.
6917 */
6918 if (!VALID_STAT(smb_fname_src->st) &&
6919 mangle_is_mangled(fname_src_mask, conn->params)) {
6920 char *new_mask = NULL;
6921 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6922 &new_mask, conn->params);
6923
6924 /* Use demangled name if one was successfully found. */
6925 if (new_mask) {
6926 TALLOC_FREE(fname_src_mask);
6927 fname_src_mask = new_mask;
6928 }
6929 }
6930
6931 if (!source_has_wild) {
6932
6933 /*
6934 * Only one file needs to be copied. Append the mask back onto
6935 * the directory.
6936 */
6937 TALLOC_FREE(smb_fname_src->base_name);
6938 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6939 "%s/%s",
6940 fname_src_dir,
6941 fname_src_mask);
6942 if (!smb_fname_src->base_name) {
6943 reply_nterror(req, NT_STATUS_NO_MEMORY);
6944 goto out;
6945 }
6946
6947 if (dest_has_wild) {
6948 char *fname_dst_mod = NULL;
6949 if (!resolve_wildcards(smb_fname_dst,
6950 smb_fname_src->base_name,
6951 smb_fname_dst->base_name,
6952 &fname_dst_mod)) {
6953 reply_nterror(req, NT_STATUS_NO_MEMORY);
6954 goto out;
6955 }
6956 TALLOC_FREE(smb_fname_dst->base_name);
6957 smb_fname_dst->base_name = fname_dst_mod;
6958 }
6959
6960 status = check_name(conn, smb_fname_src->base_name);
6961 if (!NT_STATUS_IS_OK(status)) {
6962 reply_nterror(req, status);
6963 goto out;
6964 }
6965
6966 status = check_name(conn, smb_fname_dst->base_name);
6967 if (!NT_STATUS_IS_OK(status)) {
6968 reply_nterror(req, status);
6969 goto out;
6970 }
6971
6972 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6973 ofun, count, target_is_directory);
6974
6975 if(!NT_STATUS_IS_OK(status)) {
6976 reply_nterror(req, status);
6977 goto out;
6978 } else {
6979 count++;
6980 }
6981 } else {
6982 struct smb_Dir *dir_hnd = NULL;
6983 const char *dname = NULL;
6984 char *talloced = NULL;
6985 long offset = 0;
6986
6987 /*
6988 * There is a wildcard that requires us to actually read the
6989 * src dir and copy each file matching the mask to the dst.
6990 * Right now streams won't be copied, but this could
6991 * presumably be added with a nested loop for reach dir entry.
6992 */
6993 SMB_ASSERT(!smb_fname_src->stream_name);
6994 SMB_ASSERT(!smb_fname_dst->stream_name);
6995
6996 smb_fname_src->stream_name = NULL;
6997 smb_fname_dst->stream_name = NULL;
6998
6999 if (strequal(fname_src_mask,"????????.???")) {
7000 TALLOC_FREE(fname_src_mask);
7001 fname_src_mask = talloc_strdup(ctx, "*");
7002 if (!fname_src_mask) {
7003 reply_nterror(req, NT_STATUS_NO_MEMORY);
7004 goto out;
7005 }
7006 }
7007
7008 status = check_name(conn, fname_src_dir);
7009 if (!NT_STATUS_IS_OK(status)) {
7010 reply_nterror(req, status);
7011 goto out;
7012 }
7013
7014 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7015 if (dir_hnd == NULL) {
7016 status = map_nt_error_from_unix(errno);
7017 reply_nterror(req, status);
7018 goto out;
7019 }
7020
7021 error = ERRbadfile;
7022
7023 /* Iterate over the src dir copying each entry to the dst. */
7024 while ((dname = ReadDirName(dir_hnd, &offset,
7025 &smb_fname_src->st, &talloced))) {
7026 char *destname = NULL;
7027
7028 if (ISDOT(dname) || ISDOTDOT(dname)) {
7029 TALLOC_FREE(talloced);
7030 continue;
7031 }
7032
7033 if (!is_visible_file(conn, fname_src_dir, dname,
7034 &smb_fname_src->st, false)) {
7035 TALLOC_FREE(talloced);
7036 continue;
7037 }
7038
7039 if(!mask_match(dname, fname_src_mask,
7040 conn->case_sensitive)) {
7041 TALLOC_FREE(talloced);
7042 continue;
7043 }
7044
7045 error = ERRnoaccess;
7046
7047 /* Get the src smb_fname struct setup. */
7048 TALLOC_FREE(smb_fname_src->base_name);
7049 smb_fname_src->base_name =
7050 talloc_asprintf(smb_fname_src, "%s/%s",
7051 fname_src_dir, dname);
7052
7053 if (!smb_fname_src->base_name) {
7054 TALLOC_FREE(dir_hnd);
7055 TALLOC_FREE(talloced);
7056 reply_nterror(req, NT_STATUS_NO_MEMORY);
7057 goto out;
7058 }
7059
7060 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7061 smb_fname_dst->base_name,
