?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Make sure we don't clobber the stack when response consists of the empty
[Samba/gebeck_regimport.git] / source3 / smbd / nttrans.c
blob4a9db06c874acfeea56714d073b9ab52585c4c38
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern int Protocol;
25 extern int smb_read_error;
26 extern int global_oplock_break;
27 extern BOOL case_sensitive;
28 extern BOOL case_preserve;
29 extern BOOL short_case_preserve;
30 extern struct current_user current_user;
31
32 static const char *known_nt_pipes[] = {
33 "\\LANMAN",
34 "\\srvsvc",
35 "\\samr",
36 "\\wkssvc",
37 "\\NETLOGON",
38 "\\ntlsa",
39 "\\ntsvcs",
40 "\\lsass",
41 "\\lsarpc",
42 "\\winreg",
43 "\\spoolss",
44 "\\netdfs",
45 "\\rpcecho",
46 "\\epmapper",
47 NULL
48 };
49
50 /* Map generic permissions to file object specific permissions */
51
52 struct generic_mapping file_generic_mapping = {
53 FILE_GENERIC_READ,
54 FILE_GENERIC_WRITE,
55 FILE_GENERIC_EXECUTE,
56 FILE_GENERIC_ALL
57 };
58
59 static char *nttrans_realloc(char **ptr, size_t size)
60 {
61 char *tptr = NULL;
62 if (ptr==NULL)
63 smb_panic("nttrans_realloc() called with NULL ptr\n");
64
65 tptr = Realloc_zero(*ptr, size);
66 if(tptr == NULL) {
67 *ptr = NULL;
68 return NULL;
69 }
70
71 *ptr = tptr;
72
73 return tptr;
74 }
75
76
77 /****************************************************************************
78 Send the required number of replies back.
79 We assume all fields other than the data fields are
80 set correctly for the type of call.
81 HACK ! Always assumes smb_setup field is zero.
82 ****************************************************************************/
83
84 static int send_nt_replies(char *inbuf, char *outbuf, int bufsize, NTSTATUS nt_error, char *params,
85 int paramsize, char *pdata, int datasize)
86 {
87 extern int max_send;
88 int data_to_send = datasize;
89 int params_to_send = paramsize;
90 int useable_space;
91 char *pp = params;
92 char *pd = pdata;
93 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
94 int alignment_offset = 3;
95 int data_alignment_offset = 0;
96
97 /*
98 * Initially set the wcnt area to be 18 - this is true for all
99 * transNT replies.
100 */
101
102 set_message(outbuf,18,0,True);
103
104 if (NT_STATUS_V(nt_error))
105 ERROR_NT(nt_error);
106
107 /*
108 * If there genuinely are no parameters or data to send just send
109 * the empty packet.
110 */
111
112 if(params_to_send == 0 && data_to_send == 0) {
113 if (!send_smb(smbd_server_fd(),outbuf))
114 exit_server("send_nt_replies: send_smb failed.");
115 return 0;
116 }
117
118 /*
119 * When sending params and data ensure that both are nicely aligned.
120 * Only do this alignment when there is also data to send - else
121 * can cause NT redirector problems.
122 */
123
124 if (((params_to_send % 4) != 0) && (data_to_send != 0))
125 data_alignment_offset = 4 - (params_to_send % 4);
126
127 /*
128 * Space is bufsize minus Netbios over TCP header minus SMB header.
129 * The alignment_offset is to align the param bytes on a four byte
130 * boundary (2 bytes for data len, one byte pad).
131 * NT needs this to work correctly.
132 */
133
134 useable_space = bufsize - ((smb_buf(outbuf)+
135 alignment_offset+data_alignment_offset) -
136 outbuf);
137
138 /*
139 * useable_space can never be more than max_send minus the
140 * alignment offset.
141 */
142
143 useable_space = MIN(useable_space,
144 max_send - (alignment_offset+data_alignment_offset));
145
146
147 while (params_to_send || data_to_send) {
148
149 /*
150 * Calculate whether we will totally or partially fill this packet.
151 */
152
153 total_sent_thistime = params_to_send + data_to_send +
154 alignment_offset + data_alignment_offset;
155
156 /*
157 * We can never send more than useable_space.
158 */
159
160 total_sent_thistime = MIN(total_sent_thistime, useable_space);
161
162 set_message(outbuf, 18, total_sent_thistime, True);
163
164 /*
165 * Set total params and data to be sent.
166 */
167
168 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
169 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
170
171 /*
172 * Calculate how many parameters and data we can fit into
173 * this packet. Parameters get precedence.
174 */
175
176 params_sent_thistime = MIN(params_to_send,useable_space);
177 data_sent_thistime = useable_space - params_sent_thistime;
178 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
179
180 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
181
182 if(params_sent_thistime == 0) {
183 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
184 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
185 } else {
186 /*
187 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
188 * parameter bytes, however the first 4 bytes of outbuf are
189 * the Netbios over TCP header. Thus use smb_base() to subtract
190 * them from the calculation.
191 */
192
193 SIVAL(outbuf,smb_ntr_ParameterOffset,
194 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
195 /*
196 * Absolute displacement of param bytes sent in this packet.
197 */
198
199 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
200 }
201
202 /*
203 * Deal with the data portion.
204 */
205
206 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
207
208 if(data_sent_thistime == 0) {
209 SIVAL(outbuf,smb_ntr_DataOffset,0);
210 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
211 } else {
212 /*
213 * The offset of the data bytes is the offset of the
214 * parameter bytes plus the number of parameters being sent this time.
215 */
216
217 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
218 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
219 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
220 }
221
222 /*
223 * Copy the param bytes into the packet.
224 */
225
226 if(params_sent_thistime)
227 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
228
229 /*
230 * Copy in the data bytes
231 */
232
233 if(data_sent_thistime)
234 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
235 data_alignment_offset,pd,data_sent_thistime);
236
237 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
238 params_sent_thistime, data_sent_thistime, useable_space));
239 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
240 params_to_send, data_to_send, paramsize, datasize));
241
242 /* Send the packet */
243 if (!send_smb(smbd_server_fd(),outbuf))
244 exit_server("send_nt_replies: send_smb failed.");
245
246 pp += params_sent_thistime;
247 pd += data_sent_thistime;
248
249 params_to_send -= params_sent_thistime;
250 data_to_send -= data_sent_thistime;
251
252 /*
253 * Sanity check
254 */
255
256 if(params_to_send < 0 || data_to_send < 0) {
257 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
258 params_to_send, data_to_send));
259 return -1;
260 }
261 }
262
263 return 0;
264 }
265
266 /****************************************************************************
267 Save case statics.
268 ****************************************************************************/
269
270 static BOOL saved_case_sensitive;
271 static BOOL saved_case_preserve;
272 static BOOL saved_short_case_preserve;
273
274 /****************************************************************************
275 Save case semantics.
276 ****************************************************************************/
277
278 static void set_posix_case_semantics(uint32 file_attributes)
279 {
280 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
281 return;
282
283 saved_case_sensitive = case_sensitive;
284 saved_case_preserve = case_preserve;
285 saved_short_case_preserve = short_case_preserve;
286
287 /* Set to POSIX. */
288 case_sensitive = True;
289 case_preserve = True;
290 short_case_preserve = True;
291 }
292
293 /****************************************************************************
294 Restore case semantics.
295 ****************************************************************************/
296
297 static void restore_case_semantics(uint32 file_attributes)
298 {
299 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
300 return;
301
302 case_sensitive = saved_case_sensitive;
303 case_preserve = saved_case_preserve;
304 short_case_preserve = saved_short_case_preserve;
305 }
306
307 /****************************************************************************
308 Utility function to map create disposition.
309 ****************************************************************************/
310
311 static int map_create_disposition( uint32 create_disposition)
312 {
313 int ret;
314
315 switch( create_disposition ) {
316 case FILE_CREATE:
317 /* create if not exist, fail if exist */
318 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL);
319 break;
320 case FILE_SUPERSEDE:
321 case FILE_OVERWRITE_IF:
322 /* create if not exist, trunc if exist */
323 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
324 break;
325 case FILE_OPEN:
326 /* fail if not exist, open if exists */
327 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN);
328 break;
329 case FILE_OPEN_IF:
330 /* create if not exist, open if exists */
331 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_OPEN);
332 break;
333 case FILE_OVERWRITE:
334 /* fail if not exist, truncate if exists */
335 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
336 break;
337 default:
338 DEBUG(0,("map_create_disposition: Incorrect value for create_disposition = %d\n",
339 create_disposition ));
340 return -1;
341 }
342
343 DEBUG(10,("map_create_disposition: Mapped create_disposition 0x%lx to 0x%x\n",
344 (unsigned long)create_disposition, ret ));
345
346 return ret;
347 }
348
349 /****************************************************************************
350 Utility function to map share modes.
351 ****************************************************************************/
352
353 static int map_share_mode( char *fname, uint32 create_options,
354 uint32 *desired_access, uint32 share_access, uint32 file_attributes)
355 {
356 int smb_open_mode = -1;
357 uint32 original_desired_access = *desired_access;
358
359 /*
360 * Convert GENERIC bits to specific bits.
361 */
362
363 se_map_generic(desired_access, &file_generic_mapping);
364
365 switch( *desired_access & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA) ) {
366 case FILE_READ_DATA:
367 smb_open_mode = DOS_OPEN_RDONLY;
368 break;
369 case FILE_WRITE_DATA:
370 case FILE_APPEND_DATA:
371 case FILE_WRITE_DATA|FILE_APPEND_DATA:
372 smb_open_mode = DOS_OPEN_WRONLY;
373 break;
374 case FILE_READ_DATA|FILE_WRITE_DATA:
375 case FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA:
376 case FILE_READ_DATA|FILE_APPEND_DATA:
377 smb_open_mode = DOS_OPEN_RDWR;
378 break;
379 }
380
381 /*
382 * NB. For DELETE_ACCESS we should really check the
383 * directory permissions, as that is what controls
384 * delete, and for WRITE_DAC_ACCESS we should really
385 * check the ownership, as that is what controls the
386 * chmod. Note that this is *NOT* a security hole (this
387 * note is for you, Andrew) as we are not *allowing*
388 * the access at this point, the actual unlink or
389 * chown or chmod call would do this. We are just helping
390 * clients out by telling them if they have a hope
391 * of any of this succeeding. POSIX acls may still
392 * deny the real call. JRA.
