?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libcli/smb: fix padding in smb2_create_blob*
[Samba/gebeck_regimport.git] / source3 / smbd / reply.c
blob1b4a1620d6c6bc6240eb8e7e01fe60389cc5acda
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
322 pp_dest, src, smbreq_bufrem(req, src),
323 flags, err, contains_wcard);
324 }
325
326 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
327 char **pp_dest, const char *src, int flags,
328 NTSTATUS *err)
329 {
330 bool ignore;
331 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
332 flags, err, &ignore);
333 }
334
335 /****************************************************************************
336 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
337 ****************************************************************************/
338
339 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
340 files_struct *fsp)
341 {
342 if ((fsp == NULL) || (conn == NULL)) {
343 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
344 return False;
345 }
346 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
347 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
348 return False;
349 }
350 return True;
351 }
352
353 /****************************************************************************
354 Check if we have a correct fsp pointing to a file.
355 ****************************************************************************/
356
357 bool check_fsp(connection_struct *conn, struct smb_request *req,
358 files_struct *fsp)
359 {
360 if (!check_fsp_open(conn, req, fsp)) {
361 return False;
362 }
363 if (fsp->is_directory) {
364 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
365 return False;
366 }
367 if (fsp->fh->fd == -1) {
368 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
369 return False;
370 }
371 fsp->num_smb_operations++;
372 return True;
373 }
374
375 /****************************************************************************
376 Check if we have a correct fsp pointing to a quota fake file. Replacement for
377 the CHECK_NTQUOTA_HANDLE_OK macro.
378 ****************************************************************************/
379
380 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
381 files_struct *fsp)
382 {
383 if (!check_fsp_open(conn, req, fsp)) {
384 return false;
385 }
386
387 if (fsp->is_directory) {
388 return false;
389 }
390
391 if (fsp->fake_file_handle == NULL) {
392 return false;
393 }
394
395 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
396 return false;
397 }
398
399 if (fsp->fake_file_handle->private_data == NULL) {
400 return false;
401 }
402
403 return true;
404 }
405
406 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
407 const char *name, int name_type)
408 {
409 char *trim_name;
410 char *trim_name_type;
411 const char *retarget_parm;
412 char *retarget;
413 char *p;
414 int retarget_type = 0x20;
415 int retarget_port = NBT_SMB_PORT;
416 struct sockaddr_storage retarget_addr;
417 struct sockaddr_in *in_addr;
418 bool ret = false;
419 uint8_t outbuf[10];
420
421 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
422 return false;
423 }
424
425 trim_name = talloc_strdup(talloc_tos(), name);
426 if (trim_name == NULL) {
427 goto fail;
428 }
429 trim_char(trim_name, ' ', ' ');
430
431 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
432 name_type);
433 if (trim_name_type == NULL) {
434 goto fail;
435 }
436
437 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
438 trim_name_type, NULL);
439 if (retarget_parm == NULL) {
440 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
441 trim_name, NULL);
442 }
443 if (retarget_parm == NULL) {
444 goto fail;
445 }
446
447 retarget = talloc_strdup(trim_name, retarget_parm);
448 if (retarget == NULL) {
449 goto fail;
450 }
451
452 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
453
454 p = strchr(retarget, ':');
455 if (p != NULL) {
456 *p++ = '\0';
457 retarget_port = atoi(p);
458 }
459
460 p = strchr_m(retarget, '#');
461 if (p != NULL) {
462 *p++ = '\0';
463 if (sscanf(p, "%x", &retarget_type) != 1) {
464 goto fail;
465 }
466 }
467
468 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
469 if (!ret) {
470 DEBUG(10, ("could not resolve %s\n", retarget));
471 goto fail;
472 }
473
474 if (retarget_addr.ss_family != AF_INET) {
475 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
476 goto fail;
477 }
478
479 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
480
481 _smb_setlen(outbuf, 6);
482 SCVAL(outbuf, 0, 0x84);
483 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
484 *(uint16_t *)(outbuf+8) = htons(retarget_port);
485
486 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
487 NULL)) {
488 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
489 "failed.");
490 }
491
492 ret = true;
493 fail:
494 TALLOC_FREE(trim_name);
495 return ret;
496 }
497
498 static void reply_called_name_not_present(char *outbuf)
499 {
500 smb_setlen(outbuf, 1);
501 SCVAL(outbuf, 0, 0x83);
502 SCVAL(outbuf, 4, 0x82);
503 }
504
505 /****************************************************************************
506 Reply to a (netbios-level) special message.
507 ****************************************************************************/
508
509 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
510 {
511 int msg_type = CVAL(inbuf,0);
512 int msg_flags = CVAL(inbuf,1);
513 /*
514 * We only really use 4 bytes of the outbuf, but for the smb_setlen
515 * calculation & friends (srv_send_smb uses that) we need the full smb
516 * header.
517 */
518 char outbuf[smb_size];
519
520 memset(outbuf, '\0', sizeof(outbuf));
521
522 smb_setlen(outbuf,0);
523
524 switch (msg_type) {
525 case NBSSrequest: /* session request */
526 {
527 /* inbuf_size is guarenteed to be at least 4. */
528 fstring name1,name2;
529 int name_type1, name_type2;
530 int name_len1, name_len2;
531
532 *name1 = *name2 = 0;
533
534 if (sconn->nbt.got_session) {
535 exit_server_cleanly("multiple session request not permitted");
536 }
537
538 SCVAL(outbuf,0,NBSSpositive);
539 SCVAL(outbuf,3,0);
540
541 /* inbuf_size is guaranteed to be at least 4. */
542 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
543 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
544 DEBUG(0,("Invalid name length in session request\n"));
545 reply_called_name_not_present(outbuf);
546 break;
547 }
548 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
549 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
550 DEBUG(0,("Invalid name length in session request\n"));
551 reply_called_name_not_present(outbuf);
552 break;
553 }
554
555 name_type1 = name_extract((unsigned char *)inbuf,
556 inbuf_size,(unsigned int)4,name1);
557 name_type2 = name_extract((unsigned char *)inbuf,
558 inbuf_size,(unsigned int)(4 + name_len1),name2);
559
560 if (name_type1 == -1 || name_type2 == -1) {
561 DEBUG(0,("Invalid name type in session request\n"));
562 reply_called_name_not_present(outbuf);
563 break;
564 }
565
566 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
567 name1, name_type1, name2, name_type2));
568
569 if (netbios_session_retarget(sconn, name1, name_type1)) {
570 exit_server_cleanly("retargeted client");
571 }
572
573 /*
574 * Windows NT/2k uses "*SMBSERVER" and XP uses
575 * "*SMBSERV" arrggg!!!
576 */
577 if (strequal(name1, "*SMBSERVER ")
578 || strequal(name1, "*SMBSERV ")) {
579 char *raddr;
580
581 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
582 talloc_tos());
583 if (raddr == NULL) {
584 exit_server_cleanly("could not allocate raddr");
585 }
586
587 fstrcpy(name1, raddr);
588 }
589
590 set_local_machine_name(name1, True);
591 set_remote_machine_name(name2, True);
592
593 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
594 get_local_machine_name(), get_remote_machine_name(),
595 name_type2));
596
597 if (name_type2 == 'R') {
598 /* We are being asked for a pathworks session ---
599 no thanks! */
600 reply_called_name_not_present(outbuf);
601 break;
602 }
603
604 reload_services(sconn, conn_snum_used, true);
605 reopen_logs();
606
607 sconn->nbt.got_session = true;
608 break;
609 }
610
611 case 0x89: /* session keepalive request
612 (some old clients produce this?) */
613 SCVAL(outbuf,0,NBSSkeepalive);
614 SCVAL(outbuf,3,0);
615 break;
616
617 case NBSSpositive: /* positive session response */
618 case NBSSnegative: /* negative session response */
619 case NBSSretarget: /* retarget session response */
620 DEBUG(0,("Unexpected session response\n"));
621 break;
622
623 case NBSSkeepalive: /* session keepalive */
624 default:
625 return;
626 }
627
628 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
629 msg_type, msg_flags));
630
631 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
632
633 if (CVAL(outbuf, 0) != 0x82) {
634 exit_server_cleanly("invalid netbios session");
635 }
636 return;
637 }
638
639 /****************************************************************************
640 Reply to a tcon.
641 conn POINTER CAN BE NULL HERE !
642 ****************************************************************************/
643
644 void reply_tcon(struct smb_request *req)
645 {
646 connection_struct *conn = req->conn;
647 const char *service;
648 char *service_buf = NULL;
649 char *password = NULL;
650 char *dev = NULL;
651 int pwlen=0;
652 NTSTATUS nt_status;
653 const char *p;
654 TALLOC_CTX *ctx = talloc_tos();
655 struct smbd_server_connection *sconn = req->sconn;
656
657 START_PROFILE(SMBtcon);
658
659 if (req->buflen < 4) {
660 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
661 END_PROFILE(SMBtcon);
662 return;
663 }
664
665 p = (const char *)req->buf + 1;
666 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
667 p += 1;
668 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
669 p += pwlen+1;
670 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
671 p += 1;
672
673 if (service_buf == NULL || password == NULL || dev == NULL) {
674 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
675 END_PROFILE(SMBtcon);
676 return;
677 }
678 p = strrchr_m(service_buf,'\\');
679 if (p) {
680 service = p+1;
681 } else {
682 service = service_buf;
683 }
684
685 conn = make_connection(sconn,service,dev,
686 req->vuid,&nt_status);
687 req->conn = conn;
688
689 if (!conn) {
690 reply_nterror(req, nt_status);
691 END_PROFILE(SMBtcon);
692 return;
693 }
694
695 reply_outbuf(req, 2, 0);
696 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
697 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
698 SSVAL(req->outbuf,smb_tid,conn->cnum);
699
700 DEBUG(3,("tcon service=%s cnum=%d\n",
701 service, conn->cnum));
702
703 END_PROFILE(SMBtcon);
704 return;
705 }
706
707 /****************************************************************************
708 Reply to a tcon and X.
709 conn POINTER CAN BE NULL HERE !
710 ****************************************************************************/
711
712 void reply_tcon_and_X(struct smb_request *req)
713 {
714 connection_struct *conn = req->conn;
715 const char *service = NULL;
716 TALLOC_CTX *ctx = talloc_tos();
717 /* what the cleint thinks the device is */
718 char *client_devicetype = NULL;
719 /* what the server tells the client the share represents */
720 const char *server_devicetype;
721 NTSTATUS nt_status;
722 int passlen;
723 char *path = NULL;
724 const char *p, *q;
725 uint16_t tcon_flags;
726 struct smbXsrv_session *session = NULL;
727 NTTIME now = timeval_to_nttime(&req->request_time);
728 bool session_key_updated = false;
729 uint16_t optional_support = 0;
730 struct smbd_server_connection *sconn = req->sconn;
731
732 START_PROFILE(SMBtconX);
733
734 if (req->wct < 4) {
735 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
736 END_PROFILE(SMBtconX);
737 return;
738 }
739
740 passlen = SVAL(req->vwv+3, 0);
741 tcon_flags = SVAL(req->vwv+2, 0);
742
743 /* we might have to close an old one */
744 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
745 struct smbXsrv_tcon *tcon;
746 NTSTATUS status;
747
748 tcon = conn->tcon;
749 req->conn = NULL;
750 conn = NULL;
751
752 /*
753 * TODO: cancel all outstanding requests on the tcon
754 */
755 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
756 if (!NT_STATUS_IS_OK(status)) {
757 DEBUG(0, ("reply_tcon_and_X: "
758 "smbXsrv_tcon_disconnect() failed: %s\n",
759 nt_errstr(status)));
760 /*
761 * If we hit this case, there is something completely
762 * wrong, so we better disconnect the transport connection.
763 */
764 END_PROFILE(SMBtconX);
765 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
766 return;
767 }
768
769 TALLOC_FREE(tcon);
770 }
771
772 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
773 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
774 END_PROFILE(SMBtconX);
775 return;
776 }
777
778 if (sconn->smb1.negprot.encrypted_passwords) {
779 p = (const char *)req->buf + passlen;
780 } else {
781 p = (const char *)req->buf + passlen + 1;
782 }
783
784 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
785
786 if (path == NULL) {
787 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
788 END_PROFILE(SMBtconX);
789 return;
790 }
791
792 /*
793 * the service name can be either: \\server\share
794 * or share directly like on the DELL PowerVault 705
795 */
796 if (*path=='\\') {
797 q = strchr_m(path+2,'\\');
798 if (!q) {
799 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
800 END_PROFILE(SMBtconX);
801 return;
802 }
803 service = q+1;
804 } else {
805 service = path;
806 }
807
808 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
809 &client_devicetype, p,
810 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
811
812 if (client_devicetype == NULL) {
813 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
814 END_PROFILE(SMBtconX);
815 return;
816 }
817
818 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
819
820 nt_status = smb1srv_session_lookup(req->sconn->conn,
821 req->vuid, now, &session);
822 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
823 reply_force_doserror(req, ERRSRV, ERRbaduid);
824 END_PROFILE(SMBtconX);
825 return;
826 }
827 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
828 reply_nterror(req, nt_status);
829 END_PROFILE(SMBtconX);
830 return;
831 }
832 if (!NT_STATUS_IS_OK(nt_status)) {
833 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
834 END_PROFILE(SMBtconX);
835 return;
836 }
837
838 if (session->global->auth_session_info == NULL) {
839 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
840 END_PROFILE(SMBtconX);
841 return;
842 }
843
844 /*
845 * If there is no application key defined yet
846 * we create one.
847 *
848 * This means we setup the application key on the
849 * first tcon that happens via the given session.
850 *
851 * Once the application key is defined, it does not
852 * change any more.
853 */
854 if (session->global->application_key.length == 0 &&
855 session->global->signing_key.length > 0)
856 {
857 struct smbXsrv_session *x = session;
858 struct auth_session_info *session_info =
859 session->global->auth_session_info;
860 uint8_t session_key[16];
861
862 ZERO_STRUCT(session_key);
863 memcpy(session_key, x->global->signing_key.data,
864 MIN(x->global->signing_key.length, sizeof(session_key)));
865
866 /*
867 * The application key is truncated/padded to 16 bytes
868 */
869 x->global->application_key = data_blob_talloc(x->global,
870 session_key,
871 sizeof(session_key));
872 ZERO_STRUCT(session_key);
873 if (x->global->application_key.data == NULL) {
874 reply_nterror(req, NT_STATUS_NO_MEMORY);
875 END_PROFILE(SMBtconX);
876 return;
877 }
878
879 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
880 smb_key_derivation(x->global->application_key.data,
881 x->global->application_key.length,
882 x->global->application_key.data);
883 optional_support |= SMB_EXTENDED_SIGNATURES;
884 }
885
886 /*
887 * Place the application key into the session_info
888 */
889 data_blob_clear_free(&session_info->session_key);
890 session_info->session_key = data_blob_dup_talloc(session_info,
891 x->global->application_key);
892 if (session_info->session_key.data == NULL) {
893 data_blob_clear_free(&x->global->application_key);
894 reply_nterror(req, NT_STATUS_NO_MEMORY);
895 END_PROFILE(SMBtconX);
896 return;
897 }
898 session_key_updated = true;
899 }
900
901 conn = make_connection(sconn, service, client_devicetype,
902 req->vuid, &nt_status);
903 req->conn =conn;
904
905 if (!conn) {
906 if (session_key_updated) {
907 struct smbXsrv_session *x = session;
908 struct auth_session_info *session_info =
909 session->global->auth_session_info;
910 data_blob_clear_free(&x->global->application_key);
911 data_blob_clear_free(&session_info->session_key);
912 }
913 reply_nterror(req, nt_status);
914 END_PROFILE(SMBtconX);
915 return;
916 }
917
918 if ( IS_IPC(conn) )
919 server_devicetype = "IPC";
920 else if ( IS_PRINT(conn) )
921 server_devicetype = "LPT1:";
922 else
923 server_devicetype = "A:";
924
925 if (get_Protocol() < PROTOCOL_NT1) {
926 reply_outbuf(req, 2, 0);
927 if (message_push_string(&req->outbuf, server_devicetype,
928 STR_TERMINATE|STR_ASCII) == -1) {
929 reply_nterror(req, NT_STATUS_NO_MEMORY);
930 END_PROFILE(SMBtconX);
931 return;
932 }
933 } else {
934 /* NT sets the fstype of IPC$ to the null string */
935 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
936
937 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
938 /* Return permissions. */
939 uint32 perm1 = 0;
940 uint32 perm2 = 0;
941
942 reply_outbuf(req, 7, 0);
943
944 if (IS_IPC(conn)) {
945 perm1 = FILE_ALL_ACCESS;
946 perm2 = FILE_ALL_ACCESS;
947 } else {
948 perm1 = conn->share_access;
949 }
950
951 SIVAL(req->outbuf, smb_vwv3, perm1);
952 SIVAL(req->outbuf, smb_vwv5, perm2);
953 } else {
954 reply_outbuf(req, 3, 0);
955 }
956
957 if ((message_push_string(&req->outbuf, server_devicetype,
958 STR_TERMINATE|STR_ASCII) == -1)
959 || (message_push_string(&req->outbuf, fstype,
960 STR_TERMINATE) == -1)) {
961 reply_nterror(req, NT_STATUS_NO_MEMORY);
962 END_PROFILE(SMBtconX);
963 return;
964 }
965
966 /* what does setting this bit do? It is set by NT4 and
967 may affect the ability to autorun mounted cdroms */
968 optional_support |= SMB_SUPPORT_SEARCH_BITS;
969 optional_support |=
970 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
971
972 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
973 DEBUG(2,("Serving %s as a Dfs root\n",
974 lp_servicename(ctx, SNUM(conn)) ));
975 optional_support |= SMB_SHARE_IN_DFS;
976 }
977
978 SSVAL(req->outbuf, smb_vwv2, optional_support);
979 }
980
981 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
982 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
983
984 DEBUG(3,("tconX service=%s \n",
985 service));
986
987 /* set the incoming and outgoing tid to the just created one */
988 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
989 SSVAL(req->outbuf,smb_tid,conn->cnum);
990
991 END_PROFILE(SMBtconX);
992
993 req->tid = conn->cnum;
994 }
995
996 /****************************************************************************
997 Reply to an unknown type.
998 ****************************************************************************/
999
1000 void reply_unknown_new(struct smb_request *req, uint8 type)
1001 {
1002 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1003 smb_fn_name(type), type, type));
1004 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1005 return;
1006 }
1007
1008 /****************************************************************************
1009 Reply to an ioctl.
1010 conn POINTER CAN BE NULL HERE !
1011 ****************************************************************************/
1012
1013 void reply_ioctl(struct smb_request *req)
1014 {
1015 connection_struct *conn = req->conn;
1016 uint16 device;
1017 uint16 function;
1018 uint32 ioctl_code;
1019 int replysize;
1020 char *p;
1021
1022 START_PROFILE(SMBioctl);
1023
1024 if (req->wct < 3) {
1025 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1026 END_PROFILE(SMBioctl);
1027 return;
1028 }
1029
1030 device = SVAL(req->vwv+1, 0);
1031 function = SVAL(req->vwv+2, 0);
1032 ioctl_code = (device << 16) + function;
1033
1034 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1035
1036 switch (ioctl_code) {
1037 case IOCTL_QUERY_JOB_INFO:
1038 replysize = 32;
1039 break;
1040 default:
1041 reply_force_doserror(req, ERRSRV, ERRnosupport);
1042 END_PROFILE(SMBioctl);
1043 return;
1044 }
1045
1046 reply_outbuf(req, 8, replysize+1);
1047 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1048 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1049 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1050 p = smb_buf(req->outbuf);
1051 memset(p, '\0', replysize+1); /* valgrind-safe. */
1052 p += 1; /* Allow for alignment */
1053
1054 switch (ioctl_code) {
1055 case IOCTL_QUERY_JOB_INFO:
1056 {
1057 files_struct *fsp = file_fsp(
1058 req, SVAL(req->vwv+0, 0));
1059 if (!fsp) {
1060 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1061 END_PROFILE(SMBioctl);
1062 return;
1063 }
1064 /* Job number */
1065 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1066
1067 srvstr_push((char *)req->outbuf, req->flags2, p+2,
1068 lp_netbios_name(), 15,
1069 STR_TERMINATE|STR_ASCII);
1070 if (conn) {
1071 srvstr_push((char *)req->outbuf, req->flags2,
1072 p+18,
1073 lp_servicename(talloc_tos(),
1074 SNUM(conn)),
1075 13, STR_TERMINATE|STR_ASCII);
1076 } else {
1077 memset(p+18, 0, 13);
1078 }
1079 break;
1080 }
1081 }
1082
1083 END_PROFILE(SMBioctl);
1084 return;
1085 }
1086
1087 /****************************************************************************
1088 Strange checkpath NTSTATUS mapping.
1089 ****************************************************************************/
1090
1091 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1092 {
1093 /* Strange DOS error code semantics only for checkpath... */
1094 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1095 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1096 /* We need to map to ERRbadpath */
1097 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1098 }
1099 }
1100 return status;
1101 }
1102
1103 /****************************************************************************
1104 Reply to a checkpath.
1105 ****************************************************************************/
1106
1107 void reply_checkpath(struct smb_request *req)
1108 {
1109 connection_struct *conn = req->conn;
1110 struct smb_filename *smb_fname = NULL;
1111 char *name = NULL;
1112 NTSTATUS status;
1113 TALLOC_CTX *ctx = talloc_tos();
1114
1115 START_PROFILE(SMBcheckpath);
1116
1117 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1118 STR_TERMINATE, &status);
1119
1120 if (!NT_STATUS_IS_OK(status)) {
1121 status = map_checkpath_error(req->flags2, status);
1122 reply_nterror(req, status);
1123 END_PROFILE(SMBcheckpath);
1124 return;
1125 }
1126
1127 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1128
1129 status = filename_convert(ctx,
1130 conn,
1131 req->flags2 & FLAGS2_DFS_PATHNAMES,
1132 name,
1133 0,
1134 NULL,
1135 &smb_fname);
1136
1137 if (!NT_STATUS_IS_OK(status)) {
1138 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1139 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1140 ERRSRV, ERRbadpath);
1141 END_PROFILE(SMBcheckpath);
1142 return;
1143 }
1144 goto path_err;
1145 }
1146
1147 if (!VALID_STAT(smb_fname->st) &&
1148 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1149 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1150 smb_fname_str_dbg(smb_fname), strerror(errno)));
1151 status = map_nt_error_from_unix(errno);
1152 goto path_err;
1153 }
1154
1155 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1156 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1157 ERRDOS, ERRbadpath);
1158 goto out;
1159 }
1160
1161 reply_outbuf(req, 0, 0);
1162
1163 path_err:
1164 /* We special case this - as when a Windows machine
1165 is parsing a path is steps through the components
1166 one at a time - if a component fails it expects
1167 ERRbadpath, not ERRbadfile.
1168 */
1169 status = map_checkpath_error(req->flags2, status);
1170 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1171 /*
1172 * Windows returns different error codes if
1173 * the parent directory is valid but not the
1174 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1175 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1176 * if the path is invalid.
1177 */
1178 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1179 ERRDOS, ERRbadpath);
1180 goto out;
1181 }
1182
1183 reply_nterror(req, status);
1184
1185 out:
1186 TALLOC_FREE(smb_fname);
1187 END_PROFILE(SMBcheckpath);
1188 return;
1189 }
1190
1191 /****************************************************************************
1192 Reply to a getatr.
1193 ****************************************************************************/
1194
1195 void reply_getatr(struct smb_request *req)
1196 {
1197 connection_struct *conn = req->conn;
1198 struct smb_filename *smb_fname = NULL;
1199 char *fname = NULL;
1200 int mode=0;
1201 off_t size=0;
1202 time_t mtime=0;
1203 const char *p;
1204 NTSTATUS status;
1205 TALLOC_CTX *ctx = talloc_tos();
1206 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1207
1208 START_PROFILE(SMBgetatr);
1209
1210 p = (const char *)req->buf + 1;
1211 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1212 if (!NT_STATUS_IS_OK(status)) {
1213 reply_nterror(req, status);
1214 goto out;
1215 }
1216
1217 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1218 under WfWg - weird! */
1219 if (*fname == '\0') {
1220 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1221 if (!CAN_WRITE(conn)) {
1222 mode |= FILE_ATTRIBUTE_READONLY;
1223 }
1224 size = 0;
1225 mtime = 0;
1226 } else {
1227 status = filename_convert(ctx,
1228 conn,
1229 req->flags2 & FLAGS2_DFS_PATHNAMES,
1230 fname,
1231 0,
1232 NULL,
1233 &smb_fname);
1234 if (!NT_STATUS_IS_OK(status)) {
1235 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1236 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1237 ERRSRV, ERRbadpath);
1238 goto out;
1239 }
1240 reply_nterror(req, status);
1241 goto out;
1242 }
1243 if (!VALID_STAT(smb_fname->st) &&
1244 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1245 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1246 smb_fname_str_dbg(smb_fname),
1247 strerror(errno)));
1248 reply_nterror(req, map_nt_error_from_unix(errno));
1249 goto out;
1250 }
1251
1252 mode = dos_mode(conn, smb_fname);
1253 size = smb_fname->st.st_ex_size;
1254
1255 if (ask_sharemode) {
1256 struct timespec write_time_ts;
1257 struct file_id fileid;
1258
1259 ZERO_STRUCT(write_time_ts);
1260 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1261 get_file_infos(fileid, 0, NULL, &write_time_ts);
1262 if (!null_timespec(write_time_ts)) {
1263 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1264 }
1265 }
1266
1267 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1268 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1269 size = 0;
1270 }
1271 }
1272
1273 reply_outbuf(req, 10, 0);
1274
1275 SSVAL(req->outbuf,smb_vwv0,mode);
1276 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1277 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1278 } else {
1279 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1280 }
1281 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1282
1283 if (get_Protocol() >= PROTOCOL_NT1) {
1284 SSVAL(req->outbuf, smb_flg2,
1285 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1286 }
1287
1288 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1289 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1290
1291 out:
1292 TALLOC_FREE(smb_fname);
1293 TALLOC_FREE(fname);
1294 END_PROFILE(SMBgetatr);
1295 return;
1296 }
1297
1298 /****************************************************************************
1299 Reply to a setatr.
1300 ****************************************************************************/
1301
1302 void reply_setatr(struct smb_request *req)
1303 {
1304 struct smb_file_time ft;
1305 connection_struct *conn = req->conn;
1306 struct smb_filename *smb_fname = NULL;
1307 char *fname = NULL;
1308 int mode;
1309 time_t mtime;
1310 const char *p;
1311 NTSTATUS status;
1312 TALLOC_CTX *ctx = talloc_tos();
1313
1314 START_PROFILE(SMBsetatr);
1315
1316 ZERO_STRUCT(ft);
1317
1318 if (req->wct < 2) {
1319 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1320 goto out;
1321 }
1322
1323 p = (const char *)req->buf + 1;
1324 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1325 if (!NT_STATUS_IS_OK(status)) {
1326 reply_nterror(req, status);
1327 goto out;
1328 }
1329
1330 status = filename_convert(ctx,
1331 conn,
1332 req->flags2 & FLAGS2_DFS_PATHNAMES,
1333 fname,
1334 0,
1335 NULL,
1336 &smb_fname);
1337 if (!NT_STATUS_IS_OK(status)) {
1338 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1339 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1340 ERRSRV, ERRbadpath);
1341 goto out;
1342 }
1343 reply_nterror(req, status);
1344 goto out;
1345 }
1346
1347 if (smb_fname->base_name[0] == '.' &&
1348 smb_fname->base_name[1] == '\0') {
1349 /*
1350 * Not sure here is the right place to catch this
1351 * condition. Might be moved to somewhere else later -- vl
1352 */
1353 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1354 goto out;
1355 }
1356
1357 mode = SVAL(req->vwv+0, 0);
1358 mtime = srv_make_unix_date3(req->vwv+1);
1359
1360 if (mode != FILE_ATTRIBUTE_NORMAL) {
1361 if (VALID_STAT_OF_DIR(smb_fname->st))
1362 mode |= FILE_ATTRIBUTE_DIRECTORY;
1363 else
1364 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1365
1366 status = check_access(conn, NULL, smb_fname,
1367 FILE_WRITE_ATTRIBUTES);
1368 if (!NT_STATUS_IS_OK(status)) {
1369 reply_nterror(req, status);
1370 goto out;
1371 }
1372
1373 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1374 false) != 0) {
1375 reply_nterror(req, map_nt_error_from_unix(errno));
1376 goto out;
1377 }
1378 }
1379
1380 ft.mtime = convert_time_t_to_timespec(mtime);
1381 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1382 if (!NT_STATUS_IS_OK(status)) {
1383 reply_nterror(req, status);
1384 goto out;
1385 }
1386
1387 reply_outbuf(req, 0, 0);
1388
1389 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1390 mode));
1391 out:
1392 TALLOC_FREE(smb_fname);
1393 END_PROFILE(SMBsetatr);
1394 return;
1395 }
1396
1397 /****************************************************************************
1398 Reply to a dskattr.
1399 ****************************************************************************/
1400
1401 void reply_dskattr(struct smb_request *req)
1402 {
1403 connection_struct *conn = req->conn;
1404 uint64_t dfree,dsize,bsize;
1405 START_PROFILE(SMBdskattr);
1406
1407 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1408 reply_nterror(req, map_nt_error_from_unix(errno));
1409 END_PROFILE(SMBdskattr);
1410 return;
1411 }
1412
1413 reply_outbuf(req, 5, 0);
1414
1415 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1416 double total_space, free_space;
1417 /* we need to scale this to a number that DOS6 can handle. We
1418 use floating point so we can handle large drives on systems
1419 that don't have 64 bit integers
1420
1421 we end up displaying a maximum of 2G to DOS systems
1422 */
1423 total_space = dsize * (double)bsize;
1424 free_space = dfree * (double)bsize;
1425
1426 dsize = (uint64_t)((total_space+63*512) / (64*512));
1427 dfree = (uint64_t)((free_space+63*512) / (64*512));
1428
1429 if (dsize > 0xFFFF) dsize = 0xFFFF;
1430 if (dfree > 0xFFFF) dfree = 0xFFFF;
1431
1432 SSVAL(req->outbuf,smb_vwv0,dsize);
1433 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1434 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1435 SSVAL(req->outbuf,smb_vwv3,dfree);
1436 } else {
1437 SSVAL(req->outbuf,smb_vwv0,dsize);
1438 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1439 SSVAL(req->outbuf,smb_vwv2,512);
1440 SSVAL(req->outbuf,smb_vwv3,dfree);
1441 }
1442
1443 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1444
1445 END_PROFILE(SMBdskattr);
1446 return;
1447 }
1448
1449 /*
1450 * Utility function to split the filename from the directory.
