?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libcli/smb: add basic session->smb2.channel_sequence handling
[Samba/gebeck_regimport.git] / source3 / smbd / reply.c
blobc043bb6e0639d2677155caaf41c92352be9e43c9
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45
46 /****************************************************************************
47 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
48 path or anything including wildcards.
49 We're assuming here that '/' is not the second byte in any multibyte char
50 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
51 set.
52 ****************************************************************************/
53
54 /* Custom version for processing POSIX paths. */
55 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
56
57 static NTSTATUS check_path_syntax_internal(char *path,
58 bool posix_path,
59 bool *p_last_component_contains_wcard)
60 {
61 char *d = path;
62 const char *s = path;
63 NTSTATUS ret = NT_STATUS_OK;
64 bool start_of_name_component = True;
65 bool stream_started = false;
66
67 *p_last_component_contains_wcard = False;
68
69 while (*s) {
70 if (stream_started) {
71 switch (*s) {
72 case '/':
73 case '\\':
74 return NT_STATUS_OBJECT_NAME_INVALID;
75 case ':':
76 if (s[1] == '\0') {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 if (strchr_m(&s[1], ':')) {
80 return NT_STATUS_OBJECT_NAME_INVALID;
81 }
82 break;
83 }
84 }
85
86 if ((*s == ':') && !posix_path && !stream_started) {
87 if (*p_last_component_contains_wcard) {
88 return NT_STATUS_OBJECT_NAME_INVALID;
89 }
90 /* Stream names allow more characters than file names.
91 We're overloading posix_path here to allow a wider
92 range of characters. If stream_started is true this
93 is still a Windows path even if posix_path is true.
94 JRA.
95 */
96 stream_started = true;
97 start_of_name_component = false;
98 posix_path = true;
99
100 if (s[1] == '\0') {
101 return NT_STATUS_OBJECT_NAME_INVALID;
102 }
103 }
104
105 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
106 /*
107 * Safe to assume is not the second part of a mb char
108 * as this is handled below.
109 */
110 /* Eat multiple '/' or '\\' */
111 while (IS_PATH_SEP(*s,posix_path)) {
112 s++;
113 }
114 if ((d != path) && (*s != '\0')) {
115 /* We only care about non-leading or trailing '/' or '\\' */
116 *d++ = '/';
117 }
118
119 start_of_name_component = True;
120 /* New component. */
121 *p_last_component_contains_wcard = False;
122 continue;
123 }
124
125 if (start_of_name_component) {
126 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
127 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
128
129 /*
130 * No mb char starts with '.' so we're safe checking the directory separator here.
131 */
132
133 /* If we just added a '/' - delete it */
134 if ((d > path) && (*(d-1) == '/')) {
135 *(d-1) = '\0';
136 d--;
137 }
138
139 /* Are we at the start ? Can't go back further if so. */
140 if (d <= path) {
141 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
142 break;
143 }
144 /* Go back one level... */
145 /* We know this is safe as '/' cannot be part of a mb sequence. */
146 /* NOTE - if this assumption is invalid we are not in good shape... */
147 /* Decrement d first as d points to the *next* char to write into. */
148 for (d--; d > path; d--) {
149 if (*d == '/')
150 break;
151 }
152 s += 2; /* Else go past the .. */
153 /* We're still at the start of a name component, just the previous one. */
154 continue;
155
156 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
157 if (posix_path) {
158 /* Eat the '.' */
159 s++;
160 continue;
161 }
162 }
163
164 }
165
166 if (!(*s & 0x80)) {
167 if (!posix_path) {
168 if (*s <= 0x1f || *s == '|') {
169 return NT_STATUS_OBJECT_NAME_INVALID;
170 }
171 switch (*s) {
172 case '*':
173 case '?':
174 case '<':
175 case '>':
176 case '"':
177 *p_last_component_contains_wcard = True;
178 break;
179 default:
180 break;
181 }
182 }
183 *d++ = *s++;
184 } else {
185 size_t siz;
186 /* Get the size of the next MB character. */
187 next_codepoint(s,&siz);
188 switch(siz) {
189 case 5:
190 *d++ = *s++;
191 /*fall through*/
192 case 4:
193 *d++ = *s++;
194 /*fall through*/
195 case 3:
196 *d++ = *s++;
197 /*fall through*/
198 case 2:
199 *d++ = *s++;
200 /*fall through*/
201 case 1:
202 *d++ = *s++;
203 break;
204 default:
205 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
206 *d = '\0';
207 return NT_STATUS_INVALID_PARAMETER;
208 }
209 }
210 start_of_name_component = False;
211 }
212
213 *d = '\0';
214
215 return ret;
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 No wildcards allowed.
221 ****************************************************************************/
222
223 NTSTATUS check_path_syntax(char *path)
224 {
225 bool ignore;
226 return check_path_syntax_internal(path, False, &ignore);
227 }
228
229 /****************************************************************************
230 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
231 Wildcards allowed - p_contains_wcard returns true if the last component contained
232 a wildcard.
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
236 {
237 return check_path_syntax_internal(path, False, p_contains_wcard);
238 }
239
240 /****************************************************************************
241 Check the path for a POSIX client.
242 We're assuming here that '/' is not the second byte in any multibyte char
243 set (a safe assumption).
244 ****************************************************************************/
245
246 NTSTATUS check_path_syntax_posix(char *path)
247 {
248 bool ignore;
249 return check_path_syntax_internal(path, True, &ignore);
250 }
251
252 /****************************************************************************
253 Pull a string and check the path allowing a wilcard - provide for error return.
254 ****************************************************************************/
255
256 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
257 const char *base_ptr,
258 uint16 smb_flags2,
259 char **pp_dest,
260 const char *src,
261 size_t src_len,
262 int flags,
263 NTSTATUS *err,
264 bool *contains_wcard)
265 {
266 size_t ret;
267
268 *pp_dest = NULL;
269
270 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
271 src_len, flags);
272
273 if (!*pp_dest) {
274 *err = NT_STATUS_INVALID_PARAMETER;
275 return ret;
276 }
277
278 *contains_wcard = False;
279
280 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
281 /*
282 * For a DFS path the function parse_dfs_path()
283 * will do the path processing, just make a copy.
284 */
285 *err = NT_STATUS_OK;
286 return ret;
287 }
288
289 if (lp_posix_pathnames()) {
290 *err = check_path_syntax_posix(*pp_dest);
291 } else {
292 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
293 }
294
295 return ret;
296 }
297
298 /****************************************************************************
299 Pull a string and check the path - provide for error return.
300 ****************************************************************************/
301
302 size_t srvstr_get_path(TALLOC_CTX *ctx,
303 const char *base_ptr,
304 uint16 smb_flags2,
305 char **pp_dest,
306 const char *src,
307 size_t src_len,
308 int flags,
309 NTSTATUS *err)
310 {
311 bool ignore;
312 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
313 src_len, flags, err, &ignore);
314 }
315
316 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
317 char **pp_dest, const char *src, int flags,
318 NTSTATUS *err, bool *contains_wcard)
319 {
320 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
321 pp_dest, src, smbreq_bufrem(req, src),
322 flags, err, contains_wcard);
323 }
324
325 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
326 char **pp_dest, const char *src, int flags,
327 NTSTATUS *err)
328 {
329 bool ignore;
330 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
331 flags, err, &ignore);
332 }
333
334 /****************************************************************************
335 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
336 ****************************************************************************/
337
338 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
339 files_struct *fsp)
340 {
341 if ((fsp == NULL) || (conn == NULL)) {
342 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
343 return False;
344 }
345 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
346 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
347 return False;
348 }
349 return True;
350 }
351
352 /****************************************************************************
353 Check if we have a correct fsp pointing to a file.
354 ****************************************************************************/
355
356 bool check_fsp(connection_struct *conn, struct smb_request *req,
357 files_struct *fsp)
358 {
359 if (!check_fsp_open(conn, req, fsp)) {
360 return False;
361 }
362 if (fsp->is_directory) {
363 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
364 return False;
365 }
366 if (fsp->fh->fd == -1) {
367 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
368 return False;
369 }
370 fsp->num_smb_operations++;
371 return True;
372 }
373
374 /****************************************************************************
375 Check if we have a correct fsp pointing to a quota fake file. Replacement for
376 the CHECK_NTQUOTA_HANDLE_OK macro.
377 ****************************************************************************/
378
379 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
380 files_struct *fsp)
381 {
382 if (!check_fsp_open(conn, req, fsp)) {
383 return false;
384 }
385
386 if (fsp->is_directory) {
387 return false;
388 }
389
390 if (fsp->fake_file_handle == NULL) {
391 return false;
392 }
393
394 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
395 return false;
396 }
397
398 if (fsp->fake_file_handle->private_data == NULL) {
399 return false;
400 }
401
402 return true;
403 }
404
405 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
406 const char *name, int name_type)
407 {
408 char *trim_name;
409 char *trim_name_type;
410 const char *retarget_parm;
411 char *retarget;
412 char *p;
413 int retarget_type = 0x20;
414 int retarget_port = NBT_SMB_PORT;
415 struct sockaddr_storage retarget_addr;
416 struct sockaddr_in *in_addr;
417 bool ret = false;
418 uint8_t outbuf[10];
419
420 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
421 return false;
422 }
423
424 trim_name = talloc_strdup(talloc_tos(), name);
425 if (trim_name == NULL) {
426 goto fail;
427 }
428 trim_char(trim_name, ' ', ' ');
429
430 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
431 name_type);
432 if (trim_name_type == NULL) {
433 goto fail;
434 }
435
436 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
437 trim_name_type, NULL);
438 if (retarget_parm == NULL) {
439 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
440 trim_name, NULL);
441 }
442 if (retarget_parm == NULL) {
443 goto fail;
444 }
445
446 retarget = talloc_strdup(trim_name, retarget_parm);
447 if (retarget == NULL) {
448 goto fail;
449 }
450
451 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
452
453 p = strchr(retarget, ':');
454 if (p != NULL) {
455 *p++ = '\0';
456 retarget_port = atoi(p);
457 }
458
459 p = strchr_m(retarget, '#');
460 if (p != NULL) {
461 *p++ = '\0';
462 if (sscanf(p, "%x", &retarget_type) != 1) {
463 goto fail;
464 }
465 }
466
467 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
468 if (!ret) {
469 DEBUG(10, ("could not resolve %s\n", retarget));
470 goto fail;
471 }
472
473 if (retarget_addr.ss_family != AF_INET) {
474 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
475 goto fail;
476 }
477
478 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
479
480 _smb_setlen(outbuf, 6);
481 SCVAL(outbuf, 0, 0x84);
482 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
483 *(uint16_t *)(outbuf+8) = htons(retarget_port);
484
485 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
486 NULL)) {
487 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
488 "failed.");
489 }
490
491 ret = true;
492 fail:
493 TALLOC_FREE(trim_name);
494 return ret;
495 }
496
497 static void reply_called_name_not_present(char *outbuf)
498 {
499 smb_setlen(outbuf, 1);
500 SCVAL(outbuf, 0, 0x83);
501 SCVAL(outbuf, 4, 0x82);
502 }
503
504 /****************************************************************************
505 Reply to a (netbios-level) special message.
506 ****************************************************************************/
507
508 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
509 {
510 int msg_type = CVAL(inbuf,0);
511 int msg_flags = CVAL(inbuf,1);
512 /*
513 * We only really use 4 bytes of the outbuf, but for the smb_setlen
514 * calculation & friends (srv_send_smb uses that) we need the full smb
515 * header.
516 */
517 char outbuf[smb_size];
518
519 memset(outbuf, '\0', sizeof(outbuf));
520
521 smb_setlen(outbuf,0);
522
523 switch (msg_type) {
524 case NBSSrequest: /* session request */
525 {
526 /* inbuf_size is guarenteed to be at least 4. */
527 fstring name1,name2;
528 int name_type1, name_type2;
529 int name_len1, name_len2;
530
531 *name1 = *name2 = 0;
532
533 if (sconn->nbt.got_session) {
534 exit_server_cleanly("multiple session request not permitted");
535 }
536
537 SCVAL(outbuf,0,NBSSpositive);
538 SCVAL(outbuf,3,0);
539
540 /* inbuf_size is guaranteed to be at least 4. */
541 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
542 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
543 DEBUG(0,("Invalid name length in session request\n"));
544 reply_called_name_not_present(outbuf);
545 break;
546 }
547 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
548 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
549 DEBUG(0,("Invalid name length in session request\n"));
550 reply_called_name_not_present(outbuf);
551 break;
552 }
553
554 name_type1 = name_extract((unsigned char *)inbuf,
555 inbuf_size,(unsigned int)4,name1);
556 name_type2 = name_extract((unsigned char *)inbuf,
557 inbuf_size,(unsigned int)(4 + name_len1),name2);
558
559 if (name_type1 == -1 || name_type2 == -1) {
560 DEBUG(0,("Invalid name type in session request\n"));
561 reply_called_name_not_present(outbuf);
562 break;
563 }
564
565 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
566 name1, name_type1, name2, name_type2));
567
568 if (netbios_session_retarget(sconn, name1, name_type1)) {
569 exit_server_cleanly("retargeted client");
570 }
571
572 /*
573 * Windows NT/2k uses "*SMBSERVER" and XP uses
574 * "*SMBSERV" arrggg!!!
575 */
576 if (strequal(name1, "*SMBSERVER ")
577 || strequal(name1, "*SMBSERV ")) {
578 char *raddr;
579
580 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
581 talloc_tos());
582 if (raddr == NULL) {
583 exit_server_cleanly("could not allocate raddr");
584 }
585
586 fstrcpy(name1, raddr);
587 }
588
589 set_local_machine_name(name1, True);
590 set_remote_machine_name(name2, True);
591
592 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
593 get_local_machine_name(), get_remote_machine_name(),
594 name_type2));
595
596 if (name_type2 == 'R') {
597 /* We are being asked for a pathworks session ---
598 no thanks! */
599 reply_called_name_not_present(outbuf);
600 break;
601 }
602
603 reload_services(sconn, conn_snum_used, true);
604 reopen_logs();
605
606 sconn->nbt.got_session = true;
607 break;
608 }
609
610 case 0x89: /* session keepalive request
611 (some old clients produce this?) */
612 SCVAL(outbuf,0,NBSSkeepalive);
613 SCVAL(outbuf,3,0);
614 break;
615
616 case NBSSpositive: /* positive session response */
617 case NBSSnegative: /* negative session response */
618 case NBSSretarget: /* retarget session response */
619 DEBUG(0,("Unexpected session response\n"));
620 break;
621
622 case NBSSkeepalive: /* session keepalive */
623 default:
624 return;
625 }
626
627 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
628 msg_type, msg_flags));
629
630 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
631
632 if (CVAL(outbuf, 0) != 0x82) {
633 exit_server_cleanly("invalid netbios session");
634 }
635 return;
636 }
637
638 /****************************************************************************
639 Reply to a tcon.
640 conn POINTER CAN BE NULL HERE !
641 ****************************************************************************/
642
643 void reply_tcon(struct smb_request *req)
644 {
645 connection_struct *conn = req->conn;
646 const char *service;
647 char *service_buf = NULL;
648 char *password = NULL;
649 char *dev = NULL;
650 int pwlen=0;
651 NTSTATUS nt_status;
652 const char *p;
653 TALLOC_CTX *ctx = talloc_tos();
654 struct smbd_server_connection *sconn = req->sconn;
655
656 START_PROFILE(SMBtcon);
657
658 if (req->buflen < 4) {
659 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
660 END_PROFILE(SMBtcon);
661 return;
662 }
663
664 p = (const char *)req->buf + 1;
665 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
666 p += 1;
667 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
668 p += pwlen+1;
669 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
670 p += 1;
671
672 if (service_buf == NULL || password == NULL || dev == NULL) {
673 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
674 END_PROFILE(SMBtcon);
675 return;
676 }
677 p = strrchr_m(service_buf,'\\');
678 if (p) {
679 service = p+1;
680 } else {
681 service = service_buf;
682 }
683
684 conn = make_connection(sconn,service,dev,
685 req->vuid,&nt_status);
686 req->conn = conn;
687
688 if (!conn) {
689 reply_nterror(req, nt_status);
690 END_PROFILE(SMBtcon);
691 return;
692 }
693
694 reply_outbuf(req, 2, 0);
695 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
696 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
697 SSVAL(req->outbuf,smb_tid,conn->cnum);
698
699 DEBUG(3,("tcon service=%s cnum=%d\n",
700 service, conn->cnum));
701
702 END_PROFILE(SMBtcon);
703 return;
704 }
705
706 /****************************************************************************
707 Reply to a tcon and X.
708 conn POINTER CAN BE NULL HERE !
709 ****************************************************************************/
710
711 void reply_tcon_and_X(struct smb_request *req)
712 {
713 connection_struct *conn = req->conn;
714 const char *service = NULL;
715 TALLOC_CTX *ctx = talloc_tos();
716 /* what the cleint thinks the device is */
717 char *client_devicetype = NULL;
718 /* what the server tells the client the share represents */
719 const char *server_devicetype;
720 NTSTATUS nt_status;
721 int passlen;
722 char *path = NULL;
723 const char *p, *q;
724 uint16 tcon_flags;
725 struct smbd_server_connection *sconn = req->sconn;
726
727 START_PROFILE(SMBtconX);
728
729 if (req->wct < 4) {
730 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
731 END_PROFILE(SMBtconX);
732 return;
733 }
734
735 passlen = SVAL(req->vwv+3, 0);
736 tcon_flags = SVAL(req->vwv+2, 0);
737
738 /* we might have to close an old one */
739 if ((tcon_flags & 0x1) && conn) {
740 struct smbXsrv_tcon *tcon;
741 NTSTATUS status;
742
743 tcon = conn->tcon;
744 req->conn = NULL;
745 conn = NULL;
746
747 /*
748 * TODO: cancel all outstanding requests on the tcon
749 */
750 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
751 if (!NT_STATUS_IS_OK(status)) {
752 DEBUG(0, ("reply_tcon_and_X: "
753 "smbXsrv_tcon_disconnect() failed: %s\n",
754 nt_errstr(status)));
755 /*
756 * If we hit this case, there is something completely
757 * wrong, so we better disconnect the transport connection.
758 */
759 END_PROFILE(SMBtconX);
760 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
761 return;
762 }
763
764 TALLOC_FREE(tcon);
765 }
766
767 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
768 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
769 END_PROFILE(SMBtconX);
770 return;
771 }
772
773 if (sconn->smb1.negprot.encrypted_passwords) {
774 p = (const char *)req->buf + passlen;
775 } else {
776 p = (const char *)req->buf + passlen + 1;
777 }
778
779 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
780
781 if (path == NULL) {
782 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
783 END_PROFILE(SMBtconX);
784 return;
785 }
786
787 /*
788 * the service name can be either: \\server\share
789 * or share directly like on the DELL PowerVault 705
790 */
791 if (*path=='\\') {
792 q = strchr_m(path+2,'\\');
793 if (!q) {
794 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
795 END_PROFILE(SMBtconX);
796 return;
797 }
798 service = q+1;
799 } else {
800 service = path;
801 }
802
803 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
804 &client_devicetype, p,
805 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
806
807 if (client_devicetype == NULL) {
808 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
809 END_PROFILE(SMBtconX);
810 return;
811 }
812
813 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
814
815 conn = make_connection(sconn, service, client_devicetype,
816 req->vuid, &nt_status);
817 req->conn =conn;
818
819 if (!conn) {
820 reply_nterror(req, nt_status);
821 END_PROFILE(SMBtconX);
822 return;
823 }
824
825 if ( IS_IPC(conn) )
826 server_devicetype = "IPC";
827 else if ( IS_PRINT(conn) )
828 server_devicetype = "LPT1:";
829 else
830 server_devicetype = "A:";
831
832 if (get_Protocol() < PROTOCOL_NT1) {
833 reply_outbuf(req, 2, 0);
834 if (message_push_string(&req->outbuf, server_devicetype,
835 STR_TERMINATE|STR_ASCII) == -1) {
836 reply_nterror(req, NT_STATUS_NO_MEMORY);
837 END_PROFILE(SMBtconX);
838 return;
839 }
840 } else {
841 /* NT sets the fstype of IPC$ to the null string */
842 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
843
844 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
845 /* Return permissions. */
846 uint32 perm1 = 0;
847 uint32 perm2 = 0;
848
849 reply_outbuf(req, 7, 0);
850
851 if (IS_IPC(conn)) {
852 perm1 = FILE_ALL_ACCESS;
853 perm2 = FILE_ALL_ACCESS;
854 } else {
855 perm1 = conn->share_access;
856 }
857
858 SIVAL(req->outbuf, smb_vwv3, perm1);
859 SIVAL(req->outbuf, smb_vwv5, perm2);
860 } else {
861 reply_outbuf(req, 3, 0);
862 }
863
864 if ((message_push_string(&req->outbuf, server_devicetype,
865 STR_TERMINATE|STR_ASCII) == -1)
866 || (message_push_string(&req->outbuf, fstype,
867 STR_TERMINATE) == -1)) {
868 reply_nterror(req, NT_STATUS_NO_MEMORY);
869 END_PROFILE(SMBtconX);
870 return;
871 }
872
873 /* what does setting this bit do? It is set by NT4 and
874 may affect the ability to autorun mounted cdroms */
875 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
876 (lp_csc_policy(SNUM(conn)) << 2));
877
878 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
879 DEBUG(2,("Serving %s as a Dfs root\n",
880 lp_servicename(ctx, SNUM(conn)) ));
881 SSVAL(req->outbuf, smb_vwv2,
882 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
883 }
884 }
885
886 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
887 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
888
889 DEBUG(3,("tconX service=%s \n",
890 service));
891
892 /* set the incoming and outgoing tid to the just created one */
893 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
894 SSVAL(req->outbuf,smb_tid,conn->cnum);
895
896 END_PROFILE(SMBtconX);
897
898 req->tid = conn->cnum;
899 }
900
901 /****************************************************************************
902 Reply to an unknown type.
903 ****************************************************************************/
904
905 void reply_unknown_new(struct smb_request *req, uint8 type)
906 {
907 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
908 smb_fn_name(type), type, type));
909 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
910 return;
911 }
912
913 /****************************************************************************
914 Reply to an ioctl.
915 conn POINTER CAN BE NULL HERE !
916 ****************************************************************************/
917
918 void reply_ioctl(struct smb_request *req)
919 {
920 connection_struct *conn = req->conn;
921 uint16 device;
922 uint16 function;
923 uint32 ioctl_code;
924 int replysize;
925 char *p;
926
927 START_PROFILE(SMBioctl);
928
929 if (req->wct < 3) {
930 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
931 END_PROFILE(SMBioctl);
932 return;
933 }
934
935 device = SVAL(req->vwv+1, 0);
936 function = SVAL(req->vwv+2, 0);
937 ioctl_code = (device << 16) + function;
938
939 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
940
941 switch (ioctl_code) {
942 case IOCTL_QUERY_JOB_INFO:
943 replysize = 32;
944 break;
945 default:
946 reply_force_doserror(req, ERRSRV, ERRnosupport);
947 END_PROFILE(SMBioctl);
948 return;
949 }
950
951 reply_outbuf(req, 8, replysize+1);
952 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
953 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
954 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
955 p = smb_buf(req->outbuf);
956 memset(p, '\0', replysize+1); /* valgrind-safe. */
957 p += 1; /* Allow for alignment */
958
959 switch (ioctl_code) {
960 case IOCTL_QUERY_JOB_INFO:
961 {
962 files_struct *fsp = file_fsp(
963 req, SVAL(req->vwv+0, 0));
964 if (!fsp) {
965 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
966 END_PROFILE(SMBioctl);
967 return;
968 }
969 /* Job number */
970 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
971
972 srvstr_push((char *)req->outbuf, req->flags2, p+2,
973 lp_netbios_name(), 15,
974 STR_TERMINATE|STR_ASCII);
975 if (conn) {
976 srvstr_push((char *)req->outbuf, req->flags2,
977 p+18,
978 lp_servicename(talloc_tos(),
979 SNUM(conn)),
980 13, STR_TERMINATE|STR_ASCII);
981 } else {
982 memset(p+18, 0, 13);
983 }
984 break;
985 }
986 }
987
988 END_PROFILE(SMBioctl);
989 return;
990 }
991
992 /****************************************************************************
993 Strange checkpath NTSTATUS mapping.
994 ****************************************************************************/
995
996 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
997 {
998 /* Strange DOS error code semantics only for checkpath... */
999 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1000 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1001 /* We need to map to ERRbadpath */
1002 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1003 }
1004 }
1005 return status;
1006 }
1007
1008 /****************************************************************************
1009 Reply to a checkpath.
1010 ****************************************************************************/
1011
1012 void reply_checkpath(struct smb_request *req)
1013 {
1014 connection_struct *conn = req->conn;
1015 struct smb_filename *smb_fname = NULL;
1016 char *name = NULL;
1017 NTSTATUS status;
1018 TALLOC_CTX *ctx = talloc_tos();
1019
1020 START_PROFILE(SMBcheckpath);
1021
1022 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1023 STR_TERMINATE, &status);
1024
1025 if (!NT_STATUS_IS_OK(status)) {
1026 status = map_checkpath_error(req->flags2, status);
1027 reply_nterror(req, status);
1028 END_PROFILE(SMBcheckpath);
1029 return;
1030 }
1031
1032 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1033
1034 status = filename_convert(ctx,
1035 conn,
1036 req->flags2 & FLAGS2_DFS_PATHNAMES,
1037 name,
1038 0,
1039 NULL,
1040 &smb_fname);
1041
1042 if (!NT_STATUS_IS_OK(status)) {
1043 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1044 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1045 ERRSRV, ERRbadpath);
1046 END_PROFILE(SMBcheckpath);
1047 return;
1048 }
1049 goto path_err;
1050 }
1051
1052 if (!VALID_STAT(smb_fname->st) &&
1053 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1054 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1055 smb_fname_str_dbg(smb_fname), strerror(errno)));
1056 status = map_nt_error_from_unix(errno);
1057 goto path_err;
1058 }
1059
1060 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1061 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1062 ERRDOS, ERRbadpath);
1063 goto out;
1064 }
1065
1066 reply_outbuf(req, 0, 0);
1067
1068 path_err:
1069 /* We special case this - as when a Windows machine
1070 is parsing a path is steps through the components
1071 one at a time - if a component fails it expects
1072 ERRbadpath, not ERRbadfile.
1073 */
1074 status = map_checkpath_error(req->flags2, status);
1075 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1076 /*
1077 * Windows returns different error codes if
1078 * the parent directory is valid but not the
1079 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1080 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1081 * if the path is invalid.