393 */
394
395 if (smb_open_mode == -1) {
396
397 if(*desired_access & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS|
398 FILE_EXECUTE|FILE_READ_ATTRIBUTES|
399 FILE_READ_EA|FILE_WRITE_EA|SYSTEM_SECURITY_ACCESS|
400 FILE_WRITE_ATTRIBUTES|READ_CONTROL_ACCESS)) {
401 smb_open_mode = DOS_OPEN_RDONLY;
402 } else if(*desired_access == 0) {
403
404 /*
405 * JRA - NT seems to sometimes send desired_access as zero. play it safe
406 * and map to a stat open.
407 */
408
409 smb_open_mode = DOS_OPEN_RDONLY;
410
411 } else {
412 DEBUG(0,("map_share_mode: Incorrect value 0x%lx for desired_access to file %s\n",
413 (unsigned long)*desired_access, fname));
414 return -1;
415 }
416 }
417
418 /*
419 * Set the special bit that means allow share delete.
420 * This is held outside the normal share mode bits at 1<<15.
421 * JRA.
422 */
423
424 if(share_access & FILE_SHARE_DELETE) {
425 smb_open_mode |= ALLOW_SHARE_DELETE;
426 DEBUG(10,("map_share_mode: FILE_SHARE_DELETE requested. open_mode = 0x%x\n", smb_open_mode));
427 }
428
429 if(*desired_access & DELETE_ACCESS) {
430 DEBUG(10,("map_share_mode: DELETE_ACCESS requested. open_mode = 0x%x\n", smb_open_mode));
431 }
432
433 /*
434 * We need to store the intent to open for Delete. This
435 * is what determines if a delete on close flag can be set.
436 * This is the wrong way (and place) to store this, but for 2.2 this
437 * is the only practical way. JRA.
438 */
439
440 if (create_options & FILE_DELETE_ON_CLOSE) {
441 /*
442 * W2K3 bug compatibility mode... To set delete on close
443 * the redirector must have *specifically* set DELETE_ACCESS
444 * in the desired_access field. Just asking for GENERIC_ALL won't do. JRA.
445 */
446
447 if (!(original_desired_access & DELETE_ACCESS)) {
448 DEBUG(5,("map_share_mode: FILE_DELETE_ON_CLOSE requested without \
449 DELETE_ACCESS for file %s. (desired_access = 0x%lx)\n",
450 fname, (unsigned long)*desired_access));
451 return -1;
452 }
453 /* Implicit delete access is *NOT* requested... */
454 smb_open_mode |= DELETE_ON_CLOSE_FLAG;
455 DEBUG(10,("map_share_mode: FILE_DELETE_ON_CLOSE requested. open_mode = 0x%x\n", smb_open_mode));
456 }
457
458 /* Add in the requested share mode. */
459 switch( share_access & (FILE_SHARE_READ|FILE_SHARE_WRITE)) {
460 case FILE_SHARE_READ:
461 smb_open_mode |= SET_DENY_MODE(DENY_WRITE);
462 break;
463 case FILE_SHARE_WRITE:
464 smb_open_mode |= SET_DENY_MODE(DENY_READ);
465 break;
466 case (FILE_SHARE_READ|FILE_SHARE_WRITE):
467 smb_open_mode |= SET_DENY_MODE(DENY_NONE);
468 break;
469 case FILE_SHARE_NONE:
470 smb_open_mode |= SET_DENY_MODE(DENY_ALL);
471 break;
472 }
473
474 /*
475 * Handle an O_SYNC request.
476 */
477
478 if(file_attributes & FILE_FLAG_WRITE_THROUGH)
479 smb_open_mode |= FILE_SYNC_OPENMODE;
480
481 DEBUG(10,("map_share_mode: Mapped desired access 0x%lx, share access 0x%lx, file attributes 0x%lx \
482 to open_mode 0x%x\n", (unsigned long)*desired_access, (unsigned long)share_access,
483 (unsigned long)file_attributes, smb_open_mode ));
484
485 return smb_open_mode;
486 }
487
488 /****************************************************************************
489 Reply to an NT create and X call on a pipe.
490 ****************************************************************************/
491
492 static int nt_open_pipe(char *fname, connection_struct *conn,
493 char *inbuf, char *outbuf, int *ppnum)
494 {
495 smb_np_struct *p = NULL;
496
497 uint16 vuid = SVAL(inbuf, smb_uid);
498 int i;
499
500 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
501
502 /* See if it is one we want to handle. */
503
504 if (lp_disable_spoolss() && strequal(fname, "\\spoolss"))
505 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
506
507 for( i = 0; known_nt_pipes[i]; i++ )
508 if( strequal(fname,known_nt_pipes[i]))
509 break;
510
511 if ( known_nt_pipes[i] == NULL )
512 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
513
514 /* Strip \\ off the name. */
515 fname++;
516
517 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
518
519 p = open_rpc_pipe_p(fname, conn, vuid);
520 if (!p)
521 return(ERROR_DOS(ERRSRV,ERRnofids));
522
523 *ppnum = p->pnum;
524
525 return 0;
526 }
527
528 /****************************************************************************
529 Reply to an NT create and X call for pipes.
530 ****************************************************************************/
531
532 static int do_ntcreate_pipe_open(connection_struct *conn,
533 char *inbuf,char *outbuf,int length,int bufsize)
534 {
535 pstring fname;
536 int ret;
537 int pnum = -1;
538 char *p = NULL;
539
540 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
541
542 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
543 return ret;
544
545 /*
546 * Deal with pipe return.
547 */
548
549 set_message(outbuf,34,0,True);
550
551 p = outbuf + smb_vwv2;
552 p++;
553 SSVAL(p,0,pnum);
554 p += 2;
555 SIVAL(p,0,FILE_WAS_OPENED);
556 p += 4;
557 p += 32;
558 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
559 p += 20;
560 /* File type. */
561 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
562 /* Device state. */
563 SSVAL(p,2, 0x5FF); /* ? */
564
565 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
566
567 return chain_reply(inbuf,outbuf,length,bufsize);
568 }
569
570 /****************************************************************************
571 Reply to an NT create and X call.
572 ****************************************************************************/
573
574 int reply_ntcreate_and_X(connection_struct *conn,
575 char *inbuf,char *outbuf,int length,int bufsize)
576 {
577 int result;
578 pstring fname;
579 enum FAKE_FILE_TYPE fake_file_type = FAKE_FILE_TYPE_NONE;
580 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
581 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
582 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
583 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
584 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
585 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
586 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
587 SMB_BIG_UINT allocation_size = 0;
588 int smb_ofun;
589 int smb_open_mode;
590 int smb_attr = (file_attributes & SAMBA_ATTRIBUTES_MASK);
591 /* Breakout the oplock request bits so we can set the
592 reply bits separately. */
593 int oplock_request = 0;
594 mode_t unixmode;
595 int fmode=0,rmode=0;
596 SMB_OFF_T file_len = 0;
597 SMB_STRUCT_STAT sbuf;
598 int smb_action = 0;
599 BOOL bad_path = False;
600 files_struct *fsp=NULL;
601 char *p = NULL;
602 time_t c_time;
603 BOOL extended_oplock_granted = False;
604 NTSTATUS status;
605
606 START_PROFILE(SMBntcreateX);
607
608 DEBUG(10,("reply_ntcreateX: flags = 0x%x, desired_access = 0x%x \
609 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
610 create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attributes,
611 share_access, create_disposition,
612 create_options, root_dir_fid ));
613
614 /* If it's an IPC, use the pipe handler. */
615
616 if (IS_IPC(conn)) {
617 if (lp_nt_pipe_support()) {
618 END_PROFILE(SMBntcreateX);
619 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
620 } else {
621 END_PROFILE(SMBntcreateX);
622 return(ERROR_DOS(ERRDOS,ERRnoaccess));
623 }
624 }
625
626 if (create_options & FILE_OPEN_BY_FILE_ID) {
627 END_PROFILE(SMBntcreateX);
628 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
629 }
630
631 /*
632 * We need to construct the open_and_X ofun value from the
633 * NT values, as that's what our code is structured to accept.
634 */
635
636 if((smb_ofun = map_create_disposition( create_disposition )) == -1) {
637 END_PROFILE(SMBntcreateX);
638 return(ERROR_DOS(ERRDOS,ERRnoaccess));
639 }
640
641 /*
642 * Get the file name.
643 */
644
645 if(root_dir_fid != 0) {
646 /*
647 * This filename is relative to a directory fid.
648 */
649 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
650 size_t dir_name_len;
651
652 if(!dir_fsp) {
653 END_PROFILE(SMBntcreateX);
654 return(ERROR_DOS(ERRDOS,ERRbadfid));
655 }
656
657 if(!dir_fsp->is_directory) {
658
659 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
660 if (!NT_STATUS_IS_OK(status)) {
661 END_PROFILE(SMBntcreateX);
662 return ERROR_NT(status);
663 }
664
665 /*
666 * Check to see if this is a mac fork of some kind.
667 */
668
669 if( strchr_m(fname, ':')) {
670 END_PROFILE(SMBntcreateX);
671 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
672 }
673
674 /*
675 we need to handle the case when we get a
676 relative open relative to a file and the
677 pathname is blank - this is a reopen!
678 (hint from demyn plantenberg)
679 */
680
681 END_PROFILE(SMBntcreateX);
682 return(ERROR_DOS(ERRDOS,ERRbadfid));
683 }
684
685 /*
686 * Copy in the base directory name.
687 */
688
689 pstrcpy( fname, dir_fsp->fsp_name );
690 dir_name_len = strlen(fname);
691
692 /*
693 * Ensure it ends in a '\'.
694 */
695
696 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
697 pstrcat(fname, "\\");
698 dir_name_len++;
699 }
700
701 srvstr_get_path(inbuf, &fname[dir_name_len], smb_buf(inbuf), sizeof(fname)-dir_name_len, 0, STR_TERMINATE, &status);
702 if (!NT_STATUS_IS_OK(status)) {
703 END_PROFILE(SMBntcreateX);
704 return ERROR_NT(status);
705 }
706 } else {
707 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
708 if (!NT_STATUS_IS_OK(status)) {
709 END_PROFILE(SMBntcreateX);
710 return ERROR_NT(status);
711 }
712
713 /*
714 * Check to see if this is a mac fork of some kind.
715 */
716
717 if( strchr_m(fname, ':')) {
718
719 #ifdef HAVE_SYS_QUOTAS
720 if ((fake_file_type=is_fake_file(fname))!=FAKE_FILE_TYPE_NONE) {
721 /*
722 * here we go! support for changing the disk quotas --metze
723 *
724 * we need to fake up to open this MAGIC QUOTA file
725 * and return a valid FID
726 *
727 * w2k close this file directly after openening
728 * xp also tries a QUERY_FILE_INFO on the file and then close it
729 */
730 } else {
731 #endif
732 END_PROFILE(SMBntcreateX);
733 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
734 #ifdef HAVE_SYS_QUOTAS
735 }
736 #endif
737 }
738 }
739
740 /*
741 * Now contruct the smb_open_mode value from the filename,
742 * desired access and the share access.