1451 */
1452 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1453 char **fname_dir_out,
1454 char **fname_mask_out)
1455 {
1456 const char *p = NULL;
1457 char *fname_dir = NULL;
1458 char *fname_mask = NULL;
1459
1460 p = strrchr_m(fname_in, '/');
1461 if (!p) {
1462 fname_dir = talloc_strdup(ctx, ".");
1463 fname_mask = talloc_strdup(ctx, fname_in);
1464 } else {
1465 fname_dir = talloc_strndup(ctx, fname_in,
1466 PTR_DIFF(p, fname_in));
1467 fname_mask = talloc_strdup(ctx, p+1);
1468 }
1469
1470 if (!fname_dir || !fname_mask) {
1471 TALLOC_FREE(fname_dir);
1472 TALLOC_FREE(fname_mask);
1473 return NT_STATUS_NO_MEMORY;
1474 }
1475
1476 *fname_dir_out = fname_dir;
1477 *fname_mask_out = fname_mask;
1478 return NT_STATUS_OK;
1479 }
1480
1481 /****************************************************************************
1482 Reply to a search.
1483 Can be called from SMBsearch, SMBffirst or SMBfunique.
1484 ****************************************************************************/
1485
1486 void reply_search(struct smb_request *req)
1487 {
1488 connection_struct *conn = req->conn;
1489 char *path = NULL;
1490 const char *mask = NULL;
1491 char *directory = NULL;
1492 struct smb_filename *smb_fname = NULL;
1493 char *fname = NULL;
1494 off_t size;
1495 uint32 mode;
1496 struct timespec date;
1497 uint32 dirtype;
1498 unsigned int numentries = 0;
1499 unsigned int maxentries = 0;
1500 bool finished = False;
1501 const char *p;
1502 int status_len;
1503 char status[21];
1504 int dptr_num= -1;
1505 bool check_descend = False;
1506 bool expect_close = False;
1507 NTSTATUS nt_status;
1508 bool mask_contains_wcard = False;
1509 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1510 TALLOC_CTX *ctx = talloc_tos();
1511 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1512 struct dptr_struct *dirptr = NULL;
1513 struct smbd_server_connection *sconn = req->sconn;
1514
1515 START_PROFILE(SMBsearch);
1516
1517 if (req->wct < 2) {
1518 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1519 goto out;
1520 }
1521
1522 if (lp_posix_pathnames()) {
1523 reply_unknown_new(req, req->cmd);
1524 goto out;
1525 }
1526
1527 /* If we were called as SMBffirst then we must expect close. */
1528 if(req->cmd == SMBffirst) {
1529 expect_close = True;
1530 }
1531
1532 reply_outbuf(req, 1, 3);
1533 maxentries = SVAL(req->vwv+0, 0);
1534 dirtype = SVAL(req->vwv+1, 0);
1535 p = (const char *)req->buf + 1;
1536 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1537 &nt_status, &mask_contains_wcard);
1538 if (!NT_STATUS_IS_OK(nt_status)) {
1539 reply_nterror(req, nt_status);
1540 goto out;
1541 }
1542
1543 p++;
1544 status_len = SVAL(p, 0);
1545 p += 2;
1546
1547 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1548
1549 if (status_len == 0) {
1550 nt_status = filename_convert(ctx, conn,
1551 req->flags2 & FLAGS2_DFS_PATHNAMES,
1552 path,
1553 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1554 &mask_contains_wcard,
1555 &smb_fname);
1556 if (!NT_STATUS_IS_OK(nt_status)) {
1557 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1558 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1559 ERRSRV, ERRbadpath);
1560 goto out;
1561 }
1562 reply_nterror(req, nt_status);
1563 goto out;
1564 }
1565
1566 directory = smb_fname->base_name;
1567
1568 p = strrchr_m(directory,'/');
1569 if ((p != NULL) && (*directory != '/')) {
1570 mask = p + 1;
1571 directory = talloc_strndup(ctx, directory,
1572 PTR_DIFF(p, directory));
1573 } else {
1574 mask = directory;
1575 directory = talloc_strdup(ctx,".");
1576 }
1577
1578 if (!directory) {
1579 reply_nterror(req, NT_STATUS_NO_MEMORY);
1580 goto out;
1581 }
1582
1583 memset((char *)status,'\0',21);
1584 SCVAL(status,0,(dirtype & 0x1F));
1585
1586 nt_status = dptr_create(conn,
1587 NULL, /* req */
1588 NULL, /* fsp */
1589 directory,
1590 True,
1591 expect_close,
1592 req->smbpid,
1593 mask,
1594 mask_contains_wcard,
1595 dirtype,
1596 &dirptr);
1597 if (!NT_STATUS_IS_OK(nt_status)) {
1598 reply_nterror(req, nt_status);
1599 goto out;
1600 }
1601 dptr_num = dptr_dnum(dirptr);
1602 } else {
1603 int status_dirtype;
1604 const char *dirpath;
1605
1606 memcpy(status,p,21);
1607 status_dirtype = CVAL(status,0) & 0x1F;
1608 if (status_dirtype != (dirtype & 0x1F)) {
1609 dirtype = status_dirtype;
1610 }
1611
1612 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1613 if (!dirptr) {
1614 goto SearchEmpty;
1615 }
1616 dirpath = dptr_path(sconn, dptr_num);
1617 directory = talloc_strdup(ctx, dirpath);
1618 if (!directory) {
1619 reply_nterror(req, NT_STATUS_NO_MEMORY);
1620 goto out;
1621 }
1622
1623 mask = dptr_wcard(sconn, dptr_num);
1624 if (!mask) {
1625 goto SearchEmpty;
1626 }
1627 /*
1628 * For a 'continue' search we have no string. So
1629 * check from the initial saved string.
1630 */
1631 mask_contains_wcard = ms_has_wild(mask);
1632 dirtype = dptr_attr(sconn, dptr_num);
1633 }
1634
1635 DEBUG(4,("dptr_num is %d\n",dptr_num));
1636
1637 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1638 dptr_init_search_op(dirptr);
1639
1640 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1641 char buf[DIR_STRUCT_SIZE];
1642 memcpy(buf,status,21);
1643 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1644 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1645 reply_nterror(req, NT_STATUS_NO_MEMORY);
1646 goto out;
1647 }
1648 dptr_fill(sconn, buf+12,dptr_num);
1649 if (dptr_zero(buf+12) && (status_len==0)) {
1650 numentries = 1;
1651 } else {
1652 numentries = 0;
1653 }
1654 if (message_push_blob(&req->outbuf,
1655 data_blob_const(buf, sizeof(buf)))
1656 == -1) {
1657 reply_nterror(req, NT_STATUS_NO_MEMORY);
1658 goto out;
1659 }
1660 } else {
1661 unsigned int i;
1662 maxentries = MIN(
1663 maxentries,
1664 ((BUFFER_SIZE -
1665 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1666 /DIR_STRUCT_SIZE));
1667
1668 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1669 directory,lp_dontdescend(ctx, SNUM(conn))));
1670 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1671 check_descend = True;
1672 }
1673
1674 for (i=numentries;(i<maxentries) && !finished;i++) {
1675 finished = !get_dir_entry(ctx,
1676 dirptr,
1677 mask,
1678 dirtype,
1679 &fname,
1680 &size,
1681 &mode,
1682 &date,
1683 check_descend,
1684 ask_sharemode);
1685 if (!finished) {
1686 char buf[DIR_STRUCT_SIZE];
1687 memcpy(buf,status,21);
1688 if (!make_dir_struct(ctx,
1689 buf,
1690 mask,
1691 fname,
1692 size,
1693 mode,
1694 convert_timespec_to_time_t(date),
1695 !allow_long_path_components)) {
1696 reply_nterror(req, NT_STATUS_NO_MEMORY);
1697 goto out;
1698 }
1699 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1700 break;
1701 }
1702 if (message_push_blob(&req->outbuf,
1703 data_blob_const(buf, sizeof(buf)))
1704 == -1) {
1705 reply_nterror(req, NT_STATUS_NO_MEMORY);
1706 goto out;
1707 }
1708 numentries++;
1709 }
1710 }
1711 }
1712
1713 SearchEmpty:
1714
1715 /* If we were called as SMBffirst with smb_search_id == NULL
1716 and no entries were found then return error and close dirptr
1717 (X/Open spec) */
1718
1719 if (numentries == 0) {
1720 dptr_close(sconn, &dptr_num);
1721 } else if(expect_close && status_len == 0) {
1722 /* Close the dptr - we know it's gone */
1723 dptr_close(sconn, &dptr_num);
1724 }
1725
1726 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1727 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1728 dptr_close(sconn, &dptr_num);
1729 }
1730
1731 if ((numentries == 0) && !mask_contains_wcard) {
1732 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1733 goto out;
1734 }
1735
1736 SSVAL(req->outbuf,smb_vwv0,numentries);
1737 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1738 SCVAL(smb_buf(req->outbuf),0,5);
1739 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1740
1741 /* The replies here are never long name. */
1742 SSVAL(req->outbuf, smb_flg2,
1743 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1744 if (!allow_long_path_components) {
1745 SSVAL(req->outbuf, smb_flg2,
1746 SVAL(req->outbuf, smb_flg2)
1747 & (~FLAGS2_LONG_PATH_COMPONENTS));
1748 }
1749
1750 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1751 SSVAL(req->outbuf, smb_flg2,
1752 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1753
1754 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1755 smb_fn_name(req->cmd),
1756 mask,
1757 directory,
1758 dirtype,
1759 numentries,
1760 maxentries ));
1761 out:
1762 TALLOC_FREE(directory);
1763 TALLOC_FREE(smb_fname);
1764 END_PROFILE(SMBsearch);
1765 return;
1766 }
1767
1768 /****************************************************************************
1769 Reply to a fclose (stop directory search).
1770 ****************************************************************************/
1771
1772 void reply_fclose(struct smb_request *req)
1773 {
1774 int status_len;
1775 char status[21];
1776 int dptr_num= -2;
1777 const char *p;
1778 char *path = NULL;
1779 NTSTATUS err;
1780 bool path_contains_wcard = False;
1781 TALLOC_CTX *ctx = talloc_tos();
1782 struct smbd_server_connection *sconn = req->sconn;
1783
1784 START_PROFILE(SMBfclose);
1785
1786 if (lp_posix_pathnames()) {
1787 reply_unknown_new(req, req->cmd);
1788 END_PROFILE(SMBfclose);
1789 return;
1790 }
1791
1792 p = (const char *)req->buf + 1;
1793 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1794 &err, &path_contains_wcard);
1795 if (!NT_STATUS_IS_OK(err)) {
1796 reply_nterror(req, err);
1797 END_PROFILE(SMBfclose);
1798 return;
1799 }
1800 p++;
1801 status_len = SVAL(p,0);
1802 p += 2;
1803
1804 if (status_len == 0) {
1805 reply_force_doserror(req, ERRSRV, ERRsrverror);
1806 END_PROFILE(SMBfclose);
1807 return;
1808 }
1809
1810 memcpy(status,p,21);
1811
1812 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1813 /* Close the dptr - we know it's gone */
1814 dptr_close(sconn, &dptr_num);
1815 }
1816
1817 reply_outbuf(req, 1, 0);
1818 SSVAL(req->outbuf,smb_vwv0,0);
1819
1820 DEBUG(3,("search close\n"));
1821
1822 END_PROFILE(SMBfclose);
1823 return;
1824 }
1825
1826 /****************************************************************************
1827 Reply to an open.
1828 ****************************************************************************/
1829
1830 void reply_open(struct smb_request *req)
1831 {
1832 connection_struct *conn = req->conn;
1833 struct smb_filename *smb_fname = NULL;
1834 char *fname = NULL;
1835 uint32 fattr=0;
1836 off_t size = 0;
1837 time_t mtime=0;
1838 int info;
1839 files_struct *fsp;
1840 int oplock_request;
1841 int deny_mode;
1842 uint32 dos_attr;
1843 uint32 access_mask;
1844 uint32 share_mode;
1845 uint32 create_disposition;
1846 uint32 create_options = 0;
1847 uint32_t private_flags = 0;
1848 NTSTATUS status;
1849 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1850 TALLOC_CTX *ctx = talloc_tos();
1851
1852 START_PROFILE(SMBopen);
1853
1854 if (req->wct < 2) {
1855 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1856 goto out;
1857 }
1858
1859 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1860 deny_mode = SVAL(req->vwv+0, 0);
1861 dos_attr = SVAL(req->vwv+1, 0);
1862
1863 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1864 STR_TERMINATE, &status);
1865 if (!NT_STATUS_IS_OK(status)) {
1866 reply_nterror(req, status);
1867 goto out;
1868 }
1869
1870 status = filename_convert(ctx,
1871 conn,
1872 req->flags2 & FLAGS2_DFS_PATHNAMES,
1873 fname,
1874 0,
1875 NULL,
1876 &smb_fname);
1877 if (!NT_STATUS_IS_OK(status)) {
1878 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1879 reply_botherror(req,
1880 NT_STATUS_PATH_NOT_COVERED,
1881 ERRSRV, ERRbadpath);
1882 goto out;
1883 }
1884 reply_nterror(req, status);
1885 goto out;
1886 }
1887
1888 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1889 OPENX_FILE_EXISTS_OPEN, &access_mask,
1890 &share_mode, &create_disposition,
1891 &create_options, &private_flags)) {
1892 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1893 goto out;
1894 }
1895
1896 status = SMB_VFS_CREATE_FILE(
1897 conn, /* conn */
1898 req, /* req */
1899 0, /* root_dir_fid */
1900 smb_fname, /* fname */
1901 access_mask, /* access_mask */
1902 share_mode, /* share_access */
1903 create_disposition, /* create_disposition*/
1904 create_options, /* create_options */
1905 dos_attr, /* file_attributes */
1906 oplock_request, /* oplock_request */
1907 0, /* allocation_size */
1908 private_flags,
1909 NULL, /* sd */
1910 NULL, /* ea_list */
1911 &fsp, /* result */
1912 &info); /* pinfo */
1913
1914 if (!NT_STATUS_IS_OK(status)) {
1915 if (open_was_deferred(req->sconn, req->mid)) {
1916 /* We have re-scheduled this call. */
1917 goto out;
1918 }
1919 reply_openerror(req, status);
1920 goto out;
1921 }
1922
1923 size = smb_fname->st.st_ex_size;
1924 fattr = dos_mode(conn, smb_fname);
1925
1926 /* Deal with other possible opens having a modified
1927 write time. JRA. */
1928 if (ask_sharemode) {
1929 struct timespec write_time_ts;
1930
1931 ZERO_STRUCT(write_time_ts);
1932 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1933 if (!null_timespec(write_time_ts)) {
1934 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1935 }
1936 }
1937
1938 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1939
1940 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1941 DEBUG(3,("attempt to open a directory %s\n",
1942 fsp_str_dbg(fsp)));
1943 close_file(req, fsp, ERROR_CLOSE);
1944 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1945 ERRDOS, ERRnoaccess);
1946 goto out;
1947 }
1948
1949 reply_outbuf(req, 7, 0);
1950 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1951 SSVAL(req->outbuf,smb_vwv1,fattr);
1952 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1953 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1954 } else {
1955 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1956 }
1957 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1958 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1959
1960 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1961 SCVAL(req->outbuf,smb_flg,
1962 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1963 }
1964
1965 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1966 SCVAL(req->outbuf,smb_flg,
1967 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1968 }
1969 out:
1970 TALLOC_FREE(smb_fname);
1971 END_PROFILE(SMBopen);
1972 return;
1973 }
1974
1975 /****************************************************************************
1976 Reply to an open and X.
1977 ****************************************************************************/
1978
1979 void reply_open_and_X(struct smb_request *req)
1980 {
1981 connection_struct *conn = req->conn;
1982 struct smb_filename *smb_fname = NULL;
1983 char *fname = NULL;
1984 uint16 open_flags;
1985 int deny_mode;
1986 uint32 smb_attr;
1987 /* Breakout the oplock request bits so we can set the
1988 reply bits separately. */
1989 int ex_oplock_request;
1990 int core_oplock_request;
1991 int oplock_request;
1992 #if 0
1993 int smb_sattr = SVAL(req->vwv+4, 0);
1994 uint32 smb_time = make_unix_date3(req->vwv+6);
1995 #endif
1996 int smb_ofun;
1997 uint32 fattr=0;
1998 int mtime=0;
1999 int smb_action = 0;
2000 files_struct *fsp;
2001 NTSTATUS status;
2002 uint64_t allocation_size;
2003 ssize_t retval = -1;
2004 uint32 access_mask;
2005 uint32 share_mode;
2006 uint32 create_disposition;
2007 uint32 create_options = 0;
2008 uint32_t private_flags = 0;
2009 TALLOC_CTX *ctx = talloc_tos();
2010
2011 START_PROFILE(SMBopenX);
2012
2013 if (req->wct < 15) {
2014 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2015 goto out;
2016 }
2017
2018 open_flags = SVAL(req->vwv+2, 0);
2019 deny_mode = SVAL(req->vwv+3, 0);
2020 smb_attr = SVAL(req->vwv+5, 0);
2021 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2022 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2023 oplock_request = ex_oplock_request | core_oplock_request;
2024 smb_ofun = SVAL(req->vwv+8, 0);
2025 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2026
2027 /* If it's an IPC, pass off the pipe handler. */
2028 if (IS_IPC(conn)) {
2029 if (lp_nt_pipe_support()) {
2030 reply_open_pipe_and_X(conn, req);
2031 } else {
2032 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2033 }
2034 goto out;
2035 }
2036
2037 /* XXXX we need to handle passed times, sattr and flags */
2038 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2039 STR_TERMINATE, &status);
2040 if (!NT_STATUS_IS_OK(status)) {
2041 reply_nterror(req, status);
2042 goto out;
2043 }
2044
2045 status = filename_convert(ctx,
2046 conn,
2047 req->flags2 & FLAGS2_DFS_PATHNAMES,
2048 fname,
2049 0,
2050 NULL,
2051 &smb_fname);
2052 if (!NT_STATUS_IS_OK(status)) {
2053 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2054 reply_botherror(req,
2055 NT_STATUS_PATH_NOT_COVERED,
2056 ERRSRV, ERRbadpath);
2057 goto out;
2058 }
2059 reply_nterror(req, status);
2060 goto out;
2061 }
2062
2063 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
2064 smb_ofun,
2065 &access_mask, &share_mode,
2066 &create_disposition,
2067 &create_options,
2068 &private_flags)) {
2069 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2070 goto out;
2071 }
2072
2073 status = SMB_VFS_CREATE_FILE(
2074 conn, /* conn */
2075 req, /* req */
2076 0, /* root_dir_fid */
2077 smb_fname, /* fname */
2078 access_mask, /* access_mask */
2079 share_mode, /* share_access */
2080 create_disposition, /* create_disposition*/
2081 create_options, /* create_options */
2082 smb_attr, /* file_attributes */
2083 oplock_request, /* oplock_request */
2084 0, /* allocation_size */
2085 private_flags,
2086 NULL, /* sd */
2087 NULL, /* ea_list */
2088 &fsp, /* result */
2089 &smb_action); /* pinfo */
2090
2091 if (!NT_STATUS_IS_OK(status)) {
2092 if (open_was_deferred(req->sconn, req->mid)) {
2093 /* We have re-scheduled this call. */
2094 goto out;
2095 }
2096 reply_openerror(req, status);
2097 goto out;
2098 }
2099
2100 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2101 if the file is truncated or created. */
2102 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2103 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2104 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2105 close_file(req, fsp, ERROR_CLOSE);
2106 reply_nterror(req, NT_STATUS_DISK_FULL);
2107 goto out;
2108 }
2109 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2110 if (retval < 0) {
2111 close_file(req, fsp, ERROR_CLOSE);
2112 reply_nterror(req, NT_STATUS_DISK_FULL);
2113 goto out;
2114 }
2115 status = vfs_stat_fsp(fsp);
2116 if (!NT_STATUS_IS_OK(status)) {
2117 close_file(req, fsp, ERROR_CLOSE);
2118 reply_nterror(req, status);
2119 goto out;
2120 }
2121 }
2122
2123 fattr = dos_mode(conn, fsp->fsp_name);
2124 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2125 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2126 close_file(req, fsp, ERROR_CLOSE);
2127 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2128 goto out;
2129 }
2130
2131 /* If the caller set the extended oplock request bit
2132 and we granted one (by whatever means) - set the
2133 correct bit for extended oplock reply.
2134 */
2135
2136 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2137 smb_action |= EXTENDED_OPLOCK_GRANTED;
2138 }
2139
2140 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2141 smb_action |= EXTENDED_OPLOCK_GRANTED;
2142 }
2143
2144 /* If the caller set the core oplock request bit
2145 and we granted one (by whatever means) - set the
2146 correct bit for core oplock reply.
2147 */
2148
2149 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2150 reply_outbuf(req, 19, 0);
2151 } else {
2152 reply_outbuf(req, 15, 0);
2153 }
2154
2155 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2156 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2157
2158 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2159 SCVAL(req->outbuf, smb_flg,
2160 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2161 }
2162
2163 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2164 SCVAL(req->outbuf, smb_flg,
2165 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2166 }
2167
2168 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2169 SSVAL(req->outbuf,smb_vwv3,fattr);
2170 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2171 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2172 } else {
2173 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2174 }
2175 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2176 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2177 SSVAL(req->outbuf,smb_vwv11,smb_action);
2178
2179 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2180 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2181 }
2182
2183 out:
2184 TALLOC_FREE(smb_fname);
2185 END_PROFILE(SMBopenX);
2186 return;
2187 }
2188
2189 /****************************************************************************
2190 Reply to a SMBulogoffX.
2191 ****************************************************************************/
2192
2193 void reply_ulogoffX(struct smb_request *req)
2194 {
2195 struct smbd_server_connection *sconn = req->sconn;
2196 struct user_struct *vuser;
2197 struct smbXsrv_session *session = NULL;
2198 NTSTATUS status;
2199
2200 START_PROFILE(SMBulogoffX);
2201
2202 vuser = get_valid_user_struct(sconn, req->vuid);
2203
2204 if(vuser == NULL) {
2205 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2206 (unsigned long long)req->vuid));
2207
2208 req->vuid = UID_FIELD_INVALID;
2209 reply_force_doserror(req, ERRSRV, ERRbaduid);
2210 END_PROFILE(SMBulogoffX);
2211 return;
2212 }
2213
2214 session = vuser->session;
2215 vuser = NULL;
2216
2217 /*
2218 * TODO: cancel all outstanding requests on the session
2219 */
2220 status = smbXsrv_session_logoff(session);
2221 if (!NT_STATUS_IS_OK(status)) {
2222 DEBUG(0, ("reply_ulogoff: "
2223 "smbXsrv_session_logoff() failed: %s\n",
2224 nt_errstr(status)));
2225 /*
2226 * If we hit this case, there is something completely
2227 * wrong, so we better disconnect the transport connection.