1082 */
1083 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1084 ERRDOS, ERRbadpath);
1085 goto out;
1086 }
1087
1088 reply_nterror(req, status);
1089
1090 out:
1091 TALLOC_FREE(smb_fname);
1092 END_PROFILE(SMBcheckpath);
1093 return;
1094 }
1095
1096 /****************************************************************************
1097 Reply to a getatr.
1098 ****************************************************************************/
1099
1100 void reply_getatr(struct smb_request *req)
1101 {
1102 connection_struct *conn = req->conn;
1103 struct smb_filename *smb_fname = NULL;
1104 char *fname = NULL;
1105 int mode=0;
1106 off_t size=0;
1107 time_t mtime=0;
1108 const char *p;
1109 NTSTATUS status;
1110 TALLOC_CTX *ctx = talloc_tos();
1111 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1112
1113 START_PROFILE(SMBgetatr);
1114
1115 p = (const char *)req->buf + 1;
1116 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 reply_nterror(req, status);
1119 goto out;
1120 }
1121
1122 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1123 under WfWg - weird! */
1124 if (*fname == '\0') {
1125 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1126 if (!CAN_WRITE(conn)) {
1127 mode |= FILE_ATTRIBUTE_READONLY;
1128 }
1129 size = 0;
1130 mtime = 0;
1131 } else {
1132 status = filename_convert(ctx,
1133 conn,
1134 req->flags2 & FLAGS2_DFS_PATHNAMES,
1135 fname,
1136 0,
1137 NULL,
1138 &smb_fname);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1141 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1142 ERRSRV, ERRbadpath);
1143 goto out;
1144 }
1145 reply_nterror(req, status);
1146 goto out;
1147 }
1148 if (!VALID_STAT(smb_fname->st) &&
1149 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1150 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1151 smb_fname_str_dbg(smb_fname),
1152 strerror(errno)));
1153 reply_nterror(req, map_nt_error_from_unix(errno));
1154 goto out;
1155 }
1156
1157 mode = dos_mode(conn, smb_fname);
1158 size = smb_fname->st.st_ex_size;
1159
1160 if (ask_sharemode) {
1161 struct timespec write_time_ts;
1162 struct file_id fileid;
1163
1164 ZERO_STRUCT(write_time_ts);
1165 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1166 get_file_infos(fileid, 0, NULL, &write_time_ts);
1167 if (!null_timespec(write_time_ts)) {
1168 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1169 }
1170 }
1171
1172 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1173 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1174 size = 0;
1175 }
1176 }
1177
1178 reply_outbuf(req, 10, 0);
1179
1180 SSVAL(req->outbuf,smb_vwv0,mode);
1181 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1182 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1183 } else {
1184 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1185 }
1186 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1187
1188 if (get_Protocol() >= PROTOCOL_NT1) {
1189 SSVAL(req->outbuf, smb_flg2,
1190 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1191 }
1192
1193 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1194 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1195
1196 out:
1197 TALLOC_FREE(smb_fname);
1198 TALLOC_FREE(fname);
1199 END_PROFILE(SMBgetatr);
1200 return;
1201 }
1202
1203 /****************************************************************************
1204 Reply to a setatr.
1205 ****************************************************************************/
1206
1207 void reply_setatr(struct smb_request *req)
1208 {
1209 struct smb_file_time ft;
1210 connection_struct *conn = req->conn;
1211 struct smb_filename *smb_fname = NULL;
1212 char *fname = NULL;
1213 int mode;
1214 time_t mtime;
1215 const char *p;
1216 NTSTATUS status;
1217 TALLOC_CTX *ctx = talloc_tos();
1218
1219 START_PROFILE(SMBsetatr);
1220
1221 ZERO_STRUCT(ft);
1222
1223 if (req->wct < 2) {
1224 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1225 goto out;
1226 }
1227
1228 p = (const char *)req->buf + 1;
1229 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1230 if (!NT_STATUS_IS_OK(status)) {
1231 reply_nterror(req, status);
1232 goto out;
1233 }
1234
1235 status = filename_convert(ctx,
1236 conn,
1237 req->flags2 & FLAGS2_DFS_PATHNAMES,
1238 fname,
1239 0,
1240 NULL,
1241 &smb_fname);
1242 if (!NT_STATUS_IS_OK(status)) {
1243 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1244 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1245 ERRSRV, ERRbadpath);
1246 goto out;
1247 }
1248 reply_nterror(req, status);
1249 goto out;
1250 }
1251
1252 if (smb_fname->base_name[0] == '.' &&
1253 smb_fname->base_name[1] == '\0') {
1254 /*
1255 * Not sure here is the right place to catch this
1256 * condition. Might be moved to somewhere else later -- vl
1257 */
1258 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1259 goto out;
1260 }
1261
1262 mode = SVAL(req->vwv+0, 0);
1263 mtime = srv_make_unix_date3(req->vwv+1);
1264
1265 if (mode != FILE_ATTRIBUTE_NORMAL) {
1266 if (VALID_STAT_OF_DIR(smb_fname->st))
1267 mode |= FILE_ATTRIBUTE_DIRECTORY;
1268 else
1269 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1270
1271 status = check_access(conn, NULL, smb_fname,
1272 FILE_WRITE_ATTRIBUTES);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 reply_nterror(req, status);
1275 goto out;
1276 }
1277
1278 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1279 false) != 0) {
1280 reply_nterror(req, map_nt_error_from_unix(errno));
1281 goto out;
1282 }
1283 }
1284
1285 ft.mtime = convert_time_t_to_timespec(mtime);
1286 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1287 if (!NT_STATUS_IS_OK(status)) {
1288 reply_nterror(req, status);
1289 goto out;
1290 }
1291
1292 reply_outbuf(req, 0, 0);
1293
1294 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1295 mode));
1296 out:
1297 TALLOC_FREE(smb_fname);
1298 END_PROFILE(SMBsetatr);
1299 return;
1300 }
1301
1302 /****************************************************************************
1303 Reply to a dskattr.
1304 ****************************************************************************/
1305
1306 void reply_dskattr(struct smb_request *req)
1307 {
1308 connection_struct *conn = req->conn;
1309 uint64_t dfree,dsize,bsize;
1310 START_PROFILE(SMBdskattr);
1311
1312 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1313 reply_nterror(req, map_nt_error_from_unix(errno));
1314 END_PROFILE(SMBdskattr);
1315 return;
1316 }
1317
1318 reply_outbuf(req, 5, 0);
1319
1320 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1321 double total_space, free_space;
1322 /* we need to scale this to a number that DOS6 can handle. We
1323 use floating point so we can handle large drives on systems
1324 that don't have 64 bit integers
1325
1326 we end up displaying a maximum of 2G to DOS systems
1327 */
1328 total_space = dsize * (double)bsize;
1329 free_space = dfree * (double)bsize;
1330
1331 dsize = (uint64_t)((total_space+63*512) / (64*512));
1332 dfree = (uint64_t)((free_space+63*512) / (64*512));
1333
1334 if (dsize > 0xFFFF) dsize = 0xFFFF;
1335 if (dfree > 0xFFFF) dfree = 0xFFFF;
1336
1337 SSVAL(req->outbuf,smb_vwv0,dsize);
1338 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1339 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1340 SSVAL(req->outbuf,smb_vwv3,dfree);
1341 } else {
1342 SSVAL(req->outbuf,smb_vwv0,dsize);
1343 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1344 SSVAL(req->outbuf,smb_vwv2,512);
1345 SSVAL(req->outbuf,smb_vwv3,dfree);
1346 }
1347
1348 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1349
1350 END_PROFILE(SMBdskattr);
1351 return;
1352 }
1353
1354 /*
1355 * Utility function to split the filename from the directory.
1356 */
1357 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1358 char **fname_dir_out,
1359 char **fname_mask_out)
1360 {
1361 const char *p = NULL;
1362 char *fname_dir = NULL;
1363 char *fname_mask = NULL;
1364
1365 p = strrchr_m(fname_in, '/');
1366 if (!p) {
1367 fname_dir = talloc_strdup(ctx, ".");
1368 fname_mask = talloc_strdup(ctx, fname_in);
1369 } else {
1370 fname_dir = talloc_strndup(ctx, fname_in,
1371 PTR_DIFF(p, fname_in));
1372 fname_mask = talloc_strdup(ctx, p+1);
1373 }
1374
1375 if (!fname_dir || !fname_mask) {
1376 TALLOC_FREE(fname_dir);
1377 TALLOC_FREE(fname_mask);
1378 return NT_STATUS_NO_MEMORY;
1379 }
1380
1381 *fname_dir_out = fname_dir;
1382 *fname_mask_out = fname_mask;
1383 return NT_STATUS_OK;
1384 }
1385
1386 /****************************************************************************
1387 Reply to a search.
1388 Can be called from SMBsearch, SMBffirst or SMBfunique.
1389 ****************************************************************************/
1390
1391 void reply_search(struct smb_request *req)
1392 {
1393 connection_struct *conn = req->conn;
1394 char *path = NULL;
1395 const char *mask = NULL;
1396 char *directory = NULL;
1397 struct smb_filename *smb_fname = NULL;
1398 char *fname = NULL;
1399 off_t size;
1400 uint32 mode;
1401 struct timespec date;
1402 uint32 dirtype;
1403 unsigned int numentries = 0;
1404 unsigned int maxentries = 0;
1405 bool finished = False;
1406 const char *p;
1407 int status_len;
1408 char status[21];
1409 int dptr_num= -1;
1410 bool check_descend = False;
1411 bool expect_close = False;
1412 NTSTATUS nt_status;
1413 bool mask_contains_wcard = False;
1414 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1415 TALLOC_CTX *ctx = talloc_tos();
1416 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1417 struct dptr_struct *dirptr = NULL;
1418 struct smbd_server_connection *sconn = req->sconn;
1419
1420 START_PROFILE(SMBsearch);
1421
1422 if (req->wct < 2) {
1423 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1424 goto out;
1425 }
1426
1427 if (lp_posix_pathnames()) {
1428 reply_unknown_new(req, req->cmd);
1429 goto out;
1430 }
1431
1432 /* If we were called as SMBffirst then we must expect close. */
1433 if(req->cmd == SMBffirst) {
1434 expect_close = True;
1435 }
1436
1437 reply_outbuf(req, 1, 3);
1438 maxentries = SVAL(req->vwv+0, 0);
1439 dirtype = SVAL(req->vwv+1, 0);
1440 p = (const char *)req->buf + 1;
1441 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1442 &nt_status, &mask_contains_wcard);
1443 if (!NT_STATUS_IS_OK(nt_status)) {
1444 reply_nterror(req, nt_status);
1445 goto out;
1446 }
1447
1448 p++;
1449 status_len = SVAL(p, 0);
1450 p += 2;
1451
1452 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1453
1454 if (status_len == 0) {
1455 nt_status = filename_convert(ctx, conn,
1456 req->flags2 & FLAGS2_DFS_PATHNAMES,
1457 path,
1458 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1459 &mask_contains_wcard,
1460 &smb_fname);
1461 if (!NT_STATUS_IS_OK(nt_status)) {
1462 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1463 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1464 ERRSRV, ERRbadpath);
1465 goto out;
1466 }
1467 reply_nterror(req, nt_status);
1468 goto out;
1469 }
1470
1471 directory = smb_fname->base_name;
1472
1473 p = strrchr_m(directory,'/');
1474 if ((p != NULL) && (*directory != '/')) {
1475 mask = p + 1;
1476 directory = talloc_strndup(ctx, directory,
1477 PTR_DIFF(p, directory));
1478 } else {
1479 mask = directory;
1480 directory = talloc_strdup(ctx,".");
1481 }
1482
1483 if (!directory) {
1484 reply_nterror(req, NT_STATUS_NO_MEMORY);
1485 goto out;
1486 }
1487
1488 memset((char *)status,'\0',21);
1489 SCVAL(status,0,(dirtype & 0x1F));
1490
1491 nt_status = dptr_create(conn,
1492 NULL, /* req */
1493 NULL, /* fsp */
1494 directory,
1495 True,
1496 expect_close,
1497 req->smbpid,
1498 mask,
1499 mask_contains_wcard,
1500 dirtype,
1501 &dirptr);
1502 if (!NT_STATUS_IS_OK(nt_status)) {
1503 reply_nterror(req, nt_status);
1504 goto out;
1505 }
1506 dptr_num = dptr_dnum(dirptr);
1507 } else {
1508 int status_dirtype;
1509 const char *dirpath;
1510
1511 memcpy(status,p,21);
1512 status_dirtype = CVAL(status,0) & 0x1F;
1513 if (status_dirtype != (dirtype & 0x1F)) {
1514 dirtype = status_dirtype;
1515 }
1516
1517 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1518 if (!dirptr) {
1519 goto SearchEmpty;
1520 }
1521 dirpath = dptr_path(sconn, dptr_num);
1522 directory = talloc_strdup(ctx, dirpath);
1523 if (!directory) {
1524 reply_nterror(req, NT_STATUS_NO_MEMORY);
1525 goto out;
1526 }
1527
1528 mask = dptr_wcard(sconn, dptr_num);
1529 if (!mask) {
1530 goto SearchEmpty;
1531 }
1532 /*
1533 * For a 'continue' search we have no string. So
1534 * check from the initial saved string.
1535 */
1536 mask_contains_wcard = ms_has_wild(mask);
1537 dirtype = dptr_attr(sconn, dptr_num);
1538 }
1539
1540 DEBUG(4,("dptr_num is %d\n",dptr_num));
1541
1542 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1543 dptr_init_search_op(dirptr);
1544
1545 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1546 char buf[DIR_STRUCT_SIZE];
1547 memcpy(buf,status,21);
1548 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1549 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1550 reply_nterror(req, NT_STATUS_NO_MEMORY);
1551 goto out;
1552 }
1553 dptr_fill(sconn, buf+12,dptr_num);
1554 if (dptr_zero(buf+12) && (status_len==0)) {
1555 numentries = 1;
1556 } else {
1557 numentries = 0;
1558 }
1559 if (message_push_blob(&req->outbuf,
1560 data_blob_const(buf, sizeof(buf)))
1561 == -1) {
1562 reply_nterror(req, NT_STATUS_NO_MEMORY);
1563 goto out;
1564 }
1565 } else {
1566 unsigned int i;
1567 maxentries = MIN(
1568 maxentries,
1569 ((BUFFER_SIZE -
1570 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1571 /DIR_STRUCT_SIZE));
1572
1573 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1574 directory,lp_dontdescend(ctx, SNUM(conn))));
1575 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1576 check_descend = True;
1577 }
1578
1579 for (i=numentries;(i<maxentries) && !finished;i++) {
1580 finished = !get_dir_entry(ctx,
1581 dirptr,
1582 mask,
1583 dirtype,
1584 &fname,
1585 &size,
1586 &mode,
1587 &date,
1588 check_descend,
1589 ask_sharemode);
1590 if (!finished) {
1591 char buf[DIR_STRUCT_SIZE];
1592 memcpy(buf,status,21);
1593 if (!make_dir_struct(ctx,
1594 buf,
1595 mask,
1596 fname,
1597 size,
1598 mode,
1599 convert_timespec_to_time_t(date),
1600 !allow_long_path_components)) {
1601 reply_nterror(req, NT_STATUS_NO_MEMORY);
1602 goto out;
1603 }
1604 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1605 break;
1606 }
1607 if (message_push_blob(&req->outbuf,
1608 data_blob_const(buf, sizeof(buf)))
1609 == -1) {
1610 reply_nterror(req, NT_STATUS_NO_MEMORY);
1611 goto out;
1612 }
1613 numentries++;
1614 }
1615 }
1616 }
1617
1618 SearchEmpty:
1619
1620 /* If we were called as SMBffirst with smb_search_id == NULL
1621 and no entries were found then return error and close dirptr
1622 (X/Open spec) */
1623
1624 if (numentries == 0) {
1625 dptr_close(sconn, &dptr_num);
1626 } else if(expect_close && status_len == 0) {
1627 /* Close the dptr - we know it's gone */
1628 dptr_close(sconn, &dptr_num);
1629 }
1630
1631 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1632 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1633 dptr_close(sconn, &dptr_num);
1634 }
1635
1636 if ((numentries == 0) && !mask_contains_wcard) {
1637 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1638 goto out;
1639 }
1640
1641 SSVAL(req->outbuf,smb_vwv0,numentries);
1642 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1643 SCVAL(smb_buf(req->outbuf),0,5);
1644 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1645
1646 /* The replies here are never long name. */
1647 SSVAL(req->outbuf, smb_flg2,
1648 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1649 if (!allow_long_path_components) {
1650 SSVAL(req->outbuf, smb_flg2,
1651 SVAL(req->outbuf, smb_flg2)
1652 & (~FLAGS2_LONG_PATH_COMPONENTS));
1653 }
1654
1655 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1656 SSVAL(req->outbuf, smb_flg2,
1657 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1658
1659 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1660 smb_fn_name(req->cmd),
1661 mask,
1662 directory,
1663 dirtype,
1664 numentries,
1665 maxentries ));
1666 out:
1667 TALLOC_FREE(directory);
1668 TALLOC_FREE(smb_fname);
1669 END_PROFILE(SMBsearch);
1670 return;
1671 }
1672
1673 /****************************************************************************
1674 Reply to a fclose (stop directory search).
1675 ****************************************************************************/
1676
1677 void reply_fclose(struct smb_request *req)
1678 {
1679 int status_len;
1680 char status[21];
1681 int dptr_num= -2;
1682 const char *p;
1683 char *path = NULL;
1684 NTSTATUS err;
1685 bool path_contains_wcard = False;
1686 TALLOC_CTX *ctx = talloc_tos();
1687 struct smbd_server_connection *sconn = req->sconn;
1688
1689 START_PROFILE(SMBfclose);
1690
1691 if (lp_posix_pathnames()) {
1692 reply_unknown_new(req, req->cmd);
1693 END_PROFILE(SMBfclose);
1694 return;
1695 }
1696
1697 p = (const char *)req->buf + 1;
1698 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1699 &err, &path_contains_wcard);
1700 if (!NT_STATUS_IS_OK(err)) {
1701 reply_nterror(req, err);
1702 END_PROFILE(SMBfclose);
1703 return;
1704 }
1705 p++;
1706 status_len = SVAL(p,0);
1707 p += 2;
1708
1709 if (status_len == 0) {
1710 reply_force_doserror(req, ERRSRV, ERRsrverror);
1711 END_PROFILE(SMBfclose);
1712 return;
1713 }
1714
1715 memcpy(status,p,21);
1716
1717 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1718 /* Close the dptr - we know it's gone */
1719 dptr_close(sconn, &dptr_num);
1720 }
1721
1722 reply_outbuf(req, 1, 0);
1723 SSVAL(req->outbuf,smb_vwv0,0);
1724
1725 DEBUG(3,("search close\n"));
1726
1727 END_PROFILE(SMBfclose);
1728 return;
1729 }
1730
1731 /****************************************************************************
1732 Reply to an open.
1733 ****************************************************************************/
1734
1735 void reply_open(struct smb_request *req)
1736 {
1737 connection_struct *conn = req->conn;
1738 struct smb_filename *smb_fname = NULL;
1739 char *fname = NULL;
1740 uint32 fattr=0;
1741 off_t size = 0;
1742 time_t mtime=0;
1743 int info;
1744 files_struct *fsp;
1745 int oplock_request;
1746 int deny_mode;
1747 uint32 dos_attr;
1748 uint32 access_mask;
1749 uint32 share_mode;
1750 uint32 create_disposition;
1751 uint32 create_options = 0;
1752 uint32_t private_flags = 0;
1753 NTSTATUS status;
1754 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1755 TALLOC_CTX *ctx = talloc_tos();
1756
1757 START_PROFILE(SMBopen);
1758
1759 if (req->wct < 2) {
1760 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1761 goto out;
1762 }
1763
1764 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1765 deny_mode = SVAL(req->vwv+0, 0);
1766 dos_attr = SVAL(req->vwv+1, 0);
1767
1768 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1769 STR_TERMINATE, &status);
1770 if (!NT_STATUS_IS_OK(status)) {
1771 reply_nterror(req, status);
1772 goto out;
1773 }
1774
1775 status = filename_convert(ctx,
1776 conn,
1777 req->flags2 & FLAGS2_DFS_PATHNAMES,
1778 fname,
1779 0,
1780 NULL,
1781 &smb_fname);
1782 if (!NT_STATUS_IS_OK(status)) {
1783 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1784 reply_botherror(req,
1785 NT_STATUS_PATH_NOT_COVERED,
1786 ERRSRV, ERRbadpath);
1787 goto out;
1788 }
1789 reply_nterror(req, status);
1790 goto out;
1791 }
1792
1793 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1794 OPENX_FILE_EXISTS_OPEN, &access_mask,
1795 &share_mode, &create_disposition,
1796 &create_options, &private_flags)) {
1797 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1798 goto out;
1799 }
1800
1801 status = SMB_VFS_CREATE_FILE(
1802 conn, /* conn */
1803 req, /* req */
1804 0, /* root_dir_fid */
1805 smb_fname, /* fname */
1806 access_mask, /* access_mask */
1807 share_mode, /* share_access */
1808 create_disposition, /* create_disposition*/
1809 create_options, /* create_options */
1810 dos_attr, /* file_attributes */
1811 oplock_request, /* oplock_request */
1812 0, /* allocation_size */
1813 private_flags,
1814 NULL, /* sd */
1815 NULL, /* ea_list */
1816 &fsp, /* result */
1817 &info); /* pinfo */
1818
1819 if (!NT_STATUS_IS_OK(status)) {
1820 if (open_was_deferred(req->sconn, req->mid)) {
1821 /* We have re-scheduled this call. */
1822 goto out;
1823 }
1824 reply_openerror(req, status);
1825 goto out;
1826 }
1827
1828 size = smb_fname->st.st_ex_size;
1829 fattr = dos_mode(conn, smb_fname);
1830
1831 /* Deal with other possible opens having a modified
1832 write time. JRA. */
1833 if (ask_sharemode) {
1834 struct timespec write_time_ts;
1835
1836 ZERO_STRUCT(write_time_ts);
1837 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1838 if (!null_timespec(write_time_ts)) {
1839 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1840 }
1841 }
1842
1843 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1844
1845 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1846 DEBUG(3,("attempt to open a directory %s\n",
1847 fsp_str_dbg(fsp)));
1848 close_file(req, fsp, ERROR_CLOSE);
1849 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1850 ERRDOS, ERRnoaccess);
1851 goto out;
1852 }
1853
1854 reply_outbuf(req, 7, 0);
1855 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1856 SSVAL(req->outbuf,smb_vwv1,fattr);
1857 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1858 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1859 } else {
1860 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1861 }
1862 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1863 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1864
1865 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1866 SCVAL(req->outbuf,smb_flg,
1867 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1868 }
1869
1870 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1871 SCVAL(req->outbuf,smb_flg,
1872 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1873 }
1874 out:
1875 TALLOC_FREE(smb_fname);
1876 END_PROFILE(SMBopen);
1877 return;
1878 }
1879
1880 /****************************************************************************
1881 Reply to an open and X.
1882 ****************************************************************************/
1883
1884 void reply_open_and_X(struct smb_request *req)
1885 {
1886 connection_struct *conn = req->conn;
1887 struct smb_filename *smb_fname = NULL;
1888 char *fname = NULL;
1889 uint16 open_flags;
1890 int deny_mode;
1891 uint32 smb_attr;
1892 /* Breakout the oplock request bits so we can set the
1893 reply bits separately. */
1894 int ex_oplock_request;
1895 int core_oplock_request;
1896 int oplock_request;
1897 #if 0
1898 int smb_sattr = SVAL(req->vwv+4, 0);
1899 uint32 smb_time = make_unix_date3(req->vwv+6);
1900 #endif
1901 int smb_ofun;
1902 uint32 fattr=0;
1903 int mtime=0;
1904 int smb_action = 0;
1905 files_struct *fsp;
1906 NTSTATUS status;
1907 uint64_t allocation_size;
1908 ssize_t retval = -1;
1909 uint32 access_mask;
1910 uint32 share_mode;
1911 uint32 create_disposition;
1912 uint32 create_options = 0;
1913 uint32_t private_flags = 0;
1914 TALLOC_CTX *ctx = talloc_tos();
1915
1916 START_PROFILE(SMBopenX);
1917
1918 if (req->wct < 15) {
1919 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1920 goto out;
1921 }
1922
1923 open_flags = SVAL(req->vwv+2, 0);
1924 deny_mode = SVAL(req->vwv+3, 0);
1925 smb_attr = SVAL(req->vwv+5, 0);
1926 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1927 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1928 oplock_request = ex_oplock_request | core_oplock_request;
1929 smb_ofun = SVAL(req->vwv+8, 0);
1930 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1931
1932 /* If it's an IPC, pass off the pipe handler. */
1933 if (IS_IPC(conn)) {
1934 if (lp_nt_pipe_support()) {
1935 reply_open_pipe_and_X(conn, req);
1936 } else {
1937 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1938 }
1939 goto out;
1940 }
1941
1942 /* XXXX we need to handle passed times, sattr and flags */
1943 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1944 STR_TERMINATE, &status);
1945 if (!NT_STATUS_IS_OK(status)) {
1946 reply_nterror(req, status);
1947 goto out;
1948 }
1949
1950 status = filename_convert(ctx,
1951 conn,
1952 req->flags2 & FLAGS2_DFS_PATHNAMES,
1953 fname,
1954 0,
1955 NULL,
1956 &smb_fname);
1957 if (!NT_STATUS_IS_OK(status)) {
1958 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1959 reply_botherror(req,
1960 NT_STATUS_PATH_NOT_COVERED,
1961 ERRSRV, ERRbadpath);
1962 goto out;
1963 }
1964 reply_nterror(req, status);
1965 goto out;
1966 }
1967
1968 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1969 smb_ofun,
1970 &access_mask, &share_mode,
1971 &create_disposition,
1972 &create_options,
1973 &private_flags)) {
1974 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1975 goto out;
1976 }
1977
1978 status = SMB_VFS_CREATE_FILE(
1979 conn, /* conn */
1980 req, /* req */
1981 0, /* root_dir_fid */
1982 smb_fname, /* fname */
1983 access_mask, /* access_mask */
1984 share_mode, /* share_access */
1985 create_disposition, /* create_disposition*/
1986 create_options, /* create_options */
1987 smb_attr, /* file_attributes */
1988 oplock_request, /* oplock_request */
1989 0, /* allocation_size */
1990 private_flags,
1991 NULL, /* sd */
1992 NULL, /* ea_list */
1993 &fsp, /* result */
1994 &smb_action); /* pinfo */
1995
1996 if (!NT_STATUS_IS_OK(status)) {
1997 if (open_was_deferred(req->sconn, req->mid)) {
1998 /* We have re-scheduled this call. */
1999 goto out;
2000 }
2001 reply_openerror(req, status);
2002 goto out;
2003 }
2004
2005 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2006 if the file is truncated or created. */
2007 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2008 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2009 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2010 close_file(req, fsp, ERROR_CLOSE);
2011 reply_nterror(req, NT_STATUS_DISK_FULL);
2012 goto out;
2013 }
2014 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2015 if (retval < 0) {
2016 close_file(req, fsp, ERROR_CLOSE);
2017 reply_nterror(req, NT_STATUS_DISK_FULL);
2018 goto out;
2019 }
2020 status = vfs_stat_fsp(fsp);
2021 if (!NT_STATUS_IS_OK(status)) {
2022 close_file(req, fsp, ERROR_CLOSE);
2023 reply_nterror(req, status);
2024 goto out;
2025 }
2026 }
2027
2028 fattr = dos_mode(conn, fsp->fsp_name);
2029 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2030 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2031 close_file(req, fsp, ERROR_CLOSE);
2032 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2033 goto out;
2034 }
2035
2036 /* If the caller set the extended oplock request bit
2037 and we granted one (by whatever means) - set the
2038 correct bit for extended oplock reply.
2039 */
2040
2041 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2042 smb_action |= EXTENDED_OPLOCK_GRANTED;
2043 }
2044
2045 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2046 smb_action |= EXTENDED_OPLOCK_GRANTED;
2047 }
2048
2049 /* If the caller set the core oplock request bit
2050 and we granted one (by whatever means) - set the
2051 correct bit for core oplock reply.
2052 */
2053
2054 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2055 reply_outbuf(req, 19, 0);
2056 } else {
2057 reply_outbuf(req, 15, 0);
2058 }
2059
2060 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2061 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2062
2063 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2064 SCVAL(req->outbuf, smb_flg,
2065 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2066 }
2067
2068 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2069 SCVAL(req->outbuf, smb_flg,
2070 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2071 }
2072
2073 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2074 SSVAL(req->outbuf,smb_vwv3,fattr);
2075 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2076 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2077 } else {
2078 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2079 }
2080 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2081 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2082 SSVAL(req->outbuf,smb_vwv11,smb_action);
2083
2084 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2085 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2086 }
2087
2088 out:
2089 TALLOC_FREE(smb_fname);
2090 END_PROFILE(SMBopenX);
2091 return;
2092 }
2093
2094 /****************************************************************************
2095 Reply to a SMBulogoffX.
2096 ****************************************************************************/
2097
2098 void reply_ulogoffX(struct smb_request *req)
2099 {
2100 struct smbd_server_connection *sconn = req->sconn;
2101 struct user_struct *vuser;
2102 struct smbXsrv_session *session = NULL;
2103 NTSTATUS status;
2104
2105 START_PROFILE(SMBulogoffX);
2106
2107 vuser = get_valid_user_struct(sconn, req->vuid);
2108
2109 if(vuser == NULL) {
2110 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2111 (unsigned long long)req->vuid));
2112
2113 req->vuid = UID_FIELD_INVALID;
2114 reply_force_doserror(req, ERRSRV, ERRbaduid);
2115 END_PROFILE(SMBulogoffX);
2116 return;
2117 }
2118
2119 session = vuser->session;
2120 vuser = NULL;
2121
2122 /*
2123 * TODO: cancel all outstanding requests on the session
2124 */
2125 status = smbXsrv_session_logoff(session);
2126 if (!NT_STATUS_IS_OK(status)) {
2127 DEBUG(0, ("reply_ulogoff: "
2128 "smbXsrv_session_logoff() failed: %s\n",
2129 nt_errstr(status)));
2130 /*
2131 * If we hit this case, there is something completely
2132 * wrong, so we better disconnect the transport connection.