743 */
744 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
745
746 if((smb_open_mode = map_share_mode(fname, create_options, &desired_access,
747 share_access,
748 file_attributes)) == -1) {
749 END_PROFILE(SMBntcreateX);
750 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
751 }
752
753 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
754 if (oplock_request) {
755 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
756 }
757
758 /*
759 * Ordinary file or directory.
760 */
761
762 /*
763 * Check if POSIX semantics are wanted.
764 */
765
766 set_posix_case_semantics(file_attributes);
767
768 unix_convert(fname,conn,0,&bad_path,&sbuf);
769
770 unixmode = unix_mode(conn,smb_attr | aARCH, fname);
771
772 /*
773 * If it's a request for a directory open, deal with it separately.
774 */
775
776 if(create_options & FILE_DIRECTORY_FILE) {
777 oplock_request = 0;
778
779 /* Can't open a temp directory. IFS kit test. */
780 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
781 END_PROFILE(SMBntcreateX);
782 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
783 }
784
785 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, unixmode, &smb_action);
786
787 restore_case_semantics(file_attributes);
788
789 if(!fsp) {
790 END_PROFILE(SMBntcreateX);
791 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
792 }
793 } else {
794 /*
795 * Ordinary file case.
796 */
797
798 /* NB. We have a potential bug here. If we
799 * cause an oplock break to ourselves, then we
800 * could end up processing filename related
801 * SMB requests whilst we await the oplock
802 * break response. As we may have changed the
803 * filename case semantics to be POSIX-like,
804 * this could mean a filename request could
805 * fail when it should succeed. This is a rare
806 * condition, but eventually we must arrange
807 * to restore the correct case semantics
808 * before issuing an oplock break request to
809 * our client. JRA. */
810
811 if (fake_file_type==FAKE_FILE_TYPE_NONE) {
812 fsp = open_file_shared1(conn,fname,&sbuf,
813 desired_access,
814 smb_open_mode,
815 smb_ofun,unixmode, oplock_request,
816 &rmode,&smb_action);
817 } else {
818 /* to open a fake_file --metze */
819 fsp = open_fake_file_shared1(fake_file_type,conn,fname,&sbuf,
820 desired_access,
821 smb_open_mode,
822 smb_ofun,unixmode, oplock_request,
823 &rmode,&smb_action);
824 }
825
826 if (!fsp) {
827 /* We cheat here. There are two cases we
828 * care about. One is a directory rename,
829 * where the NT client will attempt to
830 * open the source directory for
831 * DELETE access. Note that when the
832 * NT client does this it does *not*
833 * set the directory bit in the
834 * request packet. This is translated
835 * into a read/write open
836 * request. POSIX states that any open
837 * for write request on a directory
838 * will generate an EISDIR error, so
839 * we can catch this here and open a
840 * pseudo handle that is flagged as a
841 * directory. The second is an open
842 * for a permissions read only, which
843 * we handle in the open_file_stat case. JRA.
844 */
845
846 if(errno == EISDIR) {
847
848 /*
849 * Fail the open if it was explicitly a non-directory file.
850 */
851
852 if (create_options & FILE_NON_DIRECTORY_FILE) {
853 restore_case_semantics(file_attributes);
854 SSVAL(outbuf, smb_flg2,
855 SVAL(outbuf,smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
856 END_PROFILE(SMBntcreateX);
857 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
858 }
859
860 oplock_request = 0;
861 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, unixmode, &smb_action);
862
863 if(!fsp) {
864 restore_case_semantics(file_attributes);
865 END_PROFILE(SMBntcreateX);
866 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
867 }
868 } else {
869
870 restore_case_semantics(file_attributes);
871 END_PROFILE(SMBntcreateX);
872 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
873 }
874 }
875 }
876
877 restore_case_semantics(file_attributes);
878
879 file_len = sbuf.st_size;
880 fmode = dos_mode(conn,fname,&sbuf);
881 if(fmode == 0)
882 fmode = FILE_ATTRIBUTE_NORMAL;
883 if (!fsp->is_directory && (fmode & aDIR)) {
884 close_file(fsp,False);
885 END_PROFILE(SMBntcreateX);
886 return ERROR_DOS(ERRDOS,ERRnoaccess);
887 }
888
889 /* Save the requested allocation size. */
890 allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
891 #ifdef LARGE_SMB_OFF_T
892 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
893 #endif
894 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
895 fsp->initial_allocation_size = SMB_ROUNDUP(allocation_size,SMB_ROUNDUP_ALLOCATION_SIZE);
896 if (fsp->is_directory) {
897 close_file(fsp,False);
898 END_PROFILE(SMBntcreateX);
899 /* Can't set allocation size on a directory. */
900 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
901 }
902 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
903 close_file(fsp,False);
904 END_PROFILE(SMBntcreateX);
905 return ERROR_NT(NT_STATUS_DISK_FULL);
906 }
907 } else {
908 fsp->initial_allocation_size = SMB_ROUNDUP(((SMB_BIG_UINT)file_len),SMB_ROUNDUP_ALLOCATION_SIZE);
909 }
910
911 /*
912 * If the caller set the extended oplock request bit
913 * and we granted one (by whatever means) - set the
914 * correct bit for extended oplock reply.
915 */
916
917 if (oplock_request && lp_fake_oplocks(SNUM(conn)))
918 extended_oplock_granted = True;
919
920 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
921 extended_oplock_granted = True;
922
923 #if 0
924 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
925 set_message(outbuf,42,0,True);
926 #else
927 set_message(outbuf,34,0,True);
928 #endif
929
930 p = outbuf + smb_vwv2;
931
932 /*
933 * Currently as we don't support level II oplocks we just report
934 * exclusive & batch here.
935 */
936
937 if (extended_oplock_granted) {
938 if (flags & REQUEST_BATCH_OPLOCK) {
939 SCVAL(p,0, BATCH_OPLOCK_RETURN);
940 } else {
941 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
942 }
943 } else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type)) {
944 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
945 } else {
946 SCVAL(p,0,NO_OPLOCK_RETURN);
947 }
948
949 p++;
950 SSVAL(p,0,fsp->fnum);
951 p += 2;
952 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
953 SIVAL(p,0,FILE_WAS_SUPERSEDED);
954 else
955 SIVAL(p,0,smb_action);
956 p += 4;
957
958 /* Create time. */
959 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
960
961 if (lp_dos_filetime_resolution(SNUM(conn))) {
962 c_time &= ~1;
963 sbuf.st_atime &= ~1;
964 sbuf.st_mtime &= ~1;
965 sbuf.st_mtime &= ~1;
966 }
967
968 put_long_date(p,c_time);
969 p += 8;
970 put_long_date(p,sbuf.st_atime); /* access time */
971 p += 8;
972 put_long_date(p,sbuf.st_mtime); /* write time */
973 p += 8;
974 put_long_date(p,sbuf.st_mtime); /* change time */
975 p += 8;
976 SIVAL(p,0,fmode); /* File Attributes. */
977 p += 4;
978 SOFF_T(p, 0, get_allocation_size(fsp,&sbuf));
979 p += 8;
980 SOFF_T(p,0,file_len);
981 p += 8;
982 if (flags & EXTENDED_RESPONSE_REQUIRED)
983 SSVAL(p,2,0x7);
984 p += 4;
985 SCVAL(p,0,fsp->is_directory ? 1 : 0);
986
987 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
988
989 result = chain_reply(inbuf,outbuf,length,bufsize);
990 END_PROFILE(SMBntcreateX);
991 return result;
992 }
993
994 /****************************************************************************
995 Reply to a NT_TRANSACT_CREATE call to open a pipe.
996 ****************************************************************************/
997
998 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
999 char **ppsetup, uint32 setup_count,
1000 char **ppparams, uint32 parameter_count,
1001 char **ppdata, uint32 data_count)
1002 {
1003 pstring fname;
1004 char *params = *ppparams;
1005 int ret;
1006 int pnum = -1;
1007 char *p = NULL;
1008 NTSTATUS status;
1009
1010 /*
1011 * Ensure minimum number of parameters sent.
1012 */
1013
1014 if(parameter_count < 54) {
1015 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1016 return ERROR_DOS(ERRDOS,ERRnoaccess);
1017 }
1018
1019 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1020 if (!NT_STATUS_IS_OK(status)) {
1021 return ERROR_NT(status);
1022 }
1023
1024 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
1025 return ret;
1026
1027 /* Realloc the size of parameters and data we will return */
1028 params = nttrans_realloc(ppparams, 69);
1029 if(params == NULL)
1030 return ERROR_DOS(ERRDOS,ERRnomem);
1031
1032 p = params;
1033 SCVAL(p,0,NO_OPLOCK_RETURN);
1034
1035 p += 2;
1036 SSVAL(p,0,pnum);
1037 p += 2;
1038 SIVAL(p,0,FILE_WAS_OPENED);
1039 p += 8;
1040
1041 p += 32;
1042 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1043 p += 20;
1044 /* File type. */
1045 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1046 /* Device state. */
1047 SSVAL(p,2, 0x5FF); /* ? */
1048
1049 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1050
1051 /* Send the required number of replies */
1052 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1053
1054 return -1;
1055 }
1056
1057 /****************************************************************************
1058 Internal fn to set security descriptors.
1059 ****************************************************************************/
1060
1061 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1062 {
1063 prs_struct pd;
1064 SEC_DESC *psd = NULL;
1065 TALLOC_CTX *mem_ctx;
1066 BOOL ret;
1067
1068 if (sd_len == 0) {
1069 return NT_STATUS_OK;
1070 }
1071
1072 /*
1073 * Init the parse struct we will unmarshall from.
1074 */
1075
1076 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1077 DEBUG(0,("set_sd: talloc_init failed.\n"));
1078 return NT_STATUS_NO_MEMORY;
1079 }
1080
1081 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1082
1083 /*
1084 * Setup the prs_struct to point at the memory we just
1085 * allocated.
1086 */
1087
1088 prs_give_memory( &pd, data, sd_len, False);
1089
1090 /*
1091 * Finally, unmarshall from the data buffer.
1092 */
1093
1094 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1095 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1096 /*
1097 * Return access denied for want of a better error message..