2228 */
2229 END_PROFILE(SMBulogoffX);
2230 exit_server(__location__ ": smbXsrv_session_logoff failed");
2231 return;
2232 }
2233
2234 TALLOC_FREE(session);
2235
2236 reply_outbuf(req, 2, 0);
2237 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2238 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2239
2240 DEBUG(3, ("ulogoffX vuid=%llu\n",
2241 (unsigned long long)req->vuid));
2242
2243 END_PROFILE(SMBulogoffX);
2244 req->vuid = UID_FIELD_INVALID;
2245 }
2246
2247 /****************************************************************************
2248 Reply to a mknew or a create.
2249 ****************************************************************************/
2250
2251 void reply_mknew(struct smb_request *req)
2252 {
2253 connection_struct *conn = req->conn;
2254 struct smb_filename *smb_fname = NULL;
2255 char *fname = NULL;
2256 uint32 fattr = 0;
2257 struct smb_file_time ft;
2258 files_struct *fsp;
2259 int oplock_request = 0;
2260 NTSTATUS status;
2261 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2262 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2263 uint32 create_disposition;
2264 uint32 create_options = 0;
2265 TALLOC_CTX *ctx = talloc_tos();
2266
2267 START_PROFILE(SMBcreate);
2268 ZERO_STRUCT(ft);
2269
2270 if (req->wct < 3) {
2271 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2272 goto out;
2273 }
2274
2275 fattr = SVAL(req->vwv+0, 0);
2276 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2277
2278 /* mtime. */
2279 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2280
2281 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2282 STR_TERMINATE, &status);
2283 if (!NT_STATUS_IS_OK(status)) {
2284 reply_nterror(req, status);
2285 goto out;
2286 }
2287
2288 status = filename_convert(ctx,
2289 conn,
2290 req->flags2 & FLAGS2_DFS_PATHNAMES,
2291 fname,
2292 0,
2293 NULL,
2294 &smb_fname);
2295 if (!NT_STATUS_IS_OK(status)) {
2296 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2297 reply_botherror(req,
2298 NT_STATUS_PATH_NOT_COVERED,
2299 ERRSRV, ERRbadpath);
2300 goto out;
2301 }
2302 reply_nterror(req, status);
2303 goto out;
2304 }
2305
2306 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2307 DEBUG(0,("Attempt to create file (%s) with volid set - "
2308 "please report this\n",
2309 smb_fname_str_dbg(smb_fname)));
2310 }
2311
2312 if(req->cmd == SMBmknew) {
2313 /* We should fail if file exists. */
2314 create_disposition = FILE_CREATE;
2315 } else {
2316 /* Create if file doesn't exist, truncate if it does. */
2317 create_disposition = FILE_OVERWRITE_IF;
2318 }
2319
2320 status = SMB_VFS_CREATE_FILE(
2321 conn, /* conn */
2322 req, /* req */
2323 0, /* root_dir_fid */
2324 smb_fname, /* fname */
2325 access_mask, /* access_mask */
2326 share_mode, /* share_access */
2327 create_disposition, /* create_disposition*/
2328 create_options, /* create_options */
2329 fattr, /* file_attributes */
2330 oplock_request, /* oplock_request */
2331 0, /* allocation_size */
2332 0, /* private_flags */
2333 NULL, /* sd */
2334 NULL, /* ea_list */
2335 &fsp, /* result */
2336 NULL); /* pinfo */
2337
2338 if (!NT_STATUS_IS_OK(status)) {
2339 if (open_was_deferred(req->sconn, req->mid)) {
2340 /* We have re-scheduled this call. */
2341 goto out;
2342 }
2343 reply_openerror(req, status);
2344 goto out;
2345 }
2346
2347 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2348 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2349 if (!NT_STATUS_IS_OK(status)) {
2350 END_PROFILE(SMBcreate);
2351 goto out;
2352 }
2353
2354 reply_outbuf(req, 1, 0);
2355 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2356
2357 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2358 SCVAL(req->outbuf,smb_flg,
2359 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2360 }
2361
2362 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2363 SCVAL(req->outbuf,smb_flg,
2364 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2365 }
2366
2367 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2368 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2369 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2370 (unsigned int)fattr));
2371
2372 out:
2373 TALLOC_FREE(smb_fname);
2374 END_PROFILE(SMBcreate);
2375 return;
2376 }
2377
2378 /****************************************************************************
2379 Reply to a create temporary file.
2380 ****************************************************************************/
2381
2382 void reply_ctemp(struct smb_request *req)
2383 {
2384 connection_struct *conn = req->conn;
2385 struct smb_filename *smb_fname = NULL;
2386 char *fname = NULL;
2387 uint32 fattr;
2388 files_struct *fsp;
2389 int oplock_request;
2390 int tmpfd;
2391 char *s;
2392 NTSTATUS status;
2393 TALLOC_CTX *ctx = talloc_tos();
2394
2395 START_PROFILE(SMBctemp);
2396
2397 if (req->wct < 3) {
2398 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2399 goto out;
2400 }
2401
2402 fattr = SVAL(req->vwv+0, 0);
2403 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2404
2405 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2406 STR_TERMINATE, &status);
2407 if (!NT_STATUS_IS_OK(status)) {
2408 reply_nterror(req, status);
2409 goto out;
2410 }
2411 if (*fname) {
2412 fname = talloc_asprintf(ctx,
2413 "%s/TMXXXXXX",
2414 fname);
2415 } else {
2416 fname = talloc_strdup(ctx, "TMXXXXXX");
2417 }
2418
2419 if (!fname) {
2420 reply_nterror(req, NT_STATUS_NO_MEMORY);
2421 goto out;
2422 }
2423
2424 status = filename_convert(ctx, conn,
2425 req->flags2 & FLAGS2_DFS_PATHNAMES,
2426 fname,
2427 0,
2428 NULL,
2429 &smb_fname);
2430 if (!NT_STATUS_IS_OK(status)) {
2431 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2432 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2433 ERRSRV, ERRbadpath);
2434 goto out;
2435 }
2436 reply_nterror(req, status);
2437 goto out;
2438 }
2439
2440 tmpfd = mkstemp(smb_fname->base_name);
2441 if (tmpfd == -1) {
2442 reply_nterror(req, map_nt_error_from_unix(errno));
2443 goto out;
2444 }
2445
2446 SMB_VFS_STAT(conn, smb_fname);
2447
2448 /* We should fail if file does not exist. */
2449 status = SMB_VFS_CREATE_FILE(
2450 conn, /* conn */
2451 req, /* req */
2452 0, /* root_dir_fid */
2453 smb_fname, /* fname */
2454 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2455 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2456 FILE_OPEN, /* create_disposition*/
2457 0, /* create_options */
2458 fattr, /* file_attributes */
2459 oplock_request, /* oplock_request */
2460 0, /* allocation_size */
2461 0, /* private_flags */
2462 NULL, /* sd */
2463 NULL, /* ea_list */
2464 &fsp, /* result */
2465 NULL); /* pinfo */
2466
2467 /* close fd from mkstemp() */
2468 close(tmpfd);
2469
2470 if (!NT_STATUS_IS_OK(status)) {
2471 if (open_was_deferred(req->sconn, req->mid)) {
2472 /* We have re-scheduled this call. */
2473 goto out;
2474 }
2475 reply_openerror(req, status);
2476 goto out;
2477 }
2478
2479 reply_outbuf(req, 1, 0);
2480 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2481
2482 /* the returned filename is relative to the directory */
2483 s = strrchr_m(fsp->fsp_name->base_name, '/');
2484 if (!s) {
2485 s = fsp->fsp_name->base_name;
2486 } else {
2487 s++;
2488 }
2489
2490 #if 0
2491 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2492 thing in the byte section. JRA */
2493 SSVALS(p, 0, -1); /* what is this? not in spec */
2494 #endif
2495 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2496 == -1) {
2497 reply_nterror(req, NT_STATUS_NO_MEMORY);
2498 goto out;
2499 }
2500
2501 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2502 SCVAL(req->outbuf, smb_flg,
2503 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2504 }
2505
2506 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2507 SCVAL(req->outbuf, smb_flg,
2508 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2509 }
2510
2511 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2512 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2513 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2514 out:
2515 TALLOC_FREE(smb_fname);
2516 END_PROFILE(SMBctemp);
2517 return;
2518 }
2519
2520 /*******************************************************************
2521 Check if a user is allowed to rename a file.
2522 ********************************************************************/
2523
2524 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2525 uint16 dirtype)
2526 {
2527 if (!CAN_WRITE(conn)) {
2528 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2529 }
2530
2531 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2532 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2533 /* Only bother to read the DOS attribute if we might deny the
2534 rename on the grounds of attribute missmatch. */
2535 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2536 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2537 return NT_STATUS_NO_SUCH_FILE;
2538 }
2539 }
2540
2541 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2542 if (fsp->posix_open) {
2543 return NT_STATUS_OK;
2544 }
2545
2546 /* If no pathnames are open below this
2547 directory, allow the rename. */
2548
2549 if (file_find_subpath(fsp)) {
2550 return NT_STATUS_ACCESS_DENIED;
2551 }
2552 return NT_STATUS_OK;
2553 }
2554
2555 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2556 return NT_STATUS_OK;
2557 }
2558
2559 return NT_STATUS_ACCESS_DENIED;
2560 }
2561
2562 /*******************************************************************
2563 * unlink a file with all relevant access checks
2564 *******************************************************************/
2565
2566 static NTSTATUS do_unlink(connection_struct *conn,
2567 struct smb_request *req,
2568 struct smb_filename *smb_fname,
2569 uint32 dirtype)
2570 {
2571 uint32 fattr;
2572 files_struct *fsp;
2573 uint32 dirtype_orig = dirtype;
2574 NTSTATUS status;
2575 int ret;
2576 bool posix_paths = lp_posix_pathnames();
2577
2578 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2579 smb_fname_str_dbg(smb_fname),
2580 dirtype));
2581
2582 if (!CAN_WRITE(conn)) {
2583 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2584 }
2585
2586 if (posix_paths) {
2587 ret = SMB_VFS_LSTAT(conn, smb_fname);
2588 } else {
2589 ret = SMB_VFS_STAT(conn, smb_fname);
2590 }
2591 if (ret != 0) {
2592 return map_nt_error_from_unix(errno);
2593 }
2594
2595 fattr = dos_mode(conn, smb_fname);
2596
2597 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2598 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2599 }
2600
2601 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2602 if (!dirtype) {
2603 return NT_STATUS_NO_SUCH_FILE;
2604 }
2605
2606 if (!dir_check_ftype(conn, fattr, dirtype)) {
2607 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2608 return NT_STATUS_FILE_IS_A_DIRECTORY;
2609 }
2610 return NT_STATUS_NO_SUCH_FILE;
2611 }
2612
2613 if (dirtype_orig & 0x8000) {
2614 /* These will never be set for POSIX. */
2615 return NT_STATUS_NO_SUCH_FILE;
2616 }
2617
2618 #if 0
2619 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2620 return NT_STATUS_FILE_IS_A_DIRECTORY;
2621 }
2622
2623 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2624 return NT_STATUS_NO_SUCH_FILE;
2625 }
2626
2627 if (dirtype & 0xFF00) {
2628 /* These will never be set for POSIX. */
2629 return NT_STATUS_NO_SUCH_FILE;
2630 }
2631
2632 dirtype &= 0xFF;
2633 if (!dirtype) {
2634 return NT_STATUS_NO_SUCH_FILE;
2635 }
2636
2637 /* Can't delete a directory. */
2638 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2639 return NT_STATUS_FILE_IS_A_DIRECTORY;
2640 }
2641 #endif
2642
2643 #if 0 /* JRATEST */
2644 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2645 return NT_STATUS_OBJECT_NAME_INVALID;
2646 #endif /* JRATEST */
2647
2648 /* On open checks the open itself will check the share mode, so
2649 don't do it here as we'll get it wrong. */
2650
2651 status = SMB_VFS_CREATE_FILE
2652 (conn, /* conn */
2653 req, /* req */
2654 0, /* root_dir_fid */
2655 smb_fname, /* fname */
2656 DELETE_ACCESS, /* access_mask */
2657 FILE_SHARE_NONE, /* share_access */
2658 FILE_OPEN, /* create_disposition*/
2659 FILE_NON_DIRECTORY_FILE, /* create_options */
2660 /* file_attributes */
2661 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2662 FILE_ATTRIBUTE_NORMAL,
2663 0, /* oplock_request */
2664 0, /* allocation_size */
2665 0, /* private_flags */
2666 NULL, /* sd */
2667 NULL, /* ea_list */
2668 &fsp, /* result */
2669 NULL); /* pinfo */
2670
2671 if (!NT_STATUS_IS_OK(status)) {
2672 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2673 nt_errstr(status)));
2674 return status;
2675 }
2676
2677 status = can_set_delete_on_close(fsp, fattr);
2678 if (!NT_STATUS_IS_OK(status)) {
2679 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2680 "(%s)\n",
2681 smb_fname_str_dbg(smb_fname),
2682 nt_errstr(status)));
2683 close_file(req, fsp, NORMAL_CLOSE);
2684 return status;
2685 }
2686
2687 /* The set is across all open files on this dev/inode pair. */
2688 if (!set_delete_on_close(fsp, True,
2689 conn->session_info->security_token,
2690 conn->session_info->unix_token)) {
2691 close_file(req, fsp, NORMAL_CLOSE);
2692 return NT_STATUS_ACCESS_DENIED;
2693 }
2694
2695 return close_file(req, fsp, NORMAL_CLOSE);
2696 }
2697
2698 /****************************************************************************
2699 The guts of the unlink command, split out so it may be called by the NT SMB
2700 code.
2701 ****************************************************************************/
2702
2703 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2704 uint32 dirtype, struct smb_filename *smb_fname,
2705 bool has_wild)
2706 {
2707 char *fname_dir = NULL;
2708 char *fname_mask = NULL;
2709 int count=0;
2710 NTSTATUS status = NT_STATUS_OK;
2711 TALLOC_CTX *ctx = talloc_tos();
2712
2713 /* Split up the directory from the filename/mask. */
2714 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2715 &fname_dir, &fname_mask);
2716 if (!NT_STATUS_IS_OK(status)) {
2717 goto out;
2718 }
2719
2720 /*
2721 * We should only check the mangled cache
2722 * here if unix_convert failed. This means
2723 * that the path in 'mask' doesn't exist
2724 * on the file system and so we need to look
2725 * for a possible mangle. This patch from
2726 * Tine Smukavec <valentin.smukavec@hermes.si>.
2727 */
2728
2729 if (!VALID_STAT(smb_fname->st) &&
2730 mangle_is_mangled(fname_mask, conn->params)) {
2731 char *new_mask = NULL;
2732 mangle_lookup_name_from_8_3(ctx, fname_mask,
2733 &new_mask, conn->params);
2734 if (new_mask) {
2735 TALLOC_FREE(fname_mask);
2736 fname_mask = new_mask;
2737 }
2738 }
2739
2740 if (!has_wild) {
2741
2742 /*
2743 * Only one file needs to be unlinked. Append the mask back
2744 * onto the directory.
2745 */
2746 TALLOC_FREE(smb_fname->base_name);
2747 if (ISDOT(fname_dir)) {
2748 /* Ensure we use canonical names on open. */
2749 smb_fname->base_name = talloc_asprintf(smb_fname,
2750 "%s",
2751 fname_mask);
2752 } else {
2753 smb_fname->base_name = talloc_asprintf(smb_fname,
2754 "%s/%s",
2755 fname_dir,
2756 fname_mask);
2757 }
2758 if (!smb_fname->base_name) {
2759 status = NT_STATUS_NO_MEMORY;
2760 goto out;
2761 }
2762 if (dirtype == 0) {
2763 dirtype = FILE_ATTRIBUTE_NORMAL;
2764 }
2765
2766 status = check_name(conn, smb_fname->base_name);
2767 if (!NT_STATUS_IS_OK(status)) {
2768 goto out;
2769 }
2770
2771 status = do_unlink(conn, req, smb_fname, dirtype);
2772 if (!NT_STATUS_IS_OK(status)) {
2773 goto out;
2774 }
2775
2776 count++;
2777 } else {
2778 struct smb_Dir *dir_hnd = NULL;
2779 long offset = 0;
2780 const char *dname = NULL;
2781 char *talloced = NULL;
2782
2783 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2784 status = NT_STATUS_OBJECT_NAME_INVALID;
2785 goto out;
2786 }
2787
2788 if (strequal(fname_mask,"????????.???")) {
2789 TALLOC_FREE(fname_mask);
2790 fname_mask = talloc_strdup(ctx, "*");
2791 if (!fname_mask) {
2792 status = NT_STATUS_NO_MEMORY;
2793 goto out;
2794 }
2795 }
2796
2797 status = check_name(conn, fname_dir);
2798 if (!NT_STATUS_IS_OK(status)) {
2799 goto out;
2800 }
2801
2802 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2803 dirtype);
2804 if (dir_hnd == NULL) {
2805 status = map_nt_error_from_unix(errno);
2806 goto out;
2807 }
2808
2809 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2810 the pattern matches against the long name, otherwise the short name
2811 We don't implement this yet XXXX
2812 */
2813
2814 status = NT_STATUS_NO_SUCH_FILE;
2815
2816 while ((dname = ReadDirName(dir_hnd, &offset,
2817 &smb_fname->st, &talloced))) {
2818 TALLOC_CTX *frame = talloc_stackframe();
2819
2820 if (!is_visible_file(conn, fname_dir, dname,
2821 &smb_fname->st, true)) {
2822 TALLOC_FREE(frame);
2823 TALLOC_FREE(talloced);
2824 continue;
2825 }
2826
2827 /* Quick check for "." and ".." */
2828 if (ISDOT(dname) || ISDOTDOT(dname)) {
2829 TALLOC_FREE(frame);
2830 TALLOC_FREE(talloced);
2831 continue;
2832 }
2833
2834 if(!mask_match(dname, fname_mask,
2835 conn->case_sensitive)) {
2836 TALLOC_FREE(frame);
2837 TALLOC_FREE(talloced);
2838 continue;
2839 }
2840
2841 TALLOC_FREE(smb_fname->base_name);
2842 if (ISDOT(fname_dir)) {
2843 /* Ensure we use canonical names on open. */
2844 smb_fname->base_name =
2845 talloc_asprintf(smb_fname, "%s",
2846 dname);
2847 } else {
2848 smb_fname->base_name =
2849 talloc_asprintf(smb_fname, "%s/%s",
2850 fname_dir, dname);
2851 }
2852
2853 if (!smb_fname->base_name) {
2854 TALLOC_FREE(dir_hnd);
2855 status = NT_STATUS_NO_MEMORY;
2856 TALLOC_FREE(frame);
2857 TALLOC_FREE(talloced);
2858 goto out;
2859 }
2860
2861 status = check_name(conn, smb_fname->base_name);
2862 if (!NT_STATUS_IS_OK(status)) {
2863 TALLOC_FREE(dir_hnd);
2864 TALLOC_FREE(frame);
2865 TALLOC_FREE(talloced);
2866 goto out;
2867 }
2868
2869 status = do_unlink(conn, req, smb_fname, dirtype);
2870 if (!NT_STATUS_IS_OK(status)) {
2871 TALLOC_FREE(frame);
2872 TALLOC_FREE(talloced);
2873 continue;
2874 }
2875
2876 count++;
2877 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2878 smb_fname->base_name));
2879
2880 TALLOC_FREE(frame);
2881 TALLOC_FREE(talloced);
2882 }
2883 TALLOC_FREE(dir_hnd);
2884 }
2885
2886 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2887 status = map_nt_error_from_unix(errno);
2888 }
2889
2890 out:
2891 TALLOC_FREE(fname_dir);
2892 TALLOC_FREE(fname_mask);
2893 return status;
2894 }
2895
2896 /****************************************************************************
2897 Reply to a unlink
2898 ****************************************************************************/
2899
2900 void reply_unlink(struct smb_request *req)
2901 {
2902 connection_struct *conn = req->conn;
2903 char *name = NULL;
2904 struct smb_filename *smb_fname = NULL;
2905 uint32 dirtype;
2906 NTSTATUS status;
2907 bool path_contains_wcard = False;
2908 TALLOC_CTX *ctx = talloc_tos();
2909
2910 START_PROFILE(SMBunlink);
2911
2912 if (req->wct < 1) {
2913 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2914 goto out;
2915 }
2916
2917 dirtype = SVAL(req->vwv+0, 0);
2918
2919 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2920 STR_TERMINATE, &status,
2921 &path_contains_wcard);
2922 if (!NT_STATUS_IS_OK(status)) {
2923 reply_nterror(req, status);
2924 goto out;
2925 }
2926
2927 status = filename_convert(ctx, conn,
2928 req->flags2 & FLAGS2_DFS_PATHNAMES,
2929 name,
2930 UCF_COND_ALLOW_WCARD_LCOMP,
2931 &path_contains_wcard,
2932 &smb_fname);
2933 if (!NT_STATUS_IS_OK(status)) {
2934 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2935 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2936 ERRSRV, ERRbadpath);
2937 goto out;
2938 }
2939 reply_nterror(req, status);
2940 goto out;
2941 }
2942
2943 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2944
2945 status = unlink_internals(conn, req, dirtype, smb_fname,
2946 path_contains_wcard);
2947 if (!NT_STATUS_IS_OK(status)) {
2948 if (open_was_deferred(req->sconn, req->mid)) {
2949 /* We have re-scheduled this call. */
2950 goto out;
2951 }
2952 reply_nterror(req, status);
2953 goto out;
2954 }
2955
2956 reply_outbuf(req, 0, 0);
2957 out:
2958 TALLOC_FREE(smb_fname);
2959 END_PROFILE(SMBunlink);
2960 return;
2961 }
2962
2963 /****************************************************************************
2964 Fail for readbraw.
2965 ****************************************************************************/
2966
2967 static void fail_readraw(void)
2968 {
2969 const char *errstr = talloc_asprintf(talloc_tos(),
2970 "FAIL ! reply_readbraw: socket write fail (%s)",
2971 strerror(errno));
2972 if (!errstr) {
2973 errstr = "";
2974 }
2975 exit_server_cleanly(errstr);
2976 }
2977
2978 /****************************************************************************
2979 Fake (read/write) sendfile. Returns -1 on read or write fail.
2980 ****************************************************************************/
2981
2982 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
2983 {
2984 size_t bufsize;
2985 size_t tosend = nread;
2986 char *buf;
2987
2988 if (nread == 0) {
2989 return 0;
2990 }
2991
2992 bufsize = MIN(nread, 65536);
2993
2994 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2995 return -1;
2996 }
2997
2998 while (tosend > 0) {
2999 ssize_t ret;
3000 size_t cur_read;
3001
3002 if (tosend > bufsize) {
3003 cur_read = bufsize;
3004 } else {
3005 cur_read = tosend;
3006 }
3007 ret = read_file(fsp,buf,startpos,cur_read);
3008 if (ret == -1) {
3009 SAFE_FREE(buf);
3010 return -1;
3011 }
3012
3013 /* If we had a short read, fill with zeros. */
3014 if (ret < cur_read) {
3015 memset(buf + ret, '\0', cur_read - ret);
3016 }
3017
3018 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3019 != cur_read) {
3020 char addr[INET6_ADDRSTRLEN];
3021 /*
3022 * Try and give an error message saying what
3023 * client failed.
3024 */
3025 DEBUG(0, ("write_data failed for client %s. "
3026 "Error %s\n",
3027 get_peer_addr(fsp->conn->sconn->sock, addr,
3028 sizeof(addr)),
3029 strerror(errno)));
3030 SAFE_FREE(buf);
3031 return -1;
3032 }
3033 tosend -= cur_read;
3034 startpos += cur_read;
3035 }
3036
3037 SAFE_FREE(buf);
3038 return (ssize_t)nread;
3039 }
3040
3041 /****************************************************************************
3042 Deal with the case of sendfile reading less bytes from the file than
3043 requested. Fill with zeros (all we can do).
3044 ****************************************************************************/
3045
3046 void sendfile_short_send(files_struct *fsp,
3047 ssize_t nread,
3048 size_t headersize,
3049 size_t smb_maxcnt)
3050 {
3051 #define SHORT_SEND_BUFSIZE 1024
3052 if (nread < headersize) {
3053 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3054 "header for file %s (%s). Terminating\n",
3055 fsp_str_dbg(fsp), strerror(errno)));
3056 exit_server_cleanly("sendfile_short_send failed");
3057 }
3058
3059 nread -= headersize;
3060
3061 if (nread < smb_maxcnt) {
3062 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3063 if (!buf) {
3064 exit_server_cleanly("sendfile_short_send: "
3065 "malloc failed");
3066 }
3067
3068 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3069 "with zeros !\n", fsp_str_dbg(fsp)));
3070
3071 while (nread < smb_maxcnt) {
3072 /*
3073 * We asked for the real file size and told sendfile
3074 * to not go beyond the end of the file. But it can
3075 * happen that in between our fstat call and the
3076 * sendfile call the file was truncated. This is very
3077 * bad because we have already announced the larger
3078 * number of bytes to the client.
3079 *
3080 * The best we can do now is to send 0-bytes, just as
3081 * a read from a hole in a sparse file would do.
3082 *
3083 * This should happen rarely enough that I don't care
3084 * about efficiency here :-)
3085 */
3086 size_t to_write;
3087
3088 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3089 if (write_data(fsp->conn->sconn->sock, buf, to_write)
3090 != to_write) {
3091 char addr[INET6_ADDRSTRLEN];
3092 /*
3093 * Try and give an error message saying what
3094 * client failed.
3095 */
3096 DEBUG(0, ("write_data failed for client %s. "
3097 "Error %s\n",
3098 get_peer_addr(
3099 fsp->conn->sconn->sock, addr,
3100 sizeof(addr)),
3101 strerror(errno)));
3102 exit_server_cleanly("sendfile_short_send: "
3103 "write_data failed");
3104 }
3105 nread += to_write;
3106 }
3107 SAFE_FREE(buf);
3108 }
3109 }
3110
3111 /****************************************************************************
3112 Return a readbraw error (4 bytes of zero).
3113 ****************************************************************************/
3114
3115 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3116 {
3117 char header[4];
3118
3119 SIVAL(header,0,0);
3120
3121 smbd_lock_socket(sconn);
3122 if (write_data(sconn->sock,header,4) != 4) {
3123 char addr[INET6_ADDRSTRLEN];
3124 /*
3125 * Try and give an error message saying what
3126 * client failed.
3127 */
3128 DEBUG(0, ("write_data failed for client %s. "
3129 "Error %s\n",
3130 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3131 strerror(errno)));
3132
3133 fail_readraw();
3134 }
3135 smbd_unlock_socket(sconn);
3136 }
3137
3138 /****************************************************************************
3139 Use sendfile in readbraw.
3140 ****************************************************************************/
3141
3142 static void send_file_readbraw(connection_struct *conn,
3143 struct smb_request *req,
3144 files_struct *fsp,
3145 off_t startpos,
3146 size_t nread,
3147 ssize_t mincount)
3148 {
3149 struct smbd_server_connection *sconn = req->sconn;
3150 char *outbuf = NULL;
3151 ssize_t ret=0;
3152
3153 /*
3154 * We can only use sendfile on a non-chained packet
3155 * but we can use on a non-oplocked file. tridge proved this
3156 * on a train in Germany :-). JRA.
3157 * reply_readbraw has already checked the length.
3158 */
3159
3160 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3161 (fsp->wcp == NULL) &&
3162 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3163 ssize_t sendfile_read = -1;
3164 char header[4];
3165 DATA_BLOB header_blob;
3166
3167 _smb_setlen(header,nread);
3168 header_blob = data_blob_const(header, 4);
3169
3170 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3171 &header_blob, startpos,
3172 nread);
3173 if (sendfile_read == -1) {
3174 /* Returning ENOSYS means no data at all was sent.
3175 * Do this as a normal read. */
3176 if (errno == ENOSYS) {
3177 goto normal_readbraw;
3178 }
3179
3180 /*
3181 * Special hack for broken Linux with no working sendfile. If we
3182 * return EINTR we sent the header but not the rest of the data.
3183 * Fake this up by doing read/write calls.
3184 */
3185 if (errno == EINTR) {
3186 /* Ensure we don't do this again. */
3187 set_use_sendfile(SNUM(conn), False);
3188 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3189
3190 if (fake_sendfile(fsp, startpos, nread) == -1) {
3191 DEBUG(0,("send_file_readbraw: "
3192 "fake_sendfile failed for "
3193 "file %s (%s).\n",
3194 fsp_str_dbg(fsp),
3195 strerror(errno)));
3196 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3197 }
3198 return;
3199 }
3200
3201 DEBUG(0,("send_file_readbraw: sendfile failed for "
3202 "file %s (%s). Terminating\n",
3203 fsp_str_dbg(fsp), strerror(errno)));
3204 exit_server_cleanly("send_file_readbraw sendfile failed");
3205 } else if (sendfile_read == 0) {
3206 /*
3207 * Some sendfile implementations return 0 to indicate
3208 * that there was a short read, but nothing was
3209 * actually written to the socket. In this case,
3210 * fallback to the normal read path so the header gets
3211 * the correct byte count.