7062 &destname)) {
7063 TALLOC_FREE(talloced);
7064 continue;
7065 }
7066 if (!destname) {
7067 TALLOC_FREE(dir_hnd);
7068 TALLOC_FREE(talloced);
7069 reply_nterror(req, NT_STATUS_NO_MEMORY);
7070 goto out;
7071 }
7072
7073 TALLOC_FREE(smb_fname_dst->base_name);
7074 smb_fname_dst->base_name = destname;
7075
7076 status = check_name(conn, smb_fname_src->base_name);
7077 if (!NT_STATUS_IS_OK(status)) {
7078 TALLOC_FREE(dir_hnd);
7079 TALLOC_FREE(talloced);
7080 reply_nterror(req, status);
7081 goto out;
7082 }
7083
7084 status = check_name(conn, smb_fname_dst->base_name);
7085 if (!NT_STATUS_IS_OK(status)) {
7086 TALLOC_FREE(dir_hnd);
7087 TALLOC_FREE(talloced);
7088 reply_nterror(req, status);
7089 goto out;
7090 }
7091
7092 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7093 smb_fname_src->base_name,
7094 smb_fname_dst->base_name));
7095
7096 status = copy_file(ctx, conn, smb_fname_src,
7097 smb_fname_dst, ofun, count,
7098 target_is_directory);
7099 if (NT_STATUS_IS_OK(status)) {
7100 count++;
7101 }
7102
7103 TALLOC_FREE(talloced);
7104 }
7105 TALLOC_FREE(dir_hnd);
7106 }
7107
7108 if (count == 0) {
7109 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7110 goto out;
7111 }
7112
7113 reply_outbuf(req, 1, 0);
7114 SSVAL(req->outbuf,smb_vwv0,count);
7115 out:
7116 TALLOC_FREE(smb_fname_src);
7117 TALLOC_FREE(smb_fname_dst);
7118 TALLOC_FREE(fname_src);
7119 TALLOC_FREE(fname_dst);
7120 TALLOC_FREE(fname_src_mask);
7121 TALLOC_FREE(fname_src_dir);
7122
7123 END_PROFILE(SMBcopy);
7124 return;
7125 }
7126
7127 #undef DBGC_CLASS
7128 #define DBGC_CLASS DBGC_LOCKING
7129
7130 /****************************************************************************
7131 Get a lock pid, dealing with large count requests.
7132 ****************************************************************************/
7133
7134 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7135 bool large_file_format)
7136 {
7137 if(!large_file_format)
7138 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7139 else
7140 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7141 }
7142
7143 /****************************************************************************
7144 Get a lock count, dealing with large count requests.
7145 ****************************************************************************/
7146
7147 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7148 bool large_file_format)
7149 {
7150 uint64_t count = 0;
7151
7152 if(!large_file_format) {
7153 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7154 } else {
7155
7156 #if defined(HAVE_LONGLONG)
7157 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7158 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7159 #else /* HAVE_LONGLONG */
7160
7161 /*
7162 * NT4.x seems to be broken in that it sends large file (64 bit)
7163 * lockingX calls even if the CAP_LARGE_FILES was *not*
7164 * negotiated. For boxes without large unsigned ints truncate the
7165 * lock count by dropping the top 32 bits.
7166 */
7167
7168 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7169 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7170 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7171 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7172 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7173 }
7174
7175 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7176 #endif /* HAVE_LONGLONG */
7177 }
7178
7179 return count;
7180 }
7181
7182 #if !defined(HAVE_LONGLONG)
7183 /****************************************************************************
7184 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7185 ****************************************************************************/
7186
7187 static uint32 map_lock_offset(uint32 high, uint32 low)
7188 {
7189 unsigned int i;
7190 uint32 mask = 0;
7191 uint32 highcopy = high;
7192
7193 /*
7194 * Try and find out how many significant bits there are in high.