1098 */
1099 talloc_destroy(mem_ctx);
1100 return NT_STATUS_NO_MEMORY;
1101 }
1102
1103 if (psd->off_owner_sid==0)
1104 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1105 if (psd->off_grp_sid==0)
1106 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1107 if (psd->off_sacl==0)
1108 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1109 if (psd->off_dacl==0)
1110 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1111
1112 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fd, security_info_sent, psd);
1113
1114 if (!ret) {
1115 talloc_destroy(mem_ctx);
1116 return NT_STATUS_ACCESS_DENIED;
1117 }
1118
1119 talloc_destroy(mem_ctx);
1120
1121 return NT_STATUS_OK;
1122 }
1123
1124 /****************************************************************************
1125 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1126 ****************************************************************************/
1127
1128 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1129 char **ppsetup, uint32 setup_count,
1130 char **ppparams, uint32 parameter_count,
1131 char **ppdata, uint32 data_count)
1132 {
1133 pstring fname;
1134 char *params = *ppparams;
1135 char *data = *ppdata;
1136 /* Breakout the oplock request bits so we can set the reply bits separately. */
1137 int oplock_request = 0;
1138 mode_t unixmode;
1139 int fmode=0,rmode=0;
1140 SMB_OFF_T file_len = 0;
1141 SMB_STRUCT_STAT sbuf;
1142 int smb_action = 0;
1143 BOOL bad_path = False;
1144 files_struct *fsp = NULL;
1145 char *p = NULL;
1146 BOOL extended_oplock_granted = False;
1147 uint32 flags;
1148 uint32 desired_access;
1149 uint32 file_attributes;
1150 uint32 share_access;
1151 uint32 create_disposition;
1152 uint32 create_options;
1153 uint32 sd_len;
1154 uint16 root_dir_fid;
1155 SMB_BIG_UINT allocation_size = 0;
1156 int smb_ofun;
1157 int smb_open_mode;
1158 int smb_attr;
1159 time_t c_time;
1160 NTSTATUS status;
1161
1162 DEBUG(5,("call_nt_transact_create\n"));
1163
1164 /*
1165 * If it's an IPC, use the pipe handler.
1166 */
1167
1168 if (IS_IPC(conn)) {
1169 if (lp_nt_pipe_support())
1170 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1171 bufsize,
1172 ppsetup, setup_count,
1173 ppparams, parameter_count,
1174 ppdata, data_count);
1175 else
1176 return ERROR_DOS(ERRDOS,ERRnoaccess);
1177 }
1178
1179 /*
1180 * Ensure minimum number of parameters sent.
1181 */
1182
1183 if(parameter_count < 54) {
1184 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1185 return ERROR_DOS(ERRDOS,ERRnoaccess);
1186 }
1187
1188 flags = IVAL(params,0);
1189 desired_access = IVAL(params,8);
1190 file_attributes = IVAL(params,20);
1191 share_access = IVAL(params,24);
1192 create_disposition = IVAL(params,28);
1193 create_options = IVAL(params,32);
1194 sd_len = IVAL(params,36);
1195 root_dir_fid = (uint16)IVAL(params,4);
1196 smb_attr = (file_attributes & SAMBA_ATTRIBUTES_MASK);
1197
1198 if (create_options & FILE_OPEN_BY_FILE_ID) {
1199 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1200 }
1201
1202 /*
1203 * We need to construct the open_and_X ofun value from the
1204 * NT values, as that's what our code is structured to accept.
1205 */
1206
1207 if((smb_ofun = map_create_disposition( create_disposition )) == -1)
1208 return ERROR_DOS(ERRDOS,ERRbadmem);
1209
1210 /*
1211 * Get the file name.
1212 */
1213
1214 if(root_dir_fid != 0) {
1215 /*
1216 * This filename is relative to a directory fid.
1217 */
1218
1219 files_struct *dir_fsp = file_fsp(params,4);
1220 size_t dir_name_len;
1221
1222 if(!dir_fsp)
1223 return ERROR_DOS(ERRDOS,ERRbadfid);
1224
1225 if(!dir_fsp->is_directory) {
1226 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1227 if (!NT_STATUS_IS_OK(status)) {
1228 return ERROR_NT(status);
1229 }
1230
1231 /*
1232 * Check to see if this is a mac fork of some kind.
1233 */
1234
1235 if( strchr_m(fname, ':'))
1236 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1237
1238 return ERROR_DOS(ERRDOS,ERRbadfid);
1239 }
1240
1241 /*
1242 * Copy in the base directory name.
1243 */
1244
1245 pstrcpy( fname, dir_fsp->fsp_name );
1246 dir_name_len = strlen(fname);
1247
1248 /*
1249 * Ensure it ends in a '\'.
1250 */
1251
1252 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1253 pstrcat(fname, "\\");
1254 dir_name_len++;
1255 }
1256
1257 {
1258 pstring tmpname;
1259 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1260 if (!NT_STATUS_IS_OK(status)) {
1261 return ERROR_NT(status);
1262 }
1263 pstrcat(fname, tmpname);
1264 }
1265 } else {
1266 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1267 if (!NT_STATUS_IS_OK(status)) {
1268 return ERROR_NT(status);
1269 }
1270
1271 /*
1272 * Check to see if this is a mac fork of some kind.
1273 */
1274
1275 if( strchr_m(fname, ':'))
1276 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1277 }
1278
1279 /*
1280 * Now contruct the smb_open_mode value from the desired access
1281 * and the share access.
1282 */
1283
1284 if((smb_open_mode = map_share_mode( fname, create_options, &desired_access,
1285 share_access, file_attributes)) == -1)
1286 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1287
1288 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1289 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1290
1291 /*
1292 * Check if POSIX semantics are wanted.
1293 */
1294
1295 set_posix_case_semantics(file_attributes);
1296
1297 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1298
1299 unix_convert(fname,conn,0,&bad_path,&sbuf);
1300
1301 unixmode = unix_mode(conn,smb_attr | aARCH, fname);
1302
1303 /*
1304 * If it's a request for a directory open, deal with it separately.
1305 */
1306
1307 if(create_options & FILE_DIRECTORY_FILE) {
1308
1309 /* Can't open a temp directory. IFS kit test. */
1310 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1311 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1312 }
1313
1314 oplock_request = 0;
1315
1316 /*
1317 * We will get a create directory here if the Win32
1318 * app specified a security descriptor in the
1319 * CreateDirectory() call.
1320 */
1321
1322 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, unixmode, &smb_action);
1323
1324 if(!fsp) {
1325 restore_case_semantics(file_attributes);
1326 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1327 }
1328
1329 } else {
1330
1331 /*
1332 * Ordinary file case.
1333 */
1334
1335 fsp = open_file_shared1(conn,fname,&sbuf,desired_access,
1336 smb_open_mode,smb_ofun,unixmode,
1337 oplock_request,&rmode,&smb_action);
1338
1339 if (!fsp) {
1340
1341 if(errno == EISDIR) {
1342
1343 /*
1344 * Fail the open if it was explicitly a non-directory file.
1345 */
1346
1347 if (create_options & FILE_NON_DIRECTORY_FILE) {
1348 restore_case_semantics(file_attributes);
1349 SSVAL(outbuf, smb_flg2, SVAL(outbuf,smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
1350 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1351 }
1352
1353 oplock_request = 0;
1354 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, unixmode, &smb_action);
1355
1356 if(!fsp) {
1357 restore_case_semantics(file_attributes);
1358 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1359 }
1360 } else {
1361 restore_case_semantics(file_attributes);
1362 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1363 }
1364 }
1365
1366 file_len = sbuf.st_size;
1367 fmode = dos_mode(conn,fname,&sbuf);
1368 if(fmode == 0)
1369 fmode = FILE_ATTRIBUTE_NORMAL;
1370
1371 if (fmode & aDIR) {
1372 close_file(fsp,False);
1373 restore_case_semantics(file_attributes);
1374 return ERROR_DOS(ERRDOS,ERRnoaccess);
1375 }
1376
1377 /*
1378 * If the caller set the extended oplock request bit
1379 * and we granted one (by whatever means) - set the
1380 * correct bit for extended oplock reply.
1381 */
1382
1383 if (oplock_request && lp_fake_oplocks(SNUM(conn)))
1384 extended_oplock_granted = True;
1385
1386 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
1387 extended_oplock_granted = True;
1388 }
1389
1390 /*
1391 * Now try and apply the desired SD.
1392 */
1393
1394 if (sd_len && !NT_STATUS_IS_OK(status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION))) {
1395 close_file(fsp,False);
1396 restore_case_semantics(file_attributes);
1397 return ERROR_NT(status);
1398 }
1399
1400 restore_case_semantics(file_attributes);
1401
1402 /* Save the requested allocation size. */
1403 allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1404 #ifdef LARGE_SMB_OFF_T
1405 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1406 #endif
1407 if (allocation_size && (allocation_size > file_len)) {
1408 fsp->initial_allocation_size = SMB_ROUNDUP(allocation_size,SMB_ROUNDUP_ALLOCATION_SIZE);
1409 if (fsp->is_directory) {
1410 close_file(fsp,False);
1411 END_PROFILE(SMBntcreateX);
1412 /* Can't set allocation size on a directory. */
1413 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1414 }
1415 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1416 close_file(fsp,False);
1417 return ERROR_NT(NT_STATUS_DISK_FULL);
1418 }
1419 } else {
1420 fsp->initial_allocation_size = SMB_ROUNDUP(((SMB_BIG_UINT)file_len),SMB_ROUNDUP_ALLOCATION_SIZE);
1421 }
1422
1423 /* Realloc the size of parameters and data we will return */
1424 params = nttrans_realloc(ppparams, 69);
1425 if(params == NULL)
1426 return ERROR_DOS(ERRDOS,ERRnomem);
1427
1428 p = params;
1429 if (extended_oplock_granted)
1430 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1431 else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type))
1432 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1433 else
1434 SCVAL(p,0,NO_OPLOCK_RETURN);
1435
1436 p += 2;
1437 SSVAL(p,0,fsp->fnum);
1438 p += 2;
1439 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
1440 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1441 else
1442 SIVAL(p,0,smb_action);
1443 p += 8;
1444
1445 /* Create time. */
1446 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1447
1448 if (lp_dos_filetime_resolution(SNUM(conn))) {
1449 c_time &= ~1;
1450 sbuf.st_atime &= ~1;
1451 sbuf.st_mtime &= ~1;
1452 sbuf.st_mtime &= ~1;
1453 }
1454
1455 put_long_date(p,c_time);
1456 p += 8;
1457 put_long_date(p,sbuf.st_atime); /* access time */
1458 p += 8;
1459 put_long_date(p,sbuf.st_mtime); /* write time */
1460 p += 8;
1461 put_long_date(p,sbuf.st_mtime); /* change time */
1462 p += 8;
1463 SIVAL(p,0,fmode); /* File Attributes. */
1464 p += 4;
1465 SOFF_T(p, 0, get_allocation_size(fsp,&sbuf));
1466 p += 8;
1467 SOFF_T(p,0,file_len);
1468 p += 8;
1469 if (flags & EXTENDED_RESPONSE_REQUIRED)
1470 SSVAL(p,2,0x7);
1471 p += 4;
1472 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1473
1474 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1475
1476 /* Send the required number of replies */
1477 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1478
1479 return -1;
1480 }
1481
1482 /****************************************************************************
1483 Reply to a NT CANCEL request.
1484 ****************************************************************************/
1485
1486 int reply_ntcancel(connection_struct *conn,
1487 char *inbuf,char *outbuf,int length,int bufsize)
1488 {
1489 /*
1490 * Go through and cancel any pending change notifies.