2133 */
2134 END_PROFILE(SMBulogoffX);
2135 exit_server(__location__ ": smbXsrv_session_logoff failed");
2136 return;
2137 }
2138
2139 TALLOC_FREE(session);
2140
2141 reply_outbuf(req, 2, 0);
2142 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2143 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2144
2145 DEBUG(3, ("ulogoffX vuid=%llu\n",
2146 (unsigned long long)req->vuid));
2147
2148 END_PROFILE(SMBulogoffX);
2149 req->vuid = UID_FIELD_INVALID;
2150 }
2151
2152 /****************************************************************************
2153 Reply to a mknew or a create.
2154 ****************************************************************************/
2155
2156 void reply_mknew(struct smb_request *req)
2157 {
2158 connection_struct *conn = req->conn;
2159 struct smb_filename *smb_fname = NULL;
2160 char *fname = NULL;
2161 uint32 fattr = 0;
2162 struct smb_file_time ft;
2163 files_struct *fsp;
2164 int oplock_request = 0;
2165 NTSTATUS status;
2166 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2167 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2168 uint32 create_disposition;
2169 uint32 create_options = 0;
2170 TALLOC_CTX *ctx = talloc_tos();
2171
2172 START_PROFILE(SMBcreate);
2173 ZERO_STRUCT(ft);
2174
2175 if (req->wct < 3) {
2176 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2177 goto out;
2178 }
2179
2180 fattr = SVAL(req->vwv+0, 0);
2181 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2182
2183 /* mtime. */
2184 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2185
2186 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2187 STR_TERMINATE, &status);
2188 if (!NT_STATUS_IS_OK(status)) {
2189 reply_nterror(req, status);
2190 goto out;
2191 }
2192
2193 status = filename_convert(ctx,
2194 conn,
2195 req->flags2 & FLAGS2_DFS_PATHNAMES,
2196 fname,
2197 0,
2198 NULL,
2199 &smb_fname);
2200 if (!NT_STATUS_IS_OK(status)) {
2201 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2202 reply_botherror(req,
2203 NT_STATUS_PATH_NOT_COVERED,
2204 ERRSRV, ERRbadpath);
2205 goto out;
2206 }
2207 reply_nterror(req, status);
2208 goto out;
2209 }
2210
2211 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2212 DEBUG(0,("Attempt to create file (%s) with volid set - "
2213 "please report this\n",
2214 smb_fname_str_dbg(smb_fname)));
2215 }
2216
2217 if(req->cmd == SMBmknew) {
2218 /* We should fail if file exists. */
2219 create_disposition = FILE_CREATE;
2220 } else {
2221 /* Create if file doesn't exist, truncate if it does. */
2222 create_disposition = FILE_OVERWRITE_IF;
2223 }
2224
2225 status = SMB_VFS_CREATE_FILE(
2226 conn, /* conn */
2227 req, /* req */
2228 0, /* root_dir_fid */
2229 smb_fname, /* fname */
2230 access_mask, /* access_mask */
2231 share_mode, /* share_access */
2232 create_disposition, /* create_disposition*/
2233 create_options, /* create_options */
2234 fattr, /* file_attributes */
2235 oplock_request, /* oplock_request */
2236 0, /* allocation_size */
2237 0, /* private_flags */
2238 NULL, /* sd */
2239 NULL, /* ea_list */
2240 &fsp, /* result */
2241 NULL); /* pinfo */
2242
2243 if (!NT_STATUS_IS_OK(status)) {
2244 if (open_was_deferred(req->sconn, req->mid)) {
2245 /* We have re-scheduled this call. */
2246 goto out;
2247 }
2248 reply_openerror(req, status);
2249 goto out;
2250 }
2251
2252 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2253 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2254 if (!NT_STATUS_IS_OK(status)) {
2255 END_PROFILE(SMBcreate);
2256 goto out;
2257 }
2258
2259 reply_outbuf(req, 1, 0);
2260 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2261
2262 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2263 SCVAL(req->outbuf,smb_flg,
2264 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2265 }
2266
2267 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2268 SCVAL(req->outbuf,smb_flg,
2269 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2270 }
2271
2272 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2273 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2274 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2275 (unsigned int)fattr));
2276
2277 out:
2278 TALLOC_FREE(smb_fname);
2279 END_PROFILE(SMBcreate);
2280 return;
2281 }
2282
2283 /****************************************************************************
2284 Reply to a create temporary file.
2285 ****************************************************************************/
2286
2287 void reply_ctemp(struct smb_request *req)
2288 {
2289 connection_struct *conn = req->conn;
2290 struct smb_filename *smb_fname = NULL;
2291 char *fname = NULL;
2292 uint32 fattr;
2293 files_struct *fsp;
2294 int oplock_request;
2295 int tmpfd;
2296 char *s;
2297 NTSTATUS status;
2298 TALLOC_CTX *ctx = talloc_tos();
2299
2300 START_PROFILE(SMBctemp);
2301
2302 if (req->wct < 3) {
2303 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2304 goto out;
2305 }
2306
2307 fattr = SVAL(req->vwv+0, 0);
2308 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2309
2310 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2311 STR_TERMINATE, &status);
2312 if (!NT_STATUS_IS_OK(status)) {
2313 reply_nterror(req, status);
2314 goto out;
2315 }
2316 if (*fname) {
2317 fname = talloc_asprintf(ctx,
2318 "%s/TMXXXXXX",
2319 fname);
2320 } else {
2321 fname = talloc_strdup(ctx, "TMXXXXXX");
2322 }
2323
2324 if (!fname) {
2325 reply_nterror(req, NT_STATUS_NO_MEMORY);
2326 goto out;
2327 }
2328
2329 status = filename_convert(ctx, conn,
2330 req->flags2 & FLAGS2_DFS_PATHNAMES,
2331 fname,
2332 0,
2333 NULL,
2334 &smb_fname);
2335 if (!NT_STATUS_IS_OK(status)) {
2336 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2337 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2338 ERRSRV, ERRbadpath);
2339 goto out;
2340 }
2341 reply_nterror(req, status);
2342 goto out;
2343 }
2344
2345 tmpfd = mkstemp(smb_fname->base_name);
2346 if (tmpfd == -1) {
2347 reply_nterror(req, map_nt_error_from_unix(errno));
2348 goto out;
2349 }
2350
2351 SMB_VFS_STAT(conn, smb_fname);
2352
2353 /* We should fail if file does not exist. */
2354 status = SMB_VFS_CREATE_FILE(
2355 conn, /* conn */
2356 req, /* req */
2357 0, /* root_dir_fid */
2358 smb_fname, /* fname */
2359 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2360 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2361 FILE_OPEN, /* create_disposition*/
2362 0, /* create_options */
2363 fattr, /* file_attributes */
2364 oplock_request, /* oplock_request */
2365 0, /* allocation_size */
2366 0, /* private_flags */
2367 NULL, /* sd */
2368 NULL, /* ea_list */
2369 &fsp, /* result */
2370 NULL); /* pinfo */
2371
2372 /* close fd from mkstemp() */
2373 close(tmpfd);
2374
2375 if (!NT_STATUS_IS_OK(status)) {
2376 if (open_was_deferred(req->sconn, req->mid)) {
2377 /* We have re-scheduled this call. */
2378 goto out;
2379 }
2380 reply_openerror(req, status);
2381 goto out;
2382 }
2383
2384 reply_outbuf(req, 1, 0);
2385 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2386
2387 /* the returned filename is relative to the directory */
2388 s = strrchr_m(fsp->fsp_name->base_name, '/');
2389 if (!s) {
2390 s = fsp->fsp_name->base_name;
2391 } else {
2392 s++;
2393 }
2394
2395 #if 0
2396 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2397 thing in the byte section. JRA */
2398 SSVALS(p, 0, -1); /* what is this? not in spec */
2399 #endif
2400 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2401 == -1) {
2402 reply_nterror(req, NT_STATUS_NO_MEMORY);
2403 goto out;
2404 }
2405
2406 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2407 SCVAL(req->outbuf, smb_flg,
2408 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2409 }
2410
2411 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2412 SCVAL(req->outbuf, smb_flg,
2413 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2414 }
2415
2416 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2417 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2418 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2419 out:
2420 TALLOC_FREE(smb_fname);
2421 END_PROFILE(SMBctemp);
2422 return;
2423 }
2424
2425 /*******************************************************************
2426 Check if a user is allowed to rename a file.
2427 ********************************************************************/
2428
2429 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2430 uint16 dirtype)
2431 {
2432 if (!CAN_WRITE(conn)) {
2433 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2434 }
2435
2436 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2437 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2438 /* Only bother to read the DOS attribute if we might deny the
2439 rename on the grounds of attribute missmatch. */
2440 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2441 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2442 return NT_STATUS_NO_SUCH_FILE;
2443 }
2444 }
2445
2446 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2447 if (fsp->posix_open) {
2448 return NT_STATUS_OK;
2449 }
2450
2451 /* If no pathnames are open below this
2452 directory, allow the rename. */
2453
2454 if (file_find_subpath(fsp)) {
2455 return NT_STATUS_ACCESS_DENIED;
2456 }
2457 return NT_STATUS_OK;
2458 }
2459
2460 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2461 return NT_STATUS_OK;
2462 }
2463
2464 return NT_STATUS_ACCESS_DENIED;
2465 }
2466
2467 /*******************************************************************
2468 * unlink a file with all relevant access checks
2469 *******************************************************************/
2470
2471 static NTSTATUS do_unlink(connection_struct *conn,
2472 struct smb_request *req,
2473 struct smb_filename *smb_fname,
2474 uint32 dirtype)
2475 {
2476 uint32 fattr;
2477 files_struct *fsp;
2478 uint32 dirtype_orig = dirtype;
2479 NTSTATUS status;
2480 int ret;
2481 bool posix_paths = lp_posix_pathnames();
2482
2483 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2484 smb_fname_str_dbg(smb_fname),
2485 dirtype));
2486
2487 if (!CAN_WRITE(conn)) {
2488 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2489 }
2490
2491 if (posix_paths) {
2492 ret = SMB_VFS_LSTAT(conn, smb_fname);
2493 } else {
2494 ret = SMB_VFS_STAT(conn, smb_fname);
2495 }
2496 if (ret != 0) {
2497 return map_nt_error_from_unix(errno);
2498 }
2499
2500 fattr = dos_mode(conn, smb_fname);
2501
2502 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2503 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2504 }
2505
2506 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2507 if (!dirtype) {
2508 return NT_STATUS_NO_SUCH_FILE;
2509 }
2510
2511 if (!dir_check_ftype(conn, fattr, dirtype)) {
2512 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2513 return NT_STATUS_FILE_IS_A_DIRECTORY;
2514 }
2515 return NT_STATUS_NO_SUCH_FILE;
2516 }
2517
2518 if (dirtype_orig & 0x8000) {
2519 /* These will never be set for POSIX. */
2520 return NT_STATUS_NO_SUCH_FILE;
2521 }
2522
2523 #if 0
2524 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2525 return NT_STATUS_FILE_IS_A_DIRECTORY;
2526 }
2527
2528 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2529 return NT_STATUS_NO_SUCH_FILE;
2530 }
2531
2532 if (dirtype & 0xFF00) {
2533 /* These will never be set for POSIX. */
2534 return NT_STATUS_NO_SUCH_FILE;
2535 }
2536
2537 dirtype &= 0xFF;
2538 if (!dirtype) {
2539 return NT_STATUS_NO_SUCH_FILE;
2540 }
2541
2542 /* Can't delete a directory. */
2543 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2544 return NT_STATUS_FILE_IS_A_DIRECTORY;
2545 }
2546 #endif
2547
2548 #if 0 /* JRATEST */
2549 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2550 return NT_STATUS_OBJECT_NAME_INVALID;
2551 #endif /* JRATEST */
2552
2553 /* On open checks the open itself will check the share mode, so
2554 don't do it here as we'll get it wrong. */
2555
2556 status = SMB_VFS_CREATE_FILE
2557 (conn, /* conn */
2558 req, /* req */
2559 0, /* root_dir_fid */
2560 smb_fname, /* fname */
2561 DELETE_ACCESS, /* access_mask */
2562 FILE_SHARE_NONE, /* share_access */
2563 FILE_OPEN, /* create_disposition*/
2564 FILE_NON_DIRECTORY_FILE, /* create_options */
2565 /* file_attributes */
2566 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2567 FILE_ATTRIBUTE_NORMAL,
2568 0, /* oplock_request */
2569 0, /* allocation_size */
2570 0, /* private_flags */
2571 NULL, /* sd */
2572 NULL, /* ea_list */
2573 &fsp, /* result */
2574 NULL); /* pinfo */
2575
2576 if (!NT_STATUS_IS_OK(status)) {
2577 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2578 nt_errstr(status)));
2579 return status;
2580 }
2581
2582 status = can_set_delete_on_close(fsp, fattr);
2583 if (!NT_STATUS_IS_OK(status)) {
2584 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2585 "(%s)\n",
2586 smb_fname_str_dbg(smb_fname),
2587 nt_errstr(status)));
2588 close_file(req, fsp, NORMAL_CLOSE);
2589 return status;
2590 }
2591
2592 /* The set is across all open files on this dev/inode pair. */
2593 if (!set_delete_on_close(fsp, True,
2594 conn->session_info->security_token,
2595 conn->session_info->unix_token)) {
2596 close_file(req, fsp, NORMAL_CLOSE);
2597 return NT_STATUS_ACCESS_DENIED;
2598 }
2599
2600 return close_file(req, fsp, NORMAL_CLOSE);
2601 }
2602
2603 /****************************************************************************
2604 The guts of the unlink command, split out so it may be called by the NT SMB
2605 code.
2606 ****************************************************************************/
2607
2608 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2609 uint32 dirtype, struct smb_filename *smb_fname,
2610 bool has_wild)
2611 {
2612 char *fname_dir = NULL;
2613 char *fname_mask = NULL;
2614 int count=0;
2615 NTSTATUS status = NT_STATUS_OK;
2616 TALLOC_CTX *ctx = talloc_tos();
2617
2618 /* Split up the directory from the filename/mask. */
2619 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2620 &fname_dir, &fname_mask);
2621 if (!NT_STATUS_IS_OK(status)) {
2622 goto out;
2623 }
2624
2625 /*
2626 * We should only check the mangled cache
2627 * here if unix_convert failed. This means
2628 * that the path in 'mask' doesn't exist
2629 * on the file system and so we need to look
2630 * for a possible mangle. This patch from
2631 * Tine Smukavec <valentin.smukavec@hermes.si>.
2632 */
2633
2634 if (!VALID_STAT(smb_fname->st) &&
2635 mangle_is_mangled(fname_mask, conn->params)) {
2636 char *new_mask = NULL;
2637 mangle_lookup_name_from_8_3(ctx, fname_mask,
2638 &new_mask, conn->params);
2639 if (new_mask) {
2640 TALLOC_FREE(fname_mask);
2641 fname_mask = new_mask;
2642 }
2643 }
2644
2645 if (!has_wild) {
2646
2647 /*
2648 * Only one file needs to be unlinked. Append the mask back
2649 * onto the directory.
2650 */
2651 TALLOC_FREE(smb_fname->base_name);
2652 if (ISDOT(fname_dir)) {
2653 /* Ensure we use canonical names on open. */
2654 smb_fname->base_name = talloc_asprintf(smb_fname,
2655 "%s",
2656 fname_mask);
2657 } else {
2658 smb_fname->base_name = talloc_asprintf(smb_fname,
2659 "%s/%s",
2660 fname_dir,
2661 fname_mask);
2662 }
2663 if (!smb_fname->base_name) {
2664 status = NT_STATUS_NO_MEMORY;
2665 goto out;
2666 }
2667 if (dirtype == 0) {
2668 dirtype = FILE_ATTRIBUTE_NORMAL;
2669 }
2670
2671 status = check_name(conn, smb_fname->base_name);
2672 if (!NT_STATUS_IS_OK(status)) {
2673 goto out;
2674 }
2675
2676 status = do_unlink(conn, req, smb_fname, dirtype);
2677 if (!NT_STATUS_IS_OK(status)) {
2678 goto out;
2679 }
2680
2681 count++;
2682 } else {
2683 struct smb_Dir *dir_hnd = NULL;
2684 long offset = 0;
2685 const char *dname = NULL;
2686 char *talloced = NULL;
2687
2688 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2689 status = NT_STATUS_OBJECT_NAME_INVALID;
2690 goto out;
2691 }
2692
2693 if (strequal(fname_mask,"????????.???")) {
2694 TALLOC_FREE(fname_mask);
2695 fname_mask = talloc_strdup(ctx, "*");
2696 if (!fname_mask) {
2697 status = NT_STATUS_NO_MEMORY;
2698 goto out;
2699 }
2700 }
2701
2702 status = check_name(conn, fname_dir);
2703 if (!NT_STATUS_IS_OK(status)) {
2704 goto out;
2705 }
2706
2707 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2708 dirtype);
2709 if (dir_hnd == NULL) {
2710 status = map_nt_error_from_unix(errno);
2711 goto out;
2712 }
2713
2714 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2715 the pattern matches against the long name, otherwise the short name
2716 We don't implement this yet XXXX
2717 */
2718
2719 status = NT_STATUS_NO_SUCH_FILE;
2720
2721 while ((dname = ReadDirName(dir_hnd, &offset,
2722 &smb_fname->st, &talloced))) {
2723 TALLOC_CTX *frame = talloc_stackframe();
2724
2725 if (!is_visible_file(conn, fname_dir, dname,
2726 &smb_fname->st, true)) {
2727 TALLOC_FREE(frame);
2728 TALLOC_FREE(talloced);
2729 continue;
2730 }
2731
2732 /* Quick check for "." and ".." */
2733 if (ISDOT(dname) || ISDOTDOT(dname)) {
2734 TALLOC_FREE(frame);
2735 TALLOC_FREE(talloced);
2736 continue;
2737 }
2738
2739 if(!mask_match(dname, fname_mask,
2740 conn->case_sensitive)) {
2741 TALLOC_FREE(frame);
2742 TALLOC_FREE(talloced);
2743 continue;
2744 }
2745
2746 TALLOC_FREE(smb_fname->base_name);
2747 if (ISDOT(fname_dir)) {
2748 /* Ensure we use canonical names on open. */
2749 smb_fname->base_name =
2750 talloc_asprintf(smb_fname, "%s",
2751 dname);
2752 } else {
2753 smb_fname->base_name =
2754 talloc_asprintf(smb_fname, "%s/%s",
2755 fname_dir, dname);
2756 }
2757
2758 if (!smb_fname->base_name) {
2759 TALLOC_FREE(dir_hnd);
2760 status = NT_STATUS_NO_MEMORY;
2761 TALLOC_FREE(frame);
2762 TALLOC_FREE(talloced);
2763 goto out;
2764 }
2765
2766 status = check_name(conn, smb_fname->base_name);
2767 if (!NT_STATUS_IS_OK(status)) {
2768 TALLOC_FREE(dir_hnd);
2769 TALLOC_FREE(frame);
2770 TALLOC_FREE(talloced);
2771 goto out;
2772 }
2773
2774 status = do_unlink(conn, req, smb_fname, dirtype);
2775 if (!NT_STATUS_IS_OK(status)) {
2776 TALLOC_FREE(frame);
2777 TALLOC_FREE(talloced);
2778 continue;
2779 }
2780
2781 count++;
2782 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2783 smb_fname->base_name));
2784
2785 TALLOC_FREE(frame);
2786 TALLOC_FREE(talloced);
2787 }
2788 TALLOC_FREE(dir_hnd);
2789 }
2790
2791 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2792 status = map_nt_error_from_unix(errno);
2793 }
2794
2795 out:
2796 TALLOC_FREE(fname_dir);
2797 TALLOC_FREE(fname_mask);
2798 return status;
2799 }
2800
2801 /****************************************************************************
2802 Reply to a unlink
2803 ****************************************************************************/
2804
2805 void reply_unlink(struct smb_request *req)
2806 {
2807 connection_struct *conn = req->conn;
2808 char *name = NULL;
2809 struct smb_filename *smb_fname = NULL;
2810 uint32 dirtype;
2811 NTSTATUS status;
2812 bool path_contains_wcard = False;
2813 TALLOC_CTX *ctx = talloc_tos();
2814
2815 START_PROFILE(SMBunlink);
2816
2817 if (req->wct < 1) {
2818 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2819 goto out;
2820 }
2821
2822 dirtype = SVAL(req->vwv+0, 0);
2823
2824 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2825 STR_TERMINATE, &status,
2826 &path_contains_wcard);
2827 if (!NT_STATUS_IS_OK(status)) {
2828 reply_nterror(req, status);
2829 goto out;
2830 }
2831
2832 status = filename_convert(ctx, conn,
2833 req->flags2 & FLAGS2_DFS_PATHNAMES,
2834 name,
2835 UCF_COND_ALLOW_WCARD_LCOMP,
2836 &path_contains_wcard,
2837 &smb_fname);
2838 if (!NT_STATUS_IS_OK(status)) {
2839 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2840 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2841 ERRSRV, ERRbadpath);
2842 goto out;
2843 }
2844 reply_nterror(req, status);
2845 goto out;
2846 }
2847
2848 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2849
2850 status = unlink_internals(conn, req, dirtype, smb_fname,
2851 path_contains_wcard);
2852 if (!NT_STATUS_IS_OK(status)) {
2853 if (open_was_deferred(req->sconn, req->mid)) {
2854 /* We have re-scheduled this call. */
2855 goto out;
2856 }
2857 reply_nterror(req, status);
2858 goto out;
2859 }
2860
2861 reply_outbuf(req, 0, 0);
2862 out:
2863 TALLOC_FREE(smb_fname);
2864 END_PROFILE(SMBunlink);
2865 return;
2866 }
2867
2868 /****************************************************************************
2869 Fail for readbraw.
2870 ****************************************************************************/
2871
2872 static void fail_readraw(void)
2873 {
2874 const char *errstr = talloc_asprintf(talloc_tos(),
2875 "FAIL ! reply_readbraw: socket write fail (%s)",
2876 strerror(errno));
2877 if (!errstr) {
2878 errstr = "";
2879 }
2880 exit_server_cleanly(errstr);
2881 }
2882
2883 /****************************************************************************
2884 Fake (read/write) sendfile. Returns -1 on read or write fail.
2885 ****************************************************************************/
2886
2887 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
2888 {
2889 size_t bufsize;
2890 size_t tosend = nread;
2891 char *buf;
2892
2893 if (nread == 0) {
2894 return 0;
2895 }
2896
2897 bufsize = MIN(nread, 65536);
2898
2899 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2900 return -1;
2901 }
2902
2903 while (tosend > 0) {
2904 ssize_t ret;
2905 size_t cur_read;
2906
2907 if (tosend > bufsize) {
2908 cur_read = bufsize;
2909 } else {
2910 cur_read = tosend;
2911 }
2912 ret = read_file(fsp,buf,startpos,cur_read);
2913 if (ret == -1) {
2914 SAFE_FREE(buf);
2915 return -1;
2916 }
2917
2918 /* If we had a short read, fill with zeros. */
2919 if (ret < cur_read) {
2920 memset(buf + ret, '\0', cur_read - ret);
2921 }
2922
2923 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2924 != cur_read) {
2925 char addr[INET6_ADDRSTRLEN];
2926 /*
2927 * Try and give an error message saying what
2928 * client failed.
2929 */
2930 DEBUG(0, ("write_data failed for client %s. "
2931 "Error %s\n",
2932 get_peer_addr(fsp->conn->sconn->sock, addr,
2933 sizeof(addr)),
2934 strerror(errno)));
2935 SAFE_FREE(buf);
2936 return -1;
2937 }
2938 tosend -= cur_read;
2939 startpos += cur_read;
2940 }
2941
2942 SAFE_FREE(buf);
2943 return (ssize_t)nread;
2944 }
2945
2946 /****************************************************************************
2947 Deal with the case of sendfile reading less bytes from the file than
2948 requested. Fill with zeros (all we can do).
2949 ****************************************************************************/
2950
2951 void sendfile_short_send(files_struct *fsp,
2952 ssize_t nread,
2953 size_t headersize,
2954 size_t smb_maxcnt)
2955 {
2956 #define SHORT_SEND_BUFSIZE 1024
2957 if (nread < headersize) {
2958 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2959 "header for file %s (%s). Terminating\n",
2960 fsp_str_dbg(fsp), strerror(errno)));
2961 exit_server_cleanly("sendfile_short_send failed");
2962 }
2963
2964 nread -= headersize;
2965
2966 if (nread < smb_maxcnt) {
2967 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2968 if (!buf) {
2969 exit_server_cleanly("sendfile_short_send: "
2970 "malloc failed");
2971 }
2972
2973 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2974 "with zeros !\n", fsp_str_dbg(fsp)));
2975
2976 while (nread < smb_maxcnt) {
2977 /*
2978 * We asked for the real file size and told sendfile
2979 * to not go beyond the end of the file. But it can
2980 * happen that in between our fstat call and the
2981 * sendfile call the file was truncated. This is very
2982 * bad because we have already announced the larger
2983 * number of bytes to the client.
2984 *
2985 * The best we can do now is to send 0-bytes, just as
2986 * a read from a hole in a sparse file would do.
2987 *
2988 * This should happen rarely enough that I don't care
2989 * about efficiency here :-)
2990 */
2991 size_t to_write;
2992
2993 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2994 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2995 != to_write) {
2996 char addr[INET6_ADDRSTRLEN];
2997 /*
2998 * Try and give an error message saying what
2999 * client failed.
3000 */
3001 DEBUG(0, ("write_data failed for client %s. "
3002 "Error %s\n",
3003 get_peer_addr(
3004 fsp->conn->sconn->sock, addr,
3005 sizeof(addr)),
3006 strerror(errno)));
3007 exit_server_cleanly("sendfile_short_send: "
3008 "write_data failed");
3009 }
3010 nread += to_write;
3011 }
3012 SAFE_FREE(buf);
3013 }
3014 }
3015
3016 /****************************************************************************
3017 Return a readbraw error (4 bytes of zero).
3018 ****************************************************************************/
3019
3020 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3021 {
3022 char header[4];
3023
3024 SIVAL(header,0,0);
3025
3026 smbd_lock_socket(sconn);
3027 if (write_data(sconn->sock,header,4) != 4) {
3028 char addr[INET6_ADDRSTRLEN];
3029 /*
3030 * Try and give an error message saying what
3031 * client failed.
3032 */
3033 DEBUG(0, ("write_data failed for client %s. "
3034 "Error %s\n",
3035 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3036 strerror(errno)));
3037
3038 fail_readraw();
3039 }
3040 smbd_unlock_socket(sconn);
3041 }
3042
3043 /****************************************************************************
3044 Use sendfile in readbraw.
3045 ****************************************************************************/
3046
3047 static void send_file_readbraw(connection_struct *conn,
3048 struct smb_request *req,
3049 files_struct *fsp,
3050 off_t startpos,
3051 size_t nread,
3052 ssize_t mincount)
3053 {
3054 struct smbd_server_connection *sconn = req->sconn;
3055 char *outbuf = NULL;
3056 ssize_t ret=0;
3057
3058 /*
3059 * We can only use sendfile on a non-chained packet
3060 * but we can use on a non-oplocked file. tridge proved this
3061 * on a train in Germany :-). JRA.
3062 * reply_readbraw has already checked the length.
3063 */
3064
3065 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3066 (fsp->wcp == NULL) &&
3067 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3068 ssize_t sendfile_read = -1;
3069 char header[4];
3070 DATA_BLOB header_blob;
3071
3072 _smb_setlen(header,nread);
3073 header_blob = data_blob_const(header, 4);
3074
3075 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3076 &header_blob, startpos,
3077 nread);
3078 if (sendfile_read == -1) {
3079 /* Returning ENOSYS means no data at all was sent.
3080 * Do this as a normal read. */
3081 if (errno == ENOSYS) {
3082 goto normal_readbraw;
3083 }
3084
3085 /*
3086 * Special hack for broken Linux with no working sendfile. If we
3087 * return EINTR we sent the header but not the rest of the data.
3088 * Fake this up by doing read/write calls.
3089 */
3090 if (errno == EINTR) {
3091 /* Ensure we don't do this again. */
3092 set_use_sendfile(SNUM(conn), False);
3093 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3094
3095 if (fake_sendfile(fsp, startpos, nread) == -1) {
3096 DEBUG(0,("send_file_readbraw: "
3097 "fake_sendfile failed for "
3098 "file %s (%s).\n",
3099 fsp_str_dbg(fsp),
3100 strerror(errno)));
3101 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3102 }
3103 return;
3104 }
3105
3106 DEBUG(0,("send_file_readbraw: sendfile failed for "
3107 "file %s (%s). Terminating\n",
3108 fsp_str_dbg(fsp), strerror(errno)));
3109 exit_server_cleanly("send_file_readbraw sendfile failed");
3110 } else if (sendfile_read == 0) {
3111 /*
3112 * Some sendfile implementations return 0 to indicate
3113 * that there was a short read, but nothing was
3114 * actually written to the socket. In this case,
3115 * fallback to the normal read path so the header gets
3116 * the correct byte count.