7195 */
7196
7197 for(i = 0; highcopy; i++)
7198 highcopy >>= 1;
7199
7200 /*
7201 * We use 31 bits not 32 here as POSIX
7202 * lock offsets may not be negative.
7203 */
7204
7205 mask = (~0) << (31 - i);
7206
7207 if(low & mask)
7208 return 0; /* Fail. */
7209
7210 high <<= (31 - i);
7211
7212 return (high|low);
7213 }
7214 #endif /* !defined(HAVE_LONGLONG) */
7215
7216 /****************************************************************************
7217 Get a lock offset, dealing with large offset requests.
7218 ****************************************************************************/
7219
7220 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7221 bool large_file_format, bool *err)
7222 {
7223 uint64_t offset = 0;
7224
7225 *err = False;
7226
7227 if(!large_file_format) {
7228 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7229 } else {
7230
7231 #if defined(HAVE_LONGLONG)
7232 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7233 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7234 #else /* HAVE_LONGLONG */
7235
7236 /*
7237 * NT4.x seems to be broken in that it sends large file (64 bit)
7238 * lockingX calls even if the CAP_LARGE_FILES was *not*
7239 * negotiated. For boxes without large unsigned ints mangle the
7240 * lock offset by mapping the top 32 bits onto the lower 32.
7241 */
7242
7243 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7244 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7245 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7246 uint32 new_low = 0;
7247
7248 if((new_low = map_lock_offset(high, low)) == 0) {
7249 *err = True;
7250 return (uint64_t)-1;
7251 }
7252
7253 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7254 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7255 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7256 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7257 }
7258
7259 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7260 #endif /* HAVE_LONGLONG */
7261 }
7262
7263 return offset;
7264 }
7265
7266 NTSTATUS smbd_do_locking(struct smb_request *req,
7267 files_struct *fsp,
7268 uint8_t type,
7269 int32_t timeout,
7270 uint16_t num_ulocks,
7271 struct smbd_lock_element *ulocks,
7272 uint16_t num_locks,
7273 struct smbd_lock_element *locks,
7274 bool *async)
7275 {
7276 connection_struct *conn = req->conn;
7277 int i;
7278 NTSTATUS status = NT_STATUS_OK;
7279
7280 *async = false;
7281
7282 /* Data now points at the beginning of the list
7283 of smb_unlkrng structs */
7284 for(i = 0; i < (int)num_ulocks; i++) {
7285 struct smbd_lock_element *e = &ulocks[i];
7286
7287 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7288 "pid %u, file %s\n",
7289 (double)e->offset,
7290 (double)e->count,
7291 (unsigned int)e->smblctx,
7292 fsp_str_dbg(fsp)));
7293
7294 if (e->brltype != UNLOCK_LOCK) {
7295 /* this can only happen with SMB2 */
7296 return NT_STATUS_INVALID_PARAMETER;
7297 }
7298
7299 status = do_unlock(req->sconn->msg_ctx,
7300 fsp,
7301 e->smblctx,
7302 e->count,
7303 e->offset,
7304 WINDOWS_LOCK);
7305
7306 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7307 nt_errstr(status)));
7308
7309 if (!NT_STATUS_IS_OK(status)) {
7310 return status;
7311 }
7312 }
7313
7314 /* Setup the timeout in seconds. */
7315
7316 if (!lp_blocking_locks(SNUM(conn))) {
7317 timeout = 0;
7318 }
7319
7320 /* Data now points at the beginning of the list
7321 of smb_lkrng structs */
7322
7323 for(i = 0; i < (int)num_locks; i++) {
7324 struct smbd_lock_element *e = &locks[i];
7325
7326 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7327 "%llu, file %s timeout = %d\n",
7328 (double)e->offset,
7329 (double)e->count,
7330 (unsigned long long)e->smblctx,
7331 fsp_str_dbg(fsp),
7332 (int)timeout));
7333
7334 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7335 struct blocking_lock_record *blr = NULL;
7336
7337 if (num_locks > 1) {
7338 /*
7339 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7340 * if the lock vector contains one entry. When given mutliple cancel
7341 * requests in a single PDU we expect the server to return an
7342 * error. Windows servers seem to accept the request but only
7343 * cancel the first lock.