3212 */
3213 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3214 "bytes falling back to the normal read: "
3215 "%s\n", fsp_str_dbg(fsp)));
3216 goto normal_readbraw;
3217 }
3218
3219 /* Deal with possible short send. */
3220 if (sendfile_read != 4+nread) {
3221 sendfile_short_send(fsp, sendfile_read, 4, nread);
3222 }
3223 return;
3224 }
3225
3226 normal_readbraw:
3227
3228 outbuf = talloc_array(NULL, char, nread+4);
3229 if (!outbuf) {
3230 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3231 (unsigned)(nread+4)));
3232 reply_readbraw_error(sconn);
3233 return;
3234 }
3235
3236 if (nread > 0) {
3237 ret = read_file(fsp,outbuf+4,startpos,nread);
3238 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3239 if (ret < mincount)
3240 ret = 0;
3241 #else
3242 if (ret < nread)
3243 ret = 0;
3244 #endif
3245 }
3246
3247 _smb_setlen(outbuf,ret);
3248 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3249 char addr[INET6_ADDRSTRLEN];
3250 /*
3251 * Try and give an error message saying what
3252 * client failed.
3253 */
3254 DEBUG(0, ("write_data failed for client %s. "
3255 "Error %s\n",
3256 get_peer_addr(fsp->conn->sconn->sock, addr,
3257 sizeof(addr)),
3258 strerror(errno)));
3259
3260 fail_readraw();
3261 }
3262
3263 TALLOC_FREE(outbuf);
3264 }
3265
3266 /****************************************************************************
3267 Reply to a readbraw (core+ protocol).
3268 ****************************************************************************/
3269
3270 void reply_readbraw(struct smb_request *req)
3271 {
3272 connection_struct *conn = req->conn;
3273 struct smbd_server_connection *sconn = req->sconn;
3274 ssize_t maxcount,mincount;
3275 size_t nread = 0;
3276 off_t startpos;
3277 files_struct *fsp;
3278 struct lock_struct lock;
3279 off_t size = 0;
3280
3281 START_PROFILE(SMBreadbraw);
3282
3283 if (srv_is_signing_active(sconn) ||
3284 is_encrypted_packet(sconn, req->inbuf)) {
3285 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3286 "raw reads/writes are disallowed.");
3287 }
3288
3289 if (req->wct < 8) {
3290 reply_readbraw_error(sconn);
3291 END_PROFILE(SMBreadbraw);
3292 return;
3293 }
3294
3295 if (sconn->smb1.echo_handler.trusted_fde) {
3296 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3297 "'async smb echo handler = yes'\n"));
3298 reply_readbraw_error(sconn);
3299 END_PROFILE(SMBreadbraw);
3300 return;
3301 }
3302
3303 /*
3304 * Special check if an oplock break has been issued
3305 * and the readraw request croses on the wire, we must
3306 * return a zero length response here.
3307 */
3308
3309 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3310
3311 /*
3312 * We have to do a check_fsp by hand here, as
3313 * we must always return 4 zero bytes on error,
3314 * not a NTSTATUS.
3315 */
3316
3317 if (!fsp || !conn || conn != fsp->conn ||
3318 req->vuid != fsp->vuid ||
3319 fsp->is_directory || fsp->fh->fd == -1) {
3320 /*
3321 * fsp could be NULL here so use the value from the packet. JRA.
3322 */
3323 DEBUG(3,("reply_readbraw: fnum %d not valid "
3324 "- cache prime?\n",
3325 (int)SVAL(req->vwv+0, 0)));
3326 reply_readbraw_error(sconn);
3327 END_PROFILE(SMBreadbraw);
3328 return;
3329 }
3330
3331 /* Do a "by hand" version of CHECK_READ. */
3332 if (!(fsp->can_read ||
3333 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3334 (fsp->access_mask & FILE_EXECUTE)))) {
3335 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3336 (int)SVAL(req->vwv+0, 0)));
3337 reply_readbraw_error(sconn);
3338 END_PROFILE(SMBreadbraw);
3339 return;
3340 }
3341
3342 flush_write_cache(fsp, READRAW_FLUSH);
3343
3344 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3345 if(req->wct == 10) {
3346 /*
3347 * This is a large offset (64 bit) read.
3348 */
3349
3350 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3351
3352 if(startpos < 0) {
3353 DEBUG(0,("reply_readbraw: negative 64 bit "
3354 "readraw offset (%.0f) !\n",
3355 (double)startpos ));
3356 reply_readbraw_error(sconn);
3357 END_PROFILE(SMBreadbraw);
3358 return;
3359 }
3360 }
3361
3362 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3363 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3364
3365 /* ensure we don't overrun the packet size */
3366 maxcount = MIN(65535,maxcount);
3367
3368 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3369 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3370 &lock);
3371
3372 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3373 reply_readbraw_error(sconn);
3374 END_PROFILE(SMBreadbraw);
3375 return;
3376 }
3377
3378 if (fsp_stat(fsp) == 0) {
3379 size = fsp->fsp_name->st.st_ex_size;
3380 }
3381
3382 if (startpos >= size) {
3383 nread = 0;
3384 } else {
3385 nread = MIN(maxcount,(size - startpos));
3386 }
3387
3388 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3389 if (nread < mincount)
3390 nread = 0;
3391 #endif
3392
3393 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3394 "min=%lu nread=%lu\n",
3395 fsp_fnum_dbg(fsp), (double)startpos,
3396 (unsigned long)maxcount,
3397 (unsigned long)mincount,
3398 (unsigned long)nread ) );
3399
3400 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3401
3402 DEBUG(5,("reply_readbraw finished\n"));
3403
3404 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3405
3406 END_PROFILE(SMBreadbraw);
3407 return;
3408 }
3409
3410 #undef DBGC_CLASS
3411 #define DBGC_CLASS DBGC_LOCKING
3412
3413 /****************************************************************************
3414 Reply to a lockread (core+ protocol).
3415 ****************************************************************************/
3416
3417 void reply_lockread(struct smb_request *req)
3418 {
3419 connection_struct *conn = req->conn;
3420 ssize_t nread = -1;
3421 char *data;
3422 off_t startpos;
3423 size_t numtoread;
3424 NTSTATUS status;
3425 files_struct *fsp;
3426 struct byte_range_lock *br_lck = NULL;
3427 char *p = NULL;
3428 struct smbd_server_connection *sconn = req->sconn;
3429
3430 START_PROFILE(SMBlockread);
3431
3432 if (req->wct < 5) {
3433 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3434 END_PROFILE(SMBlockread);
3435 return;
3436 }
3437
3438 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3439
3440 if (!check_fsp(conn, req, fsp)) {
3441 END_PROFILE(SMBlockread);
3442 return;
3443 }
3444
3445 if (!CHECK_READ(fsp,req)) {
3446 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3447 END_PROFILE(SMBlockread);
3448 return;
3449 }
3450
3451 numtoread = SVAL(req->vwv+1, 0);
3452 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3453
3454 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3455
3456 reply_outbuf(req, 5, numtoread + 3);
3457
3458 data = smb_buf(req->outbuf) + 3;
3459
3460 /*
3461 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3462 * protocol request that predates the read/write lock concept.
3463 * Thus instead of asking for a read lock here we need to ask
3464 * for a write lock. JRA.
3465 * Note that the requested lock size is unaffected by max_recv.
3466 */
3467
3468 br_lck = do_lock(req->sconn->msg_ctx,
3469 fsp,
3470 (uint64_t)req->smbpid,
3471 (uint64_t)numtoread,
3472 (uint64_t)startpos,
3473 WRITE_LOCK,
3474 WINDOWS_LOCK,
3475 False, /* Non-blocking lock. */
3476 &status,
3477 NULL,
3478 NULL);
3479 TALLOC_FREE(br_lck);
3480
3481 if (NT_STATUS_V(status)) {
3482 reply_nterror(req, status);
3483 END_PROFILE(SMBlockread);
3484 return;
3485 }
3486
3487 /*
3488 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3489 */
3490
3491 if (numtoread > sconn->smb1.negprot.max_recv) {
3492 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3493 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3494 (unsigned int)numtoread,
3495 (unsigned int)sconn->smb1.negprot.max_recv));
3496 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3497 }
3498 nread = read_file(fsp,data,startpos,numtoread);
3499
3500 if (nread < 0) {
3501 reply_nterror(req, map_nt_error_from_unix(errno));
3502 END_PROFILE(SMBlockread);
3503 return;
3504 }
3505
3506 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3507
3508 SSVAL(req->outbuf,smb_vwv0,nread);
3509 SSVAL(req->outbuf,smb_vwv5,nread+3);
3510 p = smb_buf(req->outbuf);
3511 SCVAL(p,0,0); /* pad byte. */
3512 SSVAL(p,1,nread);
3513
3514 DEBUG(3,("lockread %s num=%d nread=%d\n",
3515 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3516
3517 END_PROFILE(SMBlockread);
3518 return;
3519 }
3520
3521 #undef DBGC_CLASS
3522 #define DBGC_CLASS DBGC_ALL
3523
3524 /****************************************************************************
3525 Reply to a read.
3526 ****************************************************************************/
3527
3528 void reply_read(struct smb_request *req)
3529 {
3530 connection_struct *conn = req->conn;
3531 size_t numtoread;
3532 ssize_t nread = 0;
3533 char *data;
3534 off_t startpos;
3535 int outsize = 0;
3536 files_struct *fsp;
3537 struct lock_struct lock;
3538 struct smbd_server_connection *sconn = req->sconn;
3539
3540 START_PROFILE(SMBread);
3541
3542 if (req->wct < 3) {
3543 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3544 END_PROFILE(SMBread);
3545 return;
3546 }
3547
3548 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3549
3550 if (!check_fsp(conn, req, fsp)) {
3551 END_PROFILE(SMBread);
3552 return;
3553 }
3554
3555 if (!CHECK_READ(fsp,req)) {
3556 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3557 END_PROFILE(SMBread);
3558 return;
3559 }
3560
3561 numtoread = SVAL(req->vwv+1, 0);
3562 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3563
3564 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3565
3566 /*
3567 * The requested read size cannot be greater than max_recv. JRA.
3568 */
3569 if (numtoread > sconn->smb1.negprot.max_recv) {
3570 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3571 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3572 (unsigned int)numtoread,
3573 (unsigned int)sconn->smb1.negprot.max_recv));
3574 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3575 }
3576
3577 reply_outbuf(req, 5, numtoread+3);
3578
3579 data = smb_buf(req->outbuf) + 3;
3580
3581 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3582 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3583 &lock);
3584
3585 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3586 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3587 END_PROFILE(SMBread);
3588 return;
3589 }
3590
3591 if (numtoread > 0)
3592 nread = read_file(fsp,data,startpos,numtoread);
3593
3594 if (nread < 0) {
3595 reply_nterror(req, map_nt_error_from_unix(errno));
3596 goto strict_unlock;
3597 }
3598
3599 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3600
3601 SSVAL(req->outbuf,smb_vwv0,nread);
3602 SSVAL(req->outbuf,smb_vwv5,nread+3);
3603 SCVAL(smb_buf(req->outbuf),0,1);
3604 SSVAL(smb_buf(req->outbuf),1,nread);
3605
3606 DEBUG(3, ("read %s num=%d nread=%d\n",
3607 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3608
3609 strict_unlock:
3610 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3611
3612 END_PROFILE(SMBread);
3613 return;
3614 }
3615
3616 /****************************************************************************
3617 Setup readX header.
3618 ****************************************************************************/
3619
3620 static int setup_readX_header(struct smb_request *req, char *outbuf,
3621 size_t smb_maxcnt)
3622 {
3623 int outsize;
3624
3625 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3626
3627 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3628
3629 SCVAL(outbuf,smb_vwv0,0xFF);
3630 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3631 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3632 SSVAL(outbuf,smb_vwv6,
3633 (smb_wct - 4) /* offset from smb header to wct */
3634 + 1 /* the wct field */
3635 + 12 * sizeof(uint16_t) /* vwv */
3636 + 2); /* the buflen field */
3637 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3638 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3639 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3640 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3641 return outsize;
3642 }
3643
3644 /****************************************************************************
3645 Reply to a read and X - possibly using sendfile.
3646 ****************************************************************************/
3647
3648 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3649 files_struct *fsp, off_t startpos,
3650 size_t smb_maxcnt)
3651 {
3652 ssize_t nread = -1;
3653 struct lock_struct lock;
3654 int saved_errno = 0;
3655
3656 if(fsp_stat(fsp) == -1) {
3657 reply_nterror(req, map_nt_error_from_unix(errno));
3658 return;
3659 }
3660
3661 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3662 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3663 &lock);
3664
3665 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3666 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3667 return;
3668 }
3669
3670 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3671 (startpos > fsp->fsp_name->st.st_ex_size)
3672 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3673 /*
3674 * We already know that we would do a short read, so don't
3675 * try the sendfile() path.
3676 */
3677 goto nosendfile_read;
3678 }
3679
3680 /*
3681 * We can only use sendfile on a non-chained packet
3682 * but we can use on a non-oplocked file. tridge proved this
3683 * on a train in Germany :-). JRA.
3684 */
3685
3686 if (!req_is_in_chain(req) &&
3687 !is_encrypted_packet(req->sconn, req->inbuf) &&
3688 (fsp->base_fsp == NULL) &&
3689 (fsp->wcp == NULL) &&
3690 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3691 uint8 headerbuf[smb_size + 12 * 2];
3692 DATA_BLOB header;
3693
3694 /*
3695 * Set up the packet header before send. We
3696 * assume here the sendfile will work (get the
3697 * correct amount of data).
3698 */
3699
3700 header = data_blob_const(headerbuf, sizeof(headerbuf));
3701
3702 construct_reply_common_req(req, (char *)headerbuf);
3703 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3704
3705 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3706 startpos, smb_maxcnt);
3707 if (nread == -1) {
3708 /* Returning ENOSYS means no data at all was sent.
3709 Do this as a normal read. */
3710 if (errno == ENOSYS) {
3711 goto normal_read;
3712 }
3713
3714 /*
3715 * Special hack for broken Linux with no working sendfile. If we
3716 * return EINTR we sent the header but not the rest of the data.
3717 * Fake this up by doing read/write calls.
3718 */
3719
3720 if (errno == EINTR) {
3721 /* Ensure we don't do this again. */
3722 set_use_sendfile(SNUM(conn), False);
3723 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3724 nread = fake_sendfile(fsp, startpos,
3725 smb_maxcnt);
3726 if (nread == -1) {
3727 DEBUG(0,("send_file_readX: "
3728 "fake_sendfile failed for "
3729 "file %s (%s).\n",
3730 fsp_str_dbg(fsp),
3731 strerror(errno)));
3732 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3733 }
3734 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3735 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3736 /* No outbuf here means successful sendfile. */
3737 goto strict_unlock;
3738 }
3739
3740 DEBUG(0,("send_file_readX: sendfile failed for file "
3741 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3742 strerror(errno)));
3743 exit_server_cleanly("send_file_readX sendfile failed");
3744 } else if (nread == 0) {
3745 /*
3746 * Some sendfile implementations return 0 to indicate
3747 * that there was a short read, but nothing was
3748 * actually written to the socket. In this case,
3749 * fallback to the normal read path so the header gets
3750 * the correct byte count.
3751 */
3752 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3753 "falling back to the normal read: %s\n",
3754 fsp_str_dbg(fsp)));
3755 goto normal_read;
3756 }
3757
3758 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3759 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3760
3761 /* Deal with possible short send. */
3762 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3763 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3764 }
3765 /* No outbuf here means successful sendfile. */
3766 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3767 SMB_PERFCOUNT_END(&req->pcd);
3768 goto strict_unlock;
3769 }
3770
3771 normal_read:
3772
3773 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3774 uint8 headerbuf[smb_size + 2*12];
3775
3776 construct_reply_common_req(req, (char *)headerbuf);
3777 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3778
3779 /* Send out the header. */
3780 if (write_data(req->sconn->sock, (char *)headerbuf,
3781 sizeof(headerbuf)) != sizeof(headerbuf)) {
3782
3783 char addr[INET6_ADDRSTRLEN];
3784 /*
3785 * Try and give an error message saying what
3786 * client failed.
3787 */
3788 DEBUG(0, ("write_data failed for client %s. "
3789 "Error %s\n",
3790 get_peer_addr(req->sconn->sock, addr,
3791 sizeof(addr)),
3792 strerror(errno)));
3793
3794 DEBUG(0,("send_file_readX: write_data failed for file "
3795 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3796 strerror(errno)));
3797 exit_server_cleanly("send_file_readX sendfile failed");
3798 }
3799 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3800 if (nread == -1) {
3801 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3802 "file %s (%s).\n", fsp_str_dbg(fsp),
3803 strerror(errno)));
3804 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3805 }
3806 goto strict_unlock;
3807 }
3808
3809 nosendfile_read:
3810
3811 reply_outbuf(req, 12, smb_maxcnt);
3812 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3813 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3814
3815 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3816 saved_errno = errno;
3817
3818 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3819
3820 if (nread < 0) {
3821 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3822 return;
3823 }
3824
3825 setup_readX_header(req, (char *)req->outbuf, nread);
3826
3827 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3828 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3829 return;
3830
3831 strict_unlock:
3832 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3833 TALLOC_FREE(req->outbuf);
3834 return;
3835 }
3836
3837 /****************************************************************************
3838 Reply to a read and X.
3839 ****************************************************************************/
3840
3841 void reply_read_and_X(struct smb_request *req)
3842 {
3843 struct smbd_server_connection *sconn = req->sconn;
3844 connection_struct *conn = req->conn;
3845 files_struct *fsp;
3846 off_t startpos;
3847 size_t smb_maxcnt;
3848 bool big_readX = False;
3849 #if 0
3850 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3851 #endif
3852
3853 START_PROFILE(SMBreadX);
3854
3855 if ((req->wct != 10) && (req->wct != 12)) {
3856 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3857 return;
3858 }
3859
3860 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3861 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3862 smb_maxcnt = SVAL(req->vwv+5, 0);
3863
3864 /* If it's an IPC, pass off the pipe handler. */
3865 if (IS_IPC(conn)) {
3866 reply_pipe_read_and_X(req);
3867 END_PROFILE(SMBreadX);
3868 return;
3869 }
3870
3871 if (!check_fsp(conn, req, fsp)) {
3872 END_PROFILE(SMBreadX);
3873 return;
3874 }
3875
3876 if (!CHECK_READ(fsp,req)) {
3877 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3878 END_PROFILE(SMBreadX);
3879 return;
3880 }
3881
3882 if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3883 (get_remote_arch() == RA_SAMBA)) {
3884 /*
3885 * This is Samba only behavior (up to Samba 3.6)!
3886 *
3887 * Windows 2008 R2 ignores the upper_size,
3888 * so we do unless unix extentions are active
3889 * or "smbclient" is talking to us.
3890 */
3891 size_t upper_size = SVAL(req->vwv+7, 0);
3892 smb_maxcnt |= (upper_size<<16);
3893 if (upper_size > 1) {
3894 /* Can't do this on a chained packet. */
3895 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3896 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3897 END_PROFILE(SMBreadX);
3898 return;
3899 }
3900 /* We currently don't do this on signed or sealed data. */
3901 if (srv_is_signing_active(req->sconn) ||
3902 is_encrypted_packet(req->sconn, req->inbuf)) {
3903 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3904 END_PROFILE(SMBreadX);
3905 return;
3906 }
3907 /* Is there room in the reply for this data ? */
3908 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3909 reply_nterror(req,
3910 NT_STATUS_INVALID_PARAMETER);
3911 END_PROFILE(SMBreadX);
3912 return;
3913 }
3914 big_readX = True;
3915 }
3916 }
3917
3918 if (req->wct == 12) {
3919 /*
3920 * This is a large offset (64 bit) read.
3921 */
3922 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
3923
3924 }
3925
3926 if (!big_readX) {
3927 NTSTATUS status = schedule_aio_read_and_X(conn,
3928 req,
3929 fsp,
3930 startpos,
3931 smb_maxcnt);
3932 if (NT_STATUS_IS_OK(status)) {
3933 /* Read scheduled - we're done. */
3934 goto out;
3935 }
3936 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3937 /* Real error - report to client. */
3938 END_PROFILE(SMBreadX);
3939 reply_nterror(req, status);
3940 return;
3941 }
3942 /* NT_STATUS_RETRY - fall back to sync read. */
3943 }
3944
3945 smbd_lock_socket(req->sconn);
3946 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3947 smbd_unlock_socket(req->sconn);
3948
3949 out:
3950 END_PROFILE(SMBreadX);
3951 return;
3952 }
3953
3954 /****************************************************************************
3955 Error replies to writebraw must have smb_wct == 1. Fix this up.
3956 ****************************************************************************/
3957
3958 void error_to_writebrawerr(struct smb_request *req)
3959 {
3960 uint8 *old_outbuf = req->outbuf;
3961
3962 reply_outbuf(req, 1, 0);
3963
3964 memcpy(req->outbuf, old_outbuf, smb_size);
3965 TALLOC_FREE(old_outbuf);
3966 }
3967
3968 /****************************************************************************
3969 Read 4 bytes of a smb packet and return the smb length of the packet.
3970 Store the result in the buffer. This version of the function will
3971 never return a session keepalive (length of zero).
3972 Timeout is in milliseconds.
3973 ****************************************************************************/
3974
3975 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3976 size_t *len)
3977 {
3978 uint8_t msgtype = NBSSkeepalive;
3979
3980 while (msgtype == NBSSkeepalive) {
3981 NTSTATUS status;
3982
3983 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3984 len);
3985 if (!NT_STATUS_IS_OK(status)) {
3986 char addr[INET6_ADDRSTRLEN];
3987 /* Try and give an error message
3988 * saying what client failed. */
3989 DEBUG(0, ("read_fd_with_timeout failed for "
3990 "client %s read error = %s.\n",
3991 get_peer_addr(fd,addr,sizeof(addr)),
3992 nt_errstr(status)));
3993 return status;
3994 }
3995
3996 msgtype = CVAL(inbuf, 0);
3997 }
3998
3999 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4000 (unsigned long)len));
4001
4002 return NT_STATUS_OK;
4003 }
4004
4005 /****************************************************************************
4006 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4007 ****************************************************************************/
4008
4009 void reply_writebraw(struct smb_request *req)
4010 {
4011 connection_struct *conn = req->conn;
4012 char *buf = NULL;
4013 ssize_t nwritten=0;
4014 ssize_t total_written=0;
4015 size_t numtowrite=0;
4016 size_t tcount;
4017 off_t startpos;
4018 const char *data=NULL;
4019 bool write_through;
4020 files_struct *fsp;
4021 struct lock_struct lock;
4022 NTSTATUS status;
4023
4024 START_PROFILE(SMBwritebraw);
4025
4026 /*
4027 * If we ever reply with an error, it must have the SMB command
4028 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4029 * we're finished.
4030 */
4031 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4032
4033 if (srv_is_signing_active(req->sconn)) {
4034 END_PROFILE(SMBwritebraw);
4035 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4036 "raw reads/writes are disallowed.");
4037 }
4038
4039 if (req->wct < 12) {
4040 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4041 error_to_writebrawerr(req);
4042 END_PROFILE(SMBwritebraw);
4043 return;
4044 }
4045
4046 if (req->sconn->smb1.echo_handler.trusted_fde) {
4047 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4048 "'async smb echo handler = yes'\n"));
4049 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4050 error_to_writebrawerr(req);
4051 END_PROFILE(SMBwritebraw);
4052 return;
4053 }
4054
4055 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4056 if (!check_fsp(conn, req, fsp)) {
4057 error_to_writebrawerr(req);
4058 END_PROFILE(SMBwritebraw);
4059 return;
4060 }
4061
4062 if (!CHECK_WRITE(fsp)) {
4063 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4064 error_to_writebrawerr(req);
4065 END_PROFILE(SMBwritebraw);
4066 return;
4067 }
4068
4069 tcount = IVAL(req->vwv+1, 0);
4070 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4071 write_through = BITSETW(req->vwv+7,0);
4072
4073 /* We have to deal with slightly different formats depending
4074 on whether we are using the core+ or lanman1.0 protocol */
4075
4076 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4077 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4078 data = smb_buf_const(req->inbuf);
4079 } else {
4080 numtowrite = SVAL(req->vwv+10, 0);
4081 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4082 }
4083
4084 /* Ensure we don't write bytes past the end of this packet. */
4085 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4086 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4087 error_to_writebrawerr(req);
4088 END_PROFILE(SMBwritebraw);
4089 return;
4090 }
4091
4092 if (!fsp->print_file) {
4093 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4094 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4095 &lock);
4096
4097 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4098 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4099 error_to_writebrawerr(req);
4100 END_PROFILE(SMBwritebraw);
4101 return;
4102 }
4103 }
4104
4105 if (numtowrite>0) {
4106 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4107 }
4108
4109 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4110 "wrote=%d sync=%d\n",
4111 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4112 (int)nwritten, (int)write_through));
4113
4114 if (nwritten < (ssize_t)numtowrite) {
4115 reply_nterror(req, NT_STATUS_DISK_FULL);
4116 error_to_writebrawerr(req);
4117 goto strict_unlock;
4118 }
4119
4120 total_written = nwritten;
4121
4122 /* Allocate a buffer of 64k + length. */
4123 buf = talloc_array(NULL, char, 65540);
4124 if (!buf) {
4125 reply_nterror(req, NT_STATUS_NO_MEMORY);
4126 error_to_writebrawerr(req);
4127 goto strict_unlock;
4128 }
4129
4130 /* Return a SMBwritebraw message to the redirector to tell
4131 * it to send more bytes */
4132
4133 memcpy(buf, req->inbuf, smb_size);
4134 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4135 SCVAL(buf,smb_com,SMBwritebraw);
4136 SSVALS(buf,smb_vwv0,0xFFFF);
4137 show_msg(buf);
4138 if (!srv_send_smb(req->sconn,
4139 buf,
4140 false, 0, /* no signing */
4141 IS_CONN_ENCRYPTED(conn),
4142 &req->pcd)) {
4143 exit_server_cleanly("reply_writebraw: srv_send_smb "
4144 "failed.");
4145 }
4146
4147 /* Now read the raw data into the buffer and write it */
4148 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4149 &numtowrite);
4150 if (!NT_STATUS_IS_OK(status)) {
4151 exit_server_cleanly("secondary writebraw failed");
4152 }
4153
4154 /* Set up outbuf to return the correct size */
4155 reply_outbuf(req, 1, 0);
4156
4157 if (numtowrite != 0) {
4158
4159 if (numtowrite > 0xFFFF) {
4160 DEBUG(0,("reply_writebraw: Oversize secondary write "
4161 "raw requested (%u). Terminating\n",
4162 (unsigned int)numtowrite ));
4163 exit_server_cleanly("secondary writebraw failed");
4164 }
4165
4166 if (tcount > nwritten+numtowrite) {
4167 DEBUG(3,("reply_writebraw: Client overestimated the "
4168 "write %d %d %d\n",
4169 (int)tcount,(int)nwritten,(int)numtowrite));
4170 }
4171
4172 status = read_data(req->sconn->sock, buf+4, numtowrite);
4173
4174 if (!NT_STATUS_IS_OK(status)) {
4175 char addr[INET6_ADDRSTRLEN];
4176 /* Try and give an error message
4177 * saying what client failed. */
4178 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4179 "raw read failed (%s) for client %s. "
4180 "Terminating\n", nt_errstr(status),
4181 get_peer_addr(req->sconn->sock, addr,
4182 sizeof(addr))));
4183 exit_server_cleanly("secondary writebraw failed");
4184 }
4185
4186 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4187 if (nwritten == -1) {
4188 TALLOC_FREE(buf);
4189 reply_nterror(req, map_nt_error_from_unix(errno));
4190 error_to_writebrawerr(req);
4191 goto strict_unlock;
4192 }
4193
4194 if (nwritten < (ssize_t)numtowrite) {
4195 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4196 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4197 }
4198
4199 if (nwritten > 0) {
4200 total_written += nwritten;
4201 }
4202 }
4203
4204 TALLOC_FREE(buf);
4205 SSVAL(req->outbuf,smb_vwv0,total_written);
4206
4207 status = sync_file(conn, fsp, write_through);
4208 if (!NT_STATUS_IS_OK(status)) {
4209 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4210 fsp_str_dbg(fsp), nt_errstr(status)));
4211 reply_nterror(req, status);
4212 error_to_writebrawerr(req);
4213 goto strict_unlock;
4214 }
4215
4216 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4217 "wrote=%d\n",
4218 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4219 (int)total_written));
4220
4221 if (!fsp->print_file) {
4222 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4223 }
4224
4225 /* We won't return a status if write through is not selected - this
4226 * follows what WfWg does */
4227 END_PROFILE(SMBwritebraw);
4228
4229 if (!write_through && total_written==tcount) {
4230
4231 #if RABBIT_PELLET_FIX
4232 /*
4233 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4234 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4235 * JRA.