3117 */
3118 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3119 "bytes falling back to the normal read: "
3120 "%s\n", fsp_str_dbg(fsp)));
3121 goto normal_readbraw;
3122 }
3123
3124 /* Deal with possible short send. */
3125 if (sendfile_read != 4+nread) {
3126 sendfile_short_send(fsp, sendfile_read, 4, nread);
3127 }
3128 return;
3129 }
3130
3131 normal_readbraw:
3132
3133 outbuf = talloc_array(NULL, char, nread+4);
3134 if (!outbuf) {
3135 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3136 (unsigned)(nread+4)));
3137 reply_readbraw_error(sconn);
3138 return;
3139 }
3140
3141 if (nread > 0) {
3142 ret = read_file(fsp,outbuf+4,startpos,nread);
3143 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3144 if (ret < mincount)
3145 ret = 0;
3146 #else
3147 if (ret < nread)
3148 ret = 0;
3149 #endif
3150 }
3151
3152 _smb_setlen(outbuf,ret);
3153 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3154 char addr[INET6_ADDRSTRLEN];
3155 /*
3156 * Try and give an error message saying what
3157 * client failed.
3158 */
3159 DEBUG(0, ("write_data failed for client %s. "
3160 "Error %s\n",
3161 get_peer_addr(fsp->conn->sconn->sock, addr,
3162 sizeof(addr)),
3163 strerror(errno)));
3164
3165 fail_readraw();
3166 }
3167
3168 TALLOC_FREE(outbuf);
3169 }
3170
3171 /****************************************************************************
3172 Reply to a readbraw (core+ protocol).
3173 ****************************************************************************/
3174
3175 void reply_readbraw(struct smb_request *req)
3176 {
3177 connection_struct *conn = req->conn;
3178 struct smbd_server_connection *sconn = req->sconn;
3179 ssize_t maxcount,mincount;
3180 size_t nread = 0;
3181 off_t startpos;
3182 files_struct *fsp;
3183 struct lock_struct lock;
3184 off_t size = 0;
3185
3186 START_PROFILE(SMBreadbraw);
3187
3188 if (srv_is_signing_active(sconn) ||
3189 is_encrypted_packet(sconn, req->inbuf)) {
3190 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3191 "raw reads/writes are disallowed.");
3192 }
3193
3194 if (req->wct < 8) {
3195 reply_readbraw_error(sconn);
3196 END_PROFILE(SMBreadbraw);
3197 return;
3198 }
3199
3200 if (sconn->smb1.echo_handler.trusted_fde) {
3201 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3202 "'async smb echo handler = yes'\n"));
3203 reply_readbraw_error(sconn);
3204 END_PROFILE(SMBreadbraw);
3205 return;
3206 }
3207
3208 /*
3209 * Special check if an oplock break has been issued
3210 * and the readraw request croses on the wire, we must
3211 * return a zero length response here.
3212 */
3213
3214 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3215
3216 /*
3217 * We have to do a check_fsp by hand here, as
3218 * we must always return 4 zero bytes on error,
3219 * not a NTSTATUS.
3220 */
3221
3222 if (!fsp || !conn || conn != fsp->conn ||
3223 req->vuid != fsp->vuid ||
3224 fsp->is_directory || fsp->fh->fd == -1) {
3225 /*
3226 * fsp could be NULL here so use the value from the packet. JRA.
3227 */
3228 DEBUG(3,("reply_readbraw: fnum %d not valid "
3229 "- cache prime?\n",
3230 (int)SVAL(req->vwv+0, 0)));
3231 reply_readbraw_error(sconn);
3232 END_PROFILE(SMBreadbraw);
3233 return;
3234 }
3235
3236 /* Do a "by hand" version of CHECK_READ. */
3237 if (!(fsp->can_read ||
3238 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3239 (fsp->access_mask & FILE_EXECUTE)))) {
3240 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3241 (int)SVAL(req->vwv+0, 0)));
3242 reply_readbraw_error(sconn);
3243 END_PROFILE(SMBreadbraw);
3244 return;
3245 }
3246
3247 flush_write_cache(fsp, READRAW_FLUSH);
3248
3249 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3250 if(req->wct == 10) {
3251 /*
3252 * This is a large offset (64 bit) read.
3253 */
3254
3255 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3256
3257 if(startpos < 0) {
3258 DEBUG(0,("reply_readbraw: negative 64 bit "
3259 "readraw offset (%.0f) !\n",
3260 (double)startpos ));
3261 reply_readbraw_error(sconn);
3262 END_PROFILE(SMBreadbraw);
3263 return;
3264 }
3265 }
3266
3267 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3268 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3269
3270 /* ensure we don't overrun the packet size */
3271 maxcount = MIN(65535,maxcount);
3272
3273 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3274 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3275 &lock);
3276
3277 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3278 reply_readbraw_error(sconn);
3279 END_PROFILE(SMBreadbraw);
3280 return;
3281 }
3282
3283 if (fsp_stat(fsp) == 0) {
3284 size = fsp->fsp_name->st.st_ex_size;
3285 }
3286
3287 if (startpos >= size) {
3288 nread = 0;
3289 } else {
3290 nread = MIN(maxcount,(size - startpos));
3291 }
3292
3293 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3294 if (nread < mincount)
3295 nread = 0;
3296 #endif
3297
3298 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3299 "min=%lu nread=%lu\n",
3300 fsp_fnum_dbg(fsp), (double)startpos,
3301 (unsigned long)maxcount,
3302 (unsigned long)mincount,
3303 (unsigned long)nread ) );
3304
3305 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3306
3307 DEBUG(5,("reply_readbraw finished\n"));
3308
3309 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3310
3311 END_PROFILE(SMBreadbraw);
3312 return;
3313 }
3314
3315 #undef DBGC_CLASS
3316 #define DBGC_CLASS DBGC_LOCKING
3317
3318 /****************************************************************************
3319 Reply to a lockread (core+ protocol).
3320 ****************************************************************************/
3321
3322 void reply_lockread(struct smb_request *req)
3323 {
3324 connection_struct *conn = req->conn;
3325 ssize_t nread = -1;
3326 char *data;
3327 off_t startpos;
3328 size_t numtoread;
3329 NTSTATUS status;
3330 files_struct *fsp;
3331 struct byte_range_lock *br_lck = NULL;
3332 char *p = NULL;
3333 struct smbd_server_connection *sconn = req->sconn;
3334
3335 START_PROFILE(SMBlockread);
3336
3337 if (req->wct < 5) {
3338 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3339 END_PROFILE(SMBlockread);
3340 return;
3341 }
3342
3343 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3344
3345 if (!check_fsp(conn, req, fsp)) {
3346 END_PROFILE(SMBlockread);
3347 return;
3348 }
3349
3350 if (!CHECK_READ(fsp,req)) {
3351 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3352 END_PROFILE(SMBlockread);
3353 return;
3354 }
3355
3356 numtoread = SVAL(req->vwv+1, 0);
3357 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3358
3359 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3360
3361 reply_outbuf(req, 5, numtoread + 3);
3362
3363 data = smb_buf(req->outbuf) + 3;
3364
3365 /*
3366 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3367 * protocol request that predates the read/write lock concept.
3368 * Thus instead of asking for a read lock here we need to ask
3369 * for a write lock. JRA.
3370 * Note that the requested lock size is unaffected by max_recv.
3371 */
3372
3373 br_lck = do_lock(req->sconn->msg_ctx,
3374 fsp,
3375 (uint64_t)req->smbpid,
3376 (uint64_t)numtoread,
3377 (uint64_t)startpos,
3378 WRITE_LOCK,
3379 WINDOWS_LOCK,
3380 False, /* Non-blocking lock. */
3381 &status,
3382 NULL,
3383 NULL);
3384 TALLOC_FREE(br_lck);
3385
3386 if (NT_STATUS_V(status)) {
3387 reply_nterror(req, status);
3388 END_PROFILE(SMBlockread);
3389 return;
3390 }
3391
3392 /*
3393 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3394 */
3395
3396 if (numtoread > sconn->smb1.negprot.max_recv) {
3397 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3398 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3399 (unsigned int)numtoread,
3400 (unsigned int)sconn->smb1.negprot.max_recv));
3401 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3402 }
3403 nread = read_file(fsp,data,startpos,numtoread);
3404
3405 if (nread < 0) {
3406 reply_nterror(req, map_nt_error_from_unix(errno));
3407 END_PROFILE(SMBlockread);
3408 return;
3409 }
3410
3411 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3412
3413 SSVAL(req->outbuf,smb_vwv0,nread);
3414 SSVAL(req->outbuf,smb_vwv5,nread+3);
3415 p = smb_buf(req->outbuf);
3416 SCVAL(p,0,0); /* pad byte. */
3417 SSVAL(p,1,nread);
3418
3419 DEBUG(3,("lockread %s num=%d nread=%d\n",
3420 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3421
3422 END_PROFILE(SMBlockread);
3423 return;
3424 }
3425
3426 #undef DBGC_CLASS
3427 #define DBGC_CLASS DBGC_ALL
3428
3429 /****************************************************************************
3430 Reply to a read.
3431 ****************************************************************************/
3432
3433 void reply_read(struct smb_request *req)
3434 {
3435 connection_struct *conn = req->conn;
3436 size_t numtoread;
3437 ssize_t nread = 0;
3438 char *data;
3439 off_t startpos;
3440 int outsize = 0;
3441 files_struct *fsp;
3442 struct lock_struct lock;
3443 struct smbd_server_connection *sconn = req->sconn;
3444
3445 START_PROFILE(SMBread);
3446
3447 if (req->wct < 3) {
3448 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3449 END_PROFILE(SMBread);
3450 return;
3451 }
3452
3453 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3454
3455 if (!check_fsp(conn, req, fsp)) {
3456 END_PROFILE(SMBread);
3457 return;
3458 }
3459
3460 if (!CHECK_READ(fsp,req)) {
3461 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3462 END_PROFILE(SMBread);
3463 return;
3464 }
3465
3466 numtoread = SVAL(req->vwv+1, 0);
3467 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3468
3469 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3470
3471 /*
3472 * The requested read size cannot be greater than max_recv. JRA.
3473 */
3474 if (numtoread > sconn->smb1.negprot.max_recv) {
3475 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3476 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3477 (unsigned int)numtoread,
3478 (unsigned int)sconn->smb1.negprot.max_recv));
3479 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3480 }
3481
3482 reply_outbuf(req, 5, numtoread+3);
3483
3484 data = smb_buf(req->outbuf) + 3;
3485
3486 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3487 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3488 &lock);
3489
3490 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3491 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3492 END_PROFILE(SMBread);
3493 return;
3494 }
3495
3496 if (numtoread > 0)
3497 nread = read_file(fsp,data,startpos,numtoread);
3498
3499 if (nread < 0) {
3500 reply_nterror(req, map_nt_error_from_unix(errno));
3501 goto strict_unlock;
3502 }
3503
3504 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3505
3506 SSVAL(req->outbuf,smb_vwv0,nread);
3507 SSVAL(req->outbuf,smb_vwv5,nread+3);
3508 SCVAL(smb_buf(req->outbuf),0,1);
3509 SSVAL(smb_buf(req->outbuf),1,nread);
3510
3511 DEBUG(3, ("read %s num=%d nread=%d\n",
3512 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3513
3514 strict_unlock:
3515 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3516
3517 END_PROFILE(SMBread);
3518 return;
3519 }
3520
3521 /****************************************************************************
3522 Setup readX header.
3523 ****************************************************************************/
3524
3525 static int setup_readX_header(struct smb_request *req, char *outbuf,
3526 size_t smb_maxcnt)
3527 {
3528 int outsize;
3529
3530 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3531
3532 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3533
3534 SCVAL(outbuf,smb_vwv0,0xFF);
3535 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3536 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3537 SSVAL(outbuf,smb_vwv6,
3538 (smb_wct - 4) /* offset from smb header to wct */
3539 + 1 /* the wct field */
3540 + 12 * sizeof(uint16_t) /* vwv */
3541 + 2); /* the buflen field */
3542 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3543 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3544 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3545 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3546 return outsize;
3547 }
3548
3549 /****************************************************************************
3550 Reply to a read and X - possibly using sendfile.
3551 ****************************************************************************/
3552
3553 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3554 files_struct *fsp, off_t startpos,
3555 size_t smb_maxcnt)
3556 {
3557 ssize_t nread = -1;
3558 struct lock_struct lock;
3559 int saved_errno = 0;
3560
3561 if(fsp_stat(fsp) == -1) {
3562 reply_nterror(req, map_nt_error_from_unix(errno));
3563 return;
3564 }
3565
3566 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3567 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3568 &lock);
3569
3570 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3571 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3572 return;
3573 }
3574
3575 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3576 (startpos > fsp->fsp_name->st.st_ex_size)
3577 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3578 /*
3579 * We already know that we would do a short read, so don't
3580 * try the sendfile() path.
3581 */
3582 goto nosendfile_read;
3583 }
3584
3585 /*
3586 * We can only use sendfile on a non-chained packet
3587 * but we can use on a non-oplocked file. tridge proved this
3588 * on a train in Germany :-). JRA.
3589 */
3590
3591 if (!req_is_in_chain(req) &&
3592 !is_encrypted_packet(req->sconn, req->inbuf) &&
3593 (fsp->base_fsp == NULL) &&
3594 (fsp->wcp == NULL) &&
3595 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3596 uint8 headerbuf[smb_size + 12 * 2];
3597 DATA_BLOB header;
3598
3599 /*
3600 * Set up the packet header before send. We
3601 * assume here the sendfile will work (get the
3602 * correct amount of data).
3603 */
3604
3605 header = data_blob_const(headerbuf, sizeof(headerbuf));
3606
3607 construct_reply_common_req(req, (char *)headerbuf);
3608 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3609
3610 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3611 startpos, smb_maxcnt);
3612 if (nread == -1) {
3613 /* Returning ENOSYS means no data at all was sent.
3614 Do this as a normal read. */
3615 if (errno == ENOSYS) {
3616 goto normal_read;
3617 }
3618
3619 /*
3620 * Special hack for broken Linux with no working sendfile. If we
3621 * return EINTR we sent the header but not the rest of the data.
3622 * Fake this up by doing read/write calls.
3623 */
3624
3625 if (errno == EINTR) {
3626 /* Ensure we don't do this again. */
3627 set_use_sendfile(SNUM(conn), False);
3628 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3629 nread = fake_sendfile(fsp, startpos,
3630 smb_maxcnt);
3631 if (nread == -1) {
3632 DEBUG(0,("send_file_readX: "
3633 "fake_sendfile failed for "
3634 "file %s (%s).\n",
3635 fsp_str_dbg(fsp),
3636 strerror(errno)));
3637 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3638 }
3639 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3640 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3641 /* No outbuf here means successful sendfile. */
3642 goto strict_unlock;
3643 }
3644
3645 DEBUG(0,("send_file_readX: sendfile failed for file "
3646 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3647 strerror(errno)));
3648 exit_server_cleanly("send_file_readX sendfile failed");
3649 } else if (nread == 0) {
3650 /*
3651 * Some sendfile implementations return 0 to indicate
3652 * that there was a short read, but nothing was
3653 * actually written to the socket. In this case,
3654 * fallback to the normal read path so the header gets
3655 * the correct byte count.
3656 */
3657 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3658 "falling back to the normal read: %s\n",
3659 fsp_str_dbg(fsp)));
3660 goto normal_read;
3661 }
3662
3663 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3664 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3665
3666 /* Deal with possible short send. */
3667 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3668 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3669 }
3670 /* No outbuf here means successful sendfile. */
3671 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3672 SMB_PERFCOUNT_END(&req->pcd);
3673 goto strict_unlock;
3674 }
3675
3676 normal_read:
3677
3678 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3679 uint8 headerbuf[smb_size + 2*12];
3680
3681 construct_reply_common_req(req, (char *)headerbuf);
3682 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3683
3684 /* Send out the header. */
3685 if (write_data(req->sconn->sock, (char *)headerbuf,
3686 sizeof(headerbuf)) != sizeof(headerbuf)) {
3687
3688 char addr[INET6_ADDRSTRLEN];
3689 /*
3690 * Try and give an error message saying what
3691 * client failed.
3692 */
3693 DEBUG(0, ("write_data failed for client %s. "
3694 "Error %s\n",
3695 get_peer_addr(req->sconn->sock, addr,
3696 sizeof(addr)),
3697 strerror(errno)));
3698
3699 DEBUG(0,("send_file_readX: write_data failed for file "
3700 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3701 strerror(errno)));
3702 exit_server_cleanly("send_file_readX sendfile failed");
3703 }
3704 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3705 if (nread == -1) {
3706 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3707 "file %s (%s).\n", fsp_str_dbg(fsp),
3708 strerror(errno)));
3709 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3710 }
3711 goto strict_unlock;
3712 }
3713
3714 nosendfile_read:
3715
3716 reply_outbuf(req, 12, smb_maxcnt);
3717 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3718 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3719
3720 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3721 saved_errno = errno;
3722
3723 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3724
3725 if (nread < 0) {
3726 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3727 return;
3728 }
3729
3730 setup_readX_header(req, (char *)req->outbuf, nread);
3731
3732 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3733 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3734 return;
3735
3736 strict_unlock:
3737 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3738 TALLOC_FREE(req->outbuf);
3739 return;
3740 }
3741
3742 /****************************************************************************
3743 Reply to a read and X.
3744 ****************************************************************************/
3745
3746 void reply_read_and_X(struct smb_request *req)
3747 {
3748 struct smbd_server_connection *sconn = req->sconn;
3749 connection_struct *conn = req->conn;
3750 files_struct *fsp;
3751 off_t startpos;
3752 size_t smb_maxcnt;
3753 bool big_readX = False;
3754 #if 0
3755 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3756 #endif
3757
3758 START_PROFILE(SMBreadX);
3759
3760 if ((req->wct != 10) && (req->wct != 12)) {
3761 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3762 return;
3763 }
3764
3765 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3766 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3767 smb_maxcnt = SVAL(req->vwv+5, 0);
3768
3769 /* If it's an IPC, pass off the pipe handler. */
3770 if (IS_IPC(conn)) {
3771 reply_pipe_read_and_X(req);
3772 END_PROFILE(SMBreadX);
3773 return;
3774 }
3775
3776 if (!check_fsp(conn, req, fsp)) {
3777 END_PROFILE(SMBreadX);
3778 return;
3779 }
3780
3781 if (!CHECK_READ(fsp,req)) {
3782 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3783 END_PROFILE(SMBreadX);
3784 return;
3785 }
3786
3787 if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3788 (get_remote_arch() == RA_SAMBA)) {
3789 /*
3790 * This is Samba only behavior (up to Samba 3.6)!
3791 *
3792 * Windows 2008 R2 ignores the upper_size,
3793 * so we do unless unix extentions are active
3794 * or "smbclient" is talking to us.
3795 */
3796 size_t upper_size = SVAL(req->vwv+7, 0);
3797 smb_maxcnt |= (upper_size<<16);
3798 if (upper_size > 1) {
3799 /* Can't do this on a chained packet. */
3800 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3801 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3802 END_PROFILE(SMBreadX);
3803 return;
3804 }
3805 /* We currently don't do this on signed or sealed data. */
3806 if (srv_is_signing_active(req->sconn) ||
3807 is_encrypted_packet(req->sconn, req->inbuf)) {
3808 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3809 END_PROFILE(SMBreadX);
3810 return;
3811 }
3812 /* Is there room in the reply for this data ? */
3813 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3814 reply_nterror(req,
3815 NT_STATUS_INVALID_PARAMETER);
3816 END_PROFILE(SMBreadX);
3817 return;
3818 }
3819 big_readX = True;
3820 }
3821 }
3822
3823 if (req->wct == 12) {
3824 /*
3825 * This is a large offset (64 bit) read.
3826 */
3827 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
3828
3829 }
3830
3831 if (!big_readX) {
3832 NTSTATUS status = schedule_aio_read_and_X(conn,
3833 req,
3834 fsp,
3835 startpos,
3836 smb_maxcnt);
3837 if (NT_STATUS_IS_OK(status)) {
3838 /* Read scheduled - we're done. */
3839 goto out;
3840 }
3841 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3842 /* Real error - report to client. */
3843 END_PROFILE(SMBreadX);
3844 reply_nterror(req, status);
3845 return;
3846 }
3847 /* NT_STATUS_RETRY - fall back to sync read. */
3848 }
3849
3850 smbd_lock_socket(req->sconn);
3851 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3852 smbd_unlock_socket(req->sconn);
3853
3854 out:
3855 END_PROFILE(SMBreadX);
3856 return;
3857 }
3858
3859 /****************************************************************************
3860 Error replies to writebraw must have smb_wct == 1. Fix this up.
3861 ****************************************************************************/
3862
3863 void error_to_writebrawerr(struct smb_request *req)
3864 {
3865 uint8 *old_outbuf = req->outbuf;
3866
3867 reply_outbuf(req, 1, 0);
3868
3869 memcpy(req->outbuf, old_outbuf, smb_size);
3870 TALLOC_FREE(old_outbuf);
3871 }
3872
3873 /****************************************************************************
3874 Read 4 bytes of a smb packet and return the smb length of the packet.
3875 Store the result in the buffer. This version of the function will
3876 never return a session keepalive (length of zero).
3877 Timeout is in milliseconds.
3878 ****************************************************************************/
3879
3880 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3881 size_t *len)
3882 {
3883 uint8_t msgtype = NBSSkeepalive;
3884
3885 while (msgtype == NBSSkeepalive) {
3886 NTSTATUS status;
3887
3888 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3889 len);
3890 if (!NT_STATUS_IS_OK(status)) {
3891 char addr[INET6_ADDRSTRLEN];
3892 /* Try and give an error message
3893 * saying what client failed. */
3894 DEBUG(0, ("read_fd_with_timeout failed for "
3895 "client %s read error = %s.\n",
3896 get_peer_addr(fd,addr,sizeof(addr)),
3897 nt_errstr(status)));
3898 return status;
3899 }
3900
3901 msgtype = CVAL(inbuf, 0);
3902 }
3903
3904 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3905 (unsigned long)len));
3906
3907 return NT_STATUS_OK;
3908 }
3909
3910 /****************************************************************************
3911 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3912 ****************************************************************************/
3913
3914 void reply_writebraw(struct smb_request *req)
3915 {
3916 connection_struct *conn = req->conn;
3917 char *buf = NULL;
3918 ssize_t nwritten=0;
3919 ssize_t total_written=0;
3920 size_t numtowrite=0;
3921 size_t tcount;
3922 off_t startpos;
3923 const char *data=NULL;
3924 bool write_through;
3925 files_struct *fsp;
3926 struct lock_struct lock;
3927 NTSTATUS status;
3928
3929 START_PROFILE(SMBwritebraw);
3930
3931 /*
3932 * If we ever reply with an error, it must have the SMB command
3933 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3934 * we're finished.
3935 */
3936 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3937
3938 if (srv_is_signing_active(req->sconn)) {
3939 END_PROFILE(SMBwritebraw);
3940 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3941 "raw reads/writes are disallowed.");
3942 }
3943
3944 if (req->wct < 12) {
3945 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3946 error_to_writebrawerr(req);
3947 END_PROFILE(SMBwritebraw);
3948 return;
3949 }
3950
3951 if (req->sconn->smb1.echo_handler.trusted_fde) {
3952 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3953 "'async smb echo handler = yes'\n"));
3954 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3955 error_to_writebrawerr(req);
3956 END_PROFILE(SMBwritebraw);
3957 return;
3958 }
3959
3960 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3961 if (!check_fsp(conn, req, fsp)) {
3962 error_to_writebrawerr(req);
3963 END_PROFILE(SMBwritebraw);
3964 return;
3965 }
3966
3967 if (!CHECK_WRITE(fsp)) {
3968 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3969 error_to_writebrawerr(req);
3970 END_PROFILE(SMBwritebraw);
3971 return;
3972 }
3973
3974 tcount = IVAL(req->vwv+1, 0);
3975 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3976 write_through = BITSETW(req->vwv+7,0);
3977
3978 /* We have to deal with slightly different formats depending
3979 on whether we are using the core+ or lanman1.0 protocol */
3980
3981 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3982 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
3983 data = smb_buf_const(req->inbuf);
3984 } else {
3985 numtowrite = SVAL(req->vwv+10, 0);
3986 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3987 }
3988
3989 /* Ensure we don't write bytes past the end of this packet. */
3990 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3991 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3992 error_to_writebrawerr(req);
3993 END_PROFILE(SMBwritebraw);
3994 return;
3995 }
3996
3997 if (!fsp->print_file) {
3998 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3999 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4000 &lock);
4001
4002 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4003 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4004 error_to_writebrawerr(req);
4005 END_PROFILE(SMBwritebraw);
4006 return;
4007 }
4008 }
4009
4010 if (numtowrite>0) {
4011 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4012 }
4013
4014 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4015 "wrote=%d sync=%d\n",
4016 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4017 (int)nwritten, (int)write_through));
4018
4019 if (nwritten < (ssize_t)numtowrite) {
4020 reply_nterror(req, NT_STATUS_DISK_FULL);
4021 error_to_writebrawerr(req);
4022 goto strict_unlock;
4023 }
4024
4025 total_written = nwritten;
4026
4027 /* Allocate a buffer of 64k + length. */
4028 buf = talloc_array(NULL, char, 65540);
4029 if (!buf) {
4030 reply_nterror(req, NT_STATUS_NO_MEMORY);
4031 error_to_writebrawerr(req);
4032 goto strict_unlock;
4033 }
4034
4035 /* Return a SMBwritebraw message to the redirector to tell
4036 * it to send more bytes */
4037
4038 memcpy(buf, req->inbuf, smb_size);
4039 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4040 SCVAL(buf,smb_com,SMBwritebraw);
4041 SSVALS(buf,smb_vwv0,0xFFFF);
4042 show_msg(buf);
4043 if (!srv_send_smb(req->sconn,
4044 buf,
4045 false, 0, /* no signing */
4046 IS_CONN_ENCRYPTED(conn),
4047 &req->pcd)) {
4048 exit_server_cleanly("reply_writebraw: srv_send_smb "
4049 "failed.");
4050 }
4051
4052 /* Now read the raw data into the buffer and write it */
4053 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4054 &numtowrite);
4055 if (!NT_STATUS_IS_OK(status)) {
4056 exit_server_cleanly("secondary writebraw failed");
4057 }
4058
4059 /* Set up outbuf to return the correct size */
4060 reply_outbuf(req, 1, 0);
4061
4062 if (numtowrite != 0) {
4063
4064 if (numtowrite > 0xFFFF) {
4065 DEBUG(0,("reply_writebraw: Oversize secondary write "
4066 "raw requested (%u). Terminating\n",
4067 (unsigned int)numtowrite ));
4068 exit_server_cleanly("secondary writebraw failed");
4069 }
4070
4071 if (tcount > nwritten+numtowrite) {
4072 DEBUG(3,("reply_writebraw: Client overestimated the "
4073 "write %d %d %d\n",
4074 (int)tcount,(int)nwritten,(int)numtowrite));
4075 }
4076
4077 status = read_data(req->sconn->sock, buf+4, numtowrite);
4078
4079 if (!NT_STATUS_IS_OK(status)) {
4080 char addr[INET6_ADDRSTRLEN];
4081 /* Try and give an error message
4082 * saying what client failed. */
4083 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4084 "raw read failed (%s) for client %s. "
4085 "Terminating\n", nt_errstr(status),
4086 get_peer_addr(req->sconn->sock, addr,
4087 sizeof(addr))));
4088 exit_server_cleanly("secondary writebraw failed");
4089 }
4090
4091 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4092 if (nwritten == -1) {
4093 TALLOC_FREE(buf);
4094 reply_nterror(req, map_nt_error_from_unix(errno));
4095 error_to_writebrawerr(req);
4096 goto strict_unlock;
4097 }
4098
4099 if (nwritten < (ssize_t)numtowrite) {
4100 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4101 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4102 }
4103
4104 if (nwritten > 0) {
4105 total_written += nwritten;
4106 }
4107 }
4108
4109 TALLOC_FREE(buf);
4110 SSVAL(req->outbuf,smb_vwv0,total_written);
4111
4112 status = sync_file(conn, fsp, write_through);
4113 if (!NT_STATUS_IS_OK(status)) {
4114 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4115 fsp_str_dbg(fsp), nt_errstr(status)));
4116 reply_nterror(req, status);
4117 error_to_writebrawerr(req);
4118 goto strict_unlock;
4119 }
4120
4121 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4122 "wrote=%d\n",
4123 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4124 (int)total_written));
4125
4126 if (!fsp->print_file) {
4127 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4128 }
4129
4130 /* We won't return a status if write through is not selected - this
4131 * follows what WfWg does */
4132 END_PROFILE(SMBwritebraw);
4133
4134 if (!write_through && total_written==tcount) {
4135
4136 #if RABBIT_PELLET_FIX
4137 /*
4138 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4139 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4140 * JRA.