1491 */
1492
1493 int mid = SVAL(inbuf,smb_mid);
1494 START_PROFILE(SMBntcancel);
1495 remove_pending_change_notify_requests_by_mid(mid);
1496 remove_pending_lock_requests_by_mid(mid);
1497 srv_cancel_sign_response(mid);
1498
1499 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1500
1501 END_PROFILE(SMBntcancel);
1502 return(-1);
1503 }
1504
1505 /****************************************************************************
1506 Reply to a NT rename request.
1507 ****************************************************************************/
1508
1509 int reply_ntrename(connection_struct *conn,
1510 char *inbuf,char *outbuf,int length,int bufsize)
1511 {
1512 int outsize = 0;
1513 pstring name;
1514 pstring newname;
1515 char *p;
1516 NTSTATUS status;
1517 uint16 attrs = SVAL(inbuf,smb_vwv0);
1518 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1519
1520 START_PROFILE(SMBntrename);
1521
1522 if ((rename_type != RENAME_FLAG_RENAME) && (rename_type != RENAME_FLAG_HARD_LINK)) {
1523 END_PROFILE(SMBntrename);
1524 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1525 }
1526
1527 p = smb_buf(inbuf) + 1;
1528 p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status);
1529 if (!NT_STATUS_IS_OK(status)) {
1530 END_PROFILE(SMBntrename);
1531 return ERROR_NT(status);
1532 }
1533
1534 if( strchr_m(name, ':')) {
1535 /* Can't rename a stream. */
1536 END_PROFILE(SMBntrename);
1537 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1538 }
1539
1540 p++;
1541 p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
1542 if (!NT_STATUS_IS_OK(status)) {
1543 END_PROFILE(SMBntrename);
1544 return ERROR_NT(status);
1545 }
1546
1547 RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
1548 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1549
1550 DEBUG(3,("reply_ntrename : %s -> %s\n",name,newname));
1551
1552 if (rename_type == RENAME_FLAG_RENAME) {
1553 status = rename_internals(conn, name, newname, attrs, False);
1554 } else {
1555 status = hardlink_internals(conn, name, newname);
1556 }
1557
1558 if (!NT_STATUS_IS_OK(status)) {
1559 END_PROFILE(SMBntrename);
1560 return ERROR_NT(status);
1561 }
1562
1563 /*
1564 * Win2k needs a changenotify request response before it will
1565 * update after a rename..
1566 */
1567 process_pending_change_notify_queue((time_t)0);
1568 outsize = set_message(outbuf,0,0,True);
1569
1570 END_PROFILE(SMBntrename);
1571 return(outsize);
1572 }
1573
1574 /****************************************************************************
1575 Reply to an unsolicited SMBNTtranss - just ignore it!
1576 ****************************************************************************/
1577
1578 int reply_nttranss(connection_struct *conn,
1579 char *inbuf,char *outbuf,int length,int bufsize)
1580 {
1581 START_PROFILE(SMBnttranss);
1582 DEBUG(4,("Ignoring nttranss of length %d\n",length));
1583 END_PROFILE(SMBnttranss);
1584 return(-1);
1585 }
1586
1587 /****************************************************************************
1588 Reply to a notify change - queue the request and
1589 don't allow a directory to be opened.
1590 ****************************************************************************/
1591
1592 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1593 char **ppsetup, uint32 setup_count,
1594 char **ppparams, uint32 parameter_count,
1595 char **ppdata, uint32 data_count)
1596 {
1597 char *setup = *ppsetup;
1598 files_struct *fsp;
1599 uint32 flags;
1600
1601 if(setup_count < 6)
1602 return ERROR_DOS(ERRDOS,ERRbadfunc);
1603
1604 fsp = file_fsp(setup,4);
1605 flags = IVAL(setup, 0);
1606
1607 DEBUG(3,("call_nt_transact_notify_change\n"));
1608
1609 if(!fsp)
1610 return ERROR_DOS(ERRDOS,ERRbadfid);
1611
1612 if((!fsp->is_directory) || (conn != fsp->conn))
1613 return ERROR_DOS(ERRDOS,ERRbadfid);
1614
1615 if (!change_notify_set(inbuf, fsp, conn, flags))
1616 return(UNIXERROR(ERRDOS,ERRbadfid));
1617
1618 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1619 name = %s\n", fsp->fsp_name ));
1620
1621 return -1;
1622 }
1623
1624 /****************************************************************************
1625 Reply to an NT transact rename command.
1626 ****************************************************************************/
1627
1628 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1629 char **ppsetup, uint32 setup_count,
1630 char **ppparams, uint32 parameter_count,
1631 char **ppdata, uint32 data_count)
1632 {
1633 char *params = *ppparams;
1634 pstring new_name;
1635 files_struct *fsp = NULL;
1636 BOOL replace_if_exists = False;
1637 NTSTATUS status;
1638
1639 if(parameter_count < 4)
1640 return ERROR_DOS(ERRDOS,ERRbadfunc);
1641
1642 fsp = file_fsp(params, 0);
1643 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1644 CHECK_FSP(fsp, conn);
1645 srvstr_get_path(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE, &status);
1646 if (!NT_STATUS_IS_OK(status)) {
1647 return ERROR_NT(status);
1648 }
1649
1650 status = rename_internals(conn, fsp->fsp_name,
1651 new_name, 0, replace_if_exists);
1652 if (!NT_STATUS_IS_OK(status))
1653 return ERROR_NT(status);
1654
1655 /*
1656 * Rename was successful.
1657 */
1658 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1659
1660 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1661 fsp->fsp_name, new_name));
1662
1663 /*
1664 * Win2k needs a changenotify request response before it will
1665 * update after a rename..
1666 */
1667
1668 process_pending_change_notify_queue((time_t)0);
1669
1670 return -1;
1671 }
1672
1673 /******************************************************************************
1674 Fake up a completely empty SD.
1675 *******************************************************************************/
1676
1677 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1678 {
1679 extern DOM_SID global_sid_World;
1680 size_t sd_size;
1681
1682 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1683 if(!*ppsd) {
1684 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1685 sd_size = 0;
1686 }
1687
1688 return sd_size;
1689 }
1690
1691 /****************************************************************************
1692 Reply to query a security descriptor.
1693 ****************************************************************************/
1694
1695 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1696 char **ppsetup, uint32 setup_count,
1697 char **ppparams, uint32 parameter_count,
1698 char **ppdata, uint32 data_count)
1699 {
1700 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
1701 char *params = *ppparams;
1702 char *data = *ppdata;
1703 prs_struct pd;
1704 SEC_DESC *psd = NULL;
1705 size_t sd_size;
1706 uint32 security_info_wanted;
1707 TALLOC_CTX *mem_ctx;
1708 files_struct *fsp = NULL;
1709
1710 if(parameter_count < 8)
1711 return ERROR_DOS(ERRDOS,ERRbadfunc);
1712
1713 fsp = file_fsp(params,0);
1714 if(!fsp)
1715 return ERROR_DOS(ERRDOS,ERRbadfid);
1716
1717 security_info_wanted = IVAL(params,4);
1718
1719 DEBUG(3,("call_nt_transact_query_security_desc: file = %s\n", fsp->fsp_name ));
1720
1721 params = nttrans_realloc(ppparams, 4);
1722 if(params == NULL)
1723 return ERROR_DOS(ERRDOS,ERRnomem);
1724
1725 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
1726 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1727 return ERROR_DOS(ERRDOS,ERRnomem);
1728 }
1729
1730 /*
1731 * Get the permissions to return.
1732 */
1733
1734 if (!lp_nt_acl_support(SNUM(conn)))
1735 sd_size = get_null_nt_acl(mem_ctx, &psd);
1736 else
1737 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, security_info_wanted, &psd);
1738
1739 if (sd_size == 0) {
1740 talloc_destroy(mem_ctx);
1741 return(UNIXERROR(ERRDOS,ERRnoaccess));
1742 }
1743
1744 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %d.\n",(int)sd_size));
1745
1746 SIVAL(params,0,(uint32)sd_size);
1747
1748 if(max_data_count < sd_size) {
1749
1750 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
1751 params, 4, *ppdata, 0);
1752 talloc_destroy(mem_ctx);
1753 return -1;
1754 }
1755
1756 /*
1757 * Allocate the data we will point this at.
1758 */
1759
1760 data = nttrans_realloc(ppdata, sd_size);
1761 if(data == NULL) {
1762 talloc_destroy(mem_ctx);
1763 return ERROR_DOS(ERRDOS,ERRnomem);
1764 }
1765
1766 /*
1767 * Init the parse struct we will marshall into.
1768 */
1769
1770 prs_init(&pd, 0, mem_ctx, MARSHALL);
1771
1772 /*
1773 * Setup the prs_struct to point at the memory we just
1774 * allocated.
1775 */
1776
1777 prs_give_memory( &pd, data, (uint32)sd_size, False);
1778
1779 /*
1780 * Finally, linearize into the outgoing buffer.
1781 */
1782
1783 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1784 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
1785 security descriptor.\n"));
1786 /*
1787 * Return access denied for want of a better error message..
1788 */
1789 talloc_destroy(mem_ctx);
1790 return(UNIXERROR(ERRDOS,ERRnoaccess));
1791 }
1792
1793 /*
1794 * Now we can delete the security descriptor.