4236 */
4237 if (!send_keepalive(req->sconn->sock)) {
4238 exit_server_cleanly("reply_writebraw: send of "
4239 "keepalive failed");
4240 }
4241 #endif
4242 TALLOC_FREE(req->outbuf);
4243 }
4244 return;
4245
4246 strict_unlock:
4247 if (!fsp->print_file) {
4248 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4249 }
4250
4251 END_PROFILE(SMBwritebraw);
4252 return;
4253 }
4254
4255 #undef DBGC_CLASS
4256 #define DBGC_CLASS DBGC_LOCKING
4257
4258 /****************************************************************************
4259 Reply to a writeunlock (core+).
4260 ****************************************************************************/
4261
4262 void reply_writeunlock(struct smb_request *req)
4263 {
4264 connection_struct *conn = req->conn;
4265 ssize_t nwritten = -1;
4266 size_t numtowrite;
4267 off_t startpos;
4268 const char *data;
4269 NTSTATUS status = NT_STATUS_OK;
4270 files_struct *fsp;
4271 struct lock_struct lock;
4272 int saved_errno = 0;
4273
4274 START_PROFILE(SMBwriteunlock);
4275
4276 if (req->wct < 5) {
4277 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4278 END_PROFILE(SMBwriteunlock);
4279 return;
4280 }
4281
4282 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4283
4284 if (!check_fsp(conn, req, fsp)) {
4285 END_PROFILE(SMBwriteunlock);
4286 return;
4287 }
4288
4289 if (!CHECK_WRITE(fsp)) {
4290 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4291 END_PROFILE(SMBwriteunlock);
4292 return;
4293 }
4294
4295 numtowrite = SVAL(req->vwv+1, 0);
4296 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4297 data = (const char *)req->buf + 3;
4298
4299 if (!fsp->print_file && numtowrite > 0) {
4300 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4301 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4302 &lock);
4303
4304 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4305 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4306 END_PROFILE(SMBwriteunlock);
4307 return;
4308 }
4309 }
4310
4311 /* The special X/Open SMB protocol handling of
4312 zero length writes is *NOT* done for
4313 this call */
4314 if(numtowrite == 0) {
4315 nwritten = 0;
4316 } else {
4317 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4318 saved_errno = errno;
4319 }
4320
4321 status = sync_file(conn, fsp, False /* write through */);
4322 if (!NT_STATUS_IS_OK(status)) {
4323 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4324 fsp_str_dbg(fsp), nt_errstr(status)));
4325 reply_nterror(req, status);
4326 goto strict_unlock;
4327 }
4328
4329 if(nwritten < 0) {
4330 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4331 goto strict_unlock;
4332 }
4333
4334 if((nwritten < numtowrite) && (numtowrite != 0)) {
4335 reply_nterror(req, NT_STATUS_DISK_FULL);
4336 goto strict_unlock;
4337 }
4338
4339 if (numtowrite && !fsp->print_file) {
4340 status = do_unlock(req->sconn->msg_ctx,
4341 fsp,
4342 (uint64_t)req->smbpid,
4343 (uint64_t)numtowrite,
4344 (uint64_t)startpos,
4345 WINDOWS_LOCK);
4346
4347 if (NT_STATUS_V(status)) {
4348 reply_nterror(req, status);
4349 goto strict_unlock;
4350 }
4351 }
4352
4353 reply_outbuf(req, 1, 0);
4354
4355 SSVAL(req->outbuf,smb_vwv0,nwritten);
4356
4357 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4358 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4359
4360 strict_unlock:
4361 if (numtowrite && !fsp->print_file) {
4362 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4363 }
4364
4365 END_PROFILE(SMBwriteunlock);
4366 return;
4367 }
4368
4369 #undef DBGC_CLASS
4370 #define DBGC_CLASS DBGC_ALL
4371
4372 /****************************************************************************
4373 Reply to a write.
4374 ****************************************************************************/
4375
4376 void reply_write(struct smb_request *req)
4377 {
4378 connection_struct *conn = req->conn;
4379 size_t numtowrite;
4380 ssize_t nwritten = -1;
4381 off_t startpos;
4382 const char *data;
4383 files_struct *fsp;
4384 struct lock_struct lock;
4385 NTSTATUS status;
4386 int saved_errno = 0;
4387
4388 START_PROFILE(SMBwrite);
4389
4390 if (req->wct < 5) {
4391 END_PROFILE(SMBwrite);
4392 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4393 return;
4394 }
4395
4396 /* If it's an IPC, pass off the pipe handler. */
4397 if (IS_IPC(conn)) {
4398 reply_pipe_write(req);
4399 END_PROFILE(SMBwrite);
4400 return;
4401 }
4402
4403 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4404
4405 if (!check_fsp(conn, req, fsp)) {
4406 END_PROFILE(SMBwrite);
4407 return;
4408 }
4409
4410 if (!CHECK_WRITE(fsp)) {
4411 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4412 END_PROFILE(SMBwrite);
4413 return;
4414 }
4415
4416 numtowrite = SVAL(req->vwv+1, 0);
4417 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4418 data = (const char *)req->buf + 3;
4419
4420 if (!fsp->print_file) {
4421 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4422 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4423 &lock);
4424
4425 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4426 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4427 END_PROFILE(SMBwrite);
4428 return;
4429 }
4430 }
4431
4432 /*
4433 * X/Open SMB protocol says that if smb_vwv1 is
4434 * zero then the file size should be extended or
4435 * truncated to the size given in smb_vwv[2-3].
4436 */
4437
4438 if(numtowrite == 0) {
4439 /*
4440 * This is actually an allocate call, and set EOF. JRA.
4441 */
4442 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4443 if (nwritten < 0) {
4444 reply_nterror(req, NT_STATUS_DISK_FULL);
4445 goto strict_unlock;
4446 }
4447 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4448 if (nwritten < 0) {
4449 reply_nterror(req, NT_STATUS_DISK_FULL);
4450 goto strict_unlock;
4451 }
4452 trigger_write_time_update_immediate(fsp);
4453 } else {
4454 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4455 }
4456
4457 status = sync_file(conn, fsp, False);
4458 if (!NT_STATUS_IS_OK(status)) {
4459 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4460 fsp_str_dbg(fsp), nt_errstr(status)));
4461 reply_nterror(req, status);
4462 goto strict_unlock;
4463 }
4464
4465 if(nwritten < 0) {
4466 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4467 goto strict_unlock;
4468 }
4469
4470 if((nwritten == 0) && (numtowrite != 0)) {
4471 reply_nterror(req, NT_STATUS_DISK_FULL);
4472 goto strict_unlock;
4473 }
4474
4475 reply_outbuf(req, 1, 0);
4476
4477 SSVAL(req->outbuf,smb_vwv0,nwritten);
4478
4479 if (nwritten < (ssize_t)numtowrite) {
4480 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4481 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4482 }
4483
4484 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4485
4486 strict_unlock:
4487 if (!fsp->print_file) {
4488 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4489 }
4490
4491 END_PROFILE(SMBwrite);
4492 return;
4493 }
4494
4495 /****************************************************************************
4496 Ensure a buffer is a valid writeX for recvfile purposes.
4497 ****************************************************************************/
4498
4499 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4500 (2*14) + /* word count (including bcc) */ \
4501 1 /* pad byte */)
4502
4503 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4504 const uint8_t *inbuf)
4505 {
4506 size_t numtowrite;
4507 connection_struct *conn = NULL;
4508 unsigned int doff = 0;
4509 size_t len = smb_len_large(inbuf);
4510 struct smbXsrv_tcon *tcon;
4511 NTSTATUS status;
4512 NTTIME now = 0;
4513
4514 if (is_encrypted_packet(sconn, inbuf)) {
4515 /* Can't do this on encrypted
4516 * connections. */
4517 return false;
4518 }
4519
4520 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4521 return false;
4522 }
4523
4524 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4525 CVAL(inbuf,smb_wct) != 14) {
4526 DEBUG(10,("is_valid_writeX_buffer: chained or "
4527 "invalid word length.\n"));
4528 return false;
4529 }
4530
4531 status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4532 now, &tcon);
4533 if (!NT_STATUS_IS_OK(status)) {
4534 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4535 return false;
4536 }
4537 conn = tcon->compat;
4538
4539 if (IS_IPC(conn)) {
4540 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4541 return false;
4542 }
4543 if (IS_PRINT(conn)) {
4544 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4545 return false;
4546 }
4547 doff = SVAL(inbuf,smb_vwv11);
4548
4549 numtowrite = SVAL(inbuf,smb_vwv10);
4550
4551 if (len > doff && len - doff > 0xFFFF) {
4552 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4553 }
4554
4555 if (numtowrite == 0) {
4556 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4557 return false;
4558 }
4559
4560 /* Ensure the sizes match up. */
4561 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4562 /* no pad byte...old smbclient :-( */
4563 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4564 (unsigned int)doff,
4565 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4566 return false;
4567 }
4568
4569 if (len - doff != numtowrite) {
4570 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4571 "len = %u, doff = %u, numtowrite = %u\n",
4572 (unsigned int)len,
4573 (unsigned int)doff,
4574 (unsigned int)numtowrite ));
4575 return false;
4576 }
4577
4578 DEBUG(10,("is_valid_writeX_buffer: true "
4579 "len = %u, doff = %u, numtowrite = %u\n",
4580 (unsigned int)len,
4581 (unsigned int)doff,
4582 (unsigned int)numtowrite ));
4583
4584 return true;
4585 }
4586
4587 /****************************************************************************
4588 Reply to a write and X.
4589 ****************************************************************************/
4590
4591 void reply_write_and_X(struct smb_request *req)
4592 {
4593 connection_struct *conn = req->conn;
4594 files_struct *fsp;
4595 struct lock_struct lock;
4596 off_t startpos;
4597 size_t numtowrite;
4598 bool write_through;
4599 ssize_t nwritten;
4600 unsigned int smb_doff;
4601 unsigned int smblen;
4602 const char *data;
4603 NTSTATUS status;
4604 int saved_errno = 0;
4605
4606 START_PROFILE(SMBwriteX);
4607
4608 if ((req->wct != 12) && (req->wct != 14)) {
4609 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4610 goto out;
4611 }
4612
4613 numtowrite = SVAL(req->vwv+10, 0);
4614 smb_doff = SVAL(req->vwv+11, 0);
4615 smblen = smb_len(req->inbuf);
4616
4617 if (req->unread_bytes > 0xFFFF ||
4618 (smblen > smb_doff &&
4619 smblen - smb_doff > 0xFFFF)) {
4620 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4621 }
4622
4623 if (req->unread_bytes) {
4624 /* Can't do a recvfile write on IPC$ */
4625 if (IS_IPC(conn)) {
4626 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4627 goto out;
4628 }
4629 if (numtowrite != req->unread_bytes) {
4630 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4631 goto out;
4632 }
4633 } else {
4634 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4635 smb_doff + numtowrite > smblen) {
4636 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4637 goto out;
4638 }
4639 }
4640
4641 /* If it's an IPC, pass off the pipe handler. */
4642 if (IS_IPC(conn)) {
4643 if (req->unread_bytes) {
4644 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4645 goto out;
4646 }
4647 reply_pipe_write_and_X(req);
4648 goto out;
4649 }
4650
4651 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4652 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4653 write_through = BITSETW(req->vwv+7,0);
4654
4655 if (!check_fsp(conn, req, fsp)) {
4656 goto out;
4657 }
4658
4659 if (!CHECK_WRITE(fsp)) {
4660 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4661 goto out;
4662 }
4663
4664 data = smb_base(req->inbuf) + smb_doff;
4665
4666 if(req->wct == 14) {
4667 /*
4668 * This is a large offset (64 bit) write.
4669 */
4670 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4671
4672 }
4673
4674 /* X/Open SMB protocol says that, unlike SMBwrite
4675 if the length is zero then NO truncation is
4676 done, just a write of zero. To truncate a file,
4677 use SMBwrite. */
4678
4679 if(numtowrite == 0) {
4680 nwritten = 0;
4681 } else {
4682 if (req->unread_bytes == 0) {
4683 status = schedule_aio_write_and_X(conn,
4684 req,
4685 fsp,
4686 data,
4687 startpos,
4688 numtowrite);
4689
4690 if (NT_STATUS_IS_OK(status)) {
4691 /* write scheduled - we're done. */
4692 goto out;
4693 }
4694 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4695 /* Real error - report to client. */
4696 reply_nterror(req, status);
4697 goto out;
4698 }
4699 /* NT_STATUS_RETRY - fall through to sync write. */
4700 }
4701
4702 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4703 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4704 &lock);
4705
4706 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4707 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4708 goto out;
4709 }
4710
4711 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4712 saved_errno = errno;
4713
4714 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4715 }
4716
4717 if(nwritten < 0) {
4718 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4719 goto out;
4720 }
4721
4722 if((nwritten == 0) && (numtowrite != 0)) {
4723 reply_nterror(req, NT_STATUS_DISK_FULL);
4724 goto out;
4725 }
4726
4727 reply_outbuf(req, 6, 0);
4728 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4729 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4730 SSVAL(req->outbuf,smb_vwv2,nwritten);
4731 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4732
4733 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4734 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4735
4736 status = sync_file(conn, fsp, write_through);
4737 if (!NT_STATUS_IS_OK(status)) {
4738 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4739 fsp_str_dbg(fsp), nt_errstr(status)));
4740 reply_nterror(req, status);
4741 goto out;
4742 }
4743
4744 END_PROFILE(SMBwriteX);
4745 return;
4746
4747 out:
4748 if (req->unread_bytes) {
4749 /* writeX failed. drain socket. */
4750 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4751 req->unread_bytes) {
4752 smb_panic("failed to drain pending bytes");
4753 }
4754 req->unread_bytes = 0;
4755 }
4756
4757 END_PROFILE(SMBwriteX);
4758 return;
4759 }
4760
4761 /****************************************************************************
4762 Reply to a lseek.
4763 ****************************************************************************/
4764
4765 void reply_lseek(struct smb_request *req)
4766 {
4767 connection_struct *conn = req->conn;
4768 off_t startpos;
4769 off_t res= -1;
4770 int mode,umode;
4771 files_struct *fsp;
4772
4773 START_PROFILE(SMBlseek);
4774
4775 if (req->wct < 4) {
4776 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4777 END_PROFILE(SMBlseek);
4778 return;
4779 }
4780
4781 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4782
4783 if (!check_fsp(conn, req, fsp)) {
4784 return;
4785 }
4786
4787 flush_write_cache(fsp, SEEK_FLUSH);
4788
4789 mode = SVAL(req->vwv+1, 0) & 3;
4790 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4791 startpos = (off_t)IVALS(req->vwv+2, 0);
4792
4793 switch (mode) {
4794 case 0:
4795 umode = SEEK_SET;
4796 res = startpos;
4797 break;
4798 case 1:
4799 umode = SEEK_CUR;
4800 res = fsp->fh->pos + startpos;
4801 break;
4802 case 2:
4803 umode = SEEK_END;
4804 break;
4805 default:
4806 umode = SEEK_SET;
4807 res = startpos;
4808 break;
4809 }
4810
4811 if (umode == SEEK_END) {
4812 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4813 if(errno == EINVAL) {
4814 off_t current_pos = startpos;
4815
4816 if(fsp_stat(fsp) == -1) {
4817 reply_nterror(req,
4818 map_nt_error_from_unix(errno));
4819 END_PROFILE(SMBlseek);
4820 return;
4821 }
4822
4823 current_pos += fsp->fsp_name->st.st_ex_size;
4824 if(current_pos < 0)
4825 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4826 }
4827 }
4828
4829 if(res == -1) {
4830 reply_nterror(req, map_nt_error_from_unix(errno));
4831 END_PROFILE(SMBlseek);
4832 return;
4833 }
4834 }
4835
4836 fsp->fh->pos = res;
4837
4838 reply_outbuf(req, 2, 0);
4839 SIVAL(req->outbuf,smb_vwv0,res);
4840
4841 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4842 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4843
4844 END_PROFILE(SMBlseek);
4845 return;
4846 }
4847
4848 /****************************************************************************
4849 Reply to a flush.
4850 ****************************************************************************/
4851
4852 void reply_flush(struct smb_request *req)
4853 {
4854 connection_struct *conn = req->conn;
4855 uint16 fnum;
4856 files_struct *fsp;
4857
4858 START_PROFILE(SMBflush);
4859
4860 if (req->wct < 1) {
4861 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4862 return;
4863 }
4864
4865 fnum = SVAL(req->vwv+0, 0);
4866 fsp = file_fsp(req, fnum);
4867
4868 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4869 return;
4870 }
4871
4872 if (!fsp) {
4873 file_sync_all(conn);
4874 } else {
4875 NTSTATUS status = sync_file(conn, fsp, True);
4876 if (!NT_STATUS_IS_OK(status)) {
4877 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4878 fsp_str_dbg(fsp), nt_errstr(status)));
4879 reply_nterror(req, status);
4880 END_PROFILE(SMBflush);
4881 return;
4882 }
4883 }
4884
4885 reply_outbuf(req, 0, 0);
4886
4887 DEBUG(3,("flush\n"));
4888 END_PROFILE(SMBflush);
4889 return;
4890 }
4891
4892 /****************************************************************************
4893 Reply to a exit.
4894 conn POINTER CAN BE NULL HERE !
4895 ****************************************************************************/
4896
4897 void reply_exit(struct smb_request *req)
4898 {
4899 START_PROFILE(SMBexit);
4900
4901 file_close_pid(req->sconn, req->smbpid, req->vuid);
4902
4903 reply_outbuf(req, 0, 0);
4904
4905 DEBUG(3,("exit\n"));
4906
4907 END_PROFILE(SMBexit);
4908 return;
4909 }
4910
4911 struct reply_close_state {
4912 files_struct *fsp;
4913 struct smb_request *smbreq;
4914 };
4915
4916 static void do_smb1_close(struct tevent_req *req);
4917
4918 void reply_close(struct smb_request *req)
4919 {
4920 connection_struct *conn = req->conn;
4921 NTSTATUS status = NT_STATUS_OK;
4922 files_struct *fsp = NULL;
4923 START_PROFILE(SMBclose);
4924
4925 if (req->wct < 3) {
4926 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4927 END_PROFILE(SMBclose);
4928 return;
4929 }
4930
4931 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4932
4933 /*
4934 * We can only use check_fsp if we know it's not a directory.
4935 */
4936
4937 if (!check_fsp_open(conn, req, fsp)) {
4938 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4939 END_PROFILE(SMBclose);
4940 return;
4941 }
4942
4943 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
4944 fsp->is_directory ? "directory" : "file",
4945 fsp->fh->fd, fsp_fnum_dbg(fsp),
4946 conn->num_files_open));
4947
4948 if (!fsp->is_directory) {
4949 time_t t;
4950
4951 /*
4952 * Take care of any time sent in the close.
4953 */
4954
4955 t = srv_make_unix_date3(req->vwv+1);
4956 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4957 }
4958
4959 if (fsp->num_aio_requests != 0) {
4960
4961 struct reply_close_state *state;
4962
4963 DEBUG(10, ("closing with aio %u requests pending\n",
4964 fsp->num_aio_requests));
4965
4966 /*
4967 * We depend on the aio_extra destructor to take care of this
4968 * close request once fsp->num_aio_request drops to 0.
4969 */
4970
4971 fsp->deferred_close = tevent_wait_send(
4972 fsp, fsp->conn->sconn->ev_ctx);
4973 if (fsp->deferred_close == NULL) {
4974 status = NT_STATUS_NO_MEMORY;
4975 goto done;
4976 }
4977
4978 state = talloc(fsp, struct reply_close_state);
4979 if (state == NULL) {
4980 TALLOC_FREE(fsp->deferred_close);
4981 status = NT_STATUS_NO_MEMORY;
4982 goto done;
4983 }
4984 state->fsp = fsp;
4985 state->smbreq = talloc_move(fsp, &req);
4986 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
4987 state);
4988 END_PROFILE(SMBclose);
4989 return;
4990 }
4991
4992 /*
4993 * close_file() returns the unix errno if an error was detected on
4994 * close - normally this is due to a disk full error. If not then it
4995 * was probably an I/O error.
4996 */
4997
4998 status = close_file(req, fsp, NORMAL_CLOSE);
4999 done:
5000 if (!NT_STATUS_IS_OK(status)) {
5001 reply_nterror(req, status);
5002 END_PROFILE(SMBclose);
5003 return;
5004 }
5005
5006 reply_outbuf(req, 0, 0);
5007 END_PROFILE(SMBclose);
5008 return;
5009 }
5010
5011 static void do_smb1_close(struct tevent_req *req)
5012 {
5013 struct reply_close_state *state = tevent_req_callback_data(
5014 req, struct reply_close_state);
5015 struct smb_request *smbreq;
5016 NTSTATUS status;
5017 int ret;
5018
5019 ret = tevent_wait_recv(req);
5020 TALLOC_FREE(req);
5021 if (ret != 0) {
5022 DEBUG(10, ("tevent_wait_recv returned %s\n",
5023 strerror(ret)));
5024 /*
5025 * Continue anyway, this should never happen
5026 */
5027 }
5028
5029 /*
5030 * fsp->smb2_close_request right now is a talloc grandchild of
5031 * fsp. When we close_file(fsp), it would go with it. No chance to
5032 * reply...
5033 */
5034 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5035
5036 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5037 if (NT_STATUS_IS_OK(status)) {
5038 reply_outbuf(smbreq, 0, 0);
5039 } else {
5040 reply_nterror(smbreq, status);
5041 }
5042 if (!srv_send_smb(smbreq->sconn,
5043 (char *)smbreq->outbuf,
5044 true,
5045 smbreq->seqnum+1,
5046 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5047 NULL)) {
5048 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5049 "failed.");
5050 }
5051 TALLOC_FREE(smbreq);
5052 }
5053
5054 /****************************************************************************
5055 Reply to a writeclose (Core+ protocol).
5056 ****************************************************************************/
5057
5058 void reply_writeclose(struct smb_request *req)
5059 {
5060 connection_struct *conn = req->conn;
5061 size_t numtowrite;
5062 ssize_t nwritten = -1;
5063 NTSTATUS close_status = NT_STATUS_OK;
5064 off_t startpos;
5065 const char *data;
5066 struct timespec mtime;
5067 files_struct *fsp;
5068 struct lock_struct lock;
5069
5070 START_PROFILE(SMBwriteclose);
5071
5072 if (req->wct < 6) {
5073 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5074 END_PROFILE(SMBwriteclose);
5075 return;
5076 }
5077
5078 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5079
5080 if (!check_fsp(conn, req, fsp)) {
5081 END_PROFILE(SMBwriteclose);
5082 return;
5083 }
5084 if (!CHECK_WRITE(fsp)) {
5085 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5086 END_PROFILE(SMBwriteclose);
5087 return;
5088 }
5089
5090 numtowrite = SVAL(req->vwv+1, 0);
5091 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5092 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5093 data = (const char *)req->buf + 1;
5094
5095 if (!fsp->print_file) {
5096 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5097 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5098 &lock);
5099
5100 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5101 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5102 END_PROFILE(SMBwriteclose);
5103 return;
5104 }
5105 }
5106
5107 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5108
5109 set_close_write_time(fsp, mtime);
5110
5111 /*
5112 * More insanity. W2K only closes the file if writelen > 0.
5113 * JRA.
5114 */
5115
5116 if (numtowrite) {
5117 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5118 "file %s\n", fsp_str_dbg(fsp)));
5119 close_status = close_file(req, fsp, NORMAL_CLOSE);
5120 }
5121
5122 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5123 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5124 conn->num_files_open));
5125
5126 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5127 reply_nterror(req, NT_STATUS_DISK_FULL);
5128 goto strict_unlock;
5129 }
5130
5131 if(!NT_STATUS_IS_OK(close_status)) {
5132 reply_nterror(req, close_status);
5133 goto strict_unlock;
5134 }
5135
5136 reply_outbuf(req, 1, 0);
5137
5138 SSVAL(req->outbuf,smb_vwv0,nwritten);
5139
5140 strict_unlock:
5141 if (numtowrite && !fsp->print_file) {
5142 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5143 }
5144
5145 END_PROFILE(SMBwriteclose);
5146 return;
5147 }
5148
5149 #undef DBGC_CLASS
5150 #define DBGC_CLASS DBGC_LOCKING
5151
5152 /****************************************************************************
5153 Reply to a lock.
5154 ****************************************************************************/
5155
5156 void reply_lock(struct smb_request *req)
5157 {
5158 connection_struct *conn = req->conn;
5159 uint64_t count,offset;
5160 NTSTATUS status;
5161 files_struct *fsp;
5162 struct byte_range_lock *br_lck = NULL;
5163
5164 START_PROFILE(SMBlock);
5165
5166 if (req->wct < 5) {
5167 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5168 END_PROFILE(SMBlock);
5169 return;
5170 }
5171
5172 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5173
5174 if (!check_fsp(conn, req, fsp)) {
5175 END_PROFILE(SMBlock);
5176 return;
5177 }
5178
5179 count = (uint64_t)IVAL(req->vwv+1, 0);
5180 offset = (uint64_t)IVAL(req->vwv+3, 0);
5181
5182 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5183 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5184
5185 br_lck = do_lock(req->sconn->msg_ctx,
5186 fsp,
5187 (uint64_t)req->smbpid,
5188 count,
5189 offset,
5190 WRITE_LOCK,
5191 WINDOWS_LOCK,
5192 False, /* Non-blocking lock. */
5193 &status,
5194 NULL,
5195 NULL);
5196
5197 TALLOC_FREE(br_lck);
5198
5199 if (NT_STATUS_V(status)) {
5200 reply_nterror(req, status);
5201 END_PROFILE(SMBlock);
5202 return;
5203 }
5204
5205 reply_outbuf(req, 0, 0);
5206
5207 END_PROFILE(SMBlock);
5208 return;
5209 }
5210
5211 /****************************************************************************
5212 Reply to a unlock.
5213 ****************************************************************************/
5214
5215 void reply_unlock(struct smb_request *req)
5216 {
5217 connection_struct *conn = req->conn;
5218 uint64_t count,offset;
5219 NTSTATUS status;
5220 files_struct *fsp;
5221
5222 START_PROFILE(SMBunlock);
5223
5224 if (req->wct < 5) {
5225 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5226 END_PROFILE(SMBunlock);
5227 return;
5228 }
5229
5230 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5231
5232 if (!check_fsp(conn, req, fsp)) {
5233 END_PROFILE(SMBunlock);
5234 return;
5235 }
5236
5237 count = (uint64_t)IVAL(req->vwv+1, 0);
5238 offset = (uint64_t)IVAL(req->vwv+3, 0);
5239
5240 status = do_unlock(req->sconn->msg_ctx,
5241 fsp,
5242 (uint64_t)req->smbpid,
5243 count,
5244 offset,
5245 WINDOWS_LOCK);
5246
5247 if (NT_STATUS_V(status)) {
5248 reply_nterror(req, status);
5249 END_PROFILE(SMBunlock);
5250 return;
5251 }
5252
5253 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5254 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5255
5256 reply_outbuf(req, 0, 0);
5257
5258 END_PROFILE(SMBunlock);
5259 return;
5260 }
5261
5262 #undef DBGC_CLASS
5263 #define DBGC_CLASS DBGC_ALL
5264
5265 /****************************************************************************
5266 Reply to a tdis.
5267 conn POINTER CAN BE NULL HERE !