4141 */
4142 if (!send_keepalive(req->sconn->sock)) {
4143 exit_server_cleanly("reply_writebraw: send of "
4144 "keepalive failed");
4145 }
4146 #endif
4147 TALLOC_FREE(req->outbuf);
4148 }
4149 return;
4150
4151 strict_unlock:
4152 if (!fsp->print_file) {
4153 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4154 }
4155
4156 END_PROFILE(SMBwritebraw);
4157 return;
4158 }
4159
4160 #undef DBGC_CLASS
4161 #define DBGC_CLASS DBGC_LOCKING
4162
4163 /****************************************************************************
4164 Reply to a writeunlock (core+).
4165 ****************************************************************************/
4166
4167 void reply_writeunlock(struct smb_request *req)
4168 {
4169 connection_struct *conn = req->conn;
4170 ssize_t nwritten = -1;
4171 size_t numtowrite;
4172 off_t startpos;
4173 const char *data;
4174 NTSTATUS status = NT_STATUS_OK;
4175 files_struct *fsp;
4176 struct lock_struct lock;
4177 int saved_errno = 0;
4178
4179 START_PROFILE(SMBwriteunlock);
4180
4181 if (req->wct < 5) {
4182 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4183 END_PROFILE(SMBwriteunlock);
4184 return;
4185 }
4186
4187 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4188
4189 if (!check_fsp(conn, req, fsp)) {
4190 END_PROFILE(SMBwriteunlock);
4191 return;
4192 }
4193
4194 if (!CHECK_WRITE(fsp)) {
4195 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4196 END_PROFILE(SMBwriteunlock);
4197 return;
4198 }
4199
4200 numtowrite = SVAL(req->vwv+1, 0);
4201 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4202 data = (const char *)req->buf + 3;
4203
4204 if (!fsp->print_file && numtowrite > 0) {
4205 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4206 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4207 &lock);
4208
4209 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4210 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4211 END_PROFILE(SMBwriteunlock);
4212 return;
4213 }
4214 }
4215
4216 /* The special X/Open SMB protocol handling of
4217 zero length writes is *NOT* done for
4218 this call */
4219 if(numtowrite == 0) {
4220 nwritten = 0;
4221 } else {
4222 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4223 saved_errno = errno;
4224 }
4225
4226 status = sync_file(conn, fsp, False /* write through */);
4227 if (!NT_STATUS_IS_OK(status)) {
4228 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4229 fsp_str_dbg(fsp), nt_errstr(status)));
4230 reply_nterror(req, status);
4231 goto strict_unlock;
4232 }
4233
4234 if(nwritten < 0) {
4235 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4236 goto strict_unlock;
4237 }
4238
4239 if((nwritten < numtowrite) && (numtowrite != 0)) {
4240 reply_nterror(req, NT_STATUS_DISK_FULL);
4241 goto strict_unlock;
4242 }
4243
4244 if (numtowrite && !fsp->print_file) {
4245 status = do_unlock(req->sconn->msg_ctx,
4246 fsp,
4247 (uint64_t)req->smbpid,
4248 (uint64_t)numtowrite,
4249 (uint64_t)startpos,
4250 WINDOWS_LOCK);
4251
4252 if (NT_STATUS_V(status)) {
4253 reply_nterror(req, status);
4254 goto strict_unlock;
4255 }
4256 }
4257
4258 reply_outbuf(req, 1, 0);
4259
4260 SSVAL(req->outbuf,smb_vwv0,nwritten);
4261
4262 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4263 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4264
4265 strict_unlock:
4266 if (numtowrite && !fsp->print_file) {
4267 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4268 }
4269
4270 END_PROFILE(SMBwriteunlock);
4271 return;
4272 }
4273
4274 #undef DBGC_CLASS
4275 #define DBGC_CLASS DBGC_ALL
4276
4277 /****************************************************************************
4278 Reply to a write.
4279 ****************************************************************************/
4280
4281 void reply_write(struct smb_request *req)
4282 {
4283 connection_struct *conn = req->conn;
4284 size_t numtowrite;
4285 ssize_t nwritten = -1;
4286 off_t startpos;
4287 const char *data;
4288 files_struct *fsp;
4289 struct lock_struct lock;
4290 NTSTATUS status;
4291 int saved_errno = 0;
4292
4293 START_PROFILE(SMBwrite);
4294
4295 if (req->wct < 5) {
4296 END_PROFILE(SMBwrite);
4297 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4298 return;
4299 }
4300
4301 /* If it's an IPC, pass off the pipe handler. */
4302 if (IS_IPC(conn)) {
4303 reply_pipe_write(req);
4304 END_PROFILE(SMBwrite);
4305 return;
4306 }
4307
4308 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4309
4310 if (!check_fsp(conn, req, fsp)) {
4311 END_PROFILE(SMBwrite);
4312 return;
4313 }
4314
4315 if (!CHECK_WRITE(fsp)) {
4316 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4317 END_PROFILE(SMBwrite);
4318 return;
4319 }
4320
4321 numtowrite = SVAL(req->vwv+1, 0);
4322 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4323 data = (const char *)req->buf + 3;
4324
4325 if (!fsp->print_file) {
4326 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4327 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4328 &lock);
4329
4330 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4331 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4332 END_PROFILE(SMBwrite);
4333 return;
4334 }
4335 }
4336
4337 /*
4338 * X/Open SMB protocol says that if smb_vwv1 is
4339 * zero then the file size should be extended or
4340 * truncated to the size given in smb_vwv[2-3].
4341 */
4342
4343 if(numtowrite == 0) {
4344 /*
4345 * This is actually an allocate call, and set EOF. JRA.
4346 */
4347 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4348 if (nwritten < 0) {
4349 reply_nterror(req, NT_STATUS_DISK_FULL);
4350 goto strict_unlock;
4351 }
4352 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4353 if (nwritten < 0) {
4354 reply_nterror(req, NT_STATUS_DISK_FULL);
4355 goto strict_unlock;
4356 }
4357 trigger_write_time_update_immediate(fsp);
4358 } else {
4359 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4360 }
4361
4362 status = sync_file(conn, fsp, False);
4363 if (!NT_STATUS_IS_OK(status)) {
4364 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4365 fsp_str_dbg(fsp), nt_errstr(status)));
4366 reply_nterror(req, status);
4367 goto strict_unlock;
4368 }
4369
4370 if(nwritten < 0) {
4371 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4372 goto strict_unlock;
4373 }
4374
4375 if((nwritten == 0) && (numtowrite != 0)) {
4376 reply_nterror(req, NT_STATUS_DISK_FULL);
4377 goto strict_unlock;
4378 }
4379
4380 reply_outbuf(req, 1, 0);
4381
4382 SSVAL(req->outbuf,smb_vwv0,nwritten);
4383
4384 if (nwritten < (ssize_t)numtowrite) {
4385 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4386 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4387 }
4388
4389 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4390
4391 strict_unlock:
4392 if (!fsp->print_file) {
4393 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4394 }
4395
4396 END_PROFILE(SMBwrite);
4397 return;
4398 }
4399
4400 /****************************************************************************
4401 Ensure a buffer is a valid writeX for recvfile purposes.
4402 ****************************************************************************/
4403
4404 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4405 (2*14) + /* word count (including bcc) */ \
4406 1 /* pad byte */)
4407
4408 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4409 const uint8_t *inbuf)
4410 {
4411 size_t numtowrite;
4412 connection_struct *conn = NULL;
4413 unsigned int doff = 0;
4414 size_t len = smb_len_large(inbuf);
4415 struct smbXsrv_tcon *tcon;
4416 NTSTATUS status;
4417 NTTIME now = 0;
4418
4419 if (is_encrypted_packet(sconn, inbuf)) {
4420 /* Can't do this on encrypted
4421 * connections. */
4422 return false;
4423 }
4424
4425 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4426 return false;
4427 }
4428
4429 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4430 CVAL(inbuf,smb_wct) != 14) {
4431 DEBUG(10,("is_valid_writeX_buffer: chained or "
4432 "invalid word length.\n"));
4433 return false;
4434 }
4435
4436 status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4437 now, &tcon);
4438 if (!NT_STATUS_IS_OK(status)) {
4439 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4440 return false;
4441 }
4442 conn = tcon->compat;
4443
4444 if (IS_IPC(conn)) {
4445 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4446 return false;
4447 }
4448 if (IS_PRINT(conn)) {
4449 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4450 return false;
4451 }
4452 doff = SVAL(inbuf,smb_vwv11);
4453
4454 numtowrite = SVAL(inbuf,smb_vwv10);
4455
4456 if (len > doff && len - doff > 0xFFFF) {
4457 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4458 }
4459
4460 if (numtowrite == 0) {
4461 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4462 return false;
4463 }
4464
4465 /* Ensure the sizes match up. */
4466 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4467 /* no pad byte...old smbclient :-( */
4468 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4469 (unsigned int)doff,
4470 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4471 return false;
4472 }
4473
4474 if (len - doff != numtowrite) {
4475 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4476 "len = %u, doff = %u, numtowrite = %u\n",
4477 (unsigned int)len,
4478 (unsigned int)doff,
4479 (unsigned int)numtowrite ));
4480 return false;
4481 }
4482
4483 DEBUG(10,("is_valid_writeX_buffer: true "
4484 "len = %u, doff = %u, numtowrite = %u\n",
4485 (unsigned int)len,
4486 (unsigned int)doff,
4487 (unsigned int)numtowrite ));
4488
4489 return true;
4490 }
4491
4492 /****************************************************************************
4493 Reply to a write and X.
4494 ****************************************************************************/
4495
4496 void reply_write_and_X(struct smb_request *req)
4497 {
4498 connection_struct *conn = req->conn;
4499 files_struct *fsp;
4500 struct lock_struct lock;
4501 off_t startpos;
4502 size_t numtowrite;
4503 bool write_through;
4504 ssize_t nwritten;
4505 unsigned int smb_doff;
4506 unsigned int smblen;
4507 const char *data;
4508 NTSTATUS status;
4509 int saved_errno = 0;
4510
4511 START_PROFILE(SMBwriteX);
4512
4513 if ((req->wct != 12) && (req->wct != 14)) {
4514 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4515 goto out;
4516 }
4517
4518 numtowrite = SVAL(req->vwv+10, 0);
4519 smb_doff = SVAL(req->vwv+11, 0);
4520 smblen = smb_len(req->inbuf);
4521
4522 if (req->unread_bytes > 0xFFFF ||
4523 (smblen > smb_doff &&
4524 smblen - smb_doff > 0xFFFF)) {
4525 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4526 }
4527
4528 if (req->unread_bytes) {
4529 /* Can't do a recvfile write on IPC$ */
4530 if (IS_IPC(conn)) {
4531 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4532 goto out;
4533 }
4534 if (numtowrite != req->unread_bytes) {
4535 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4536 goto out;
4537 }
4538 } else {
4539 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4540 smb_doff + numtowrite > smblen) {
4541 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4542 goto out;
4543 }
4544 }
4545
4546 /* If it's an IPC, pass off the pipe handler. */
4547 if (IS_IPC(conn)) {
4548 if (req->unread_bytes) {
4549 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4550 goto out;
4551 }
4552 reply_pipe_write_and_X(req);
4553 goto out;
4554 }
4555
4556 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4557 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4558 write_through = BITSETW(req->vwv+7,0);
4559
4560 if (!check_fsp(conn, req, fsp)) {
4561 goto out;
4562 }
4563
4564 if (!CHECK_WRITE(fsp)) {
4565 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4566 goto out;
4567 }
4568
4569 data = smb_base(req->inbuf) + smb_doff;
4570
4571 if(req->wct == 14) {
4572 /*
4573 * This is a large offset (64 bit) write.
4574 */
4575 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4576
4577 }
4578
4579 /* X/Open SMB protocol says that, unlike SMBwrite
4580 if the length is zero then NO truncation is
4581 done, just a write of zero. To truncate a file,
4582 use SMBwrite. */
4583
4584 if(numtowrite == 0) {
4585 nwritten = 0;
4586 } else {
4587 if (req->unread_bytes == 0) {
4588 status = schedule_aio_write_and_X(conn,
4589 req,
4590 fsp,
4591 data,
4592 startpos,
4593 numtowrite);
4594
4595 if (NT_STATUS_IS_OK(status)) {
4596 /* write scheduled - we're done. */
4597 goto out;
4598 }
4599 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4600 /* Real error - report to client. */
4601 reply_nterror(req, status);
4602 goto out;
4603 }
4604 /* NT_STATUS_RETRY - fall through to sync write. */
4605 }
4606
4607 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4608 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4609 &lock);
4610
4611 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4612 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4613 goto out;
4614 }
4615
4616 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4617 saved_errno = errno;
4618
4619 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4620 }
4621
4622 if(nwritten < 0) {
4623 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4624 goto out;
4625 }
4626
4627 if((nwritten == 0) && (numtowrite != 0)) {
4628 reply_nterror(req, NT_STATUS_DISK_FULL);
4629 goto out;
4630 }
4631
4632 reply_outbuf(req, 6, 0);
4633 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4634 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4635 SSVAL(req->outbuf,smb_vwv2,nwritten);
4636 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4637
4638 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4639 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4640
4641 status = sync_file(conn, fsp, write_through);
4642 if (!NT_STATUS_IS_OK(status)) {
4643 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4644 fsp_str_dbg(fsp), nt_errstr(status)));
4645 reply_nterror(req, status);
4646 goto out;
4647 }
4648
4649 END_PROFILE(SMBwriteX);
4650 return;
4651
4652 out:
4653 if (req->unread_bytes) {
4654 /* writeX failed. drain socket. */
4655 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4656 req->unread_bytes) {
4657 smb_panic("failed to drain pending bytes");
4658 }
4659 req->unread_bytes = 0;
4660 }
4661
4662 END_PROFILE(SMBwriteX);
4663 return;
4664 }
4665
4666 /****************************************************************************
4667 Reply to a lseek.
4668 ****************************************************************************/
4669
4670 void reply_lseek(struct smb_request *req)
4671 {
4672 connection_struct *conn = req->conn;
4673 off_t startpos;
4674 off_t res= -1;
4675 int mode,umode;
4676 files_struct *fsp;
4677
4678 START_PROFILE(SMBlseek);
4679
4680 if (req->wct < 4) {
4681 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4682 END_PROFILE(SMBlseek);
4683 return;
4684 }
4685
4686 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4687
4688 if (!check_fsp(conn, req, fsp)) {
4689 return;
4690 }
4691
4692 flush_write_cache(fsp, SEEK_FLUSH);
4693
4694 mode = SVAL(req->vwv+1, 0) & 3;
4695 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4696 startpos = (off_t)IVALS(req->vwv+2, 0);
4697
4698 switch (mode) {
4699 case 0:
4700 umode = SEEK_SET;
4701 res = startpos;
4702 break;
4703 case 1:
4704 umode = SEEK_CUR;
4705 res = fsp->fh->pos + startpos;
4706 break;
4707 case 2:
4708 umode = SEEK_END;
4709 break;
4710 default:
4711 umode = SEEK_SET;
4712 res = startpos;
4713 break;
4714 }
4715
4716 if (umode == SEEK_END) {
4717 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4718 if(errno == EINVAL) {
4719 off_t current_pos = startpos;
4720
4721 if(fsp_stat(fsp) == -1) {
4722 reply_nterror(req,
4723 map_nt_error_from_unix(errno));
4724 END_PROFILE(SMBlseek);
4725 return;
4726 }
4727
4728 current_pos += fsp->fsp_name->st.st_ex_size;
4729 if(current_pos < 0)
4730 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4731 }
4732 }
4733
4734 if(res == -1) {
4735 reply_nterror(req, map_nt_error_from_unix(errno));
4736 END_PROFILE(SMBlseek);
4737 return;
4738 }
4739 }
4740
4741 fsp->fh->pos = res;
4742
4743 reply_outbuf(req, 2, 0);
4744 SIVAL(req->outbuf,smb_vwv0,res);
4745
4746 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4747 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4748
4749 END_PROFILE(SMBlseek);
4750 return;
4751 }
4752
4753 /****************************************************************************
4754 Reply to a flush.
4755 ****************************************************************************/
4756
4757 void reply_flush(struct smb_request *req)
4758 {
4759 connection_struct *conn = req->conn;
4760 uint16 fnum;
4761 files_struct *fsp;
4762
4763 START_PROFILE(SMBflush);
4764
4765 if (req->wct < 1) {
4766 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4767 return;
4768 }
4769
4770 fnum = SVAL(req->vwv+0, 0);
4771 fsp = file_fsp(req, fnum);
4772
4773 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4774 return;
4775 }
4776
4777 if (!fsp) {
4778 file_sync_all(conn);
4779 } else {
4780 NTSTATUS status = sync_file(conn, fsp, True);
4781 if (!NT_STATUS_IS_OK(status)) {
4782 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4783 fsp_str_dbg(fsp), nt_errstr(status)));
4784 reply_nterror(req, status);
4785 END_PROFILE(SMBflush);
4786 return;
4787 }
4788 }
4789
4790 reply_outbuf(req, 0, 0);
4791
4792 DEBUG(3,("flush\n"));
4793 END_PROFILE(SMBflush);
4794 return;
4795 }
4796
4797 /****************************************************************************
4798 Reply to a exit.
4799 conn POINTER CAN BE NULL HERE !
4800 ****************************************************************************/
4801
4802 void reply_exit(struct smb_request *req)
4803 {
4804 START_PROFILE(SMBexit);
4805
4806 file_close_pid(req->sconn, req->smbpid, req->vuid);
4807
4808 reply_outbuf(req, 0, 0);
4809
4810 DEBUG(3,("exit\n"));
4811
4812 END_PROFILE(SMBexit);
4813 return;
4814 }
4815
4816 struct reply_close_state {
4817 files_struct *fsp;
4818 struct smb_request *smbreq;
4819 };
4820
4821 static void do_smb1_close(struct tevent_req *req);
4822
4823 void reply_close(struct smb_request *req)
4824 {
4825 connection_struct *conn = req->conn;
4826 NTSTATUS status = NT_STATUS_OK;
4827 files_struct *fsp = NULL;
4828 START_PROFILE(SMBclose);
4829
4830 if (req->wct < 3) {
4831 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4832 END_PROFILE(SMBclose);
4833 return;
4834 }
4835
4836 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4837
4838 /*
4839 * We can only use check_fsp if we know it's not a directory.
4840 */
4841
4842 if (!check_fsp_open(conn, req, fsp)) {
4843 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4844 END_PROFILE(SMBclose);
4845 return;
4846 }
4847
4848 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
4849 fsp->is_directory ? "directory" : "file",
4850 fsp->fh->fd, fsp_fnum_dbg(fsp),
4851 conn->num_files_open));
4852
4853 if (!fsp->is_directory) {
4854 time_t t;
4855
4856 /*
4857 * Take care of any time sent in the close.
4858 */
4859
4860 t = srv_make_unix_date3(req->vwv+1);
4861 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4862 }
4863
4864 if (fsp->num_aio_requests != 0) {
4865
4866 struct reply_close_state *state;
4867
4868 DEBUG(10, ("closing with aio %u requests pending\n",
4869 fsp->num_aio_requests));
4870
4871 /*
4872 * We depend on the aio_extra destructor to take care of this
4873 * close request once fsp->num_aio_request drops to 0.
4874 */
4875
4876 fsp->deferred_close = tevent_wait_send(
4877 fsp, fsp->conn->sconn->ev_ctx);
4878 if (fsp->deferred_close == NULL) {
4879 status = NT_STATUS_NO_MEMORY;
4880 goto done;
4881 }
4882
4883 state = talloc(fsp, struct reply_close_state);
4884 if (state == NULL) {
4885 TALLOC_FREE(fsp->deferred_close);
4886 status = NT_STATUS_NO_MEMORY;
4887 goto done;
4888 }
4889 state->fsp = fsp;
4890 state->smbreq = talloc_move(fsp, &req);
4891 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
4892 state);
4893 END_PROFILE(SMBclose);
4894 return;
4895 }
4896
4897 /*
4898 * close_file() returns the unix errno if an error was detected on
4899 * close - normally this is due to a disk full error. If not then it
4900 * was probably an I/O error.
4901 */
4902
4903 status = close_file(req, fsp, NORMAL_CLOSE);
4904 done:
4905 if (!NT_STATUS_IS_OK(status)) {
4906 reply_nterror(req, status);
4907 END_PROFILE(SMBclose);
4908 return;
4909 }
4910
4911 reply_outbuf(req, 0, 0);
4912 END_PROFILE(SMBclose);
4913 return;
4914 }
4915
4916 static void do_smb1_close(struct tevent_req *req)
4917 {
4918 struct reply_close_state *state = tevent_req_callback_data(
4919 req, struct reply_close_state);
4920 struct smb_request *smbreq;
4921 NTSTATUS status;
4922 int ret;
4923
4924 ret = tevent_wait_recv(req);
4925 TALLOC_FREE(req);
4926 if (ret != 0) {
4927 DEBUG(10, ("tevent_wait_recv returned %s\n",
4928 strerror(ret)));
4929 /*
4930 * Continue anyway, this should never happen
4931 */
4932 }
4933
4934 /*
4935 * fsp->smb2_close_request right now is a talloc grandchild of
4936 * fsp. When we close_file(fsp), it would go with it. No chance to
4937 * reply...
4938 */
4939 smbreq = talloc_move(talloc_tos(), &state->smbreq);
4940
4941 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
4942 if (NT_STATUS_IS_OK(status)) {
4943 reply_outbuf(smbreq, 0, 0);
4944 } else {
4945 reply_nterror(smbreq, status);
4946 }
4947 if (!srv_send_smb(smbreq->sconn,
4948 (char *)smbreq->outbuf,
4949 true,
4950 smbreq->seqnum+1,
4951 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
4952 NULL)) {
4953 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
4954 "failed.");
4955 }
4956 TALLOC_FREE(smbreq);
4957 }
4958
4959 /****************************************************************************
4960 Reply to a writeclose (Core+ protocol).
4961 ****************************************************************************/
4962
4963 void reply_writeclose(struct smb_request *req)
4964 {
4965 connection_struct *conn = req->conn;
4966 size_t numtowrite;
4967 ssize_t nwritten = -1;
4968 NTSTATUS close_status = NT_STATUS_OK;
4969 off_t startpos;
4970 const char *data;
4971 struct timespec mtime;
4972 files_struct *fsp;
4973 struct lock_struct lock;
4974
4975 START_PROFILE(SMBwriteclose);
4976
4977 if (req->wct < 6) {
4978 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4979 END_PROFILE(SMBwriteclose);
4980 return;
4981 }
4982
4983 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4984
4985 if (!check_fsp(conn, req, fsp)) {
4986 END_PROFILE(SMBwriteclose);
4987 return;
4988 }
4989 if (!CHECK_WRITE(fsp)) {
4990 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4991 END_PROFILE(SMBwriteclose);
4992 return;
4993 }
4994
4995 numtowrite = SVAL(req->vwv+1, 0);
4996 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4997 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4998 data = (const char *)req->buf + 1;
4999
5000 if (!fsp->print_file) {
5001 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5002 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5003 &lock);
5004
5005 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5006 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5007 END_PROFILE(SMBwriteclose);
5008 return;
5009 }
5010 }
5011
5012 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5013
5014 set_close_write_time(fsp, mtime);
5015
5016 /*
5017 * More insanity. W2K only closes the file if writelen > 0.
5018 * JRA.
5019 */
5020
5021 if (numtowrite) {
5022 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5023 "file %s\n", fsp_str_dbg(fsp)));
5024 close_status = close_file(req, fsp, NORMAL_CLOSE);
5025 }
5026
5027 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5028 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5029 conn->num_files_open));
5030
5031 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5032 reply_nterror(req, NT_STATUS_DISK_FULL);
5033 goto strict_unlock;
5034 }
5035
5036 if(!NT_STATUS_IS_OK(close_status)) {
5037 reply_nterror(req, close_status);
5038 goto strict_unlock;
5039 }
5040
5041 reply_outbuf(req, 1, 0);
5042
5043 SSVAL(req->outbuf,smb_vwv0,nwritten);
5044
5045 strict_unlock:
5046 if (numtowrite && !fsp->print_file) {
5047 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5048 }
5049
5050 END_PROFILE(SMBwriteclose);
5051 return;
5052 }
5053
5054 #undef DBGC_CLASS
5055 #define DBGC_CLASS DBGC_LOCKING
5056
5057 /****************************************************************************
5058 Reply to a lock.
5059 ****************************************************************************/
5060
5061 void reply_lock(struct smb_request *req)
5062 {
5063 connection_struct *conn = req->conn;
5064 uint64_t count,offset;
5065 NTSTATUS status;
5066 files_struct *fsp;
5067 struct byte_range_lock *br_lck = NULL;
5068
5069 START_PROFILE(SMBlock);
5070
5071 if (req->wct < 5) {
5072 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5073 END_PROFILE(SMBlock);
5074 return;
5075 }
5076
5077 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5078
5079 if (!check_fsp(conn, req, fsp)) {
5080 END_PROFILE(SMBlock);
5081 return;
5082 }
5083
5084 count = (uint64_t)IVAL(req->vwv+1, 0);
5085 offset = (uint64_t)IVAL(req->vwv+3, 0);
5086
5087 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5088 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5089
5090 br_lck = do_lock(req->sconn->msg_ctx,
5091 fsp,
5092 (uint64_t)req->smbpid,
5093 count,
5094 offset,
5095 WRITE_LOCK,
5096 WINDOWS_LOCK,
5097 False, /* Non-blocking lock. */
5098 &status,
5099 NULL,
5100 NULL);
5101
5102 TALLOC_FREE(br_lck);
5103
5104 if (NT_STATUS_V(status)) {
5105 reply_nterror(req, status);
5106 END_PROFILE(SMBlock);
5107 return;
5108 }
5109
5110 reply_outbuf(req, 0, 0);
5111
5112 END_PROFILE(SMBlock);
5113 return;
5114 }
5115
5116 /****************************************************************************
5117 Reply to a unlock.
5118 ****************************************************************************/
5119
5120 void reply_unlock(struct smb_request *req)
5121 {
5122 connection_struct *conn = req->conn;
5123 uint64_t count,offset;
5124 NTSTATUS status;
5125 files_struct *fsp;
5126
5127 START_PROFILE(SMBunlock);
5128
5129 if (req->wct < 5) {
5130 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5131 END_PROFILE(SMBunlock);
5132 return;
5133 }
5134
5135 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5136
5137 if (!check_fsp(conn, req, fsp)) {
5138 END_PROFILE(SMBunlock);
5139 return;
5140 }
5141
5142 count = (uint64_t)IVAL(req->vwv+1, 0);
5143 offset = (uint64_t)IVAL(req->vwv+3, 0);
5144
5145 status = do_unlock(req->sconn->msg_ctx,
5146 fsp,
5147 (uint64_t)req->smbpid,
5148 count,
5149 offset,
5150 WINDOWS_LOCK);
5151
5152 if (NT_STATUS_V(status)) {
5153 reply_nterror(req, status);
5154 END_PROFILE(SMBunlock);
5155 return;
5156 }
5157
5158 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5159 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5160
5161 reply_outbuf(req, 0, 0);
5162
5163 END_PROFILE(SMBunlock);
5164 return;
5165 }
5166
5167 #undef DBGC_CLASS
5168 #define DBGC_CLASS DBGC_ALL
5169
5170 /****************************************************************************
5171 Reply to a tdis.
5172 conn POINTER CAN BE NULL HERE !
5173 ****************************************************************************/
5174
5175 void reply_tdis(struct smb_request *req)
5176 {
5177 NTSTATUS status;
5178 connection_struct *conn = req->conn;
5179 struct smbXsrv_tcon *tcon;
5180
5181 START_PROFILE(SMBtdis);
5182
5183 if (!conn) {
5184 DEBUG(4,("Invalid connection in tdis\n"));
5185 reply_force_doserror(req, ERRSRV, ERRinvnid);
5186 END_PROFILE(SMBtdis);
5187 return;
5188 }
5189
5190 tcon = conn->tcon;
5191 req->conn = NULL;
5192
5193 /*
5194 * TODO: cancel all outstanding requests on the tcon
5195 */
5196 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5197 if (!NT_STATUS_IS_OK(status)) {
5198 DEBUG(0, ("reply_tdis: "
5199 "smbXsrv_tcon_disconnect() failed: %s\n",
5200 nt_errstr(status)));
5201 /*
5202 * If we hit this case, there is something completely
5203 * wrong, so we better disconnect the transport connection.
5204 */
5205 END_PROFILE(SMBtdis);
5206 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5207 return;
5208 }
5209
5210 TALLOC_FREE(tcon);
5211
5212 reply_outbuf(req, 0, 0);
5213 END_PROFILE(SMBtdis);
5214 return;
5215 }
5216
5217 /****************************************************************************
5218 Reply to a echo.
5219 conn POINTER CAN BE NULL HERE !