7344 * JRA - Do what Windows does (tm) :-).
7345 */
7346
7347 #if 0
7348 /* MS-CIFS (2.2.4.32.1) behavior. */
7349 return NT_STATUS_DOS(ERRDOS,
7350 ERRcancelviolation);
7351 #else
7352 /* Windows behavior. */
7353 if (i != 0) {
7354 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7355 "cancel request\n"));
7356 continue;
7357 }
7358 #endif
7359 }
7360
7361 if (lp_blocking_locks(SNUM(conn))) {
7362
7363 /* Schedule a message to ourselves to
7364 remove the blocking lock record and
7365 return the right error. */
7366
7367 blr = blocking_lock_cancel_smb1(fsp,
7368 e->smblctx,
7369 e->offset,
7370 e->count,
7371 WINDOWS_LOCK,
7372 type,
7373 NT_STATUS_FILE_LOCK_CONFLICT);
7374 if (blr == NULL) {
7375 return NT_STATUS_DOS(
7376 ERRDOS,
7377 ERRcancelviolation);
7378 }
7379 }
7380 /* Remove a matching pending lock. */
7381 status = do_lock_cancel(fsp,
7382 e->smblctx,
7383 e->count,
7384 e->offset,
7385 WINDOWS_LOCK,
7386 blr);
7387 } else {
7388 bool blocking_lock = timeout ? true : false;
7389 bool defer_lock = false;
7390 struct byte_range_lock *br_lck;
7391 uint64_t block_smblctx;
7392
7393 br_lck = do_lock(req->sconn->msg_ctx,
7394 fsp,
7395 e->smblctx,
7396 e->count,
7397 e->offset,
7398 e->brltype,
7399 WINDOWS_LOCK,
7400 blocking_lock,
7401 &status,
7402 &block_smblctx,
7403 NULL);
7404
7405 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7406 /* Windows internal resolution for blocking locks seems
7407 to be about 200ms... Don't wait for less than that. JRA. */
7408 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7409 timeout = lp_lock_spin_time();
7410 }
7411 defer_lock = true;
7412 }
7413
7414 /* If a lock sent with timeout of zero would fail, and
7415 * this lock has been requested multiple times,
7416 * according to brl_lock_failed() we convert this
7417 * request to a blocking lock with a timeout of between
7418 * 150 - 300 milliseconds.
7419 *
7420 * If lp_lock_spin_time() has been set to 0, we skip
7421 * this blocking retry and fail immediately.
7422 *
7423 * Replacement for do_lock_spin(). JRA. */
7424
7425 if (!req->sconn->using_smb2 &&
7426 br_lck && lp_blocking_locks(SNUM(conn)) &&
7427 lp_lock_spin_time() && !blocking_lock &&
7428 NT_STATUS_EQUAL((status),
7429 NT_STATUS_FILE_LOCK_CONFLICT))
7430 {
7431 defer_lock = true;
7432 timeout = lp_lock_spin_time();
7433 }
7434
7435 if (br_lck && defer_lock) {
7436 /*
7437 * A blocking lock was requested. Package up
7438 * this smb into a queued request and push it
7439 * onto the blocking lock queue.
7440 */
7441 if(push_blocking_lock_request(br_lck,
7442 req,
7443 fsp,
7444 timeout,
7445 i,
7446 e->smblctx,
7447 e->brltype,
7448 WINDOWS_LOCK,
7449 e->offset,
7450 e->count,
7451 block_smblctx)) {
7452 TALLOC_FREE(br_lck);
7453 *async = true;
7454 return NT_STATUS_OK;
7455 }
7456 }
7457
7458 TALLOC_FREE(br_lck);
7459 }
7460
7461 if (!NT_STATUS_IS_OK(status)) {
7462 break;
7463 }
7464 }
7465
7466 /* If any of the above locks failed, then we must unlock
7467 all of the previous locks (X/Open spec). */
7468
7469 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7470
7471 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7472 i = -1; /* we want to skip the for loop */
7473 }
7474
7475 /*
7476 * Ensure we don't do a remove on the lock that just failed,
7477 * as under POSIX rules, if we have a lock already there, we
7478 * will delete it (and we shouldn't) .....