1795 */
1796
1797 talloc_destroy(mem_ctx);
1798
1799 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data, (int)sd_size);
1800 return -1;
1801 }
1802
1803 /****************************************************************************
1804 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1805 ****************************************************************************/
1806
1807 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1808 char **ppsetup, uint32 setup_count,
1809 char **ppparams, uint32 parameter_count,
1810 char **ppdata, uint32 data_count)
1811 {
1812 char *params= *ppparams;
1813 char *data = *ppdata;
1814 files_struct *fsp = NULL;
1815 uint32 security_info_sent = 0;
1816 NTSTATUS nt_status;
1817
1818 if(parameter_count < 8)
1819 return ERROR_DOS(ERRDOS,ERRbadfunc);
1820
1821 if((fsp = file_fsp(params,0)) == NULL)
1822 return ERROR_DOS(ERRDOS,ERRbadfid);
1823
1824 if(!lp_nt_acl_support(SNUM(conn)))
1825 goto done;
1826
1827 security_info_sent = IVAL(params,4);
1828
1829 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1830 (unsigned int)security_info_sent ));
1831
1832 if (data_count == 0)
1833 return ERROR_DOS(ERRDOS, ERRnoaccess);
1834
1835 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent)))
1836 return ERROR_NT(nt_status);
1837
1838 done:
1839
1840 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1841 return -1;
1842 }
1843
1844 /****************************************************************************
1845 Reply to NT IOCTL
1846 ****************************************************************************/
1847
1848 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1849 char **ppsetup, uint32 setup_count,
1850 char **ppparams, uint32 parameter_count,
1851 char **ppdata, uint32 data_count)
1852 {
1853 uint32 function;
1854 uint16 fidnum;
1855 files_struct *fsp;
1856 uint8 isFSctl;
1857 uint8 compfilter;
1858 static BOOL logged_message;
1859 char *pdata = *ppdata;
1860
1861 if (setup_count != 8) {
1862 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1863 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1864 }
1865
1866 function = IVAL(*ppsetup, 0);
1867 fidnum = SVAL(*ppsetup, 4);
1868 isFSctl = CVAL(*ppsetup, 6);
1869 compfilter = CVAL(*ppsetup, 7);
1870
1871 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1872 function, fidnum, isFSctl, compfilter));
1873
1874 fsp=file_fsp(*ppsetup, 4);
1875 /* this check is done in each implemented function case for now
1876 because I don't want to break anything... --metze
1877 FSP_BELONGS_CONN(fsp,conn);*/
1878
1879 switch (function) {
1880 case FSCTL_SET_SPARSE:
1881 /* pretend this succeeded - tho strictly we should
1882 mark the file sparse (if the local fs supports it)
1883 so we can know if we need to pre-allocate or not */
1884
1885 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1886 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1887 return -1;
1888
1889 case FSCTL_0x000900C0:
1890 /* pretend this succeeded - don't know what this really is
1891 but works ok like this --metze
1892 */
1893
1894 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
1895 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1896 return -1;
1897
1898 case FSCTL_GET_REPARSE_POINT:
1899 /* pretend this fail - my winXP does it like this
1900 * --metze
1901 */
1902
1903 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1904 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
1905 return -1;
1906
1907 case FSCTL_SET_REPARSE_POINT:
1908 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1909 * --metze
1910 */
1911
1912 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1913 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
1914 return -1;
1915
1916 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1917 {
1918 /*
1919 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1920 * and return their volume names. If max_data_count is 16, then it is just
1921 * asking for the number of volumes and length of the combined names.
1922 *
1923 * pdata is the data allocated by our caller, but that uses
1924 * total_data_count (which is 0 in our case) rather than max_data_count.
1925 * Allocate the correct amount and return the pointer to let
1926 * it be deallocated when we return.
1927 */
1928 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
1929 SHADOW_COPY_DATA *shadow_data = NULL;
1930 TALLOC_CTX *shadow_mem_ctx = NULL;
1931 BOOL labels = False;
1932 uint32 labels_data_count = 0;
1933 uint32 i;
1934 char *cur_pdata;
1935
1936 FSP_BELONGS_CONN(fsp,conn);
1937
1938 if (max_data_count < 16) {
1939 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1940 max_data_count));
1941 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1942 }
1943
1944 if (max_data_count > 16) {
1945 labels = True;
1946 }
1947
1948 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1949 if (shadow_mem_ctx == NULL) {
1950 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1951 return ERROR_NT(NT_STATUS_NO_MEMORY);
1952 }
1953
1954 shadow_data = (SHADOW_COPY_DATA *)talloc_zero(shadow_mem_ctx,sizeof(SHADOW_COPY_DATA));
1955 if (shadow_data == NULL) {
1956 DEBUG(0,("talloc_zero() failed!\n"));
1957 return ERROR_NT(NT_STATUS_NO_MEMORY);
1958 }
1959
1960 shadow_data->mem_ctx = shadow_mem_ctx;
1961
1962 /*
1963 * Call the VFS routine to actually do the work.
1964 */
1965 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1966 talloc_destroy(shadow_data->mem_ctx);
1967 if (errno == ENOSYS) {
1968 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1969 conn->connectpath));
1970 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1971 } else {
1972 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1973 conn->connectpath));
1974 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
1975 }
1976 }
1977
1978 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
1979
1980 if (!labels) {
1981 data_count = 16;
1982 } else {
1983 data_count = 12+labels_data_count+4;
1984 }
1985
1986 if (max_data_count<data_count) {
1987 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1988 max_data_count,data_count));
1989 talloc_destroy(shadow_data->mem_ctx);
1990 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
1991 }
1992
1993 pdata = nttrans_realloc(ppdata, data_count);
1994 if (pdata == NULL) {
1995 talloc_destroy(shadow_data->mem_ctx);
1996 return ERROR_NT(NT_STATUS_NO_MEMORY);
1997 }
1998
1999 cur_pdata = pdata;
2000
2001 /* num_volumes 4 bytes */
2002 SIVAL(pdata,0,shadow_data->num_volumes);
2003
2004 if (labels) {
2005 /* num_labels 4 bytes */
2006 SIVAL(pdata,4,shadow_data->num_volumes);
2007 }
2008
2009 /* needed_data_count 4 bytes */
2010 SIVAL(pdata,8,labels_data_count);
2011
2012 cur_pdata+=12;
2013
2014 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2015 shadow_data->num_volumes,fsp->fsp_name));
2016 if (labels && shadow_data->labels) {
2017 for (i=0;i<shadow_data->num_volumes;i++) {
2018 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2019 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2020 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2021 }
2022 }
2023
2024 talloc_destroy(shadow_data->mem_ctx);
2025
2026 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2027
2028 return -1;
2029 }
2030
2031 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2032 {
2033 /* pretend this succeeded -
2034 *
2035 * we have to send back a list with all files owned by this SID
2036 *
2037 * but I have to check that --metze
2038 */
2039 DOM_SID sid;
2040 uid_t uid;
2041 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2042
2043 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2044
2045 FSP_BELONGS_CONN(fsp,conn);
2046
2047 /* unknown 4 bytes: this is not the length of the sid :-( */
2048 /*unknown = IVAL(pdata,0);*/
2049
2050 sid_parse(pdata+4,sid_len,&sid);
2051 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2052
2053 if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) {
2054 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2055 sid_string_static(&sid),(unsigned long)sid_len));
2056 uid = (-1);
2057 }
2058
2059 /* we can take a look at the find source :-)
2060 *
2061 * find ./ -uid $uid -name '*' is what we need here
2062 *
2063 *
2064 * and send 4bytes len and then NULL terminated unicode strings
2065 * for each file
2066 *
2067 * but I don't know how to deal with the paged results
2068 * (maybe we can hang the result anywhere in the fsp struct)
2069 *
2070 * we don't send all files at once
2071 * and at the next we should *not* start from the beginning,
2072 * so we have to cache the result
2073 *
2074 * --metze
2075 */
2076
2077 /* this works for now... */
2078 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2079 return -1;
2080 }
2081 default:
2082 if (!logged_message) {
2083 logged_message = True; /* Only print this once... */
2084 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2085 function));
2086 }
2087 }
2088
2089 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2090 }
2091
2092
2093 #ifdef HAVE_SYS_QUOTAS
2094 /****************************************************************************
2095 Reply to get user quota
2096 ****************************************************************************/
2097
2098 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2099 char **ppsetup, uint32 setup_count,
2100 char **ppparams, uint32 parameter_count,
2101 char **ppdata, uint32 data_count)
2102 {
2103 NTSTATUS nt_status = NT_STATUS_OK;
2104 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2105 char *params = *ppparams;
2106 char *pdata = *ppdata;
2107 char *entry;
2108 int data_len=0,param_len=0;
2109 int qt_len=0;
2110 int entry_len = 0;
2111 files_struct *fsp = NULL;
2112 uint16 level = 0;
2113 size_t sid_len;
2114 DOM_SID sid;
2115 BOOL start_enum = True;
2116 SMB_NTQUOTA_STRUCT qt;
2117 SMB_NTQUOTA_LIST *tmp_list;
2118 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2119 extern struct current_user current_user;
2120
2121 ZERO_STRUCT(qt);
2122
2123 /* access check */
2124 if (current_user.uid != 0) {
2125 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2126 lp_servicename(SNUM(conn)),conn->user));
2127 return ERROR_DOS(ERRDOS,ERRnoaccess);
2128 }
2129
2130 /*
2131 * Ensure minimum number of parameters sent.