5220 ****************************************************************************/
5221
5222 void reply_echo(struct smb_request *req)
5223 {
5224 connection_struct *conn = req->conn;
5225 struct smb_perfcount_data local_pcd;
5226 struct smb_perfcount_data *cur_pcd;
5227 int smb_reverb;
5228 int seq_num;
5229
5230 START_PROFILE(SMBecho);
5231
5232 smb_init_perfcount_data(&local_pcd);
5233
5234 if (req->wct < 1) {
5235 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5236 END_PROFILE(SMBecho);
5237 return;
5238 }
5239
5240 smb_reverb = SVAL(req->vwv+0, 0);
5241
5242 reply_outbuf(req, 1, req->buflen);
5243
5244 /* copy any incoming data back out */
5245 if (req->buflen > 0) {
5246 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5247 }
5248
5249 if (smb_reverb > 100) {
5250 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5251 smb_reverb = 100;
5252 }
5253
5254 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5255
5256 /* this makes sure we catch the request pcd */
5257 if (seq_num == smb_reverb) {
5258 cur_pcd = &req->pcd;
5259 } else {
5260 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5261 cur_pcd = &local_pcd;
5262 }
5263
5264 SSVAL(req->outbuf,smb_vwv0,seq_num);
5265
5266 show_msg((char *)req->outbuf);
5267 if (!srv_send_smb(req->sconn,
5268 (char *)req->outbuf,
5269 true, req->seqnum+1,
5270 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5271 cur_pcd))
5272 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5273 }
5274
5275 DEBUG(3,("echo %d times\n", smb_reverb));
5276
5277 TALLOC_FREE(req->outbuf);
5278
5279 END_PROFILE(SMBecho);
5280 return;
5281 }
5282
5283 /****************************************************************************
5284 Reply to a printopen.
5285 ****************************************************************************/
5286
5287 void reply_printopen(struct smb_request *req)
5288 {
5289 connection_struct *conn = req->conn;
5290 files_struct *fsp;
5291 NTSTATUS status;
5292
5293 START_PROFILE(SMBsplopen);
5294
5295 if (req->wct < 2) {
5296 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5297 END_PROFILE(SMBsplopen);
5298 return;
5299 }
5300
5301 if (!CAN_PRINT(conn)) {
5302 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5303 END_PROFILE(SMBsplopen);
5304 return;
5305 }
5306
5307 status = file_new(req, conn, &fsp);
5308 if(!NT_STATUS_IS_OK(status)) {
5309 reply_nterror(req, status);
5310 END_PROFILE(SMBsplopen);
5311 return;
5312 }
5313
5314 /* Open for exclusive use, write only. */
5315 status = print_spool_open(fsp, NULL, req->vuid);
5316
5317 if (!NT_STATUS_IS_OK(status)) {
5318 file_free(req, fsp);
5319 reply_nterror(req, status);
5320 END_PROFILE(SMBsplopen);
5321 return;
5322 }
5323
5324 reply_outbuf(req, 1, 0);
5325 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5326
5327 DEBUG(3,("openprint fd=%d %s\n",
5328 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5329
5330 END_PROFILE(SMBsplopen);
5331 return;
5332 }
5333
5334 /****************************************************************************
5335 Reply to a printclose.
5336 ****************************************************************************/
5337
5338 void reply_printclose(struct smb_request *req)
5339 {
5340 connection_struct *conn = req->conn;
5341 files_struct *fsp;
5342 NTSTATUS status;
5343
5344 START_PROFILE(SMBsplclose);
5345
5346 if (req->wct < 1) {
5347 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5348 END_PROFILE(SMBsplclose);
5349 return;
5350 }
5351
5352 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5353
5354 if (!check_fsp(conn, req, fsp)) {
5355 END_PROFILE(SMBsplclose);
5356 return;
5357 }
5358
5359 if (!CAN_PRINT(conn)) {
5360 reply_force_doserror(req, ERRSRV, ERRerror);
5361 END_PROFILE(SMBsplclose);
5362 return;
5363 }
5364
5365 DEBUG(3,("printclose fd=%d %s\n",
5366 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5367
5368 status = close_file(req, fsp, NORMAL_CLOSE);
5369
5370 if(!NT_STATUS_IS_OK(status)) {
5371 reply_nterror(req, status);
5372 END_PROFILE(SMBsplclose);
5373 return;
5374 }
5375
5376 reply_outbuf(req, 0, 0);
5377
5378 END_PROFILE(SMBsplclose);
5379 return;
5380 }
5381
5382 /****************************************************************************
5383 Reply to a printqueue.
5384 ****************************************************************************/
5385
5386 void reply_printqueue(struct smb_request *req)
5387 {
5388 connection_struct *conn = req->conn;
5389 int max_count;
5390 int start_index;
5391
5392 START_PROFILE(SMBsplretq);
5393
5394 if (req->wct < 2) {
5395 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5396 END_PROFILE(SMBsplretq);
5397 return;
5398 }
5399
5400 max_count = SVAL(req->vwv+0, 0);
5401 start_index = SVAL(req->vwv+1, 0);
5402
5403 /* we used to allow the client to get the cnum wrong, but that
5404 is really quite gross and only worked when there was only
5405 one printer - I think we should now only accept it if they
5406 get it right (tridge) */
5407 if (!CAN_PRINT(conn)) {
5408 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5409 END_PROFILE(SMBsplretq);
5410 return;
5411 }
5412
5413 reply_outbuf(req, 2, 3);
5414 SSVAL(req->outbuf,smb_vwv0,0);
5415 SSVAL(req->outbuf,smb_vwv1,0);
5416 SCVAL(smb_buf(req->outbuf),0,1);
5417 SSVAL(smb_buf(req->outbuf),1,0);
5418
5419 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5420 start_index, max_count));
5421
5422 {
5423 TALLOC_CTX *mem_ctx = talloc_tos();
5424 NTSTATUS status;
5425 WERROR werr;
5426 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5427 struct rpc_pipe_client *cli = NULL;
5428 struct dcerpc_binding_handle *b = NULL;
5429 struct policy_handle handle;
5430 struct spoolss_DevmodeContainer devmode_ctr;
5431 union spoolss_JobInfo *info;
5432 uint32_t count;
5433 uint32_t num_to_get;
5434 uint32_t first;
5435 uint32_t i;
5436
5437 ZERO_STRUCT(handle);
5438
5439 status = rpc_pipe_open_interface(conn,
5440 &ndr_table_spoolss.syntax_id,
5441 conn->session_info,
5442 conn->sconn->remote_address,
5443 conn->sconn->msg_ctx,
5444 &cli);
5445 if (!NT_STATUS_IS_OK(status)) {
5446 DEBUG(0, ("reply_printqueue: "
5447 "could not connect to spoolss: %s\n",
5448 nt_errstr(status)));
5449 reply_nterror(req, status);
5450 goto out;
5451 }
5452 b = cli->binding_handle;
5453
5454 ZERO_STRUCT(devmode_ctr);
5455
5456 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5457 sharename,
5458 NULL, devmode_ctr,
5459 SEC_FLAG_MAXIMUM_ALLOWED,
5460 &handle,
5461 &werr);
5462 if (!NT_STATUS_IS_OK(status)) {
5463 reply_nterror(req, status);
5464 goto out;
5465 }
5466 if (!W_ERROR_IS_OK(werr)) {
5467 reply_nterror(req, werror_to_ntstatus(werr));
5468 goto out;
5469 }
5470
5471 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5472 &handle,
5473 0, /* firstjob */
5474 0xff, /* numjobs */
5475 2, /* level */
5476 0, /* offered */
5477 &count,
5478 &info);
5479 if (!W_ERROR_IS_OK(werr)) {
5480 reply_nterror(req, werror_to_ntstatus(werr));
5481 goto out;
5482 }
5483
5484 if (max_count > 0) {
5485 first = start_index;
5486 } else {
5487 first = start_index + max_count + 1;
5488 }
5489
5490 if (first >= count) {
5491 num_to_get = first;
5492 } else {
5493 num_to_get = first + MIN(ABS(max_count), count - first);
5494 }
5495
5496 for (i = first; i < num_to_get; i++) {
5497 char blob[28];
5498 char *p = blob;
5499 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5500 int qstatus;
5501 uint16_t qrapjobid = pjobid_to_rap(sharename,
5502 info[i].info2.job_id);
5503
5504 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5505 qstatus = 2;
5506 } else {
5507 qstatus = 3;
5508 }
5509
5510 srv_put_dos_date2(p, 0, qtime);
5511 SCVAL(p, 4, qstatus);
5512 SSVAL(p, 5, qrapjobid);
5513 SIVAL(p, 7, info[i].info2.size);
5514 SCVAL(p, 11, 0);
5515 srvstr_push(blob, req->flags2, p+12,
5516 info[i].info2.notify_name, 16, STR_ASCII);
5517
5518 if (message_push_blob(
5519 &req->outbuf,
5520 data_blob_const(
5521 blob, sizeof(blob))) == -1) {
5522 reply_nterror(req, NT_STATUS_NO_MEMORY);
5523 goto out;
5524 }
5525 }
5526
5527 if (count > 0) {
5528 SSVAL(req->outbuf,smb_vwv0,count);
5529 SSVAL(req->outbuf,smb_vwv1,
5530 (max_count>0?first+count:first-1));
5531 SCVAL(smb_buf(req->outbuf),0,1);
5532 SSVAL(smb_buf(req->outbuf),1,28*count);
5533 }
5534
5535
5536 DEBUG(3, ("%u entries returned in queue\n",
5537 (unsigned)count));
5538
5539 out:
5540 if (b && is_valid_policy_hnd(&handle)) {
5541 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5542 }
5543
5544 }
5545
5546 END_PROFILE(SMBsplretq);
5547 return;
5548 }
5549
5550 /****************************************************************************
5551 Reply to a printwrite.
5552 ****************************************************************************/
5553
5554 void reply_printwrite(struct smb_request *req)
5555 {
5556 connection_struct *conn = req->conn;
5557 int numtowrite;
5558 const char *data;
5559 files_struct *fsp;
5560
5561 START_PROFILE(SMBsplwr);
5562
5563 if (req->wct < 1) {
5564 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5565 END_PROFILE(SMBsplwr);
5566 return;
5567 }
5568
5569 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5570
5571 if (!check_fsp(conn, req, fsp)) {
5572 END_PROFILE(SMBsplwr);
5573 return;
5574 }
5575
5576 if (!fsp->print_file) {
5577 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5578 END_PROFILE(SMBsplwr);
5579 return;
5580 }
5581
5582 if (!CHECK_WRITE(fsp)) {
5583 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5584 END_PROFILE(SMBsplwr);
5585 return;
5586 }
5587
5588 numtowrite = SVAL(req->buf, 1);
5589
5590 if (req->buflen < numtowrite + 3) {
5591 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5592 END_PROFILE(SMBsplwr);
5593 return;
5594 }
5595
5596 data = (const char *)req->buf + 3;
5597
5598 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5599 reply_nterror(req, map_nt_error_from_unix(errno));
5600 END_PROFILE(SMBsplwr);
5601 return;
5602 }
5603
5604 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5605
5606 END_PROFILE(SMBsplwr);
5607 return;
5608 }
5609
5610 /****************************************************************************
5611 Reply to a mkdir.
5612 ****************************************************************************/
5613
5614 void reply_mkdir(struct smb_request *req)
5615 {
5616 connection_struct *conn = req->conn;
5617 struct smb_filename *smb_dname = NULL;
5618 char *directory = NULL;
5619 NTSTATUS status;
5620 TALLOC_CTX *ctx = talloc_tos();
5621
5622 START_PROFILE(SMBmkdir);
5623
5624 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5625 STR_TERMINATE, &status);
5626 if (!NT_STATUS_IS_OK(status)) {
5627 reply_nterror(req, status);
5628 goto out;
5629 }
5630
5631 status = filename_convert(ctx, conn,
5632 req->flags2 & FLAGS2_DFS_PATHNAMES,
5633 directory,
5634 0,
5635 NULL,
5636 &smb_dname);
5637 if (!NT_STATUS_IS_OK(status)) {
5638 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5639 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5640 ERRSRV, ERRbadpath);
5641 goto out;
5642 }
5643 reply_nterror(req, status);
5644 goto out;
5645 }
5646
5647 status = create_directory(conn, req, smb_dname);
5648
5649 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5650
5651 if (!NT_STATUS_IS_OK(status)) {
5652
5653 if (!use_nt_status()
5654 && NT_STATUS_EQUAL(status,
5655 NT_STATUS_OBJECT_NAME_COLLISION)) {
5656 /*
5657 * Yes, in the DOS error code case we get a
5658 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5659 * samba4 torture test.
5660 */
5661 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5662 }
5663
5664 reply_nterror(req, status);
5665 goto out;
5666 }
5667
5668 reply_outbuf(req, 0, 0);
5669
5670 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5671 out:
5672 TALLOC_FREE(smb_dname);
5673 END_PROFILE(SMBmkdir);
5674 return;
5675 }
5676
5677 /****************************************************************************
5678 Reply to a rmdir.
5679 ****************************************************************************/
5680
5681 void reply_rmdir(struct smb_request *req)
5682 {
5683 connection_struct *conn = req->conn;
5684 struct smb_filename *smb_dname = NULL;
5685 char *directory = NULL;
5686 NTSTATUS status;
5687 TALLOC_CTX *ctx = talloc_tos();
5688 files_struct *fsp = NULL;
5689 int info = 0;
5690 struct smbd_server_connection *sconn = req->sconn;
5691
5692 START_PROFILE(SMBrmdir);
5693
5694 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5695 STR_TERMINATE, &status);
5696 if (!NT_STATUS_IS_OK(status)) {
5697 reply_nterror(req, status);
5698 goto out;
5699 }
5700
5701 status = filename_convert(ctx, conn,
5702 req->flags2 & FLAGS2_DFS_PATHNAMES,
5703 directory,
5704 0,
5705 NULL,
5706 &smb_dname);
5707 if (!NT_STATUS_IS_OK(status)) {
5708 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5709 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5710 ERRSRV, ERRbadpath);
5711 goto out;
5712 }
5713 reply_nterror(req, status);
5714 goto out;
5715 }
5716
5717 if (is_ntfs_stream_smb_fname(smb_dname)) {
5718 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5719 goto out;
5720 }
5721
5722 status = SMB_VFS_CREATE_FILE(
5723 conn, /* conn */
5724 req, /* req */
5725 0, /* root_dir_fid */
5726 smb_dname, /* fname */
5727 DELETE_ACCESS, /* access_mask */
5728 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5729 FILE_SHARE_DELETE),
5730 FILE_OPEN, /* create_disposition*/
5731 FILE_DIRECTORY_FILE, /* create_options */
5732 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5733 0, /* oplock_request */
5734 0, /* allocation_size */
5735 0, /* private_flags */
5736 NULL, /* sd */
5737 NULL, /* ea_list */
5738 &fsp, /* result */
5739 &info); /* pinfo */
5740
5741 if (!NT_STATUS_IS_OK(status)) {
5742 if (open_was_deferred(req->sconn, req->mid)) {
5743 /* We have re-scheduled this call. */
5744 goto out;
5745 }
5746 reply_nterror(req, status);
5747 goto out;
5748 }
5749
5750 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5751 if (!NT_STATUS_IS_OK(status)) {
5752 close_file(req, fsp, ERROR_CLOSE);
5753 reply_nterror(req, status);
5754 goto out;
5755 }
5756
5757 if (!set_delete_on_close(fsp, true,
5758 conn->session_info->security_token,
5759 conn->session_info->unix_token)) {
5760 close_file(req, fsp, ERROR_CLOSE);
5761 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5762 goto out;
5763 }
5764
5765 status = close_file(req, fsp, NORMAL_CLOSE);
5766 if (!NT_STATUS_IS_OK(status)) {
5767 reply_nterror(req, status);
5768 } else {
5769 reply_outbuf(req, 0, 0);
5770 }
5771
5772 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5773
5774 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5775 out:
5776 TALLOC_FREE(smb_dname);
5777 END_PROFILE(SMBrmdir);
5778 return;
5779 }
5780
5781 /*******************************************************************
5782 Resolve wildcards in a filename rename.
5783 ********************************************************************/
5784
5785 static bool resolve_wildcards(TALLOC_CTX *ctx,
5786 const char *name1,
5787 const char *name2,
5788 char **pp_newname)
5789 {
5790 char *name2_copy = NULL;
5791 char *root1 = NULL;
5792 char *root2 = NULL;
5793 char *ext1 = NULL;
5794 char *ext2 = NULL;
5795 char *p,*p2, *pname1, *pname2;
5796
5797 name2_copy = talloc_strdup(ctx, name2);
5798 if (!name2_copy) {
5799 return False;
5800 }
5801
5802 pname1 = strrchr_m(name1,'/');
5803 pname2 = strrchr_m(name2_copy,'/');
5804
5805 if (!pname1 || !pname2) {
5806 return False;
5807 }
5808
5809 /* Truncate the copy of name2 at the last '/' */
5810 *pname2 = '\0';
5811
5812 /* Now go past the '/' */
5813 pname1++;
5814 pname2++;
5815
5816 root1 = talloc_strdup(ctx, pname1);
5817 root2 = talloc_strdup(ctx, pname2);
5818
5819 if (!root1 || !root2) {
5820 return False;
5821 }
5822
5823 p = strrchr_m(root1,'.');
5824 if (p) {
5825 *p = 0;
5826 ext1 = talloc_strdup(ctx, p+1);
5827 } else {
5828 ext1 = talloc_strdup(ctx, "");
5829 }
5830 p = strrchr_m(root2,'.');
5831 if (p) {
5832 *p = 0;
5833 ext2 = talloc_strdup(ctx, p+1);
5834 } else {
5835 ext2 = talloc_strdup(ctx, "");
5836 }
5837
5838 if (!ext1 || !ext2) {
5839 return False;
5840 }
5841
5842 p = root1;
5843 p2 = root2;
5844 while (*p2) {
5845 if (*p2 == '?') {
5846 /* Hmmm. Should this be mb-aware ? */
5847 *p2 = *p;
5848 p2++;
5849 } else if (*p2 == '*') {
5850 *p2 = '\0';
5851 root2 = talloc_asprintf(ctx, "%s%s",
5852 root2,
5853 p);
5854 if (!root2) {
5855 return False;
5856 }
5857 break;
5858 } else {
5859 p2++;
5860 }
5861 if (*p) {
5862 p++;
5863 }
5864 }
5865
5866 p = ext1;
5867 p2 = ext2;
5868 while (*p2) {
5869 if (*p2 == '?') {
5870 /* Hmmm. Should this be mb-aware ? */
5871 *p2 = *p;
5872 p2++;
5873 } else if (*p2 == '*') {
5874 *p2 = '\0';
5875 ext2 = talloc_asprintf(ctx, "%s%s",
5876 ext2,
5877 p);
5878 if (!ext2) {
5879 return False;
5880 }
5881 break;
5882 } else {
5883 p2++;
5884 }
5885 if (*p) {
5886 p++;
5887 }
5888 }
5889
5890 if (*ext2) {
5891 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5892 name2_copy,
5893 root2,
5894 ext2);
5895 } else {
5896 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5897 name2_copy,
5898 root2);
5899 }
5900
5901 if (!*pp_newname) {
5902 return False;
5903 }
5904
5905 return True;
5906 }
5907
5908 /****************************************************************************
5909 Ensure open files have their names updated. Updated to notify other smbd's
5910 asynchronously.
5911 ****************************************************************************/
5912
5913 static void rename_open_files(connection_struct *conn,
5914 struct share_mode_lock *lck,
5915 uint32_t orig_name_hash,
5916 const struct smb_filename *smb_fname_dst)
5917 {
5918 files_struct *fsp;
5919 bool did_rename = False;
5920 NTSTATUS status;
5921 uint32_t new_name_hash = 0;
5922
5923 for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
5924 fsp = file_find_di_next(fsp)) {
5925 /* fsp_name is a relative path under the fsp. To change this for other
5926 sharepaths we need to manipulate relative paths. */
5927 /* TODO - create the absolute path and manipulate the newname
5928 relative to the sharepath. */
5929 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5930 continue;
5931 }
5932 if (fsp->name_hash != orig_name_hash) {
5933 continue;
5934 }
5935 DEBUG(10, ("rename_open_files: renaming file %s "
5936 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
5937 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5938 smb_fname_str_dbg(smb_fname_dst)));
5939
5940 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5941 if (NT_STATUS_IS_OK(status)) {
5942 did_rename = True;
5943 new_name_hash = fsp->name_hash;
5944 }
5945 }
5946
5947 if (!did_rename) {
5948 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5949 "for %s\n", file_id_string_tos(&lck->data->id),
5950 smb_fname_str_dbg(smb_fname_dst)));
5951 }
5952
5953 /* Send messages to all smbd's (not ourself) that the name has changed. */
5954 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5955 orig_name_hash, new_name_hash,
5956 smb_fname_dst);
5957
5958 }
5959
5960 /****************************************************************************
5961 We need to check if the source path is a parent directory of the destination
5962 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5963 refuse the rename with a sharing violation. Under UNIX the above call can
5964 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5965 probably need to check that the client is a Windows one before disallowing
5966 this as a UNIX client (one with UNIX extensions) can know the source is a
5967 symlink and make this decision intelligently. Found by an excellent bug
5968 report from <AndyLiebman@aol.com>.
5969 ****************************************************************************/
5970
5971 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5972 const struct smb_filename *smb_fname_dst)
5973 {
5974 const char *psrc = smb_fname_src->base_name;
5975 const char *pdst = smb_fname_dst->base_name;
5976 size_t slen;
5977
5978 if (psrc[0] == '.' && psrc[1] == '/') {
5979 psrc += 2;
5980 }
5981 if (pdst[0] == '.' && pdst[1] == '/') {
5982 pdst += 2;
5983 }
5984 if ((slen = strlen(psrc)) > strlen(pdst)) {
5985 return False;
5986 }
5987 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5988 }
5989
5990 /*
5991 * Do the notify calls from a rename
5992 */
5993
5994 static void notify_rename(connection_struct *conn, bool is_dir,
5995 const struct smb_filename *smb_fname_src,
5996 const struct smb_filename *smb_fname_dst)
5997 {
5998 char *parent_dir_src = NULL;
5999 char *parent_dir_dst = NULL;
6000 uint32 mask;
6001
6002 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6003 : FILE_NOTIFY_CHANGE_FILE_NAME;
6004
6005 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6006 &parent_dir_src, NULL) ||
6007 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6008 &parent_dir_dst, NULL)) {
6009 goto out;
6010 }
6011
6012 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6013 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6014 smb_fname_src->base_name);
6015 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6016 smb_fname_dst->base_name);
6017 }
6018 else {
6019 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6020 smb_fname_src->base_name);
6021 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6022 smb_fname_dst->base_name);
6023 }
6024
6025 /* this is a strange one. w2k3 gives an additional event for
6026 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6027 files, but not directories */
6028 if (!is_dir) {
6029 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6030 FILE_NOTIFY_CHANGE_ATTRIBUTES
6031 |FILE_NOTIFY_CHANGE_CREATION,
6032 smb_fname_dst->base_name);
6033 }
6034 out:
6035 TALLOC_FREE(parent_dir_src);
6036 TALLOC_FREE(parent_dir_dst);
6037 }
6038
6039 /****************************************************************************
6040 Returns an error if the parent directory for a filename is open in an
6041 incompatible way.
6042 ****************************************************************************/
6043
6044 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6045 const struct smb_filename *smb_fname_dst_in)
6046 {
6047 char *parent_dir = NULL;
6048 struct smb_filename smb_fname_parent;
6049 struct file_id id;
6050 files_struct *fsp = NULL;
6051 int ret;
6052
6053 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6054 &parent_dir, NULL)) {
6055 return NT_STATUS_NO_MEMORY;
6056 }
6057 ZERO_STRUCT(smb_fname_parent);
6058 smb_fname_parent.base_name = parent_dir;
6059
6060 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6061 if (ret == -1) {
6062 return map_nt_error_from_unix(errno);
6063 }
6064
6065 /*
6066 * We're only checking on this smbd here, mostly good
6067 * enough.. and will pass tests.
6068 */
6069
6070 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6071 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6072 fsp = file_find_di_next(fsp)) {
6073 if (fsp->access_mask & DELETE_ACCESS) {
6074 return NT_STATUS_SHARING_VIOLATION;
6075 }
6076 }
6077 return NT_STATUS_OK;
6078 }
6079
6080 /****************************************************************************
6081 Rename an open file - given an fsp.
6082 ****************************************************************************/
6083
6084 NTSTATUS rename_internals_fsp(connection_struct *conn,
6085 files_struct *fsp,
6086 const struct smb_filename *smb_fname_dst_in,
6087 uint32 attrs,
6088 bool replace_if_exists)
6089 {
6090 TALLOC_CTX *ctx = talloc_tos();
6091 struct smb_filename *smb_fname_dst = NULL;
6092 NTSTATUS status = NT_STATUS_OK;
6093 struct share_mode_lock *lck = NULL;
6094 bool dst_exists, old_is_stream, new_is_stream;
6095
6096 status = check_name(conn, smb_fname_dst_in->base_name);
6097 if (!NT_STATUS_IS_OK(status)) {
6098 return status;
6099 }
6100
6101 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6102 if (!NT_STATUS_IS_OK(status)) {
6103 return status;
6104 }
6105
6106 /* Make a copy of the dst smb_fname structs */
6107
6108 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6109 if (!NT_STATUS_IS_OK(status)) {
6110 goto out;
6111 }
6112
6113 /*
6114 * Check for special case with case preserving and not
6115 * case sensitive. If the old last component differs from the original
6116 * last component only by case, then we should allow
6117 * the rename (user is trying to change the case of the
6118 * filename).
6119 */
6120 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6121 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6122 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6123 char *last_slash;
6124 char *fname_dst_lcomp_base_mod = NULL;
6125 struct smb_filename *smb_fname_orig_lcomp = NULL;
6126
6127 /*
6128 * Get the last component of the destination name.
6129 */
6130 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6131 if (last_slash) {
6132 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6133 } else {
6134 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6135 }
6136 if (!fname_dst_lcomp_base_mod) {
6137 status = NT_STATUS_NO_MEMORY;
6138 goto out;
6139 }
6140
6141 /*
6142 * Create an smb_filename struct using the original last
6143 * component of the destination.
6144 */
6145 status = create_synthetic_smb_fname_split(ctx,
6146 smb_fname_dst->original_lcomp, NULL,
6147 &smb_fname_orig_lcomp);
6148 if (!NT_STATUS_IS_OK(status)) {
6149 TALLOC_FREE(fname_dst_lcomp_base_mod);
6150 goto out;
6151 }
6152
6153 /* If the base names only differ by case, use original. */
6154 if(!strcsequal(fname_dst_lcomp_base_mod,
6155 smb_fname_orig_lcomp->base_name)) {
6156 char *tmp;
6157 /*
6158 * Replace the modified last component with the
6159 * original.
6160 */
6161 if (last_slash) {
6162 *last_slash = '\0'; /* Truncate at the '/' */
6163 tmp = talloc_asprintf(smb_fname_dst,
6164 "%s/%s",
6165 smb_fname_dst->base_name,
6166 smb_fname_orig_lcomp->base_name);
6167 } else {
6168 tmp = talloc_asprintf(smb_fname_dst,
6169 "%s",
6170 smb_fname_orig_lcomp->base_name);
6171 }
6172 if (tmp == NULL) {
6173 status = NT_STATUS_NO_MEMORY;
6174 TALLOC_FREE(fname_dst_lcomp_base_mod);
6175 TALLOC_FREE(smb_fname_orig_lcomp);
6176 goto out;
6177 }
6178 TALLOC_FREE(smb_fname_dst->base_name);
6179 smb_fname_dst->base_name = tmp;
6180 }
6181
6182 /* If the stream_names only differ by case, use original. */
6183 if(!strcsequal(smb_fname_dst->stream_name,
6184 smb_fname_orig_lcomp->stream_name)) {
6185 char *tmp = NULL;
6186 /* Use the original stream. */
6187 tmp = talloc_strdup(smb_fname_dst,
6188 smb_fname_orig_lcomp->stream_name);
6189 if (tmp == NULL) {
6190 status = NT_STATUS_NO_MEMORY;
6191 TALLOC_FREE(fname_dst_lcomp_base_mod);
6192 TALLOC_FREE(smb_fname_orig_lcomp);
6193 goto out;
6194 }
6195 TALLOC_FREE(smb_fname_dst->stream_name);
6196 smb_fname_dst->stream_name = tmp;
6197 }
6198 TALLOC_FREE(fname_dst_lcomp_base_mod);
6199 TALLOC_FREE(smb_fname_orig_lcomp);
6200 }
6201
6202 /*
6203 * If the src and dest names are identical - including case,
6204 * don't do the rename, just return success.