5268 ****************************************************************************/
5269
5270 void reply_tdis(struct smb_request *req)
5271 {
5272 NTSTATUS status;
5273 connection_struct *conn = req->conn;
5274 struct smbXsrv_tcon *tcon;
5275
5276 START_PROFILE(SMBtdis);
5277
5278 if (!conn) {
5279 DEBUG(4,("Invalid connection in tdis\n"));
5280 reply_force_doserror(req, ERRSRV, ERRinvnid);
5281 END_PROFILE(SMBtdis);
5282 return;
5283 }
5284
5285 tcon = conn->tcon;
5286 req->conn = NULL;
5287
5288 /*
5289 * TODO: cancel all outstanding requests on the tcon
5290 */
5291 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5292 if (!NT_STATUS_IS_OK(status)) {
5293 DEBUG(0, ("reply_tdis: "
5294 "smbXsrv_tcon_disconnect() failed: %s\n",
5295 nt_errstr(status)));
5296 /*
5297 * If we hit this case, there is something completely
5298 * wrong, so we better disconnect the transport connection.
5299 */
5300 END_PROFILE(SMBtdis);
5301 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5302 return;
5303 }
5304
5305 TALLOC_FREE(tcon);
5306
5307 reply_outbuf(req, 0, 0);
5308 END_PROFILE(SMBtdis);
5309 return;
5310 }
5311
5312 /****************************************************************************
5313 Reply to a echo.
5314 conn POINTER CAN BE NULL HERE !
5315 ****************************************************************************/
5316
5317 void reply_echo(struct smb_request *req)
5318 {
5319 connection_struct *conn = req->conn;
5320 struct smb_perfcount_data local_pcd;
5321 struct smb_perfcount_data *cur_pcd;
5322 int smb_reverb;
5323 int seq_num;
5324
5325 START_PROFILE(SMBecho);
5326
5327 smb_init_perfcount_data(&local_pcd);
5328
5329 if (req->wct < 1) {
5330 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5331 END_PROFILE(SMBecho);
5332 return;
5333 }
5334
5335 smb_reverb = SVAL(req->vwv+0, 0);
5336
5337 reply_outbuf(req, 1, req->buflen);
5338
5339 /* copy any incoming data back out */
5340 if (req->buflen > 0) {
5341 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5342 }
5343
5344 if (smb_reverb > 100) {
5345 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5346 smb_reverb = 100;
5347 }
5348
5349 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5350
5351 /* this makes sure we catch the request pcd */
5352 if (seq_num == smb_reverb) {
5353 cur_pcd = &req->pcd;
5354 } else {
5355 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5356 cur_pcd = &local_pcd;
5357 }
5358
5359 SSVAL(req->outbuf,smb_vwv0,seq_num);
5360
5361 show_msg((char *)req->outbuf);
5362 if (!srv_send_smb(req->sconn,
5363 (char *)req->outbuf,
5364 true, req->seqnum+1,
5365 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5366 cur_pcd))
5367 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5368 }
5369
5370 DEBUG(3,("echo %d times\n", smb_reverb));
5371
5372 TALLOC_FREE(req->outbuf);
5373
5374 END_PROFILE(SMBecho);
5375 return;
5376 }
5377
5378 /****************************************************************************
5379 Reply to a printopen.
5380 ****************************************************************************/
5381
5382 void reply_printopen(struct smb_request *req)
5383 {
5384 connection_struct *conn = req->conn;
5385 files_struct *fsp;
5386 NTSTATUS status;
5387
5388 START_PROFILE(SMBsplopen);
5389
5390 if (req->wct < 2) {
5391 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5392 END_PROFILE(SMBsplopen);
5393 return;
5394 }
5395
5396 if (!CAN_PRINT(conn)) {
5397 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5398 END_PROFILE(SMBsplopen);
5399 return;
5400 }
5401
5402 status = file_new(req, conn, &fsp);
5403 if(!NT_STATUS_IS_OK(status)) {
5404 reply_nterror(req, status);
5405 END_PROFILE(SMBsplopen);
5406 return;
5407 }
5408
5409 /* Open for exclusive use, write only. */
5410 status = print_spool_open(fsp, NULL, req->vuid);
5411
5412 if (!NT_STATUS_IS_OK(status)) {
5413 file_free(req, fsp);
5414 reply_nterror(req, status);
5415 END_PROFILE(SMBsplopen);
5416 return;
5417 }
5418
5419 reply_outbuf(req, 1, 0);
5420 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5421
5422 DEBUG(3,("openprint fd=%d %s\n",
5423 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5424
5425 END_PROFILE(SMBsplopen);
5426 return;
5427 }
5428
5429 /****************************************************************************
5430 Reply to a printclose.
5431 ****************************************************************************/
5432
5433 void reply_printclose(struct smb_request *req)
5434 {
5435 connection_struct *conn = req->conn;
5436 files_struct *fsp;
5437 NTSTATUS status;
5438
5439 START_PROFILE(SMBsplclose);
5440
5441 if (req->wct < 1) {
5442 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5443 END_PROFILE(SMBsplclose);
5444 return;
5445 }
5446
5447 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5448
5449 if (!check_fsp(conn, req, fsp)) {
5450 END_PROFILE(SMBsplclose);
5451 return;
5452 }
5453
5454 if (!CAN_PRINT(conn)) {
5455 reply_force_doserror(req, ERRSRV, ERRerror);
5456 END_PROFILE(SMBsplclose);
5457 return;
5458 }
5459
5460 DEBUG(3,("printclose fd=%d %s\n",
5461 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5462
5463 status = close_file(req, fsp, NORMAL_CLOSE);
5464
5465 if(!NT_STATUS_IS_OK(status)) {
5466 reply_nterror(req, status);
5467 END_PROFILE(SMBsplclose);
5468 return;
5469 }
5470
5471 reply_outbuf(req, 0, 0);
5472
5473 END_PROFILE(SMBsplclose);
5474 return;
5475 }
5476
5477 /****************************************************************************
5478 Reply to a printqueue.
5479 ****************************************************************************/
5480
5481 void reply_printqueue(struct smb_request *req)
5482 {
5483 connection_struct *conn = req->conn;
5484 int max_count;
5485 int start_index;
5486
5487 START_PROFILE(SMBsplretq);
5488
5489 if (req->wct < 2) {
5490 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5491 END_PROFILE(SMBsplretq);
5492 return;
5493 }
5494
5495 max_count = SVAL(req->vwv+0, 0);
5496 start_index = SVAL(req->vwv+1, 0);
5497
5498 /* we used to allow the client to get the cnum wrong, but that
5499 is really quite gross and only worked when there was only
5500 one printer - I think we should now only accept it if they
5501 get it right (tridge) */
5502 if (!CAN_PRINT(conn)) {
5503 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5504 END_PROFILE(SMBsplretq);
5505 return;
5506 }
5507
5508 reply_outbuf(req, 2, 3);
5509 SSVAL(req->outbuf,smb_vwv0,0);
5510 SSVAL(req->outbuf,smb_vwv1,0);
5511 SCVAL(smb_buf(req->outbuf),0,1);
5512 SSVAL(smb_buf(req->outbuf),1,0);
5513
5514 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5515 start_index, max_count));
5516
5517 {
5518 TALLOC_CTX *mem_ctx = talloc_tos();
5519 NTSTATUS status;
5520 WERROR werr;
5521 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5522 struct rpc_pipe_client *cli = NULL;
5523 struct dcerpc_binding_handle *b = NULL;
5524 struct policy_handle handle;
5525 struct spoolss_DevmodeContainer devmode_ctr;
5526 union spoolss_JobInfo *info;
5527 uint32_t count;
5528 uint32_t num_to_get;
5529 uint32_t first;
5530 uint32_t i;
5531
5532 ZERO_STRUCT(handle);
5533
5534 status = rpc_pipe_open_interface(conn,
5535 &ndr_table_spoolss.syntax_id,
5536 conn->session_info,
5537 conn->sconn->remote_address,
5538 conn->sconn->msg_ctx,
5539 &cli);
5540 if (!NT_STATUS_IS_OK(status)) {
5541 DEBUG(0, ("reply_printqueue: "
5542 "could not connect to spoolss: %s\n",
5543 nt_errstr(status)));
5544 reply_nterror(req, status);
5545 goto out;
5546 }
5547 b = cli->binding_handle;
5548
5549 ZERO_STRUCT(devmode_ctr);
5550
5551 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5552 sharename,
5553 NULL, devmode_ctr,
5554 SEC_FLAG_MAXIMUM_ALLOWED,
5555 &handle,
5556 &werr);
5557 if (!NT_STATUS_IS_OK(status)) {
5558 reply_nterror(req, status);
5559 goto out;
5560 }
5561 if (!W_ERROR_IS_OK(werr)) {
5562 reply_nterror(req, werror_to_ntstatus(werr));
5563 goto out;
5564 }
5565
5566 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5567 &handle,
5568 0, /* firstjob */
5569 0xff, /* numjobs */
5570 2, /* level */
5571 0, /* offered */
5572 &count,
5573 &info);
5574 if (!W_ERROR_IS_OK(werr)) {
5575 reply_nterror(req, werror_to_ntstatus(werr));
5576 goto out;
5577 }
5578
5579 if (max_count > 0) {
5580 first = start_index;
5581 } else {
5582 first = start_index + max_count + 1;
5583 }
5584
5585 if (first >= count) {
5586 num_to_get = first;
5587 } else {
5588 num_to_get = first + MIN(ABS(max_count), count - first);
5589 }
5590
5591 for (i = first; i < num_to_get; i++) {
5592 char blob[28];
5593 char *p = blob;
5594 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5595 int qstatus;
5596 uint16_t qrapjobid = pjobid_to_rap(sharename,
5597 info[i].info2.job_id);
5598
5599 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5600 qstatus = 2;
5601 } else {
5602 qstatus = 3;
5603 }
5604
5605 srv_put_dos_date2(p, 0, qtime);
5606 SCVAL(p, 4, qstatus);
5607 SSVAL(p, 5, qrapjobid);
5608 SIVAL(p, 7, info[i].info2.size);
5609 SCVAL(p, 11, 0);
5610 srvstr_push(blob, req->flags2, p+12,
5611 info[i].info2.notify_name, 16, STR_ASCII);
5612
5613 if (message_push_blob(
5614 &req->outbuf,
5615 data_blob_const(
5616 blob, sizeof(blob))) == -1) {
5617 reply_nterror(req, NT_STATUS_NO_MEMORY);
5618 goto out;
5619 }
5620 }
5621
5622 if (count > 0) {
5623 SSVAL(req->outbuf,smb_vwv0,count);
5624 SSVAL(req->outbuf,smb_vwv1,
5625 (max_count>0?first+count:first-1));
5626 SCVAL(smb_buf(req->outbuf),0,1);
5627 SSVAL(smb_buf(req->outbuf),1,28*count);
5628 }
5629
5630
5631 DEBUG(3, ("%u entries returned in queue\n",
5632 (unsigned)count));
5633
5634 out:
5635 if (b && is_valid_policy_hnd(&handle)) {
5636 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5637 }
5638
5639 }
5640
5641 END_PROFILE(SMBsplretq);
5642 return;
5643 }
5644
5645 /****************************************************************************
5646 Reply to a printwrite.
5647 ****************************************************************************/
5648
5649 void reply_printwrite(struct smb_request *req)
5650 {
5651 connection_struct *conn = req->conn;
5652 int numtowrite;
5653 const char *data;
5654 files_struct *fsp;
5655
5656 START_PROFILE(SMBsplwr);
5657
5658 if (req->wct < 1) {
5659 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5660 END_PROFILE(SMBsplwr);
5661 return;
5662 }
5663
5664 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5665
5666 if (!check_fsp(conn, req, fsp)) {
5667 END_PROFILE(SMBsplwr);
5668 return;
5669 }
5670
5671 if (!fsp->print_file) {
5672 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5673 END_PROFILE(SMBsplwr);
5674 return;
5675 }
5676
5677 if (!CHECK_WRITE(fsp)) {
5678 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5679 END_PROFILE(SMBsplwr);
5680 return;
5681 }
5682
5683 numtowrite = SVAL(req->buf, 1);
5684
5685 if (req->buflen < numtowrite + 3) {
5686 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5687 END_PROFILE(SMBsplwr);
5688 return;
5689 }
5690
5691 data = (const char *)req->buf + 3;
5692
5693 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5694 reply_nterror(req, map_nt_error_from_unix(errno));
5695 END_PROFILE(SMBsplwr);
5696 return;
5697 }
5698
5699 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5700
5701 END_PROFILE(SMBsplwr);
5702 return;
5703 }
5704
5705 /****************************************************************************
5706 Reply to a mkdir.
5707 ****************************************************************************/
5708
5709 void reply_mkdir(struct smb_request *req)
5710 {
5711 connection_struct *conn = req->conn;
5712 struct smb_filename *smb_dname = NULL;
5713 char *directory = NULL;
5714 NTSTATUS status;
5715 TALLOC_CTX *ctx = talloc_tos();
5716
5717 START_PROFILE(SMBmkdir);
5718
5719 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5720 STR_TERMINATE, &status);
5721 if (!NT_STATUS_IS_OK(status)) {
5722 reply_nterror(req, status);
5723 goto out;
5724 }
5725
5726 status = filename_convert(ctx, conn,
5727 req->flags2 & FLAGS2_DFS_PATHNAMES,
5728 directory,
5729 0,
5730 NULL,
5731 &smb_dname);
5732 if (!NT_STATUS_IS_OK(status)) {
5733 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5734 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5735 ERRSRV, ERRbadpath);
5736 goto out;
5737 }
5738 reply_nterror(req, status);
5739 goto out;
5740 }
5741
5742 status = create_directory(conn, req, smb_dname);
5743
5744 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5745
5746 if (!NT_STATUS_IS_OK(status)) {
5747
5748 if (!use_nt_status()
5749 && NT_STATUS_EQUAL(status,
5750 NT_STATUS_OBJECT_NAME_COLLISION)) {
5751 /*
5752 * Yes, in the DOS error code case we get a
5753 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5754 * samba4 torture test.
5755 */
5756 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5757 }
5758
5759 reply_nterror(req, status);
5760 goto out;
5761 }
5762
5763 reply_outbuf(req, 0, 0);
5764
5765 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5766 out:
5767 TALLOC_FREE(smb_dname);
5768 END_PROFILE(SMBmkdir);
5769 return;
5770 }
5771
5772 /****************************************************************************
5773 Reply to a rmdir.
5774 ****************************************************************************/
5775
5776 void reply_rmdir(struct smb_request *req)
5777 {
5778 connection_struct *conn = req->conn;
5779 struct smb_filename *smb_dname = NULL;
5780 char *directory = NULL;
5781 NTSTATUS status;
5782 TALLOC_CTX *ctx = talloc_tos();
5783 files_struct *fsp = NULL;
5784 int info = 0;
5785 struct smbd_server_connection *sconn = req->sconn;
5786
5787 START_PROFILE(SMBrmdir);
5788
5789 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5790 STR_TERMINATE, &status);
5791 if (!NT_STATUS_IS_OK(status)) {
5792 reply_nterror(req, status);
5793 goto out;
5794 }
5795
5796 status = filename_convert(ctx, conn,
5797 req->flags2 & FLAGS2_DFS_PATHNAMES,
5798 directory,
5799 0,
5800 NULL,
5801 &smb_dname);
5802 if (!NT_STATUS_IS_OK(status)) {
5803 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5804 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5805 ERRSRV, ERRbadpath);
5806 goto out;
5807 }
5808 reply_nterror(req, status);
5809 goto out;
5810 }
5811
5812 if (is_ntfs_stream_smb_fname(smb_dname)) {
5813 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5814 goto out;
5815 }
5816
5817 status = SMB_VFS_CREATE_FILE(
5818 conn, /* conn */
5819 req, /* req */
5820 0, /* root_dir_fid */
5821 smb_dname, /* fname */
5822 DELETE_ACCESS, /* access_mask */
5823 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5824 FILE_SHARE_DELETE),
5825 FILE_OPEN, /* create_disposition*/
5826 FILE_DIRECTORY_FILE, /* create_options */
5827 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5828 0, /* oplock_request */
5829 0, /* allocation_size */
5830 0, /* private_flags */
5831 NULL, /* sd */
5832 NULL, /* ea_list */
5833 &fsp, /* result */
5834 &info); /* pinfo */
5835
5836 if (!NT_STATUS_IS_OK(status)) {
5837 if (open_was_deferred(req->sconn, req->mid)) {
5838 /* We have re-scheduled this call. */
5839 goto out;
5840 }
5841 reply_nterror(req, status);
5842 goto out;
5843 }
5844
5845 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5846 if (!NT_STATUS_IS_OK(status)) {
5847 close_file(req, fsp, ERROR_CLOSE);
5848 reply_nterror(req, status);
5849 goto out;
5850 }
5851
5852 if (!set_delete_on_close(fsp, true,
5853 conn->session_info->security_token,
5854 conn->session_info->unix_token)) {
5855 close_file(req, fsp, ERROR_CLOSE);
5856 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5857 goto out;
5858 }
5859
5860 status = close_file(req, fsp, NORMAL_CLOSE);
5861 if (!NT_STATUS_IS_OK(status)) {
5862 reply_nterror(req, status);
5863 } else {
5864 reply_outbuf(req, 0, 0);
5865 }
5866
5867 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5868
5869 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5870 out:
5871 TALLOC_FREE(smb_dname);
5872 END_PROFILE(SMBrmdir);
5873 return;
5874 }
5875
5876 /*******************************************************************
5877 Resolve wildcards in a filename rename.
5878 ********************************************************************/
5879
5880 static bool resolve_wildcards(TALLOC_CTX *ctx,
5881 const char *name1,
5882 const char *name2,
5883 char **pp_newname)
5884 {
5885 char *name2_copy = NULL;
5886 char *root1 = NULL;
5887 char *root2 = NULL;
5888 char *ext1 = NULL;
5889 char *ext2 = NULL;
5890 char *p,*p2, *pname1, *pname2;
5891
5892 name2_copy = talloc_strdup(ctx, name2);
5893 if (!name2_copy) {
5894 return False;
5895 }
5896
5897 pname1 = strrchr_m(name1,'/');
5898 pname2 = strrchr_m(name2_copy,'/');
5899
5900 if (!pname1 || !pname2) {
5901 return False;
5902 }
5903
5904 /* Truncate the copy of name2 at the last '/' */
5905 *pname2 = '\0';
5906
5907 /* Now go past the '/' */
5908 pname1++;
5909 pname2++;
5910
5911 root1 = talloc_strdup(ctx, pname1);
5912 root2 = talloc_strdup(ctx, pname2);
5913
5914 if (!root1 || !root2) {
5915 return False;
5916 }
5917
5918 p = strrchr_m(root1,'.');
5919 if (p) {
5920 *p = 0;
5921 ext1 = talloc_strdup(ctx, p+1);
5922 } else {
5923 ext1 = talloc_strdup(ctx, "");
5924 }
5925 p = strrchr_m(root2,'.');
5926 if (p) {
5927 *p = 0;
5928 ext2 = talloc_strdup(ctx, p+1);
5929 } else {
5930 ext2 = talloc_strdup(ctx, "");
5931 }
5932
5933 if (!ext1 || !ext2) {
5934 return False;
5935 }
5936
5937 p = root1;
5938 p2 = root2;
5939 while (*p2) {
5940 if (*p2 == '?') {
5941 /* Hmmm. Should this be mb-aware ? */
5942 *p2 = *p;
5943 p2++;
5944 } else if (*p2 == '*') {
5945 *p2 = '\0';
5946 root2 = talloc_asprintf(ctx, "%s%s",
5947 root2,
5948 p);
5949 if (!root2) {
5950 return False;
5951 }
5952 break;
5953 } else {
5954 p2++;
5955 }
5956 if (*p) {
5957 p++;
5958 }
5959 }
5960
5961 p = ext1;
5962 p2 = ext2;
5963 while (*p2) {
5964 if (*p2 == '?') {
5965 /* Hmmm. Should this be mb-aware ? */
5966 *p2 = *p;
5967 p2++;
5968 } else if (*p2 == '*') {
5969 *p2 = '\0';
5970 ext2 = talloc_asprintf(ctx, "%s%s",
5971 ext2,
5972 p);
5973 if (!ext2) {
5974 return False;
5975 }
5976 break;
5977 } else {
5978 p2++;
5979 }
5980 if (*p) {
5981 p++;
5982 }
5983 }
5984
5985 if (*ext2) {
5986 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5987 name2_copy,
5988 root2,
5989 ext2);
5990 } else {
5991 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5992 name2_copy,
5993 root2);
5994 }
5995
5996 if (!*pp_newname) {
5997 return False;
5998 }
5999
6000 return True;
6001 }
6002
6003 /****************************************************************************
6004 Ensure open files have their names updated. Updated to notify other smbd's
6005 asynchronously.
6006 ****************************************************************************/
6007
6008 static void rename_open_files(connection_struct *conn,
6009 struct share_mode_lock *lck,
6010 uint32_t orig_name_hash,
6011 const struct smb_filename *smb_fname_dst)
6012 {
6013 files_struct *fsp;
6014 bool did_rename = False;
6015 NTSTATUS status;
6016 uint32_t new_name_hash = 0;
6017
6018 for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6019 fsp = file_find_di_next(fsp)) {
6020 /* fsp_name is a relative path under the fsp. To change this for other
6021 sharepaths we need to manipulate relative paths. */
6022 /* TODO - create the absolute path and manipulate the newname
6023 relative to the sharepath. */
6024 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6025 continue;
6026 }
6027 if (fsp->name_hash != orig_name_hash) {
6028 continue;
6029 }
6030 DEBUG(10, ("rename_open_files: renaming file %s "
6031 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6032 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6033 smb_fname_str_dbg(smb_fname_dst)));
6034
6035 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6036 if (NT_STATUS_IS_OK(status)) {
6037 did_rename = True;
6038 new_name_hash = fsp->name_hash;
6039 }
6040 }
6041
6042 if (!did_rename) {
6043 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6044 "for %s\n", file_id_string_tos(&lck->data->id),
6045 smb_fname_str_dbg(smb_fname_dst)));
6046 }
6047
6048 /* Send messages to all smbd's (not ourself) that the name has changed. */
6049 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6050 orig_name_hash, new_name_hash,
6051 smb_fname_dst);
6052
6053 }
6054
6055 /****************************************************************************
6056 We need to check if the source path is a parent directory of the destination
6057 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6058 refuse the rename with a sharing violation. Under UNIX the above call can
6059 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6060 probably need to check that the client is a Windows one before disallowing
6061 this as a UNIX client (one with UNIX extensions) can know the source is a
6062 symlink and make this decision intelligently. Found by an excellent bug
6063 report from <AndyLiebman@aol.com>.
6064 ****************************************************************************/
6065
6066 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6067 const struct smb_filename *smb_fname_dst)
6068 {
6069 const char *psrc = smb_fname_src->base_name;
6070 const char *pdst = smb_fname_dst->base_name;
6071 size_t slen;
6072
6073 if (psrc[0] == '.' && psrc[1] == '/') {
6074 psrc += 2;
6075 }
6076 if (pdst[0] == '.' && pdst[1] == '/') {
6077 pdst += 2;
6078 }
6079 if ((slen = strlen(psrc)) > strlen(pdst)) {
6080 return False;
6081 }
6082 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6083 }
6084
6085 /*
6086 * Do the notify calls from a rename
6087 */
6088
6089 static void notify_rename(connection_struct *conn, bool is_dir,
6090 const struct smb_filename *smb_fname_src,
6091 const struct smb_filename *smb_fname_dst)
6092 {
6093 char *parent_dir_src = NULL;
6094 char *parent_dir_dst = NULL;
6095 uint32 mask;
6096
6097 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6098 : FILE_NOTIFY_CHANGE_FILE_NAME;
6099
6100 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6101 &parent_dir_src, NULL) ||
6102 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6103 &parent_dir_dst, NULL)) {
6104 goto out;
6105 }
6106
6107 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6108 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6109 smb_fname_src->base_name);
6110 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6111 smb_fname_dst->base_name);
6112 }
6113 else {
6114 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6115 smb_fname_src->base_name);
6116 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6117 smb_fname_dst->base_name);
6118 }
6119
6120 /* this is a strange one. w2k3 gives an additional event for
6121 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6122 files, but not directories */
6123 if (!is_dir) {
6124 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6125 FILE_NOTIFY_CHANGE_ATTRIBUTES
6126 |FILE_NOTIFY_CHANGE_CREATION,
6127 smb_fname_dst->base_name);
6128 }
6129 out:
6130 TALLOC_FREE(parent_dir_src);
6131 TALLOC_FREE(parent_dir_dst);
6132 }
6133
6134 /****************************************************************************
6135 Returns an error if the parent directory for a filename is open in an
6136 incompatible way.
6137 ****************************************************************************/
6138
6139 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6140 const struct smb_filename *smb_fname_dst_in)
6141 {
6142 char *parent_dir = NULL;
6143 struct smb_filename smb_fname_parent;
6144 struct file_id id;
6145 files_struct *fsp = NULL;
6146 int ret;
6147
6148 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6149 &parent_dir, NULL)) {
6150 return NT_STATUS_NO_MEMORY;
6151 }
6152 ZERO_STRUCT(smb_fname_parent);
6153 smb_fname_parent.base_name = parent_dir;
6154
6155 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6156 if (ret == -1) {
6157 return map_nt_error_from_unix(errno);
6158 }
6159
6160 /*
6161 * We're only checking on this smbd here, mostly good
6162 * enough.. and will pass tests.