7479 */
7480 for(i--; i >= 0; i--) {
7481 struct smbd_lock_element *e = &locks[i];
7482
7483 do_unlock(req->sconn->msg_ctx,
7484 fsp,
7485 e->smblctx,
7486 e->count,
7487 e->offset,
7488 WINDOWS_LOCK);
7489 }
7490 return status;
7491 }
7492
7493 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7494 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7495
7496 return NT_STATUS_OK;
7497 }
7498
7499 /****************************************************************************
7500 Reply to a lockingX request.
7501 ****************************************************************************/
7502
7503 void reply_lockingX(struct smb_request *req)
7504 {
7505 connection_struct *conn = req->conn;
7506 files_struct *fsp;
7507 unsigned char locktype;
7508 unsigned char oplocklevel;
7509 uint16 num_ulocks;
7510 uint16 num_locks;
7511 int32 lock_timeout;
7512 int i;
7513 const uint8_t *data;
7514 bool large_file_format;
7515 bool err;
7516 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7517 struct smbd_lock_element *ulocks;
7518 struct smbd_lock_element *locks;
7519 bool async = false;
7520
7521 START_PROFILE(SMBlockingX);
7522
7523 if (req->wct < 8) {
7524 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7525 END_PROFILE(SMBlockingX);
7526 return;
7527 }
7528
7529 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7530 locktype = CVAL(req->vwv+3, 0);
7531 oplocklevel = CVAL(req->vwv+3, 1);
7532 num_ulocks = SVAL(req->vwv+6, 0);
7533 num_locks = SVAL(req->vwv+7, 0);
7534 lock_timeout = IVAL(req->vwv+4, 0);
7535 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7536
7537 if (!check_fsp(conn, req, fsp)) {
7538 END_PROFILE(SMBlockingX);
7539 return;
7540 }
7541
7542 data = req->buf;
7543
7544 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7545 /* we don't support these - and CANCEL_LOCK makes w2k
7546 and XP reboot so I don't really want to be
7547 compatible! (tridge) */
7548 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7549 END_PROFILE(SMBlockingX);
7550 return;
7551 }
7552
7553 /* Check if this is an oplock break on a file
7554 we have granted an oplock on.
7555 */
7556 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7557 /* Client can insist on breaking to none. */
7558 bool break_to_none = (oplocklevel == 0);
7559 bool result;
7560
7561 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7562 "for fnum = %d\n", (unsigned int)oplocklevel,
7563 fsp->fnum ));
7564
7565 /*
7566 * Make sure we have granted an exclusive or batch oplock on
7567 * this file.
7568 */
7569
7570 if (fsp->oplock_type == 0) {
7571
7572 /* The Samba4 nbench simulator doesn't understand
7573 the difference between break to level2 and break
7574 to none from level2 - it sends oplock break
7575 replies in both cases. Don't keep logging an error
7576 message here - just ignore it. JRA. */
7577
7578 DEBUG(5,("reply_lockingX: Error : oplock break from "
7579 "client for fnum = %d (oplock=%d) and no "
7580 "oplock granted on this file (%s).\n",
7581 fsp->fnum, fsp->oplock_type,
7582 fsp_str_dbg(fsp)));
7583
7584 /* if this is a pure oplock break request then don't
7585 * send a reply */
7586 if (num_locks == 0 && num_ulocks == 0) {
7587 END_PROFILE(SMBlockingX);
7588 return;
7589 } else {
7590 END_PROFILE(SMBlockingX);
7591 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7592 return;
7593 }
7594 }
7595
7596 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7597 (break_to_none)) {
7598 result = remove_oplock(fsp);
7599 } else {
7600 result = downgrade_oplock(fsp);
7601 }
7602
7603 if (!result) {
7604 DEBUG(0, ("reply_lockingX: error in removing "
7605 "oplock on file %s\n", fsp_str_dbg(fsp)));
7606 /* Hmmm. Is this panic justified? */
7607 smb_panic("internal tdb error");
7608 }
7609
7610 reply_to_oplock_break_requests(fsp);
7611
7612 /* if this is a pure oplock break request then don't send a
7613 * reply */
7614 if (num_locks == 0 && num_ulocks == 0) {
7615 /* Sanity check - ensure a pure oplock break is not a
7616 chained request. */
7617 if(CVAL(req->vwv+0, 0) != 0xff)
7618 DEBUG(0,("reply_lockingX: Error : pure oplock "
7619 "break is a chained %d request !\n",
7620 (unsigned int)CVAL(req->vwv+0, 0)));
7621 END_PROFILE(SMBlockingX);
7622 return;
7623 }
7624 }
7625
7626 if (req->buflen <
7627 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7628 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7629 END_PROFILE(SMBlockingX);
7630 return;
7631 }
7632
7633 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7634 if (ulocks == NULL) {
7635 reply_nterror(req, NT_STATUS_NO_MEMORY);
7636 END_PROFILE(SMBlockingX);
7637 return;
7638 }
7639
7640 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7641 if (locks == NULL) {
7642 reply_nterror(req, NT_STATUS_NO_MEMORY);
7643 END_PROFILE(SMBlockingX);
7644 return;
7645 }
7646
7647 /* Data now points at the beginning of the list
7648 of smb_unlkrng structs */
7649 for(i = 0; i < (int)num_ulocks; i++) {
7650 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7651 ulocks[i].count = get_lock_count(data, i, large_file_format);
7652 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7653 ulocks[i].brltype = UNLOCK_LOCK;
7654
7655 /*
7656 * There is no error code marked "stupid client bug".... :-).