6205 */
6206
6207 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6208 strcsequal(fsp->fsp_name->stream_name,
6209 smb_fname_dst->stream_name)) {
6210 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6211 "- returning success\n",
6212 smb_fname_str_dbg(smb_fname_dst)));
6213 status = NT_STATUS_OK;
6214 goto out;
6215 }
6216
6217 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6218 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6219
6220 /* Return the correct error code if both names aren't streams. */
6221 if (!old_is_stream && new_is_stream) {
6222 status = NT_STATUS_OBJECT_NAME_INVALID;
6223 goto out;
6224 }
6225
6226 if (old_is_stream && !new_is_stream) {
6227 status = NT_STATUS_INVALID_PARAMETER;
6228 goto out;
6229 }
6230
6231 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6232
6233 if(!replace_if_exists && dst_exists) {
6234 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6235 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6236 smb_fname_str_dbg(smb_fname_dst)));
6237 status = NT_STATUS_OBJECT_NAME_COLLISION;
6238 goto out;
6239 }
6240
6241 if (dst_exists) {
6242 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6243 &smb_fname_dst->st);
6244 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6245 fileid);
6246 /* The file can be open when renaming a stream */
6247 if (dst_fsp && !new_is_stream) {
6248 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6249 status = NT_STATUS_ACCESS_DENIED;
6250 goto out;
6251 }
6252 }
6253
6254 /* Ensure we have a valid stat struct for the source. */
6255 status = vfs_stat_fsp(fsp);
6256 if (!NT_STATUS_IS_OK(status)) {
6257 goto out;
6258 }
6259
6260 status = can_rename(conn, fsp, attrs);
6261
6262 if (!NT_STATUS_IS_OK(status)) {
6263 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6264 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6265 smb_fname_str_dbg(smb_fname_dst)));
6266 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6267 status = NT_STATUS_ACCESS_DENIED;
6268 goto out;
6269 }
6270
6271 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6272 status = NT_STATUS_ACCESS_DENIED;
6273 }
6274
6275 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6276
6277 /*
6278 * We have the file open ourselves, so not being able to get the
6279 * corresponding share mode lock is a fatal error.
6280 */
6281
6282 SMB_ASSERT(lck != NULL);
6283
6284 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6285 uint32 create_options = fsp->fh->private_options;
6286
6287 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6288 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6289 smb_fname_str_dbg(smb_fname_dst)));
6290
6291 if (!lp_posix_pathnames() &&
6292 (lp_map_archive(SNUM(conn)) ||
6293 lp_store_dos_attributes(SNUM(conn)))) {
6294 /* We must set the archive bit on the newly
6295 renamed file. */
6296 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6297 uint32_t old_dosmode = dos_mode(conn,
6298 smb_fname_dst);
6299 file_set_dosmode(conn,
6300 smb_fname_dst,
6301 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6302 NULL,
6303 true);
6304 }
6305 }
6306
6307 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6308 smb_fname_dst);
6309
6310 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6311
6312 /*
6313 * A rename acts as a new file create w.r.t. allowing an initial delete
6314 * on close, probably because in Windows there is a new handle to the
6315 * new file. If initial delete on close was requested but not
6316 * originally set, we need to set it here. This is probably not 100% correct,
6317 * but will work for the CIFSFS client which in non-posix mode
6318 * depends on these semantics. JRA.
6319 */
6320
6321 if (create_options & FILE_DELETE_ON_CLOSE) {
6322 status = can_set_delete_on_close(fsp, 0);
6323
6324 if (NT_STATUS_IS_OK(status)) {
6325 /* Note that here we set the *inital* delete on close flag,
6326 * not the regular one. The magic gets handled in close. */
6327 fsp->initial_delete_on_close = True;
6328 }
6329 }
6330 TALLOC_FREE(lck);
6331 status = NT_STATUS_OK;
6332 goto out;
6333 }
6334
6335 TALLOC_FREE(lck);
6336
6337 if (errno == ENOTDIR || errno == EISDIR) {
6338 status = NT_STATUS_OBJECT_NAME_COLLISION;
6339 } else {
6340 status = map_nt_error_from_unix(errno);
6341 }
6342
6343 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6344 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6345 smb_fname_str_dbg(smb_fname_dst)));
6346
6347 out:
6348 TALLOC_FREE(smb_fname_dst);
6349
6350 return status;
6351 }
6352
6353 /****************************************************************************
6354 The guts of the rename command, split out so it may be called by the NT SMB
6355 code.
6356 ****************************************************************************/
6357
6358 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6359 connection_struct *conn,
6360 struct smb_request *req,
6361 struct smb_filename *smb_fname_src,
6362 struct smb_filename *smb_fname_dst,
6363 uint32 attrs,
6364 bool replace_if_exists,
6365 bool src_has_wild,
6366 bool dest_has_wild,
6367 uint32_t access_mask)
6368 {
6369 char *fname_src_dir = NULL;
6370 char *fname_src_mask = NULL;
6371 int count=0;
6372 NTSTATUS status = NT_STATUS_OK;
6373 struct smb_Dir *dir_hnd = NULL;
6374 const char *dname = NULL;
6375 char *talloced = NULL;
6376 long offset = 0;
6377 int create_options = 0;
6378 bool posix_pathnames = lp_posix_pathnames();
6379
6380 /*
6381 * Split the old name into directory and last component
6382 * strings. Note that unix_convert may have stripped off a
6383 * leading ./ from both name and newname if the rename is
6384 * at the root of the share. We need to make sure either both
6385 * name and newname contain a / character or neither of them do
6386 * as this is checked in resolve_wildcards().
6387 */
6388
6389 /* Split up the directory from the filename/mask. */
6390 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6391 &fname_src_dir, &fname_src_mask);
6392 if (!NT_STATUS_IS_OK(status)) {
6393 status = NT_STATUS_NO_MEMORY;
6394 goto out;
6395 }
6396
6397 /*
6398 * We should only check the mangled cache
6399 * here if unix_convert failed. This means
6400 * that the path in 'mask' doesn't exist
6401 * on the file system and so we need to look
6402 * for a possible mangle. This patch from
6403 * Tine Smukavec <valentin.smukavec@hermes.si>.
6404 */
6405
6406 if (!VALID_STAT(smb_fname_src->st) &&
6407 mangle_is_mangled(fname_src_mask, conn->params)) {
6408 char *new_mask = NULL;
6409 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6410 conn->params);
6411 if (new_mask) {
6412 TALLOC_FREE(fname_src_mask);
6413 fname_src_mask = new_mask;
6414 }
6415 }
6416
6417 if (!src_has_wild) {
6418 files_struct *fsp;
6419
6420 /*
6421 * Only one file needs to be renamed. Append the mask back
6422 * onto the directory.
6423 */
6424 TALLOC_FREE(smb_fname_src->base_name);
6425 if (ISDOT(fname_src_dir)) {
6426 /* Ensure we use canonical names on open. */
6427 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6428 "%s",
6429 fname_src_mask);
6430 } else {
6431 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6432 "%s/%s",
6433 fname_src_dir,
6434 fname_src_mask);
6435 }
6436 if (!smb_fname_src->base_name) {
6437 status = NT_STATUS_NO_MEMORY;
6438 goto out;
6439 }
6440
6441 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6442 "case_preserve = %d, short case preserve = %d, "
6443 "directory = %s, newname = %s, "
6444 "last_component_dest = %s\n",
6445 conn->case_sensitive, conn->case_preserve,
6446 conn->short_case_preserve,
6447 smb_fname_str_dbg(smb_fname_src),
6448 smb_fname_str_dbg(smb_fname_dst),
6449 smb_fname_dst->original_lcomp));
6450
6451 /* The dest name still may have wildcards. */
6452 if (dest_has_wild) {
6453 char *fname_dst_mod = NULL;
6454 if (!resolve_wildcards(smb_fname_dst,
6455 smb_fname_src->base_name,
6456 smb_fname_dst->base_name,
6457 &fname_dst_mod)) {
6458 DEBUG(6, ("rename_internals: resolve_wildcards "
6459 "%s %s failed\n",
6460 smb_fname_src->base_name,
6461 smb_fname_dst->base_name));
6462 status = NT_STATUS_NO_MEMORY;
6463 goto out;
6464 }
6465 TALLOC_FREE(smb_fname_dst->base_name);
6466 smb_fname_dst->base_name = fname_dst_mod;
6467 }
6468
6469 ZERO_STRUCT(smb_fname_src->st);
6470 if (posix_pathnames) {
6471 SMB_VFS_LSTAT(conn, smb_fname_src);
6472 } else {
6473 SMB_VFS_STAT(conn, smb_fname_src);
6474 }
6475
6476 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6477 create_options |= FILE_DIRECTORY_FILE;
6478 }
6479
6480 status = SMB_VFS_CREATE_FILE(
6481 conn, /* conn */
6482 req, /* req */
6483 0, /* root_dir_fid */
6484 smb_fname_src, /* fname */
6485 access_mask, /* access_mask */
6486 (FILE_SHARE_READ | /* share_access */
6487 FILE_SHARE_WRITE),
6488 FILE_OPEN, /* create_disposition*/
6489 create_options, /* create_options */
6490 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6491 0, /* oplock_request */
6492 0, /* allocation_size */
6493 0, /* private_flags */
6494 NULL, /* sd */
6495 NULL, /* ea_list */
6496 &fsp, /* result */
6497 NULL); /* pinfo */
6498
6499 if (!NT_STATUS_IS_OK(status)) {
6500 DEBUG(3, ("Could not open rename source %s: %s\n",
6501 smb_fname_str_dbg(smb_fname_src),
6502 nt_errstr(status)));
6503 goto out;
6504 }
6505
6506 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6507 attrs, replace_if_exists);
6508
6509 close_file(req, fsp, NORMAL_CLOSE);
6510
6511 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6512 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6513 smb_fname_str_dbg(smb_fname_dst)));
6514
6515 goto out;
6516 }
6517
6518 /*
6519 * Wildcards - process each file that matches.
6520 */
6521 if (strequal(fname_src_mask, "????????.???")) {
6522 TALLOC_FREE(fname_src_mask);
6523 fname_src_mask = talloc_strdup(ctx, "*");
6524 if (!fname_src_mask) {
6525 status = NT_STATUS_NO_MEMORY;
6526 goto out;
6527 }
6528 }
6529
6530 status = check_name(conn, fname_src_dir);
6531 if (!NT_STATUS_IS_OK(status)) {
6532 goto out;
6533 }
6534
6535 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6536 attrs);
6537 if (dir_hnd == NULL) {
6538 status = map_nt_error_from_unix(errno);
6539 goto out;
6540 }
6541
6542 status = NT_STATUS_NO_SUCH_FILE;
6543 /*
6544 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6545 * - gentest fix. JRA
6546 */
6547
6548 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6549 &talloced))) {
6550 files_struct *fsp = NULL;
6551 char *destname = NULL;
6552 bool sysdir_entry = False;
6553
6554 /* Quick check for "." and ".." */
6555 if (ISDOT(dname) || ISDOTDOT(dname)) {
6556 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6557 sysdir_entry = True;
6558 } else {
6559 TALLOC_FREE(talloced);
6560 continue;
6561 }
6562 }
6563
6564 if (!is_visible_file(conn, fname_src_dir, dname,
6565 &smb_fname_src->st, false)) {
6566 TALLOC_FREE(talloced);
6567 continue;
6568 }
6569
6570 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6571 TALLOC_FREE(talloced);
6572 continue;
6573 }
6574
6575 if (sysdir_entry) {
6576 status = NT_STATUS_OBJECT_NAME_INVALID;
6577 break;
6578 }
6579
6580 TALLOC_FREE(smb_fname_src->base_name);
6581 if (ISDOT(fname_src_dir)) {
6582 /* Ensure we use canonical names on open. */
6583 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6584 "%s",
6585 dname);
6586 } else {
6587 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6588 "%s/%s",
6589 fname_src_dir,
6590 dname);
6591 }
6592 if (!smb_fname_src->base_name) {
6593 status = NT_STATUS_NO_MEMORY;
6594 goto out;
6595 }
6596
6597 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6598 smb_fname_dst->base_name,
6599 &destname)) {
6600 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6601 smb_fname_src->base_name, destname));
6602 TALLOC_FREE(talloced);
6603 continue;
6604 }
6605 if (!destname) {
6606 status = NT_STATUS_NO_MEMORY;
6607 goto out;
6608 }
6609
6610 TALLOC_FREE(smb_fname_dst->base_name);
6611 smb_fname_dst->base_name = destname;
6612
6613 ZERO_STRUCT(smb_fname_src->st);
6614 if (posix_pathnames) {
6615 SMB_VFS_LSTAT(conn, smb_fname_src);
6616 } else {
6617 SMB_VFS_STAT(conn, smb_fname_src);
6618 }
6619
6620 create_options = 0;
6621
6622 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6623 create_options |= FILE_DIRECTORY_FILE;
6624 }
6625
6626 status = SMB_VFS_CREATE_FILE(
6627 conn, /* conn */
6628 req, /* req */
6629 0, /* root_dir_fid */
6630 smb_fname_src, /* fname */
6631 access_mask, /* access_mask */
6632 (FILE_SHARE_READ | /* share_access */
6633 FILE_SHARE_WRITE),
6634 FILE_OPEN, /* create_disposition*/
6635 create_options, /* create_options */
6636 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6637 0, /* oplock_request */
6638 0, /* allocation_size */
6639 0, /* private_flags */
6640 NULL, /* sd */
6641 NULL, /* ea_list */
6642 &fsp, /* result */
6643 NULL); /* pinfo */
6644
6645 if (!NT_STATUS_IS_OK(status)) {
6646 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6647 "returned %s rename %s -> %s\n",
6648 nt_errstr(status),
6649 smb_fname_str_dbg(smb_fname_src),
6650 smb_fname_str_dbg(smb_fname_dst)));
6651 break;
6652 }
6653
6654 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6655 dname);
6656 if (!smb_fname_dst->original_lcomp) {
6657 status = NT_STATUS_NO_MEMORY;
6658 goto out;
6659 }
6660
6661 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6662 attrs, replace_if_exists);
6663
6664 close_file(req, fsp, NORMAL_CLOSE);
6665
6666 if (!NT_STATUS_IS_OK(status)) {
6667 DEBUG(3, ("rename_internals_fsp returned %s for "
6668 "rename %s -> %s\n", nt_errstr(status),
6669 smb_fname_str_dbg(smb_fname_src),
6670 smb_fname_str_dbg(smb_fname_dst)));
6671 break;
6672 }
6673
6674 count++;
6675
6676 DEBUG(3,("rename_internals: doing rename on %s -> "
6677 "%s\n", smb_fname_str_dbg(smb_fname_src),
6678 smb_fname_str_dbg(smb_fname_src)));
6679 TALLOC_FREE(talloced);
6680 }
6681 TALLOC_FREE(dir_hnd);
6682
6683 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6684 status = map_nt_error_from_unix(errno);
6685 }
6686
6687 out:
6688 TALLOC_FREE(talloced);
6689 TALLOC_FREE(fname_src_dir);
6690 TALLOC_FREE(fname_src_mask);
6691 return status;
6692 }
6693
6694 /****************************************************************************
6695 Reply to a mv.
6696 ****************************************************************************/
6697
6698 void reply_mv(struct smb_request *req)
6699 {
6700 connection_struct *conn = req->conn;
6701 char *name = NULL;
6702 char *newname = NULL;
6703 const char *p;
6704 uint32 attrs;
6705 NTSTATUS status;
6706 bool src_has_wcard = False;
6707 bool dest_has_wcard = False;
6708 TALLOC_CTX *ctx = talloc_tos();
6709 struct smb_filename *smb_fname_src = NULL;
6710 struct smb_filename *smb_fname_dst = NULL;
6711 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6712 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6713 bool stream_rename = false;
6714
6715 START_PROFILE(SMBmv);
6716
6717 if (req->wct < 1) {
6718 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6719 goto out;
6720 }
6721
6722 attrs = SVAL(req->vwv+0, 0);
6723
6724 p = (const char *)req->buf + 1;
6725 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6726 &status, &src_has_wcard);
6727 if (!NT_STATUS_IS_OK(status)) {
6728 reply_nterror(req, status);
6729 goto out;
6730 }
6731 p++;
6732 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6733 &status, &dest_has_wcard);
6734 if (!NT_STATUS_IS_OK(status)) {
6735 reply_nterror(req, status);
6736 goto out;
6737 }
6738
6739 if (!lp_posix_pathnames()) {
6740 /* The newname must begin with a ':' if the
6741 name contains a ':'. */
6742 if (strchr_m(name, ':')) {
6743 if (newname[0] != ':') {
6744 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6745 goto out;
6746 }
6747 stream_rename = true;
6748 }
6749 }
6750
6751 status = filename_convert(ctx,
6752 conn,
6753 req->flags2 & FLAGS2_DFS_PATHNAMES,
6754 name,
6755 src_ucf_flags,
6756 &src_has_wcard,
6757 &smb_fname_src);
6758
6759 if (!NT_STATUS_IS_OK(status)) {
6760 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6761 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6762 ERRSRV, ERRbadpath);
6763 goto out;
6764 }
6765 reply_nterror(req, status);
6766 goto out;
6767 }
6768
6769 status = filename_convert(ctx,
6770 conn,
6771 req->flags2 & FLAGS2_DFS_PATHNAMES,
6772 newname,
6773 dst_ucf_flags,
6774 &dest_has_wcard,
6775 &smb_fname_dst);
6776
6777 if (!NT_STATUS_IS_OK(status)) {
6778 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6779 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6780 ERRSRV, ERRbadpath);
6781 goto out;
6782 }
6783 reply_nterror(req, status);
6784 goto out;
6785 }
6786
6787 if (stream_rename) {
6788 /* smb_fname_dst->base_name must be the same as
6789 smb_fname_src->base_name. */
6790 TALLOC_FREE(smb_fname_dst->base_name);
6791 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6792 smb_fname_src->base_name);
6793 if (!smb_fname_dst->base_name) {
6794 reply_nterror(req, NT_STATUS_NO_MEMORY);
6795 goto out;
6796 }
6797 }
6798
6799 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6800 smb_fname_str_dbg(smb_fname_dst)));
6801
6802 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6803 attrs, False, src_has_wcard, dest_has_wcard,
6804 DELETE_ACCESS);
6805 if (!NT_STATUS_IS_OK(status)) {
6806 if (open_was_deferred(req->sconn, req->mid)) {
6807 /* We have re-scheduled this call. */
6808 goto out;
6809 }
6810 reply_nterror(req, status);
6811 goto out;
6812 }
6813
6814 reply_outbuf(req, 0, 0);
6815 out:
6816 TALLOC_FREE(smb_fname_src);
6817 TALLOC_FREE(smb_fname_dst);
6818 END_PROFILE(SMBmv);
6819 return;
6820 }
6821
6822 /*******************************************************************
6823 Copy a file as part of a reply_copy.
6824 ******************************************************************/
6825
6826 /*
6827 * TODO: check error codes on all callers
6828 */
6829
6830 NTSTATUS copy_file(TALLOC_CTX *ctx,
6831 connection_struct *conn,
6832 struct smb_filename *smb_fname_src,
6833 struct smb_filename *smb_fname_dst,
6834 int ofun,
6835 int count,
6836 bool target_is_directory)
6837 {
6838 struct smb_filename *smb_fname_dst_tmp = NULL;
6839 off_t ret=-1;
6840 files_struct *fsp1,*fsp2;
6841 uint32 dosattrs;
6842 uint32 new_create_disposition;
6843 NTSTATUS status;
6844
6845
6846 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6847 if (!NT_STATUS_IS_OK(status)) {
6848 return status;
6849 }
6850
6851 /*
6852 * If the target is a directory, extract the last component from the
6853 * src filename and append it to the dst filename
6854 */
6855 if (target_is_directory) {
6856 const char *p;
6857
6858 /* dest/target can't be a stream if it's a directory. */
6859 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6860
6861 p = strrchr_m(smb_fname_src->base_name,'/');
6862 if (p) {
6863 p++;
6864 } else {
6865 p = smb_fname_src->base_name;
6866 }
6867 smb_fname_dst_tmp->base_name =
6868 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6869 p);
6870 if (!smb_fname_dst_tmp->base_name) {
6871 status = NT_STATUS_NO_MEMORY;
6872 goto out;
6873 }
6874 }
6875
6876 status = vfs_file_exist(conn, smb_fname_src);
6877 if (!NT_STATUS_IS_OK(status)) {
6878 goto out;
6879 }
6880
6881 if (!target_is_directory && count) {
6882 new_create_disposition = FILE_OPEN;
6883 } else {
6884 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6885 0, ofun,
6886 NULL, NULL,
6887 &new_create_disposition,
6888 NULL,
6889 NULL)) {
6890 status = NT_STATUS_INVALID_PARAMETER;
6891 goto out;
6892 }
6893 }
6894
6895 /* Open the src file for reading. */
6896 status = SMB_VFS_CREATE_FILE(
6897 conn, /* conn */
6898 NULL, /* req */
6899 0, /* root_dir_fid */
6900 smb_fname_src, /* fname */
6901 FILE_GENERIC_READ, /* access_mask */
6902 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6903 FILE_OPEN, /* create_disposition*/
6904 0, /* create_options */
6905 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6906 INTERNAL_OPEN_ONLY, /* oplock_request */
6907 0, /* allocation_size */
6908 0, /* private_flags */
6909 NULL, /* sd */
6910 NULL, /* ea_list */
6911 &fsp1, /* result */
6912 NULL); /* psbuf */
6913
6914 if (!NT_STATUS_IS_OK(status)) {
6915 goto out;
6916 }
6917
6918 dosattrs = dos_mode(conn, smb_fname_src);
6919
6920 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6921 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6922 }
6923
6924 /* Open the dst file for writing. */
6925 status = SMB_VFS_CREATE_FILE(
6926 conn, /* conn */
6927 NULL, /* req */
6928 0, /* root_dir_fid */
6929 smb_fname_dst, /* fname */
6930 FILE_GENERIC_WRITE, /* access_mask */
6931 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6932 new_create_disposition, /* create_disposition*/
6933 0, /* create_options */
6934 dosattrs, /* file_attributes */
6935 INTERNAL_OPEN_ONLY, /* oplock_request */
6936 0, /* allocation_size */
6937 0, /* private_flags */
6938 NULL, /* sd */
6939 NULL, /* ea_list */
6940 &fsp2, /* result */
6941 NULL); /* psbuf */
6942
6943 if (!NT_STATUS_IS_OK(status)) {
6944 close_file(NULL, fsp1, ERROR_CLOSE);
6945 goto out;
6946 }
6947
6948 if (ofun & OPENX_FILE_EXISTS_OPEN) {
6949 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6950 if (ret == -1) {
6951 DEBUG(0, ("error - vfs lseek returned error %s\n",
6952 strerror(errno)));
6953 status = map_nt_error_from_unix(errno);
6954 close_file(NULL, fsp1, ERROR_CLOSE);
6955 close_file(NULL, fsp2, ERROR_CLOSE);
6956 goto out;
6957 }
6958 }
6959
6960 /* Do the actual copy. */
6961 if (smb_fname_src->st.st_ex_size) {
6962 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6963 } else {
6964 ret = 0;
6965 }
6966
6967 close_file(NULL, fsp1, NORMAL_CLOSE);
6968
6969 /* Ensure the modtime is set correctly on the destination file. */
6970 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6971
6972 /*
6973 * As we are opening fsp1 read-only we only expect
6974 * an error on close on fsp2 if we are out of space.
6975 * Thus we don't look at the error return from the
6976 * close of fsp1.
6977 */
6978 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6979
6980 if (!NT_STATUS_IS_OK(status)) {
6981 goto out;
6982 }
6983
6984 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
6985 status = NT_STATUS_DISK_FULL;
6986 goto out;
6987 }
6988
6989 status = NT_STATUS_OK;
6990
6991 out:
6992 TALLOC_FREE(smb_fname_dst_tmp);
6993 return status;
6994 }
6995
6996 /****************************************************************************
6997 Reply to a file copy.
6998 ****************************************************************************/
6999
7000 void reply_copy(struct smb_request *req)
7001 {
7002 connection_struct *conn = req->conn;
7003 struct smb_filename *smb_fname_src = NULL;
7004 struct smb_filename *smb_fname_dst = NULL;
7005 char *fname_src = NULL;
7006 char *fname_dst = NULL;
7007 char *fname_src_mask = NULL;
7008 char *fname_src_dir = NULL;
7009 const char *p;
7010 int count=0;
7011 int error = ERRnoaccess;
7012 int tid2;
7013 int ofun;
7014 int flags;
7015 bool target_is_directory=False;
7016 bool source_has_wild = False;
7017 bool dest_has_wild = False;
7018 NTSTATUS status;
7019 TALLOC_CTX *ctx = talloc_tos();
7020
7021 START_PROFILE(SMBcopy);
7022
7023 if (req->wct < 3) {
7024 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7025 goto out;
7026 }
7027
7028 tid2 = SVAL(req->vwv+0, 0);
7029 ofun = SVAL(req->vwv+1, 0);
7030 flags = SVAL(req->vwv+2, 0);
7031
7032 p = (const char *)req->buf;
7033 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7034 &status, &source_has_wild);
7035 if (!NT_STATUS_IS_OK(status)) {
7036 reply_nterror(req, status);
7037 goto out;
7038 }
7039 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7040 &status, &dest_has_wild);
7041 if (!NT_STATUS_IS_OK(status)) {
7042 reply_nterror(req, status);
7043 goto out;
7044 }
7045
7046 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7047
7048 if (tid2 != conn->cnum) {
7049 /* can't currently handle inter share copies XXXX */
7050 DEBUG(3,("Rejecting inter-share copy\n"));
7051 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7052 goto out;
7053 }
7054
7055 status = filename_convert(ctx, conn,
7056 req->flags2 & FLAGS2_DFS_PATHNAMES,
7057 fname_src,
7058 UCF_COND_ALLOW_WCARD_LCOMP,
7059 &source_has_wild,
7060 &smb_fname_src);
7061 if (!NT_STATUS_IS_OK(status)) {
7062 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7063 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7064 ERRSRV, ERRbadpath);
7065 goto out;
7066 }
7067 reply_nterror(req, status);
7068 goto out;
7069 }
7070
7071 status = filename_convert(ctx, conn,
7072 req->flags2 & FLAGS2_DFS_PATHNAMES,
7073 fname_dst,
7074 UCF_COND_ALLOW_WCARD_LCOMP,
7075 &dest_has_wild,
7076 &smb_fname_dst);
7077 if (!NT_STATUS_IS_OK(status)) {
7078 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7079 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7080 ERRSRV, ERRbadpath);
7081 goto out;
7082 }
7083 reply_nterror(req, status);
7084 goto out;
7085 }
7086
7087 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7088
7089 if ((flags&1) && target_is_directory) {
7090 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7091 goto out;
7092 }
7093
7094 if ((flags&2) && !target_is_directory) {
7095 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7096 goto out;
7097 }
7098
7099 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7100 /* wants a tree copy! XXXX */
7101 DEBUG(3,("Rejecting tree copy\n"));
7102 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7103 goto out;
7104 }
7105
7106 /* Split up the directory from the filename/mask. */
7107 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7108 &fname_src_dir, &fname_src_mask);
7109 if (!NT_STATUS_IS_OK(status)) {
7110 reply_nterror(req, NT_STATUS_NO_MEMORY);
7111 goto out;
7112 }
7113
7114 /*
7115 * We should only check the mangled cache
7116 * here if unix_convert failed. This means
7117 * that the path in 'mask' doesn't exist
7118 * on the file system and so we need to look
7119 * for a possible mangle. This patch from
7120 * Tine Smukavec <valentin.smukavec@hermes.si>.
7121 */
7122 if (!VALID_STAT(smb_fname_src->st) &&
7123 mangle_is_mangled(fname_src_mask, conn->params)) {
7124 char *new_mask = NULL;
7125 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7126 &new_mask, conn->params);
7127
7128 /* Use demangled name if one was successfully found. */
7129 if (new_mask) {
7130 TALLOC_FREE(fname_src_mask);
7131 fname_src_mask = new_mask;
7132 }
7133 }
7134
7135 if (!source_has_wild) {
7136
7137 /*
7138 * Only one file needs to be copied. Append the mask back onto
7139 * the directory.