6163 */
6164
6165 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6166 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6167 fsp = file_find_di_next(fsp)) {
6168 if (fsp->access_mask & DELETE_ACCESS) {
6169 return NT_STATUS_SHARING_VIOLATION;
6170 }
6171 }
6172 return NT_STATUS_OK;
6173 }
6174
6175 /****************************************************************************
6176 Rename an open file - given an fsp.
6177 ****************************************************************************/
6178
6179 NTSTATUS rename_internals_fsp(connection_struct *conn,
6180 files_struct *fsp,
6181 const struct smb_filename *smb_fname_dst_in,
6182 uint32 attrs,
6183 bool replace_if_exists)
6184 {
6185 TALLOC_CTX *ctx = talloc_tos();
6186 struct smb_filename *smb_fname_dst = NULL;
6187 NTSTATUS status = NT_STATUS_OK;
6188 struct share_mode_lock *lck = NULL;
6189 bool dst_exists, old_is_stream, new_is_stream;
6190
6191 status = check_name(conn, smb_fname_dst_in->base_name);
6192 if (!NT_STATUS_IS_OK(status)) {
6193 return status;
6194 }
6195
6196 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6197 if (!NT_STATUS_IS_OK(status)) {
6198 return status;
6199 }
6200
6201 /* Make a copy of the dst smb_fname structs */
6202
6203 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6204 if (!NT_STATUS_IS_OK(status)) {
6205 goto out;
6206 }
6207
6208 /*
6209 * Check for special case with case preserving and not
6210 * case sensitive. If the old last component differs from the original
6211 * last component only by case, then we should allow
6212 * the rename (user is trying to change the case of the
6213 * filename).
6214 */
6215 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6216 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6217 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6218 char *last_slash;
6219 char *fname_dst_lcomp_base_mod = NULL;
6220 struct smb_filename *smb_fname_orig_lcomp = NULL;
6221
6222 /*
6223 * Get the last component of the destination name.
6224 */
6225 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6226 if (last_slash) {
6227 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6228 } else {
6229 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6230 }
6231 if (!fname_dst_lcomp_base_mod) {
6232 status = NT_STATUS_NO_MEMORY;
6233 goto out;
6234 }
6235
6236 /*
6237 * Create an smb_filename struct using the original last
6238 * component of the destination.
6239 */
6240 status = create_synthetic_smb_fname_split(ctx,
6241 smb_fname_dst->original_lcomp, NULL,
6242 &smb_fname_orig_lcomp);
6243 if (!NT_STATUS_IS_OK(status)) {
6244 TALLOC_FREE(fname_dst_lcomp_base_mod);
6245 goto out;
6246 }
6247
6248 /* If the base names only differ by case, use original. */
6249 if(!strcsequal(fname_dst_lcomp_base_mod,
6250 smb_fname_orig_lcomp->base_name)) {
6251 char *tmp;
6252 /*
6253 * Replace the modified last component with the
6254 * original.
6255 */
6256 if (last_slash) {
6257 *last_slash = '\0'; /* Truncate at the '/' */
6258 tmp = talloc_asprintf(smb_fname_dst,
6259 "%s/%s",
6260 smb_fname_dst->base_name,
6261 smb_fname_orig_lcomp->base_name);
6262 } else {
6263 tmp = talloc_asprintf(smb_fname_dst,
6264 "%s",
6265 smb_fname_orig_lcomp->base_name);
6266 }
6267 if (tmp == NULL) {
6268 status = NT_STATUS_NO_MEMORY;
6269 TALLOC_FREE(fname_dst_lcomp_base_mod);
6270 TALLOC_FREE(smb_fname_orig_lcomp);
6271 goto out;
6272 }
6273 TALLOC_FREE(smb_fname_dst->base_name);
6274 smb_fname_dst->base_name = tmp;
6275 }
6276
6277 /* If the stream_names only differ by case, use original. */
6278 if(!strcsequal(smb_fname_dst->stream_name,
6279 smb_fname_orig_lcomp->stream_name)) {
6280 char *tmp = NULL;
6281 /* Use the original stream. */
6282 tmp = talloc_strdup(smb_fname_dst,
6283 smb_fname_orig_lcomp->stream_name);
6284 if (tmp == NULL) {
6285 status = NT_STATUS_NO_MEMORY;
6286 TALLOC_FREE(fname_dst_lcomp_base_mod);
6287 TALLOC_FREE(smb_fname_orig_lcomp);
6288 goto out;
6289 }
6290 TALLOC_FREE(smb_fname_dst->stream_name);
6291 smb_fname_dst->stream_name = tmp;
6292 }
6293 TALLOC_FREE(fname_dst_lcomp_base_mod);
6294 TALLOC_FREE(smb_fname_orig_lcomp);
6295 }
6296
6297 /*
6298 * If the src and dest names are identical - including case,
6299 * don't do the rename, just return success.
6300 */
6301
6302 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6303 strcsequal(fsp->fsp_name->stream_name,
6304 smb_fname_dst->stream_name)) {
6305 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6306 "- returning success\n",
6307 smb_fname_str_dbg(smb_fname_dst)));
6308 status = NT_STATUS_OK;
6309 goto out;
6310 }
6311
6312 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6313 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6314
6315 /* Return the correct error code if both names aren't streams. */
6316 if (!old_is_stream && new_is_stream) {
6317 status = NT_STATUS_OBJECT_NAME_INVALID;
6318 goto out;
6319 }
6320
6321 if (old_is_stream && !new_is_stream) {
6322 status = NT_STATUS_INVALID_PARAMETER;
6323 goto out;
6324 }
6325
6326 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6327
6328 if(!replace_if_exists && dst_exists) {
6329 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6330 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6331 smb_fname_str_dbg(smb_fname_dst)));
6332 status = NT_STATUS_OBJECT_NAME_COLLISION;
6333 goto out;
6334 }
6335
6336 if (dst_exists) {
6337 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6338 &smb_fname_dst->st);
6339 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6340 fileid);
6341 /* The file can be open when renaming a stream */
6342 if (dst_fsp && !new_is_stream) {
6343 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6344 status = NT_STATUS_ACCESS_DENIED;
6345 goto out;
6346 }
6347 }
6348
6349 /* Ensure we have a valid stat struct for the source. */
6350 status = vfs_stat_fsp(fsp);
6351 if (!NT_STATUS_IS_OK(status)) {
6352 goto out;
6353 }
6354
6355 status = can_rename(conn, fsp, attrs);
6356
6357 if (!NT_STATUS_IS_OK(status)) {
6358 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6359 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6360 smb_fname_str_dbg(smb_fname_dst)));
6361 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6362 status = NT_STATUS_ACCESS_DENIED;
6363 goto out;
6364 }
6365
6366 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6367 status = NT_STATUS_ACCESS_DENIED;
6368 }
6369
6370 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6371
6372 /*
6373 * We have the file open ourselves, so not being able to get the
6374 * corresponding share mode lock is a fatal error.
6375 */
6376
6377 SMB_ASSERT(lck != NULL);
6378
6379 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6380 uint32 create_options = fsp->fh->private_options;
6381
6382 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6383 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6384 smb_fname_str_dbg(smb_fname_dst)));
6385
6386 if (!lp_posix_pathnames() &&
6387 (lp_map_archive(SNUM(conn)) ||
6388 lp_store_dos_attributes(SNUM(conn)))) {
6389 /* We must set the archive bit on the newly
6390 renamed file. */
6391 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6392 uint32_t old_dosmode = dos_mode(conn,
6393 smb_fname_dst);
6394 file_set_dosmode(conn,
6395 smb_fname_dst,
6396 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6397 NULL,
6398 true);
6399 }
6400 }
6401
6402 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6403 smb_fname_dst);
6404
6405 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6406
6407 /*
6408 * A rename acts as a new file create w.r.t. allowing an initial delete
6409 * on close, probably because in Windows there is a new handle to the
6410 * new file. If initial delete on close was requested but not
6411 * originally set, we need to set it here. This is probably not 100% correct,
6412 * but will work for the CIFSFS client which in non-posix mode
6413 * depends on these semantics. JRA.
6414 */
6415
6416 if (create_options & FILE_DELETE_ON_CLOSE) {
6417 status = can_set_delete_on_close(fsp, 0);
6418
6419 if (NT_STATUS_IS_OK(status)) {
6420 /* Note that here we set the *inital* delete on close flag,
6421 * not the regular one. The magic gets handled in close. */
6422 fsp->initial_delete_on_close = True;
6423 }
6424 }
6425 TALLOC_FREE(lck);
6426 status = NT_STATUS_OK;
6427 goto out;
6428 }
6429
6430 TALLOC_FREE(lck);
6431
6432 if (errno == ENOTDIR || errno == EISDIR) {
6433 status = NT_STATUS_OBJECT_NAME_COLLISION;
6434 } else {
6435 status = map_nt_error_from_unix(errno);
6436 }
6437
6438 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6439 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6440 smb_fname_str_dbg(smb_fname_dst)));
6441
6442 out:
6443 TALLOC_FREE(smb_fname_dst);
6444
6445 return status;
6446 }
6447
6448 /****************************************************************************
6449 The guts of the rename command, split out so it may be called by the NT SMB
6450 code.
6451 ****************************************************************************/
6452
6453 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6454 connection_struct *conn,
6455 struct smb_request *req,
6456 struct smb_filename *smb_fname_src,
6457 struct smb_filename *smb_fname_dst,
6458 uint32 attrs,
6459 bool replace_if_exists,
6460 bool src_has_wild,
6461 bool dest_has_wild,
6462 uint32_t access_mask)
6463 {
6464 char *fname_src_dir = NULL;
6465 char *fname_src_mask = NULL;
6466 int count=0;
6467 NTSTATUS status = NT_STATUS_OK;
6468 struct smb_Dir *dir_hnd = NULL;
6469 const char *dname = NULL;
6470 char *talloced = NULL;
6471 long offset = 0;
6472 int create_options = 0;
6473 bool posix_pathnames = lp_posix_pathnames();
6474
6475 /*
6476 * Split the old name into directory and last component
6477 * strings. Note that unix_convert may have stripped off a
6478 * leading ./ from both name and newname if the rename is
6479 * at the root of the share. We need to make sure either both
6480 * name and newname contain a / character or neither of them do
6481 * as this is checked in resolve_wildcards().
6482 */
6483
6484 /* Split up the directory from the filename/mask. */
6485 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6486 &fname_src_dir, &fname_src_mask);
6487 if (!NT_STATUS_IS_OK(status)) {
6488 status = NT_STATUS_NO_MEMORY;
6489 goto out;
6490 }
6491
6492 /*
6493 * We should only check the mangled cache
6494 * here if unix_convert failed. This means
6495 * that the path in 'mask' doesn't exist
6496 * on the file system and so we need to look
6497 * for a possible mangle. This patch from
6498 * Tine Smukavec <valentin.smukavec@hermes.si>.
6499 */
6500
6501 if (!VALID_STAT(smb_fname_src->st) &&
6502 mangle_is_mangled(fname_src_mask, conn->params)) {
6503 char *new_mask = NULL;
6504 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6505 conn->params);
6506 if (new_mask) {
6507 TALLOC_FREE(fname_src_mask);
6508 fname_src_mask = new_mask;
6509 }
6510 }
6511
6512 if (!src_has_wild) {
6513 files_struct *fsp;
6514
6515 /*
6516 * Only one file needs to be renamed. Append the mask back
6517 * onto the directory.
6518 */
6519 TALLOC_FREE(smb_fname_src->base_name);
6520 if (ISDOT(fname_src_dir)) {
6521 /* Ensure we use canonical names on open. */
6522 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6523 "%s",
6524 fname_src_mask);
6525 } else {
6526 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6527 "%s/%s",
6528 fname_src_dir,
6529 fname_src_mask);
6530 }
6531 if (!smb_fname_src->base_name) {
6532 status = NT_STATUS_NO_MEMORY;
6533 goto out;
6534 }
6535
6536 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6537 "case_preserve = %d, short case preserve = %d, "
6538 "directory = %s, newname = %s, "
6539 "last_component_dest = %s\n",
6540 conn->case_sensitive, conn->case_preserve,
6541 conn->short_case_preserve,
6542 smb_fname_str_dbg(smb_fname_src),
6543 smb_fname_str_dbg(smb_fname_dst),
6544 smb_fname_dst->original_lcomp));
6545
6546 /* The dest name still may have wildcards. */
6547 if (dest_has_wild) {
6548 char *fname_dst_mod = NULL;
6549 if (!resolve_wildcards(smb_fname_dst,
6550 smb_fname_src->base_name,
6551 smb_fname_dst->base_name,
6552 &fname_dst_mod)) {
6553 DEBUG(6, ("rename_internals: resolve_wildcards "
6554 "%s %s failed\n",
6555 smb_fname_src->base_name,
6556 smb_fname_dst->base_name));
6557 status = NT_STATUS_NO_MEMORY;
6558 goto out;
6559 }
6560 TALLOC_FREE(smb_fname_dst->base_name);
6561 smb_fname_dst->base_name = fname_dst_mod;
6562 }
6563
6564 ZERO_STRUCT(smb_fname_src->st);
6565 if (posix_pathnames) {
6566 SMB_VFS_LSTAT(conn, smb_fname_src);
6567 } else {
6568 SMB_VFS_STAT(conn, smb_fname_src);
6569 }
6570
6571 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6572 create_options |= FILE_DIRECTORY_FILE;
6573 }
6574
6575 status = SMB_VFS_CREATE_FILE(
6576 conn, /* conn */
6577 req, /* req */
6578 0, /* root_dir_fid */
6579 smb_fname_src, /* fname */
6580 access_mask, /* access_mask */
6581 (FILE_SHARE_READ | /* share_access */
6582 FILE_SHARE_WRITE),
6583 FILE_OPEN, /* create_disposition*/
6584 create_options, /* create_options */
6585 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6586 0, /* oplock_request */
6587 0, /* allocation_size */
6588 0, /* private_flags */
6589 NULL, /* sd */
6590 NULL, /* ea_list */
6591 &fsp, /* result */
6592 NULL); /* pinfo */
6593
6594 if (!NT_STATUS_IS_OK(status)) {
6595 DEBUG(3, ("Could not open rename source %s: %s\n",
6596 smb_fname_str_dbg(smb_fname_src),
6597 nt_errstr(status)));
6598 goto out;
6599 }
6600
6601 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6602 attrs, replace_if_exists);
6603
6604 close_file(req, fsp, NORMAL_CLOSE);
6605
6606 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6607 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6608 smb_fname_str_dbg(smb_fname_dst)));
6609
6610 goto out;
6611 }
6612
6613 /*
6614 * Wildcards - process each file that matches.
6615 */
6616 if (strequal(fname_src_mask, "????????.???")) {
6617 TALLOC_FREE(fname_src_mask);
6618 fname_src_mask = talloc_strdup(ctx, "*");
6619 if (!fname_src_mask) {
6620 status = NT_STATUS_NO_MEMORY;
6621 goto out;
6622 }
6623 }
6624
6625 status = check_name(conn, fname_src_dir);
6626 if (!NT_STATUS_IS_OK(status)) {
6627 goto out;
6628 }
6629
6630 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6631 attrs);
6632 if (dir_hnd == NULL) {
6633 status = map_nt_error_from_unix(errno);
6634 goto out;
6635 }
6636
6637 status = NT_STATUS_NO_SUCH_FILE;
6638 /*
6639 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6640 * - gentest fix. JRA
6641 */
6642
6643 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6644 &talloced))) {
6645 files_struct *fsp = NULL;
6646 char *destname = NULL;
6647 bool sysdir_entry = False;
6648
6649 /* Quick check for "." and ".." */
6650 if (ISDOT(dname) || ISDOTDOT(dname)) {
6651 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6652 sysdir_entry = True;
6653 } else {
6654 TALLOC_FREE(talloced);
6655 continue;
6656 }
6657 }
6658
6659 if (!is_visible_file(conn, fname_src_dir, dname,
6660 &smb_fname_src->st, false)) {
6661 TALLOC_FREE(talloced);
6662 continue;
6663 }
6664
6665 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6666 TALLOC_FREE(talloced);
6667 continue;
6668 }
6669
6670 if (sysdir_entry) {
6671 status = NT_STATUS_OBJECT_NAME_INVALID;
6672 break;
6673 }
6674
6675 TALLOC_FREE(smb_fname_src->base_name);
6676 if (ISDOT(fname_src_dir)) {
6677 /* Ensure we use canonical names on open. */
6678 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6679 "%s",
6680 dname);
6681 } else {
6682 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6683 "%s/%s",
6684 fname_src_dir,
6685 dname);
6686 }
6687 if (!smb_fname_src->base_name) {
6688 status = NT_STATUS_NO_MEMORY;
6689 goto out;
6690 }
6691
6692 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6693 smb_fname_dst->base_name,
6694 &destname)) {
6695 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6696 smb_fname_src->base_name, destname));
6697 TALLOC_FREE(talloced);
6698 continue;
6699 }
6700 if (!destname) {
6701 status = NT_STATUS_NO_MEMORY;
6702 goto out;
6703 }
6704
6705 TALLOC_FREE(smb_fname_dst->base_name);
6706 smb_fname_dst->base_name = destname;
6707
6708 ZERO_STRUCT(smb_fname_src->st);
6709 if (posix_pathnames) {
6710 SMB_VFS_LSTAT(conn, smb_fname_src);
6711 } else {
6712 SMB_VFS_STAT(conn, smb_fname_src);
6713 }
6714
6715 create_options = 0;
6716
6717 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6718 create_options |= FILE_DIRECTORY_FILE;
6719 }
6720
6721 status = SMB_VFS_CREATE_FILE(
6722 conn, /* conn */
6723 req, /* req */
6724 0, /* root_dir_fid */
6725 smb_fname_src, /* fname */
6726 access_mask, /* access_mask */
6727 (FILE_SHARE_READ | /* share_access */
6728 FILE_SHARE_WRITE),
6729 FILE_OPEN, /* create_disposition*/
6730 create_options, /* create_options */
6731 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6732 0, /* oplock_request */
6733 0, /* allocation_size */
6734 0, /* private_flags */
6735 NULL, /* sd */
6736 NULL, /* ea_list */
6737 &fsp, /* result */
6738 NULL); /* pinfo */
6739
6740 if (!NT_STATUS_IS_OK(status)) {
6741 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6742 "returned %s rename %s -> %s\n",
6743 nt_errstr(status),
6744 smb_fname_str_dbg(smb_fname_src),
6745 smb_fname_str_dbg(smb_fname_dst)));
6746 break;
6747 }
6748
6749 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6750 dname);
6751 if (!smb_fname_dst->original_lcomp) {
6752 status = NT_STATUS_NO_MEMORY;
6753 goto out;
6754 }
6755
6756 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6757 attrs, replace_if_exists);
6758
6759 close_file(req, fsp, NORMAL_CLOSE);
6760
6761 if (!NT_STATUS_IS_OK(status)) {
6762 DEBUG(3, ("rename_internals_fsp returned %s for "
6763 "rename %s -> %s\n", nt_errstr(status),
6764 smb_fname_str_dbg(smb_fname_src),
6765 smb_fname_str_dbg(smb_fname_dst)));
6766 break;
6767 }
6768
6769 count++;
6770
6771 DEBUG(3,("rename_internals: doing rename on %s -> "
6772 "%s\n", smb_fname_str_dbg(smb_fname_src),
6773 smb_fname_str_dbg(smb_fname_src)));
6774 TALLOC_FREE(talloced);
6775 }
6776 TALLOC_FREE(dir_hnd);
6777
6778 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6779 status = map_nt_error_from_unix(errno);
6780 }
6781
6782 out:
6783 TALLOC_FREE(talloced);
6784 TALLOC_FREE(fname_src_dir);
6785 TALLOC_FREE(fname_src_mask);
6786 return status;
6787 }
6788
6789 /****************************************************************************
6790 Reply to a mv.
6791 ****************************************************************************/
6792
6793 void reply_mv(struct smb_request *req)
6794 {
6795 connection_struct *conn = req->conn;
6796 char *name = NULL;
6797 char *newname = NULL;
6798 const char *p;
6799 uint32 attrs;
6800 NTSTATUS status;
6801 bool src_has_wcard = False;
6802 bool dest_has_wcard = False;
6803 TALLOC_CTX *ctx = talloc_tos();
6804 struct smb_filename *smb_fname_src = NULL;
6805 struct smb_filename *smb_fname_dst = NULL;
6806 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6807 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6808 bool stream_rename = false;
6809
6810 START_PROFILE(SMBmv);
6811
6812 if (req->wct < 1) {
6813 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6814 goto out;
6815 }
6816
6817 attrs = SVAL(req->vwv+0, 0);
6818
6819 p = (const char *)req->buf + 1;
6820 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6821 &status, &src_has_wcard);
6822 if (!NT_STATUS_IS_OK(status)) {
6823 reply_nterror(req, status);
6824 goto out;
6825 }
6826 p++;
6827 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6828 &status, &dest_has_wcard);
6829 if (!NT_STATUS_IS_OK(status)) {
6830 reply_nterror(req, status);
6831 goto out;
6832 }
6833
6834 if (!lp_posix_pathnames()) {
6835 /* The newname must begin with a ':' if the
6836 name contains a ':'. */
6837 if (strchr_m(name, ':')) {
6838 if (newname[0] != ':') {
6839 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6840 goto out;
6841 }
6842 stream_rename = true;
6843 }
6844 }
6845
6846 status = filename_convert(ctx,
6847 conn,
6848 req->flags2 & FLAGS2_DFS_PATHNAMES,
6849 name,
6850 src_ucf_flags,
6851 &src_has_wcard,
6852 &smb_fname_src);
6853
6854 if (!NT_STATUS_IS_OK(status)) {
6855 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6856 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6857 ERRSRV, ERRbadpath);
6858 goto out;
6859 }
6860 reply_nterror(req, status);
6861 goto out;
6862 }
6863
6864 status = filename_convert(ctx,
6865 conn,
6866 req->flags2 & FLAGS2_DFS_PATHNAMES,
6867 newname,
6868 dst_ucf_flags,
6869 &dest_has_wcard,
6870 &smb_fname_dst);
6871
6872 if (!NT_STATUS_IS_OK(status)) {
6873 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6874 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6875 ERRSRV, ERRbadpath);
6876 goto out;
6877 }
6878 reply_nterror(req, status);
6879 goto out;
6880 }
6881
6882 if (stream_rename) {
6883 /* smb_fname_dst->base_name must be the same as
6884 smb_fname_src->base_name. */
6885 TALLOC_FREE(smb_fname_dst->base_name);
6886 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6887 smb_fname_src->base_name);
6888 if (!smb_fname_dst->base_name) {
6889 reply_nterror(req, NT_STATUS_NO_MEMORY);
6890 goto out;
6891 }
6892 }
6893
6894 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6895 smb_fname_str_dbg(smb_fname_dst)));
6896
6897 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6898 attrs, False, src_has_wcard, dest_has_wcard,
6899 DELETE_ACCESS);
6900 if (!NT_STATUS_IS_OK(status)) {
6901 if (open_was_deferred(req->sconn, req->mid)) {
6902 /* We have re-scheduled this call. */
6903 goto out;
6904 }
6905 reply_nterror(req, status);
6906 goto out;
6907 }
6908
6909 reply_outbuf(req, 0, 0);
6910 out:
6911 TALLOC_FREE(smb_fname_src);
6912 TALLOC_FREE(smb_fname_dst);
6913 END_PROFILE(SMBmv);
6914 return;
6915 }
6916
6917 /*******************************************************************
6918 Copy a file as part of a reply_copy.
6919 ******************************************************************/
6920
6921 /*
6922 * TODO: check error codes on all callers
6923 */
6924
6925 NTSTATUS copy_file(TALLOC_CTX *ctx,
6926 connection_struct *conn,
6927 struct smb_filename *smb_fname_src,
6928 struct smb_filename *smb_fname_dst,
6929 int ofun,
6930 int count,
6931 bool target_is_directory)
6932 {
6933 struct smb_filename *smb_fname_dst_tmp = NULL;
6934 off_t ret=-1;
6935 files_struct *fsp1,*fsp2;
6936 uint32 dosattrs;
6937 uint32 new_create_disposition;
6938 NTSTATUS status;
6939
6940
6941 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6942 if (!NT_STATUS_IS_OK(status)) {
6943 return status;
6944 }
6945
6946 /*
6947 * If the target is a directory, extract the last component from the
6948 * src filename and append it to the dst filename
6949 */
6950 if (target_is_directory) {
6951 const char *p;
6952
6953 /* dest/target can't be a stream if it's a directory. */
6954 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6955
6956 p = strrchr_m(smb_fname_src->base_name,'/');
6957 if (p) {
6958 p++;
6959 } else {
6960 p = smb_fname_src->base_name;
6961 }
6962 smb_fname_dst_tmp->base_name =
6963 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6964 p);
6965 if (!smb_fname_dst_tmp->base_name) {
6966 status = NT_STATUS_NO_MEMORY;
6967 goto out;
6968 }
6969 }
6970
6971 status = vfs_file_exist(conn, smb_fname_src);
6972 if (!NT_STATUS_IS_OK(status)) {
6973 goto out;
6974 }
6975
6976 if (!target_is_directory && count) {
6977 new_create_disposition = FILE_OPEN;
6978 } else {
6979 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6980 0, ofun,
6981 NULL, NULL,
6982 &new_create_disposition,
6983 NULL,
6984 NULL)) {
6985 status = NT_STATUS_INVALID_PARAMETER;
6986 goto out;
6987 }
6988 }
6989
6990 /* Open the src file for reading. */
6991 status = SMB_VFS_CREATE_FILE(
6992 conn, /* conn */
6993 NULL, /* req */
6994 0, /* root_dir_fid */
6995 smb_fname_src, /* fname */
6996 FILE_GENERIC_READ, /* access_mask */
6997 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6998 FILE_OPEN, /* create_disposition*/
6999 0, /* create_options */
7000 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7001 INTERNAL_OPEN_ONLY, /* oplock_request */
7002 0, /* allocation_size */
7003 0, /* private_flags */
7004 NULL, /* sd */
7005 NULL, /* ea_list */
7006 &fsp1, /* result */
7007 NULL); /* psbuf */
7008
7009 if (!NT_STATUS_IS_OK(status)) {
7010 goto out;
7011 }
7012
7013 dosattrs = dos_mode(conn, smb_fname_src);
7014
7015 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7016 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7017 }
7018
7019 /* Open the dst file for writing. */
7020 status = SMB_VFS_CREATE_FILE(
7021 conn, /* conn */
7022 NULL, /* req */
7023 0, /* root_dir_fid */
7024 smb_fname_dst, /* fname */
7025 FILE_GENERIC_WRITE, /* access_mask */
7026 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7027 new_create_disposition, /* create_disposition*/
7028 0, /* create_options */
7029 dosattrs, /* file_attributes */
7030 INTERNAL_OPEN_ONLY, /* oplock_request */
7031 0, /* allocation_size */
7032 0, /* private_flags */
7033 NULL, /* sd */
7034 NULL, /* ea_list */
7035 &fsp2, /* result */
7036 NULL); /* psbuf */
7037
7038 if (!NT_STATUS_IS_OK(status)) {
7039 close_file(NULL, fsp1, ERROR_CLOSE);
7040 goto out;
7041 }
7042
7043 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7044 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7045 if (ret == -1) {
7046 DEBUG(0, ("error - vfs lseek returned error %s\n",
7047 strerror(errno)));
7048 status = map_nt_error_from_unix(errno);
7049 close_file(NULL, fsp1, ERROR_CLOSE);
7050 close_file(NULL, fsp2, ERROR_CLOSE);
7051 goto out;
7052 }
7053 }
7054
7055 /* Do the actual copy. */
7056 if (smb_fname_src->st.st_ex_size) {
7057 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7058 } else {
7059 ret = 0;
7060 }
7061
7062 close_file(NULL, fsp1, NORMAL_CLOSE);
7063
7064 /* Ensure the modtime is set correctly on the destination file. */
7065 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7066
7067 /*
7068 * As we are opening fsp1 read-only we only expect
7069 * an error on close on fsp2 if we are out of space.