7657 */
7658 if(err) {
7659 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7660 END_PROFILE(SMBlockingX);
7661 return;
7662 }
7663 }
7664
7665 /* Now do any requested locks */
7666 data += ((large_file_format ? 20 : 10)*num_ulocks);
7667
7668 /* Data now points at the beginning of the list
7669 of smb_lkrng structs */
7670
7671 for(i = 0; i < (int)num_locks; i++) {
7672 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7673 locks[i].count = get_lock_count(data, i, large_file_format);
7674 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7675
7676 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7677 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7678 locks[i].brltype = PENDING_READ_LOCK;
7679 } else {
7680 locks[i].brltype = READ_LOCK;
7681 }
7682 } else {
7683 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7684 locks[i].brltype = PENDING_WRITE_LOCK;
7685 } else {
7686 locks[i].brltype = WRITE_LOCK;
7687 }
7688 }
7689
7690 /*
7691 * There is no error code marked "stupid client bug".... :-).
7692 */
7693 if(err) {
7694 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7695 END_PROFILE(SMBlockingX);
7696 return;
7697 }
7698 }
7699
7700 status = smbd_do_locking(req, fsp,
7701 locktype, lock_timeout,
7702 num_ulocks, ulocks,
7703 num_locks, locks,
7704 &async);
7705 if (!NT_STATUS_IS_OK(status)) {
7706 END_PROFILE(SMBlockingX);
7707 reply_nterror(req, status);
7708 return;
7709 }
7710 if (async) {
7711 END_PROFILE(SMBlockingX);
7712 return;
7713 }
7714
7715 reply_outbuf(req, 2, 0);
7716
7717 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7718 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7719
7720 END_PROFILE(SMBlockingX);
7721 chain_reply(req);
7722 }
7723
7724 #undef DBGC_CLASS
7725 #define DBGC_CLASS DBGC_ALL
7726
7727 /****************************************************************************
7728 Reply to a SMBreadbmpx (read block multiplex) request.
7729 Always reply with an error, if someone has a platform really needs this,
7730 please contact vl@samba.org
7731 ****************************************************************************/
7732
7733 void reply_readbmpx(struct smb_request *req)
7734 {
7735 START_PROFILE(SMBreadBmpx);
7736 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7737 END_PROFILE(SMBreadBmpx);
7738 return;
7739 }
7740
7741 /****************************************************************************
7742 Reply to a SMBreadbs (read block multiplex secondary) request.
7743 Always reply with an error, if someone has a platform really needs this,
7744 please contact vl@samba.org
7745 ****************************************************************************/
7746
7747 void reply_readbs(struct smb_request *req)
7748 {
7749 START_PROFILE(SMBreadBs);
7750 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7751 END_PROFILE(SMBreadBs);
7752 return;
7753 }
7754
7755 /****************************************************************************
7756 Reply to a SMBsetattrE.
7757 ****************************************************************************/
7758
7759 void reply_setattrE(struct smb_request *req)
7760 {
7761 connection_struct *conn = req->conn;
7762 struct smb_file_time ft;
7763 files_struct *fsp;
7764 NTSTATUS status;
7765
7766 START_PROFILE(SMBsetattrE);
7767 ZERO_STRUCT(ft);
7768
7769 if (req->wct < 7) {
7770 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7771 goto out;
7772 }
7773
7774 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7775
7776 if(!fsp || (fsp->conn != conn)) {
7777 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7778 goto out;
7779 }
7780
7781 /*
7782 * Convert the DOS times into unix times.