7140 */
7141 TALLOC_FREE(smb_fname_src->base_name);
7142 if (ISDOT(fname_src_dir)) {
7143 /* Ensure we use canonical names on open. */
7144 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7145 "%s",
7146 fname_src_mask);
7147 } else {
7148 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7149 "%s/%s",
7150 fname_src_dir,
7151 fname_src_mask);
7152 }
7153 if (!smb_fname_src->base_name) {
7154 reply_nterror(req, NT_STATUS_NO_MEMORY);
7155 goto out;
7156 }
7157
7158 if (dest_has_wild) {
7159 char *fname_dst_mod = NULL;
7160 if (!resolve_wildcards(smb_fname_dst,
7161 smb_fname_src->base_name,
7162 smb_fname_dst->base_name,
7163 &fname_dst_mod)) {
7164 reply_nterror(req, NT_STATUS_NO_MEMORY);
7165 goto out;
7166 }
7167 TALLOC_FREE(smb_fname_dst->base_name);
7168 smb_fname_dst->base_name = fname_dst_mod;
7169 }
7170
7171 status = check_name(conn, smb_fname_src->base_name);
7172 if (!NT_STATUS_IS_OK(status)) {
7173 reply_nterror(req, status);
7174 goto out;
7175 }
7176
7177 status = check_name(conn, smb_fname_dst->base_name);
7178 if (!NT_STATUS_IS_OK(status)) {
7179 reply_nterror(req, status);
7180 goto out;
7181 }
7182
7183 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7184 ofun, count, target_is_directory);
7185
7186 if(!NT_STATUS_IS_OK(status)) {
7187 reply_nterror(req, status);
7188 goto out;
7189 } else {
7190 count++;
7191 }
7192 } else {
7193 struct smb_Dir *dir_hnd = NULL;
7194 const char *dname = NULL;
7195 char *talloced = NULL;
7196 long offset = 0;
7197
7198 /*
7199 * There is a wildcard that requires us to actually read the
7200 * src dir and copy each file matching the mask to the dst.
7201 * Right now streams won't be copied, but this could
7202 * presumably be added with a nested loop for reach dir entry.
7203 */
7204 SMB_ASSERT(!smb_fname_src->stream_name);
7205 SMB_ASSERT(!smb_fname_dst->stream_name);
7206
7207 smb_fname_src->stream_name = NULL;
7208 smb_fname_dst->stream_name = NULL;
7209
7210 if (strequal(fname_src_mask,"????????.???")) {
7211 TALLOC_FREE(fname_src_mask);
7212 fname_src_mask = talloc_strdup(ctx, "*");
7213 if (!fname_src_mask) {
7214 reply_nterror(req, NT_STATUS_NO_MEMORY);
7215 goto out;
7216 }
7217 }
7218
7219 status = check_name(conn, fname_src_dir);
7220 if (!NT_STATUS_IS_OK(status)) {
7221 reply_nterror(req, status);
7222 goto out;
7223 }
7224
7225 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7226 if (dir_hnd == NULL) {
7227 status = map_nt_error_from_unix(errno);
7228 reply_nterror(req, status);
7229 goto out;
7230 }
7231
7232 error = ERRbadfile;
7233
7234 /* Iterate over the src dir copying each entry to the dst. */
7235 while ((dname = ReadDirName(dir_hnd, &offset,
7236 &smb_fname_src->st, &talloced))) {
7237 char *destname = NULL;
7238
7239 if (ISDOT(dname) || ISDOTDOT(dname)) {
7240 TALLOC_FREE(talloced);
7241 continue;
7242 }
7243
7244 if (!is_visible_file(conn, fname_src_dir, dname,
7245 &smb_fname_src->st, false)) {
7246 TALLOC_FREE(talloced);
7247 continue;
7248 }
7249
7250 if(!mask_match(dname, fname_src_mask,
7251 conn->case_sensitive)) {
7252 TALLOC_FREE(talloced);
7253 continue;
7254 }
7255
7256 error = ERRnoaccess;
7257
7258 /* Get the src smb_fname struct setup. */
7259 TALLOC_FREE(smb_fname_src->base_name);
7260 if (ISDOT(fname_src_dir)) {
7261 /* Ensure we use canonical names on open. */
7262 smb_fname_src->base_name =
7263 talloc_asprintf(smb_fname_src, "%s",
7264 dname);
7265 } else {
7266 smb_fname_src->base_name =
7267 talloc_asprintf(smb_fname_src, "%s/%s",
7268 fname_src_dir, dname);
7269 }
7270
7271 if (!smb_fname_src->base_name) {
7272 TALLOC_FREE(dir_hnd);
7273 TALLOC_FREE(talloced);
7274 reply_nterror(req, NT_STATUS_NO_MEMORY);
7275 goto out;
7276 }
7277
7278 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7279 smb_fname_dst->base_name,
7280 &destname)) {
7281 TALLOC_FREE(talloced);
7282 continue;
7283 }
7284 if (!destname) {
7285 TALLOC_FREE(dir_hnd);
7286 TALLOC_FREE(talloced);
7287 reply_nterror(req, NT_STATUS_NO_MEMORY);
7288 goto out;
7289 }
7290
7291 TALLOC_FREE(smb_fname_dst->base_name);
7292 smb_fname_dst->base_name = destname;
7293
7294 status = check_name(conn, smb_fname_src->base_name);
7295 if (!NT_STATUS_IS_OK(status)) {
7296 TALLOC_FREE(dir_hnd);
7297 TALLOC_FREE(talloced);
7298 reply_nterror(req, status);
7299 goto out;
7300 }
7301
7302 status = check_name(conn, smb_fname_dst->base_name);
7303 if (!NT_STATUS_IS_OK(status)) {
7304 TALLOC_FREE(dir_hnd);
7305 TALLOC_FREE(talloced);
7306 reply_nterror(req, status);
7307 goto out;
7308 }
7309
7310 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7311 smb_fname_src->base_name,
7312 smb_fname_dst->base_name));
7313
7314 status = copy_file(ctx, conn, smb_fname_src,
7315 smb_fname_dst, ofun, count,
7316 target_is_directory);
7317 if (NT_STATUS_IS_OK(status)) {
7318 count++;
7319 }
7320
7321 TALLOC_FREE(talloced);
7322 }
7323 TALLOC_FREE(dir_hnd);
7324 }
7325
7326 if (count == 0) {
7327 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7328 goto out;
7329 }
7330
7331 reply_outbuf(req, 1, 0);
7332 SSVAL(req->outbuf,smb_vwv0,count);
7333 out:
7334 TALLOC_FREE(smb_fname_src);
7335 TALLOC_FREE(smb_fname_dst);
7336 TALLOC_FREE(fname_src);
7337 TALLOC_FREE(fname_dst);
7338 TALLOC_FREE(fname_src_mask);
7339 TALLOC_FREE(fname_src_dir);
7340
7341 END_PROFILE(SMBcopy);
7342 return;
7343 }
7344
7345 #undef DBGC_CLASS
7346 #define DBGC_CLASS DBGC_LOCKING
7347
7348 /****************************************************************************
7349 Get a lock pid, dealing with large count requests.
7350 ****************************************************************************/
7351
7352 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7353 bool large_file_format)
7354 {
7355 if(!large_file_format)
7356 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7357 else
7358 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7359 }
7360
7361 /****************************************************************************
7362 Get a lock count, dealing with large count requests.
7363 ****************************************************************************/
7364
7365 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7366 bool large_file_format)
7367 {
7368 uint64_t count = 0;
7369
7370 if(!large_file_format) {
7371 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7372 } else {
7373
7374 #if defined(HAVE_LONGLONG)
7375 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7376 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7377 #else /* HAVE_LONGLONG */
7378
7379 /*
7380 * NT4.x seems to be broken in that it sends large file (64 bit)
7381 * lockingX calls even if the CAP_LARGE_FILES was *not*
7382 * negotiated. For boxes without large unsigned ints truncate the
7383 * lock count by dropping the top 32 bits.
7384 */
7385
7386 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7387 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7388 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7389 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7390 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7391 }
7392
7393 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7394 #endif /* HAVE_LONGLONG */
7395 }
7396
7397 return count;
7398 }
7399
7400 #if !defined(HAVE_LONGLONG)
7401 /****************************************************************************
7402 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7403 ****************************************************************************/
7404
7405 static uint32 map_lock_offset(uint32 high, uint32 low)
7406 {
7407 unsigned int i;
7408 uint32 mask = 0;
7409 uint32 highcopy = high;
7410
7411 /*
7412 * Try and find out how many significant bits there are in high.
7413 */
7414
7415 for(i = 0; highcopy; i++)
7416 highcopy >>= 1;
7417
7418 /*
7419 * We use 31 bits not 32 here as POSIX
7420 * lock offsets may not be negative.
7421 */
7422
7423 mask = (~0) << (31 - i);
7424
7425 if(low & mask)
7426 return 0; /* Fail. */
7427
7428 high <<= (31 - i);
7429
7430 return (high|low);
7431 }
7432 #endif /* !defined(HAVE_LONGLONG) */
7433
7434 /****************************************************************************
7435 Get a lock offset, dealing with large offset requests.
7436 ****************************************************************************/
7437
7438 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7439 bool large_file_format, bool *err)
7440 {
7441 uint64_t offset = 0;
7442
7443 *err = False;
7444
7445 if(!large_file_format) {
7446 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7447 } else {
7448
7449 #if defined(HAVE_LONGLONG)
7450 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7451 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7452 #else /* HAVE_LONGLONG */
7453
7454 /*
7455 * NT4.x seems to be broken in that it sends large file (64 bit)
7456 * lockingX calls even if the CAP_LARGE_FILES was *not*
7457 * negotiated. For boxes without large unsigned ints mangle the
7458 * lock offset by mapping the top 32 bits onto the lower 32.
7459 */
7460
7461 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7462 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7463 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7464 uint32 new_low = 0;
7465
7466 if((new_low = map_lock_offset(high, low)) == 0) {
7467 *err = True;
7468 return (uint64_t)-1;
7469 }
7470
7471 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7472 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7473 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7474 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7475 }
7476
7477 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7478 #endif /* HAVE_LONGLONG */
7479 }
7480
7481 return offset;
7482 }
7483
7484 NTSTATUS smbd_do_locking(struct smb_request *req,
7485 files_struct *fsp,
7486 uint8_t type,
7487 int32_t timeout,
7488 uint16_t num_ulocks,
7489 struct smbd_lock_element *ulocks,
7490 uint16_t num_locks,
7491 struct smbd_lock_element *locks,
7492 bool *async)
7493 {
7494 connection_struct *conn = req->conn;
7495 int i;
7496 NTSTATUS status = NT_STATUS_OK;
7497
7498 *async = false;
7499
7500 /* Data now points at the beginning of the list
7501 of smb_unlkrng structs */
7502 for(i = 0; i < (int)num_ulocks; i++) {
7503 struct smbd_lock_element *e = &ulocks[i];
7504
7505 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7506 "pid %u, file %s\n",
7507 (double)e->offset,
7508 (double)e->count,
7509 (unsigned int)e->smblctx,
7510 fsp_str_dbg(fsp)));
7511
7512 if (e->brltype != UNLOCK_LOCK) {
7513 /* this can only happen with SMB2 */
7514 return NT_STATUS_INVALID_PARAMETER;
7515 }
7516
7517 status = do_unlock(req->sconn->msg_ctx,
7518 fsp,
7519 e->smblctx,
7520 e->count,
7521 e->offset,
7522 WINDOWS_LOCK);
7523
7524 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7525 nt_errstr(status)));
7526
7527 if (!NT_STATUS_IS_OK(status)) {
7528 return status;
7529 }
7530 }
7531
7532 /* Setup the timeout in seconds. */
7533
7534 if (!lp_blocking_locks(SNUM(conn))) {
7535 timeout = 0;
7536 }
7537
7538 /* Data now points at the beginning of the list
7539 of smb_lkrng structs */
7540
7541 for(i = 0; i < (int)num_locks; i++) {
7542 struct smbd_lock_element *e = &locks[i];
7543
7544 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7545 "%llu, file %s timeout = %d\n",
7546 (double)e->offset,
7547 (double)e->count,
7548 (unsigned long long)e->smblctx,
7549 fsp_str_dbg(fsp),
7550 (int)timeout));
7551
7552 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7553 struct blocking_lock_record *blr = NULL;
7554
7555 if (num_locks > 1) {
7556 /*
7557 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7558 * if the lock vector contains one entry. When given mutliple cancel
7559 * requests in a single PDU we expect the server to return an
7560 * error. Windows servers seem to accept the request but only
7561 * cancel the first lock.
7562 * JRA - Do what Windows does (tm) :-).
7563 */
7564
7565 #if 0
7566 /* MS-CIFS (2.2.4.32.1) behavior. */
7567 return NT_STATUS_DOS(ERRDOS,
7568 ERRcancelviolation);
7569 #else
7570 /* Windows behavior. */
7571 if (i != 0) {
7572 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7573 "cancel request\n"));
7574 continue;
7575 }
7576 #endif
7577 }
7578
7579 if (lp_blocking_locks(SNUM(conn))) {
7580
7581 /* Schedule a message to ourselves to
7582 remove the blocking lock record and
7583 return the right error. */
7584
7585 blr = blocking_lock_cancel_smb1(fsp,
7586 e->smblctx,
7587 e->offset,
7588 e->count,
7589 WINDOWS_LOCK,
7590 type,
7591 NT_STATUS_FILE_LOCK_CONFLICT);
7592 if (blr == NULL) {
7593 return NT_STATUS_DOS(
7594 ERRDOS,
7595 ERRcancelviolation);
7596 }
7597 }
7598 /* Remove a matching pending lock. */
7599 status = do_lock_cancel(fsp,
7600 e->smblctx,
7601 e->count,
7602 e->offset,
7603 WINDOWS_LOCK,
7604 blr);
7605 } else {
7606 bool blocking_lock = timeout ? true : false;
7607 bool defer_lock = false;
7608 struct byte_range_lock *br_lck;
7609 uint64_t block_smblctx;
7610
7611 br_lck = do_lock(req->sconn->msg_ctx,
7612 fsp,
7613 e->smblctx,
7614 e->count,
7615 e->offset,
7616 e->brltype,
7617 WINDOWS_LOCK,
7618 blocking_lock,
7619 &status,
7620 &block_smblctx,
7621 NULL);
7622
7623 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7624 /* Windows internal resolution for blocking locks seems
7625 to be about 200ms... Don't wait for less than that. JRA. */
7626 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7627 timeout = lp_lock_spin_time();
7628 }
7629 defer_lock = true;
7630 }
7631
7632 /* If a lock sent with timeout of zero would fail, and
7633 * this lock has been requested multiple times,
7634 * according to brl_lock_failed() we convert this
7635 * request to a blocking lock with a timeout of between
7636 * 150 - 300 milliseconds.
7637 *
7638 * If lp_lock_spin_time() has been set to 0, we skip
7639 * this blocking retry and fail immediately.
7640 *
7641 * Replacement for do_lock_spin(). JRA. */
7642
7643 if (!req->sconn->using_smb2 &&
7644 br_lck && lp_blocking_locks(SNUM(conn)) &&
7645 lp_lock_spin_time() && !blocking_lock &&
7646 NT_STATUS_EQUAL((status),
7647 NT_STATUS_FILE_LOCK_CONFLICT))
7648 {
7649 defer_lock = true;
7650 timeout = lp_lock_spin_time();
7651 }
7652
7653 if (br_lck && defer_lock) {
7654 /*
7655 * A blocking lock was requested. Package up
7656 * this smb into a queued request and push it
7657 * onto the blocking lock queue.
7658 */
7659 if(push_blocking_lock_request(br_lck,
7660 req,
7661 fsp,
7662 timeout,
7663 i,
7664 e->smblctx,
7665 e->brltype,
7666 WINDOWS_LOCK,
7667 e->offset,
7668 e->count,
7669 block_smblctx)) {
7670 TALLOC_FREE(br_lck);
7671 *async = true;
7672 return NT_STATUS_OK;
7673 }
7674 }
7675
7676 TALLOC_FREE(br_lck);
7677 }
7678
7679 if (!NT_STATUS_IS_OK(status)) {
7680 break;
7681 }
7682 }
7683
7684 /* If any of the above locks failed, then we must unlock
7685 all of the previous locks (X/Open spec). */
7686
7687 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7688
7689 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7690 i = -1; /* we want to skip the for loop */
7691 }
7692
7693 /*
7694 * Ensure we don't do a remove on the lock that just failed,
7695 * as under POSIX rules, if we have a lock already there, we
7696 * will delete it (and we shouldn't) .....
7697 */
7698 for(i--; i >= 0; i--) {
7699 struct smbd_lock_element *e = &locks[i];
7700
7701 do_unlock(req->sconn->msg_ctx,
7702 fsp,
7703 e->smblctx,
7704 e->count,
7705 e->offset,
7706 WINDOWS_LOCK);
7707 }
7708 return status;
7709 }
7710
7711 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7712 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7713
7714 return NT_STATUS_OK;
7715 }
7716
7717 /****************************************************************************
7718 Reply to a lockingX request.
7719 ****************************************************************************/
7720
7721 void reply_lockingX(struct smb_request *req)
7722 {
7723 connection_struct *conn = req->conn;
7724 files_struct *fsp;
7725 unsigned char locktype;
7726 unsigned char oplocklevel;
7727 uint16 num_ulocks;
7728 uint16 num_locks;
7729 int32 lock_timeout;
7730 int i;
7731 const uint8_t *data;
7732 bool large_file_format;
7733 bool err;
7734 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7735 struct smbd_lock_element *ulocks;
7736 struct smbd_lock_element *locks;
7737 bool async = false;
7738
7739 START_PROFILE(SMBlockingX);
7740
7741 if (req->wct < 8) {
7742 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7743 END_PROFILE(SMBlockingX);
7744 return;
7745 }
7746
7747 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7748 locktype = CVAL(req->vwv+3, 0);
7749 oplocklevel = CVAL(req->vwv+3, 1);
7750 num_ulocks = SVAL(req->vwv+6, 0);
7751 num_locks = SVAL(req->vwv+7, 0);
7752 lock_timeout = IVAL(req->vwv+4, 0);
7753 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7754
7755 if (!check_fsp(conn, req, fsp)) {
7756 END_PROFILE(SMBlockingX);
7757 return;
7758 }
7759
7760 data = req->buf;
7761
7762 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7763 /* we don't support these - and CANCEL_LOCK makes w2k
7764 and XP reboot so I don't really want to be
7765 compatible! (tridge) */
7766 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7767 END_PROFILE(SMBlockingX);
7768 return;
7769 }
7770
7771 /* Check if this is an oplock break on a file
7772 we have granted an oplock on.
7773 */
7774 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7775 /* Client can insist on breaking to none. */
7776 bool break_to_none = (oplocklevel == 0);
7777 bool result;
7778
7779 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7780 "for %s\n", (unsigned int)oplocklevel,
7781 fsp_fnum_dbg(fsp)));
7782
7783 /*
7784 * Make sure we have granted an exclusive or batch oplock on
7785 * this file.
7786 */
7787
7788 if (fsp->oplock_type == 0) {
7789
7790 /* The Samba4 nbench simulator doesn't understand
7791 the difference between break to level2 and break
7792 to none from level2 - it sends oplock break
7793 replies in both cases. Don't keep logging an error
7794 message here - just ignore it. JRA. */
7795
7796 DEBUG(5,("reply_lockingX: Error : oplock break from "
7797 "client for %s (oplock=%d) and no "
7798 "oplock granted on this file (%s).\n",
7799 fsp_fnum_dbg(fsp), fsp->oplock_type,
7800 fsp_str_dbg(fsp)));
7801
7802 /* if this is a pure oplock break request then don't
7803 * send a reply */
7804 if (num_locks == 0 && num_ulocks == 0) {
7805 END_PROFILE(SMBlockingX);
7806 return;
7807 } else {
7808 END_PROFILE(SMBlockingX);
7809 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7810 return;
7811 }
7812 }
7813
7814 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7815 (break_to_none)) {
7816 result = remove_oplock(fsp);
7817 } else {
7818 result = downgrade_oplock(fsp);
7819 }
7820
7821 if (!result) {
7822 DEBUG(0, ("reply_lockingX: error in removing "
7823 "oplock on file %s\n", fsp_str_dbg(fsp)));
7824 /* Hmmm. Is this panic justified? */
7825 smb_panic("internal tdb error");
7826 }
7827
7828 reply_to_oplock_break_requests(fsp);
7829
7830 /* if this is a pure oplock break request then don't send a
7831 * reply */
7832 if (num_locks == 0 && num_ulocks == 0) {
7833 /* Sanity check - ensure a pure oplock break is not a
7834 chained request. */
7835 if(CVAL(req->vwv+0, 0) != 0xff)
7836 DEBUG(0,("reply_lockingX: Error : pure oplock "
7837 "break is a chained %d request !\n",
7838 (unsigned int)CVAL(req->vwv+0, 0)));
7839 END_PROFILE(SMBlockingX);
7840 return;
7841 }
7842 }
7843
7844 if (req->buflen <
7845 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7846 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7847 END_PROFILE(SMBlockingX);
7848 return;
7849 }
7850
7851 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7852 if (ulocks == NULL) {
7853 reply_nterror(req, NT_STATUS_NO_MEMORY);
7854 END_PROFILE(SMBlockingX);
7855 return;
7856 }
7857
7858 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7859 if (locks == NULL) {
7860 reply_nterror(req, NT_STATUS_NO_MEMORY);
7861 END_PROFILE(SMBlockingX);
7862 return;
7863 }
7864
7865 /* Data now points at the beginning of the list
7866 of smb_unlkrng structs */
7867 for(i = 0; i < (int)num_ulocks; i++) {
7868 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7869 ulocks[i].count = get_lock_count(data, i, large_file_format);
7870 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7871 ulocks[i].brltype = UNLOCK_LOCK;
7872
7873 /*
7874 * There is no error code marked "stupid client bug".... :-).
7875 */
7876 if(err) {
7877 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7878 END_PROFILE(SMBlockingX);
7879 return;
7880 }
7881 }
7882
7883 /* Now do any requested locks */
7884 data += ((large_file_format ? 20 : 10)*num_ulocks);
7885
7886 /* Data now points at the beginning of the list
7887 of smb_lkrng structs */
7888
7889 for(i = 0; i < (int)num_locks; i++) {
7890 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7891 locks[i].count = get_lock_count(data, i, large_file_format);
7892 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7893
7894 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7895 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7896 locks[i].brltype = PENDING_READ_LOCK;
7897 } else {
7898 locks[i].brltype = READ_LOCK;
7899 }
7900 } else {
7901 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7902 locks[i].brltype = PENDING_WRITE_LOCK;
7903 } else {
7904 locks[i].brltype = WRITE_LOCK;
7905 }
7906 }
7907
7908 /*
7909 * There is no error code marked "stupid client bug".... :-).
7910 */
7911 if(err) {
7912 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7913 END_PROFILE(SMBlockingX);
7914 return;
7915 }
7916 }
7917
7918 status = smbd_do_locking(req, fsp,
7919 locktype, lock_timeout,
7920 num_ulocks, ulocks,
7921 num_locks, locks,
7922 &async);
7923 if (!NT_STATUS_IS_OK(status)) {
7924 END_PROFILE(SMBlockingX);
7925 reply_nterror(req, status);
7926 return;
7927 }
7928 if (async) {
7929 END_PROFILE(SMBlockingX);
7930 return;
7931 }
7932
7933 reply_outbuf(req, 2, 0);
7934 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
7935 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
7936
7937 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
7938 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
7939
7940 END_PROFILE(SMBlockingX);
7941 }
7942
7943 #undef DBGC_CLASS
7944 #define DBGC_CLASS DBGC_ALL
7945
7946 /****************************************************************************
7947 Reply to a SMBreadbmpx (read block multiplex) request.
7948 Always reply with an error, if someone has a platform really needs this,
7949 please contact vl@samba.org
7950 ****************************************************************************/
7951
7952 void reply_readbmpx(struct smb_request *req)
7953 {
7954 START_PROFILE(SMBreadBmpx);
7955 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7956 END_PROFILE(SMBreadBmpx);
7957 return;
7958 }
7959
7960 /****************************************************************************
7961 Reply to a SMBreadbs (read block multiplex secondary) request.
7962 Always reply with an error, if someone has a platform really needs this,
7963 please contact vl@samba.org
7964 ****************************************************************************/
7965
7966 void reply_readbs(struct smb_request *req)
7967 {
7968 START_PROFILE(SMBreadBs);
7969 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7970 END_PROFILE(SMBreadBs);
7971 return;
7972 }
7973
7974 /****************************************************************************
7975 Reply to a SMBsetattrE.
7976 ****************************************************************************/
7977
7978 void reply_setattrE(struct smb_request *req)
7979 {
7980 connection_struct *conn = req->conn;
7981 struct smb_file_time ft;
7982 files_struct *fsp;
7983 NTSTATUS status;
7984
7985 START_PROFILE(SMBsetattrE);
7986 ZERO_STRUCT(ft);
7987
7988 if (req->wct < 7) {
7989 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7990 goto out;
7991 }
7992
7993 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7994
7995 if(!fsp || (fsp->conn != conn)) {
7996 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7997 goto out;
7998 }
7999
8000 /*
8001 * Convert the DOS times into unix times.
8002 */
8003
8004 ft.atime = convert_time_t_to_timespec(
8005 srv_make_unix_date2(req->vwv+3));
8006 ft.mtime = convert_time_t_to_timespec(
8007 srv_make_unix_date2(req->vwv+5));
8008 ft.create_time = convert_time_t_to_timespec(
8009 srv_make_unix_date2(req->vwv+1));
8010
8011 reply_outbuf(req, 0, 0);
8012
8013 /*
8014 * Patch from Ray Frush <frush@engr.colostate.edu>
8015 * Sometimes times are sent as zero - ignore them.
8016 */
8017
8018 /* Ensure we have a valid stat struct for the source. */
8019 status = vfs_stat_fsp(fsp);
8020 if (!NT_STATUS_IS_OK(status)) {
8021 reply_nterror(req, status);
8022 goto out;
8023 }
8024
8025 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8026 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8027 goto out;
8028 }
8029
8030 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8031 if (!NT_STATUS_IS_OK(status)) {
8032 reply_nterror(req, status);
8033 goto out;
8034 }
8035
8036 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8037 " createtime=%u\n",
8038 fsp_fnum_dbg(fsp),
8039 (unsigned int)ft.atime.tv_sec,
8040 (unsigned int)ft.mtime.tv_sec,
8041 (unsigned int)ft.create_time.tv_sec
8042 ));
8043 out:
8044 END_PROFILE(SMBsetattrE);
8045 return;
8046 }
8047
8048
8049 /* Back from the dead for OS/2..... JRA. */
8050
8051 /****************************************************************************
8052 Reply to a SMBwritebmpx (write block multiplex primary) request.
8053 Always reply with an error, if someone has a platform really needs this,
8054 please contact vl@samba.org
8055 ****************************************************************************/
8056
8057 void reply_writebmpx(struct smb_request *req)
8058 {
8059 START_PROFILE(SMBwriteBmpx);
8060 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8061 END_PROFILE(SMBwriteBmpx);
8062 return;
8063 }
8064
8065 /****************************************************************************
8066 Reply to a SMBwritebs (write block multiplex secondary) request.
8067 Always reply with an error, if someone has a platform really needs this,
8068 please contact vl@samba.org
8069 ****************************************************************************/
8070
8071 void reply_writebs(struct smb_request *req)
8072 {
8073 START_PROFILE(SMBwriteBs);
8074 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8075 END_PROFILE(SMBwriteBs);
8076 return;
8077 }
8078
8079 /****************************************************************************
8080 Reply to a SMBgetattrE.
8081 ****************************************************************************/
8082
8083 void reply_getattrE(struct smb_request *req)
8084 {
8085 connection_struct *conn = req->conn;
8086 int mode;
8087 files_struct *fsp;
8088 struct timespec create_ts;
8089
8090 START_PROFILE(SMBgetattrE);
8091
8092 if (req->wct < 1) {
8093 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8094 END_PROFILE(SMBgetattrE);
8095 return;
8096 }
8097
8098 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8099
8100 if(!fsp || (fsp->conn != conn)) {
8101 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8102 END_PROFILE(SMBgetattrE);
8103 return;
8104 }
8105
8106 /* Do an fstat on this file */
8107 if(fsp_stat(fsp)) {
8108 reply_nterror(req, map_nt_error_from_unix(errno));
8109 END_PROFILE(SMBgetattrE);
8110 return;
8111 }
8112
8113 mode = dos_mode(conn, fsp->fsp_name);
8114
8115 /*
8116 * Convert the times into dos times. Set create
8117 * date to be last modify date as UNIX doesn't save
8118 * this.
8119 */
8120
8121 reply_outbuf(req, 11, 0);
8122
8123 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8124 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8125 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8126 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8127 /* Should we check pending modtime here ? JRA */
8128 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8129 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8130
8131 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8132 SIVAL(req->outbuf, smb_vwv6, 0);
8133 SIVAL(req->outbuf, smb_vwv8, 0);
8134 } else {
8135 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8136 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8137 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8138 }
8139 SSVAL(req->outbuf,smb_vwv10, mode);
8140
8141 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8142
8143 END_PROFILE(SMBgetattrE);
8144 return;
8145 }
reg import