2132 */
2133
2134 if (parameter_count < 4) {
2135 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2136 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2137 }
2138
2139 /* maybe we can check the quota_fnum */
2140 fsp = file_fsp(params,0);
2141 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2142 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2143 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2144 }
2145
2146 /* the NULL pointer cheking for fsp->fake_file_handle->pd
2147 * is done by CHECK_NTQUOTA_HANDLE_OK()
2148 */
2149 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2150
2151 level = SVAL(params,2);
2152
2153 /* unknown 12 bytes leading in params */
2154
2155 switch (level) {
2156 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2157 /* seems that we should continue with the enum here --metze */
2158
2159 if (qt_handle->quota_list!=NULL &&
2160 qt_handle->tmp_list==NULL) {
2161
2162 /* free the list */
2163 free_ntquota_list(&(qt_handle->quota_list));
2164
2165 /* Realloc the size of parameters and data we will return */
2166 param_len = 4;
2167 params = nttrans_realloc(ppparams, param_len);
2168 if(params == NULL)
2169 return ERROR_DOS(ERRDOS,ERRnomem);
2170
2171 data_len = 0;
2172 SIVAL(params,0,data_len);
2173
2174 break;
2175 }
2176
2177 start_enum = False;
2178
2179 case TRANSACT_GET_USER_QUOTA_LIST_START:
2180
2181 if (qt_handle->quota_list==NULL &&
2182 qt_handle->tmp_list==NULL) {
2183 start_enum = True;
2184 }
2185
2186 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2187 return ERROR_DOS(ERRSRV,ERRerror);
2188
2189 /* Realloc the size of parameters and data we will return */
2190 param_len = 4;
2191 params = nttrans_realloc(ppparams, param_len);
2192 if(params == NULL)
2193 return ERROR_DOS(ERRDOS,ERRnomem);
2194
2195 /* we should not trust the value in max_data_count*/
2196 max_data_count = MIN(max_data_count,2048);
2197
2198 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2199 if(pdata == NULL)
2200 return ERROR_DOS(ERRDOS,ERRnomem);
2201
2202 entry = pdata;
2203
2204
2205 /* set params Size of returned Quota Data 4 bytes*/
2206 /* but set it later when we know it */
2207
2208 /* for each entry push the data */
2209
2210 if (start_enum) {
2211 qt_handle->tmp_list = qt_handle->quota_list;
2212 }
2213
2214 tmp_list = qt_handle->tmp_list;
2215
2216 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2217 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2218
2219 sid_len = sid_size(&tmp_list->quotas->sid);
2220 entry_len = 40 + sid_len;
2221
2222 /* nextoffset entry 4 bytes */
2223 SIVAL(entry,0,entry_len);
2224
2225 /* then the len of the SID 4 bytes */
2226 SIVAL(entry,4,sid_len);
2227
2228 /* unknown data 8 bytes SMB_BIG_UINT */
2229 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2230
2231 /* the used disk space 8 bytes SMB_BIG_UINT */
2232 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2233
2234 /* the soft quotas 8 bytes SMB_BIG_UINT */
2235 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2236
2237 /* the hard quotas 8 bytes SMB_BIG_UINT */
2238 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2239
2240 /* and now the SID */
2241 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2242 }
2243
2244 qt_handle->tmp_list = tmp_list;
2245
2246 /* overwrite the offset of the last entry */
2247 SIVAL(entry-entry_len,0,0);
2248
2249 data_len = 4+qt_len;
2250 /* overwrite the params quota_data_len */
2251 SIVAL(params,0,data_len);
2252
2253 break;
2254
2255 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2256
2257 /* unknown 4 bytes IVAL(pdata,0) */
2258
2259 if (data_count < 8) {
2260 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2261 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2262 }
2263
2264 sid_len = IVAL(pdata,4);
2265
2266 if (data_count < 8+sid_len) {
2267 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2268 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2269 }
2270
2271 data_len = 4+40+sid_len;
2272
2273 if (max_data_count < data_len) {
2274 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2275 max_data_count, data_len));
2276 param_len = 4;
2277 SIVAL(params,0,data_len);
2278 data_len = 0;
2279 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2280 break;
2281 }
2282
2283 sid_parse(pdata+8,sid_len,&sid);
2284
2285
2286 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2287 ZERO_STRUCT(qt);
2288 /*
2289 * we have to return zero's in all fields
2290 * instead of returning an error here
2291 * --metze
2292 */
2293 }
2294
2295 /* Realloc the size of parameters and data we will return */
2296 param_len = 4;
2297 params = nttrans_realloc(ppparams, param_len);
2298 if(params == NULL)
2299 return ERROR_DOS(ERRDOS,ERRnomem);
2300
2301 pdata = nttrans_realloc(ppdata, data_len);
2302 if(pdata == NULL)
2303 return ERROR_DOS(ERRDOS,ERRnomem);
2304
2305 entry = pdata;
2306
2307 /* set params Size of returned Quota Data 4 bytes*/
2308 SIVAL(params,0,data_len);
2309
2310 /* nextoffset entry 4 bytes */
2311 SIVAL(entry,0,0);
2312
2313 /* then the len of the SID 4 bytes */
2314 SIVAL(entry,4,sid_len);
2315
2316 /* unknown data 8 bytes SMB_BIG_UINT */
2317 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2318
2319 /* the used disk space 8 bytes SMB_BIG_UINT */
2320 SBIG_UINT(entry,16,qt.usedspace);
2321
2322 /* the soft quotas 8 bytes SMB_BIG_UINT */
2323 SBIG_UINT(entry,24,qt.softlim);
2324
2325 /* the hard quotas 8 bytes SMB_BIG_UINT */
2326 SBIG_UINT(entry,32,qt.hardlim);
2327
2328 /* and now the SID */
2329 sid_linearize(entry+40, sid_len, &sid);
2330
2331 break;
2332
2333 default:
2334 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2335 return ERROR_DOS(ERRSRV,ERRerror);
2336 break;
2337 }
2338
2339 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len);
2340
2341 return -1;
2342 }
2343
2344 /****************************************************************************
2345 Reply to set user quota
2346 ****************************************************************************/
2347
2348 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2349 char **ppsetup, uint32 setup_count,
2350 char **ppparams, uint32 parameter_count,
2351 char **ppdata, uint32 data_count)
2352 {
2353 char *params = *ppparams;
2354 char *pdata = *ppdata;
2355 int data_len=0,param_len=0;
2356 SMB_NTQUOTA_STRUCT qt;
2357 size_t sid_len;
2358 DOM_SID sid;
2359 files_struct *fsp = NULL;
2360
2361 ZERO_STRUCT(qt);
2362
2363 /* access check */
2364 if (conn->admin_user != True) {
2365 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2366 lp_servicename(SNUM(conn)),conn->user));
2367 return ERROR_DOS(ERRDOS,ERRnoaccess);
2368 }
2369
2370 /*
2371 * Ensure minimum number of parameters sent.
2372 */
2373
2374 if (parameter_count < 2) {
2375 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2376 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2377 }
2378
2379 /* maybe we can check the quota_fnum */
2380 fsp = file_fsp(params,0);
2381 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2382 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2383 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2384 }
2385
2386 if (data_count < 40) {
2387 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2388 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2389 }
2390
2391 /* offset to next quota record.
2392 * 4 bytes IVAL(pdata,0)
2393 * unused here...
2394 */
2395
2396 /* sid len */
2397 sid_len = IVAL(pdata,4);
2398
2399 if (data_count < 40+sid_len) {
2400 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2401 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2402 }
2403
2404 /* unknown 8 bytes in pdata
2405 * maybe its the change time in NTTIME
2406 */
2407
2408 /* the used space 8 bytes (SMB_BIG_UINT)*/
2409 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2410 #ifdef LARGE_SMB_OFF_T
2411 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2412 #else /* LARGE_SMB_OFF_T */
2413 if ((IVAL(pdata,20) != 0)&&
2414 ((qt.usedspace != 0xFFFFFFFF)||
2415 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2416 /* more than 32 bits? */
2417 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2418 }
2419 #endif /* LARGE_SMB_OFF_T */
2420
2421 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2422 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2423 #ifdef LARGE_SMB_OFF_T
2424 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2425 #else /* LARGE_SMB_OFF_T */
2426 if ((IVAL(pdata,28) != 0)&&
2427 ((qt.softlim != 0xFFFFFFFF)||
2428 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2429 /* more than 32 bits? */
2430 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2431 }
2432 #endif /* LARGE_SMB_OFF_T */
2433
2434 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2435 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2436 #ifdef LARGE_SMB_OFF_T
2437 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2438 #else /* LARGE_SMB_OFF_T */
2439 if ((IVAL(pdata,36) != 0)&&
2440 ((qt.hardlim != 0xFFFFFFFF)||
2441 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2442 /* more than 32 bits? */
2443 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2444 }
2445 #endif /* LARGE_SMB_OFF_T */
2446
2447 sid_parse(pdata+40,sid_len,&sid);
2448 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2449
2450 /* 44 unknown bytes left... */
2451
2452 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2453 return ERROR_DOS(ERRSRV,ERRerror);
2454 }
2455
2456 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len);
2457
2458 return -1;
2459 }
2460 #endif /* HAVE_SYS_QUOTAS */
2461
2462 /****************************************************************************
2463 Reply to a SMBNTtrans.
2464 ****************************************************************************/
2465
2466 int reply_nttrans(connection_struct *conn,
2467 char *inbuf,char *outbuf,int length,int bufsize)
2468 {
2469 int outsize = 0;
2470 #if 0 /* Not used. */
2471 uint16 max_setup_count = CVAL(inbuf, smb_nt_MaxSetupCount);
2472 uint32 max_parameter_count = IVAL(inbuf, smb_nt_MaxParameterCount);
2473 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2474 #endif /* Not used. */
2475 uint32 total_parameter_count = IVAL(inbuf, smb_nt_TotalParameterCount);
2476 uint32 total_data_count = IVAL(inbuf, smb_nt_TotalDataCount);
2477 uint32 parameter_count = IVAL(inbuf,smb_nt_ParameterCount);
2478 uint32 parameter_offset = IVAL(inbuf,smb_nt_ParameterOffset);
2479 uint32 data_count = IVAL(inbuf,smb_nt_DataCount);
2480 uint32 data_offset = IVAL(inbuf,smb_nt_DataOffset);
2481 uint16 setup_count = 2*CVAL(inbuf,smb_nt_SetupCount); /* setup count is in *words* */
2482 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2483 char *params = NULL, *data = NULL, *setup = NULL;
2484 uint32 num_params_sofar, num_data_sofar;
2485 START_PROFILE(SMBnttrans);
2486
2487 if(global_oplock_break &&
2488 ((function_code == NT_TRANSACT_CREATE) ||
2489 (function_code == NT_TRANSACT_RENAME))) {
2490 /*
2491 * Queue this open message as we are the process of an oplock break.
2492 */
2493
2494 DEBUG(2,("reply_nttrans: queueing message code 0x%x \
2495 due to being in oplock break state.\n", (unsigned int)function_code ));
2496
2497 push_oplock_pending_smb_message( inbuf, length);
2498 END_PROFILE(SMBnttrans);
2499 return -1;
2500 }
2501
2502 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2503 END_PROFILE(SMBnttrans);
2504 return ERROR_DOS(ERRSRV,ERRaccess);
2505 }
2506
2507 outsize = set_message(outbuf,0,0,True);
2508
2509 /*
2510 * All nttrans messages we handle have smb_wct == 19 + setup_count.
2511 * Ensure this is so as a sanity check.