7783 */
7784
7785 ft.atime = convert_time_t_to_timespec(
7786 srv_make_unix_date2(req->vwv+3));
7787 ft.mtime = convert_time_t_to_timespec(
7788 srv_make_unix_date2(req->vwv+5));
7789 ft.create_time = convert_time_t_to_timespec(
7790 srv_make_unix_date2(req->vwv+1));
7791
7792 reply_outbuf(req, 0, 0);
7793
7794 /*
7795 * Patch from Ray Frush <frush@engr.colostate.edu>
7796 * Sometimes times are sent as zero - ignore them.
7797 */
7798
7799 /* Ensure we have a valid stat struct for the source. */
7800 status = vfs_stat_fsp(fsp);
7801 if (!NT_STATUS_IS_OK(status)) {
7802 reply_nterror(req, status);
7803 goto out;
7804 }
7805
7806 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7807 if (!NT_STATUS_IS_OK(status)) {
7808 reply_nterror(req, status);
7809 goto out;
7810 }
7811
7812 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7813 " createtime=%u\n",
7814 fsp->fnum,
7815 (unsigned int)ft.atime.tv_sec,
7816 (unsigned int)ft.mtime.tv_sec,
7817 (unsigned int)ft.create_time.tv_sec
7818 ));
7819 out:
7820 END_PROFILE(SMBsetattrE);
7821 return;
7822 }
7823
7824
7825 /* Back from the dead for OS/2..... JRA. */
7826
7827 /****************************************************************************
7828 Reply to a SMBwritebmpx (write block multiplex primary) request.
7829 Always reply with an error, if someone has a platform really needs this,
7830 please contact vl@samba.org
7831 ****************************************************************************/
7832
7833 void reply_writebmpx(struct smb_request *req)
7834 {
7835 START_PROFILE(SMBwriteBmpx);
7836 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7837 END_PROFILE(SMBwriteBmpx);
7838 return;
7839 }
7840
7841 /****************************************************************************
7842 Reply to a SMBwritebs (write block multiplex secondary) request.
7843 Always reply with an error, if someone has a platform really needs this,
7844 please contact vl@samba.org
7845 ****************************************************************************/
7846
7847 void reply_writebs(struct smb_request *req)
7848 {
7849 START_PROFILE(SMBwriteBs);
7850 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7851 END_PROFILE(SMBwriteBs);
7852 return;
7853 }
7854
7855 /****************************************************************************
7856 Reply to a SMBgetattrE.
7857 ****************************************************************************/
7858
7859 void reply_getattrE(struct smb_request *req)
7860 {
7861 connection_struct *conn = req->conn;
7862 int mode;
7863 files_struct *fsp;
7864 struct timespec create_ts;
7865
7866 START_PROFILE(SMBgetattrE);
7867
7868 if (req->wct < 1) {
7869 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7870 END_PROFILE(SMBgetattrE);
7871 return;
7872 }
7873
7874 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7875
7876 if(!fsp || (fsp->conn != conn)) {
7877 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7878 END_PROFILE(SMBgetattrE);
7879 return;
7880 }
7881
7882 /* Do an fstat on this file */
7883 if(fsp_stat(fsp)) {
7884 reply_nterror(req, map_nt_error_from_unix(errno));
7885 END_PROFILE(SMBgetattrE);
7886 return;
7887 }
7888
7889 mode = dos_mode(conn, fsp->fsp_name);
7890
7891 /*
7892 * Convert the times into dos times. Set create
7893 * date to be last modify date as UNIX doesn't save
7894 * this.
7895 */
7896
7897 reply_outbuf(req, 11, 0);
7898
7899 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7900 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7901 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7902 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7903 /* Should we check pending modtime here ? JRA */
7904 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7905 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7906
7907 if (mode & aDIR) {
7908 SIVAL(req->outbuf, smb_vwv6, 0);
7909 SIVAL(req->outbuf, smb_vwv8, 0);
7910 } else {
7911 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7912 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7913 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7914 }
7915 SSVAL(req->outbuf,smb_vwv10, mode);
7916
7917 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7918
7919 END_PROFILE(SMBgetattrE);
7920 return;
7921 }
reg import