2512 */
2513
2514 if(CVAL(inbuf, smb_wct) != 19 + (setup_count/2)) {
2515 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2516 CVAL(inbuf, smb_wct), 19 + (setup_count/2)));
2517 goto bad_param;
2518 }
2519
2520 /* Allocate the space for the setup, the maximum needed parameters and data */
2521
2522 if(setup_count > 0)
2523 setup = (char *)malloc(setup_count);
2524 if (total_parameter_count > 0)
2525 params = (char *)malloc(total_parameter_count);
2526 if (total_data_count > 0)
2527 data = (char *)malloc(total_data_count);
2528
2529 if ((total_parameter_count && !params) || (total_data_count && !data) ||
2530 (setup_count && !setup)) {
2531 SAFE_FREE(setup);
2532 SAFE_FREE(params);
2533 SAFE_FREE(data);
2534 DEBUG(0,("reply_nttrans : Out of memory\n"));
2535 END_PROFILE(SMBnttrans);
2536 return ERROR_DOS(ERRDOS,ERRnomem);
2537 }
2538
2539 /* Copy the param and data bytes sent with this request into the params buffer */
2540 num_params_sofar = parameter_count;
2541 num_data_sofar = data_count;
2542
2543 if (parameter_count > total_parameter_count || data_count > total_data_count)
2544 goto bad_param;
2545
2546 if(setup) {
2547 DEBUG(10,("reply_nttrans: setup_count = %d\n", setup_count));
2548 if ((smb_nt_SetupStart + setup_count < smb_nt_SetupStart) ||
2549 (smb_nt_SetupStart + setup_count < setup_count))
2550 goto bad_param;
2551 if (smb_nt_SetupStart + setup_count > length)
2552 goto bad_param;
2553
2554 memcpy( setup, &inbuf[smb_nt_SetupStart], setup_count);
2555 dump_data(10, setup, setup_count);
2556 }
2557 if(params) {
2558 DEBUG(10,("reply_nttrans: parameter_count = %d\n", parameter_count));
2559 if ((parameter_offset + parameter_count < parameter_offset) ||
2560 (parameter_offset + parameter_count < parameter_count))
2561 goto bad_param;
2562 if ((smb_base(inbuf) + parameter_offset + parameter_count > inbuf + length)||
2563 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2564 goto bad_param;
2565
2566 memcpy( params, smb_base(inbuf) + parameter_offset, parameter_count);
2567 dump_data(10, params, parameter_count);
2568 }
2569 if(data) {
2570 DEBUG(10,("reply_nttrans: data_count = %d\n",data_count));
2571 if ((data_offset + data_count < data_offset) || (data_offset + data_count < data_count))
2572 goto bad_param;
2573 if ((smb_base(inbuf) + data_offset + data_count > inbuf + length) ||
2574 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
2575 goto bad_param;
2576
2577 memcpy( data, smb_base(inbuf) + data_offset, data_count);
2578 dump_data(10, data, data_count);
2579 }
2580
2581 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2582
2583 if(num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2584 /* We need to send an interim response then receive the rest
2585 of the parameter/data bytes */
2586 outsize = set_message(outbuf,0,0,True);
2587 srv_signing_trans_stop();
2588 if (!send_smb(smbd_server_fd(),outbuf))
2589 exit_server("reply_nttrans: send_smb failed.");
2590
2591 while( num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2592 BOOL ret;
2593 uint32 parameter_displacement;
2594 uint32 data_displacement;
2595
2596 ret = receive_next_smb(inbuf,bufsize,SMB_SECONDARY_WAIT);
2597
2598 /*
2599 * The sequence number for the trans reply is always
2600 * based on the last secondary received.
2601 */
2602
2603 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2604
2605 if((ret && (CVAL(inbuf, smb_com) != SMBnttranss)) || !ret) {
2606 outsize = set_message(outbuf,0,0,True);
2607 if(ret) {
2608 DEBUG(0,("reply_nttrans: Invalid secondary nttrans packet\n"));
2609 } else {
2610 DEBUG(0,("reply_nttrans: %s in getting secondary nttrans response.\n",
2611 (smb_read_error == READ_ERROR) ? "error" : "timeout" ));
2612 }
2613 goto bad_param;
2614 }
2615
2616 /* Revise total_params and total_data in case they have changed downwards */
2617 if (IVAL(inbuf, smb_nts_TotalParameterCount) < total_parameter_count)
2618 total_parameter_count = IVAL(inbuf, smb_nts_TotalParameterCount);
2619 if (IVAL(inbuf, smb_nts_TotalDataCount) < total_data_count)
2620 total_data_count = IVAL(inbuf, smb_nts_TotalDataCount);
2621
2622 parameter_count = IVAL(inbuf,smb_nts_ParameterCount);
2623 parameter_offset = IVAL(inbuf, smb_nts_ParameterOffset);
2624 parameter_displacement = IVAL(inbuf, smb_nts_ParameterDisplacement);
2625 num_params_sofar += parameter_count;
2626
2627 data_count = IVAL(inbuf, smb_nts_DataCount);
2628 data_displacement = IVAL(inbuf, smb_nts_DataDisplacement);
2629 data_offset = IVAL(inbuf, smb_nts_DataOffset);
2630 num_data_sofar += data_count;
2631
2632 if (num_params_sofar > total_parameter_count || num_data_sofar > total_data_count) {
2633 DEBUG(0,("reply_nttrans2: data overflow in secondary nttrans packet"));
2634 goto bad_param;
2635 }
2636
2637 if (parameter_count) {
2638 if (parameter_displacement + parameter_count >= total_parameter_count)
2639 goto bad_param;
2640 if ((parameter_displacement + parameter_count < parameter_displacement) ||
2641 (parameter_displacement + parameter_count < parameter_count))
2642 goto bad_param;
2643 if (parameter_displacement > total_parameter_count)
2644 goto bad_param;
2645 if ((smb_base(inbuf) + parameter_offset + parameter_count >= inbuf + bufsize) ||
2646 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2647 goto bad_param;
2648 if (parameter_displacement + params < params)
2649 goto bad_param;
2650
2651 memcpy( &params[parameter_displacement], smb_base(inbuf) + parameter_offset, parameter_count);
2652 }
2653
2654 if (data_count) {
2655 if (data_displacement + data_count >= total_data_count)
2656 goto bad_param;
2657 if ((data_displacement + data_count < data_displacement) ||
2658 (data_displacement + data_count < data_count))
2659 goto bad_param;
2660 if (data_displacement > total_data_count)
2661 goto bad_param;
2662 if ((smb_base(inbuf) + data_offset + data_count >= inbuf + bufsize) ||
2663 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
2664 goto bad_param;
2665 if (data_displacement + data < data)
2666 goto bad_param;
2667
2668 memcpy( &data[data_displacement], smb_base(inbuf)+ data_offset, data_count);
2669 }
2670 }
2671 }
2672
2673 if (Protocol >= PROTOCOL_NT1)
2674 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | FLAGS2_IS_LONG_NAME);
2675
2676 /* Now we must call the relevant NT_TRANS function */
2677 switch(function_code) {
2678 case NT_TRANSACT_CREATE:
2679 START_PROFILE_NESTED(NT_transact_create);
2680 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2681 length, bufsize,
2682 &setup, setup_count,
2683 &params, total_parameter_count,
2684 &data, total_data_count);
2685 END_PROFILE_NESTED(NT_transact_create);
2686 break;
2687 case NT_TRANSACT_IOCTL:
2688 START_PROFILE_NESTED(NT_transact_ioctl);
2689 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2690 length, bufsize,
2691 &setup, setup_count,
2692 &params, total_parameter_count,
2693 &data, total_data_count);
2694 END_PROFILE_NESTED(NT_transact_ioctl);
2695 break;
2696 case NT_TRANSACT_SET_SECURITY_DESC:
2697 START_PROFILE_NESTED(NT_transact_set_security_desc);
2698 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2699 length, bufsize,
2700 &setup, setup_count,
2701 &params, total_parameter_count,
2702 &data, total_data_count);
2703 END_PROFILE_NESTED(NT_transact_set_security_desc);
2704 break;
2705 case NT_TRANSACT_NOTIFY_CHANGE:
2706 START_PROFILE_NESTED(NT_transact_notify_change);
2707 outsize = call_nt_transact_notify_change(conn, inbuf, outbuf,
2708 length, bufsize,
2709 &setup, setup_count,
2710 &params, total_parameter_count,
2711 &data, total_data_count);
2712 END_PROFILE_NESTED(NT_transact_notify_change);
2713 break;
2714 case NT_TRANSACT_RENAME:
2715 START_PROFILE_NESTED(NT_transact_rename);
2716 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2717 length, bufsize,
2718 &setup, setup_count,
2719 &params, total_parameter_count,
2720 &data, total_data_count);
2721 END_PROFILE_NESTED(NT_transact_rename);
2722 break;
2723
2724 case NT_TRANSACT_QUERY_SECURITY_DESC:
2725 START_PROFILE_NESTED(NT_transact_query_security_desc);
2726 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2727 length, bufsize,
2728 &setup, setup_count,
2729 &params, total_parameter_count,
2730 &data, total_data_count);
2731 END_PROFILE_NESTED(NT_transact_query_security_desc);
2732 break;
2733 #ifdef HAVE_SYS_QUOTAS
2734 case NT_TRANSACT_GET_USER_QUOTA:
2735 START_PROFILE_NESTED(NT_transact_get_user_quota);
2736 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2737 length, bufsize,
2738 &setup, setup_count,
2739 &params, total_parameter_count,
2740 &data, total_data_count);
2741 END_PROFILE_NESTED(NT_transact_get_user_quota);
2742 break;
2743 case NT_TRANSACT_SET_USER_QUOTA:
2744 START_PROFILE_NESTED(NT_transact_set_user_quota);
2745 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2746 length, bufsize,
2747 &setup, setup_count,
2748 &params, total_parameter_count,
2749 &data, total_data_count);
2750 END_PROFILE_NESTED(NT_transact_set_user_quota);
2751 break;
2752 #endif /* HAVE_SYS_QUOTAS */
2753 default:
2754 /* Error in request */
2755 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n", function_code));
2756 SAFE_FREE(setup);
2757 SAFE_FREE(params);
2758 SAFE_FREE(data);
2759 END_PROFILE(SMBnttrans);
2760 srv_signing_trans_stop();
2761 return ERROR_DOS(ERRSRV,ERRerror);
2762 }
2763
2764 /* As we do not know how many data packets will need to be
2765 returned here the various call_nt_transact_xxxx calls
2766 must send their own. Thus a call_nt_transact_xxxx routine only
2767 returns a value other than -1 when it wants to send
2768 an error packet.
2769 */
2770
2771 srv_signing_trans_stop();
2772
2773 SAFE_FREE(setup);
2774 SAFE_FREE(params);
2775 SAFE_FREE(data);
2776 END_PROFILE(SMBnttrans);
2777 return outsize; /* If a correct response was needed the call_nt_transact_xxxx
2778 calls have already sent it. If outsize != -1 then it is
2779 returning an error packet. */
2780
2781 bad_param:
2782
2783 srv_signing_trans_stop();
2784 SAFE_FREE(params);
2785 SAFE_FREE(data);
2786 SAFE_FREE(setup);
2787 END_PROFILE(SMBnttrans);
2788 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2789 }
reg import