7070 * Thus we don't look at the error return from the
7071 * close of fsp1.
7072 */
7073 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7074
7075 if (!NT_STATUS_IS_OK(status)) {
7076 goto out;
7077 }
7078
7079 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7080 status = NT_STATUS_DISK_FULL;
7081 goto out;
7082 }
7083
7084 status = NT_STATUS_OK;
7085
7086 out:
7087 TALLOC_FREE(smb_fname_dst_tmp);
7088 return status;
7089 }
7090
7091 /****************************************************************************
7092 Reply to a file copy.
7093 ****************************************************************************/
7094
7095 void reply_copy(struct smb_request *req)
7096 {
7097 connection_struct *conn = req->conn;
7098 struct smb_filename *smb_fname_src = NULL;
7099 struct smb_filename *smb_fname_dst = NULL;
7100 char *fname_src = NULL;
7101 char *fname_dst = NULL;
7102 char *fname_src_mask = NULL;
7103 char *fname_src_dir = NULL;
7104 const char *p;
7105 int count=0;
7106 int error = ERRnoaccess;
7107 int tid2;
7108 int ofun;
7109 int flags;
7110 bool target_is_directory=False;
7111 bool source_has_wild = False;
7112 bool dest_has_wild = False;
7113 NTSTATUS status;
7114 TALLOC_CTX *ctx = talloc_tos();
7115
7116 START_PROFILE(SMBcopy);
7117
7118 if (req->wct < 3) {
7119 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7120 goto out;
7121 }
7122
7123 tid2 = SVAL(req->vwv+0, 0);
7124 ofun = SVAL(req->vwv+1, 0);
7125 flags = SVAL(req->vwv+2, 0);
7126
7127 p = (const char *)req->buf;
7128 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7129 &status, &source_has_wild);
7130 if (!NT_STATUS_IS_OK(status)) {
7131 reply_nterror(req, status);
7132 goto out;
7133 }
7134 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7135 &status, &dest_has_wild);
7136 if (!NT_STATUS_IS_OK(status)) {
7137 reply_nterror(req, status);
7138 goto out;
7139 }
7140
7141 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7142
7143 if (tid2 != conn->cnum) {
7144 /* can't currently handle inter share copies XXXX */
7145 DEBUG(3,("Rejecting inter-share copy\n"));
7146 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7147 goto out;
7148 }
7149
7150 status = filename_convert(ctx, conn,
7151 req->flags2 & FLAGS2_DFS_PATHNAMES,
7152 fname_src,
7153 UCF_COND_ALLOW_WCARD_LCOMP,
7154 &source_has_wild,
7155 &smb_fname_src);
7156 if (!NT_STATUS_IS_OK(status)) {
7157 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7158 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7159 ERRSRV, ERRbadpath);
7160 goto out;
7161 }
7162 reply_nterror(req, status);
7163 goto out;
7164 }
7165
7166 status = filename_convert(ctx, conn,
7167 req->flags2 & FLAGS2_DFS_PATHNAMES,
7168 fname_dst,
7169 UCF_COND_ALLOW_WCARD_LCOMP,
7170 &dest_has_wild,
7171 &smb_fname_dst);
7172 if (!NT_STATUS_IS_OK(status)) {
7173 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7174 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7175 ERRSRV, ERRbadpath);
7176 goto out;
7177 }
7178 reply_nterror(req, status);
7179 goto out;
7180 }
7181
7182 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7183
7184 if ((flags&1) && target_is_directory) {
7185 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7186 goto out;
7187 }
7188
7189 if ((flags&2) && !target_is_directory) {
7190 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7191 goto out;
7192 }
7193
7194 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7195 /* wants a tree copy! XXXX */
7196 DEBUG(3,("Rejecting tree copy\n"));
7197 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7198 goto out;
7199 }
7200
7201 /* Split up the directory from the filename/mask. */
7202 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7203 &fname_src_dir, &fname_src_mask);
7204 if (!NT_STATUS_IS_OK(status)) {
7205 reply_nterror(req, NT_STATUS_NO_MEMORY);
7206 goto out;
7207 }
7208
7209 /*
7210 * We should only check the mangled cache
7211 * here if unix_convert failed. This means
7212 * that the path in 'mask' doesn't exist
7213 * on the file system and so we need to look
7214 * for a possible mangle. This patch from
7215 * Tine Smukavec <valentin.smukavec@hermes.si>.
7216 */
7217 if (!VALID_STAT(smb_fname_src->st) &&
7218 mangle_is_mangled(fname_src_mask, conn->params)) {
7219 char *new_mask = NULL;
7220 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7221 &new_mask, conn->params);
7222
7223 /* Use demangled name if one was successfully found. */
7224 if (new_mask) {
7225 TALLOC_FREE(fname_src_mask);
7226 fname_src_mask = new_mask;
7227 }
7228 }
7229
7230 if (!source_has_wild) {
7231
7232 /*
7233 * Only one file needs to be copied. Append the mask back onto
7234 * the directory.
7235 */
7236 TALLOC_FREE(smb_fname_src->base_name);
7237 if (ISDOT(fname_src_dir)) {
7238 /* Ensure we use canonical names on open. */
7239 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7240 "%s",
7241 fname_src_mask);
7242 } else {
7243 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7244 "%s/%s",
7245 fname_src_dir,
7246 fname_src_mask);
7247 }
7248 if (!smb_fname_src->base_name) {
7249 reply_nterror(req, NT_STATUS_NO_MEMORY);
7250 goto out;
7251 }
7252
7253 if (dest_has_wild) {
7254 char *fname_dst_mod = NULL;
7255 if (!resolve_wildcards(smb_fname_dst,
7256 smb_fname_src->base_name,
7257 smb_fname_dst->base_name,
7258 &fname_dst_mod)) {
7259 reply_nterror(req, NT_STATUS_NO_MEMORY);
7260 goto out;
7261 }
7262 TALLOC_FREE(smb_fname_dst->base_name);
7263 smb_fname_dst->base_name = fname_dst_mod;
7264 }
7265
7266 status = check_name(conn, smb_fname_src->base_name);
7267 if (!NT_STATUS_IS_OK(status)) {
7268 reply_nterror(req, status);
7269 goto out;
7270 }
7271
7272 status = check_name(conn, smb_fname_dst->base_name);
7273 if (!NT_STATUS_IS_OK(status)) {
7274 reply_nterror(req, status);
7275 goto out;
7276 }
7277
7278 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7279 ofun, count, target_is_directory);
7280
7281 if(!NT_STATUS_IS_OK(status)) {
7282 reply_nterror(req, status);
7283 goto out;
7284 } else {
7285 count++;
7286 }
7287 } else {
7288 struct smb_Dir *dir_hnd = NULL;
7289 const char *dname = NULL;
7290 char *talloced = NULL;
7291 long offset = 0;
7292
7293 /*
7294 * There is a wildcard that requires us to actually read the
7295 * src dir and copy each file matching the mask to the dst.
7296 * Right now streams won't be copied, but this could
7297 * presumably be added with a nested loop for reach dir entry.
7298 */
7299 SMB_ASSERT(!smb_fname_src->stream_name);
7300 SMB_ASSERT(!smb_fname_dst->stream_name);
7301
7302 smb_fname_src->stream_name = NULL;
7303 smb_fname_dst->stream_name = NULL;
7304
7305 if (strequal(fname_src_mask,"????????.???")) {
7306 TALLOC_FREE(fname_src_mask);
7307 fname_src_mask = talloc_strdup(ctx, "*");
7308 if (!fname_src_mask) {
7309 reply_nterror(req, NT_STATUS_NO_MEMORY);
7310 goto out;
7311 }
7312 }
7313
7314 status = check_name(conn, fname_src_dir);
7315 if (!NT_STATUS_IS_OK(status)) {
7316 reply_nterror(req, status);
7317 goto out;
7318 }
7319
7320 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7321 if (dir_hnd == NULL) {
7322 status = map_nt_error_from_unix(errno);
7323 reply_nterror(req, status);
7324 goto out;
7325 }
7326
7327 error = ERRbadfile;
7328
7329 /* Iterate over the src dir copying each entry to the dst. */
7330 while ((dname = ReadDirName(dir_hnd, &offset,
7331 &smb_fname_src->st, &talloced))) {
7332 char *destname = NULL;
7333
7334 if (ISDOT(dname) || ISDOTDOT(dname)) {
7335 TALLOC_FREE(talloced);
7336 continue;
7337 }
7338
7339 if (!is_visible_file(conn, fname_src_dir, dname,
7340 &smb_fname_src->st, false)) {
7341 TALLOC_FREE(talloced);
7342 continue;
7343 }
7344
7345 if(!mask_match(dname, fname_src_mask,
7346 conn->case_sensitive)) {
7347 TALLOC_FREE(talloced);
7348 continue;
7349 }
7350
7351 error = ERRnoaccess;
7352
7353 /* Get the src smb_fname struct setup. */
7354 TALLOC_FREE(smb_fname_src->base_name);
7355 if (ISDOT(fname_src_dir)) {
7356 /* Ensure we use canonical names on open. */
7357 smb_fname_src->base_name =
7358 talloc_asprintf(smb_fname_src, "%s",
7359 dname);
7360 } else {
7361 smb_fname_src->base_name =
7362 talloc_asprintf(smb_fname_src, "%s/%s",
7363 fname_src_dir, dname);
7364 }
7365
7366 if (!smb_fname_src->base_name) {
7367 TALLOC_FREE(dir_hnd);
7368 TALLOC_FREE(talloced);
7369 reply_nterror(req, NT_STATUS_NO_MEMORY);
7370 goto out;
7371 }
7372
7373 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7374 smb_fname_dst->base_name,
7375 &destname)) {
7376 TALLOC_FREE(talloced);
7377 continue;
7378 }
7379 if (!destname) {
7380 TALLOC_FREE(dir_hnd);
7381 TALLOC_FREE(talloced);
7382 reply_nterror(req, NT_STATUS_NO_MEMORY);
7383 goto out;
7384 }
7385
7386 TALLOC_FREE(smb_fname_dst->base_name);
7387 smb_fname_dst->base_name = destname;
7388
7389 status = check_name(conn, smb_fname_src->base_name);
7390 if (!NT_STATUS_IS_OK(status)) {
7391 TALLOC_FREE(dir_hnd);
7392 TALLOC_FREE(talloced);
7393 reply_nterror(req, status);
7394 goto out;
7395 }
7396
7397 status = check_name(conn, smb_fname_dst->base_name);
7398 if (!NT_STATUS_IS_OK(status)) {
7399 TALLOC_FREE(dir_hnd);
7400 TALLOC_FREE(talloced);
7401 reply_nterror(req, status);
7402 goto out;
7403 }
7404
7405 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7406 smb_fname_src->base_name,
7407 smb_fname_dst->base_name));
7408
7409 status = copy_file(ctx, conn, smb_fname_src,
7410 smb_fname_dst, ofun, count,
7411 target_is_directory);
7412 if (NT_STATUS_IS_OK(status)) {
7413 count++;
7414 }
7415
7416 TALLOC_FREE(talloced);
7417 }
7418 TALLOC_FREE(dir_hnd);
7419 }
7420
7421 if (count == 0) {
7422 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7423 goto out;
7424 }
7425
7426 reply_outbuf(req, 1, 0);
7427 SSVAL(req->outbuf,smb_vwv0,count);
7428 out:
7429 TALLOC_FREE(smb_fname_src);
7430 TALLOC_FREE(smb_fname_dst);
7431 TALLOC_FREE(fname_src);
7432 TALLOC_FREE(fname_dst);
7433 TALLOC_FREE(fname_src_mask);
7434 TALLOC_FREE(fname_src_dir);
7435
7436 END_PROFILE(SMBcopy);
7437 return;
7438 }
7439
7440 #undef DBGC_CLASS
7441 #define DBGC_CLASS DBGC_LOCKING
7442
7443 /****************************************************************************
7444 Get a lock pid, dealing with large count requests.
7445 ****************************************************************************/
7446
7447 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7448 bool large_file_format)
7449 {
7450 if(!large_file_format)
7451 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7452 else
7453 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7454 }
7455
7456 /****************************************************************************
7457 Get a lock count, dealing with large count requests.
7458 ****************************************************************************/
7459
7460 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7461 bool large_file_format)
7462 {
7463 uint64_t count = 0;
7464
7465 if(!large_file_format) {
7466 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7467 } else {
7468
7469 #if defined(HAVE_LONGLONG)
7470 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7471 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7472 #else /* HAVE_LONGLONG */
7473
7474 /*
7475 * NT4.x seems to be broken in that it sends large file (64 bit)
7476 * lockingX calls even if the CAP_LARGE_FILES was *not*
7477 * negotiated. For boxes without large unsigned ints truncate the
7478 * lock count by dropping the top 32 bits.
7479 */
7480
7481 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7482 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7483 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7484 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7485 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7486 }
7487
7488 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7489 #endif /* HAVE_LONGLONG */
7490 }
7491
7492 return count;
7493 }
7494
7495 #if !defined(HAVE_LONGLONG)
7496 /****************************************************************************
7497 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7498 ****************************************************************************/
7499
7500 static uint32 map_lock_offset(uint32 high, uint32 low)
7501 {
7502 unsigned int i;
7503 uint32 mask = 0;
7504 uint32 highcopy = high;
7505
7506 /*
7507 * Try and find out how many significant bits there are in high.
7508 */
7509
7510 for(i = 0; highcopy; i++)
7511 highcopy >>= 1;
7512
7513 /*
7514 * We use 31 bits not 32 here as POSIX
7515 * lock offsets may not be negative.
7516 */
7517
7518 mask = (~0) << (31 - i);
7519
7520 if(low & mask)
7521 return 0; /* Fail. */
7522
7523 high <<= (31 - i);
7524
7525 return (high|low);
7526 }
7527 #endif /* !defined(HAVE_LONGLONG) */
7528
7529 /****************************************************************************
7530 Get a lock offset, dealing with large offset requests.
7531 ****************************************************************************/
7532
7533 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7534 bool large_file_format, bool *err)
7535 {
7536 uint64_t offset = 0;
7537
7538 *err = False;
7539
7540 if(!large_file_format) {
7541 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7542 } else {
7543
7544 #if defined(HAVE_LONGLONG)
7545 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7546 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7547 #else /* HAVE_LONGLONG */
7548
7549 /*
7550 * NT4.x seems to be broken in that it sends large file (64 bit)
7551 * lockingX calls even if the CAP_LARGE_FILES was *not*
7552 * negotiated. For boxes without large unsigned ints mangle the
7553 * lock offset by mapping the top 32 bits onto the lower 32.
7554 */
7555
7556 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7557 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7558 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7559 uint32 new_low = 0;
7560
7561 if((new_low = map_lock_offset(high, low)) == 0) {
7562 *err = True;
7563 return (uint64_t)-1;
7564 }
7565
7566 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7567 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7568 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7569 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7570 }
7571
7572 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7573 #endif /* HAVE_LONGLONG */
7574 }
7575
7576 return offset;
7577 }
7578
7579 NTSTATUS smbd_do_locking(struct smb_request *req,
7580 files_struct *fsp,
7581 uint8_t type,
7582 int32_t timeout,
7583 uint16_t num_ulocks,
7584 struct smbd_lock_element *ulocks,
7585 uint16_t num_locks,
7586 struct smbd_lock_element *locks,
7587 bool *async)
7588 {
7589 connection_struct *conn = req->conn;
7590 int i;
7591 NTSTATUS status = NT_STATUS_OK;
7592
7593 *async = false;
7594
7595 /* Data now points at the beginning of the list
7596 of smb_unlkrng structs */
7597 for(i = 0; i < (int)num_ulocks; i++) {
7598 struct smbd_lock_element *e = &ulocks[i];
7599
7600 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7601 "pid %u, file %s\n",
7602 (double)e->offset,
7603 (double)e->count,
7604 (unsigned int)e->smblctx,
7605 fsp_str_dbg(fsp)));
7606
7607 if (e->brltype != UNLOCK_LOCK) {
7608 /* this can only happen with SMB2 */
7609 return NT_STATUS_INVALID_PARAMETER;
7610 }
7611
7612 status = do_unlock(req->sconn->msg_ctx,
7613 fsp,
7614 e->smblctx,
7615 e->count,
7616 e->offset,
7617 WINDOWS_LOCK);
7618
7619 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7620 nt_errstr(status)));
7621
7622 if (!NT_STATUS_IS_OK(status)) {
7623 return status;
7624 }
7625 }
7626
7627 /* Setup the timeout in seconds. */
7628
7629 if (!lp_blocking_locks(SNUM(conn))) {
7630 timeout = 0;
7631 }
7632
7633 /* Data now points at the beginning of the list
7634 of smb_lkrng structs */
7635
7636 for(i = 0; i < (int)num_locks; i++) {
7637 struct smbd_lock_element *e = &locks[i];
7638
7639 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7640 "%llu, file %s timeout = %d\n",
7641 (double)e->offset,
7642 (double)e->count,
7643 (unsigned long long)e->smblctx,
7644 fsp_str_dbg(fsp),
7645 (int)timeout));
7646
7647 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7648 struct blocking_lock_record *blr = NULL;
7649
7650 if (num_locks > 1) {
7651 /*
7652 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7653 * if the lock vector contains one entry. When given mutliple cancel
7654 * requests in a single PDU we expect the server to return an
7655 * error. Windows servers seem to accept the request but only
7656 * cancel the first lock.
7657 * JRA - Do what Windows does (tm) :-).
7658 */
7659
7660 #if 0
7661 /* MS-CIFS (2.2.4.32.1) behavior. */
7662 return NT_STATUS_DOS(ERRDOS,
7663 ERRcancelviolation);
7664 #else
7665 /* Windows behavior. */
7666 if (i != 0) {
7667 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7668 "cancel request\n"));
7669 continue;
7670 }
7671 #endif
7672 }
7673
7674 if (lp_blocking_locks(SNUM(conn))) {
7675
7676 /* Schedule a message to ourselves to
7677 remove the blocking lock record and
7678 return the right error. */
7679
7680 blr = blocking_lock_cancel_smb1(fsp,
7681 e->smblctx,
7682 e->offset,
7683 e->count,
7684 WINDOWS_LOCK,
7685 type,
7686 NT_STATUS_FILE_LOCK_CONFLICT);
7687 if (blr == NULL) {
7688 return NT_STATUS_DOS(
7689 ERRDOS,
7690 ERRcancelviolation);
7691 }
7692 }
7693 /* Remove a matching pending lock. */
7694 status = do_lock_cancel(fsp,
7695 e->smblctx,
7696 e->count,
7697 e->offset,
7698 WINDOWS_LOCK,
7699 blr);
7700 } else {
7701 bool blocking_lock = timeout ? true : false;
7702 bool defer_lock = false;
7703 struct byte_range_lock *br_lck;
7704 uint64_t block_smblctx;
7705
7706 br_lck = do_lock(req->sconn->msg_ctx,
7707 fsp,
7708 e->smblctx,
7709 e->count,
7710 e->offset,
7711 e->brltype,
7712 WINDOWS_LOCK,
7713 blocking_lock,
7714 &status,
7715 &block_smblctx,
7716 NULL);
7717
7718 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7719 /* Windows internal resolution for blocking locks seems
7720 to be about 200ms... Don't wait for less than that. JRA. */
7721 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7722 timeout = lp_lock_spin_time();
7723 }
7724 defer_lock = true;
7725 }
7726
7727 /* If a lock sent with timeout of zero would fail, and
7728 * this lock has been requested multiple times,
7729 * according to brl_lock_failed() we convert this
7730 * request to a blocking lock with a timeout of between
7731 * 150 - 300 milliseconds.
7732 *
7733 * If lp_lock_spin_time() has been set to 0, we skip
7734 * this blocking retry and fail immediately.
7735 *
7736 * Replacement for do_lock_spin(). JRA. */
7737
7738 if (!req->sconn->using_smb2 &&
7739 br_lck && lp_blocking_locks(SNUM(conn)) &&
7740 lp_lock_spin_time() && !blocking_lock &&
7741 NT_STATUS_EQUAL((status),
7742 NT_STATUS_FILE_LOCK_CONFLICT))
7743 {
7744 defer_lock = true;
7745 timeout = lp_lock_spin_time();
7746 }
7747
7748 if (br_lck && defer_lock) {
7749 /*
7750 * A blocking lock was requested. Package up
7751 * this smb into a queued request and push it
7752 * onto the blocking lock queue.
7753 */
7754 if(push_blocking_lock_request(br_lck,
7755 req,
7756 fsp,
7757 timeout,
7758 i,
7759 e->smblctx,
7760 e->brltype,
7761 WINDOWS_LOCK,
7762 e->offset,
7763 e->count,
7764 block_smblctx)) {
7765 TALLOC_FREE(br_lck);
7766 *async = true;
7767 return NT_STATUS_OK;
7768 }
7769 }
7770
7771 TALLOC_FREE(br_lck);
7772 }
7773
7774 if (!NT_STATUS_IS_OK(status)) {
7775 break;
7776 }
7777 }
7778
7779 /* If any of the above locks failed, then we must unlock
7780 all of the previous locks (X/Open spec). */
7781
7782 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7783
7784 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7785 i = -1; /* we want to skip the for loop */
7786 }
7787
7788 /*
7789 * Ensure we don't do a remove on the lock that just failed,
7790 * as under POSIX rules, if we have a lock already there, we
7791 * will delete it (and we shouldn't) .....
7792 */
7793 for(i--; i >= 0; i--) {
7794 struct smbd_lock_element *e = &locks[i];
7795
7796 do_unlock(req->sconn->msg_ctx,
7797 fsp,
7798 e->smblctx,
7799 e->count,
7800 e->offset,
7801 WINDOWS_LOCK);
7802 }
7803 return status;
7804 }
7805
7806 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7807 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7808
7809 return NT_STATUS_OK;
7810 }
7811
7812 /****************************************************************************
7813 Reply to a lockingX request.
7814 ****************************************************************************/
7815
7816 void reply_lockingX(struct smb_request *req)
7817 {
7818 connection_struct *conn = req->conn;
7819 files_struct *fsp;
7820 unsigned char locktype;
7821 unsigned char oplocklevel;
7822 uint16 num_ulocks;
7823 uint16 num_locks;
7824 int32 lock_timeout;
7825 int i;
7826 const uint8_t *data;
7827 bool large_file_format;
7828 bool err;
7829 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7830 struct smbd_lock_element *ulocks;
7831 struct smbd_lock_element *locks;
7832 bool async = false;
7833
7834 START_PROFILE(SMBlockingX);
7835
7836 if (req->wct < 8) {
7837 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7838 END_PROFILE(SMBlockingX);
7839 return;
7840 }
7841
7842 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7843 locktype = CVAL(req->vwv+3, 0);
7844 oplocklevel = CVAL(req->vwv+3, 1);
7845 num_ulocks = SVAL(req->vwv+6, 0);
7846 num_locks = SVAL(req->vwv+7, 0);
7847 lock_timeout = IVAL(req->vwv+4, 0);
7848 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7849
7850 if (!check_fsp(conn, req, fsp)) {
7851 END_PROFILE(SMBlockingX);
7852 return;
7853 }
7854
7855 data = req->buf;
7856
7857 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7858 /* we don't support these - and CANCEL_LOCK makes w2k
7859 and XP reboot so I don't really want to be
7860 compatible! (tridge) */
7861 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7862 END_PROFILE(SMBlockingX);
7863 return;
7864 }
7865
7866 /* Check if this is an oplock break on a file
7867 we have granted an oplock on.
7868 */
7869 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7870 /* Client can insist on breaking to none. */
7871 bool break_to_none = (oplocklevel == 0);
7872 bool result;
7873
7874 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7875 "for %s\n", (unsigned int)oplocklevel,
7876 fsp_fnum_dbg(fsp)));
7877
7878 /*
7879 * Make sure we have granted an exclusive or batch oplock on
7880 * this file.
7881 */
7882
7883 if (fsp->oplock_type == 0) {
7884
7885 /* The Samba4 nbench simulator doesn't understand
7886 the difference between break to level2 and break
7887 to none from level2 - it sends oplock break
7888 replies in both cases. Don't keep logging an error
7889 message here - just ignore it. JRA. */
7890
7891 DEBUG(5,("reply_lockingX: Error : oplock break from "
7892 "client for %s (oplock=%d) and no "
7893 "oplock granted on this file (%s).\n",
7894 fsp_fnum_dbg(fsp), fsp->oplock_type,
7895 fsp_str_dbg(fsp)));
7896
7897 /* if this is a pure oplock break request then don't
7898 * send a reply */
7899 if (num_locks == 0 && num_ulocks == 0) {
7900 END_PROFILE(SMBlockingX);
7901 return;
7902 } else {
7903 END_PROFILE(SMBlockingX);
7904 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7905 return;
7906 }
7907 }
7908
7909 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7910 (break_to_none)) {
7911 result = remove_oplock(fsp);
7912 } else {
7913 result = downgrade_oplock(fsp);
7914 }
7915
7916 if (!result) {
7917 DEBUG(0, ("reply_lockingX: error in removing "
7918 "oplock on file %s\n", fsp_str_dbg(fsp)));
7919 /* Hmmm. Is this panic justified? */
7920 smb_panic("internal tdb error");
7921 }
7922
7923 reply_to_oplock_break_requests(fsp);
7924
7925 /* if this is a pure oplock break request then don't send a
7926 * reply */
7927 if (num_locks == 0 && num_ulocks == 0) {
7928 /* Sanity check - ensure a pure oplock break is not a
7929 chained request. */
7930 if(CVAL(req->vwv+0, 0) != 0xff)
7931 DEBUG(0,("reply_lockingX: Error : pure oplock "
7932 "break is a chained %d request !\n",
7933 (unsigned int)CVAL(req->vwv+0, 0)));
7934 END_PROFILE(SMBlockingX);
7935 return;
7936 }
7937 }
7938
7939 if (req->buflen <
7940 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7941 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7942 END_PROFILE(SMBlockingX);
7943 return;
7944 }
7945
7946 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7947 if (ulocks == NULL) {
7948 reply_nterror(req, NT_STATUS_NO_MEMORY);
7949 END_PROFILE(SMBlockingX);
7950 return;
7951 }
7952
7953 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7954 if (locks == NULL) {
7955 reply_nterror(req, NT_STATUS_NO_MEMORY);
7956 END_PROFILE(SMBlockingX);
7957 return;
7958 }
7959
7960 /* Data now points at the beginning of the list
7961 of smb_unlkrng structs */
7962 for(i = 0; i < (int)num_ulocks; i++) {
7963 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7964 ulocks[i].count = get_lock_count(data, i, large_file_format);
7965 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7966 ulocks[i].brltype = UNLOCK_LOCK;
7967
7968 /*
7969 * There is no error code marked "stupid client bug".... :-).
7970 */
7971 if(err) {
7972 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7973 END_PROFILE(SMBlockingX);
7974 return;
7975 }
7976 }
7977
7978 /* Now do any requested locks */
7979 data += ((large_file_format ? 20 : 10)*num_ulocks);
7980
7981 /* Data now points at the beginning of the list
7982 of smb_lkrng structs */
7983
7984 for(i = 0; i < (int)num_locks; i++) {
7985 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7986 locks[i].count = get_lock_count(data, i, large_file_format);
7987 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7988
7989 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7990 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7991 locks[i].brltype = PENDING_READ_LOCK;
7992 } else {
7993 locks[i].brltype = READ_LOCK;
7994 }
7995 } else {
7996 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7997 locks[i].brltype = PENDING_WRITE_LOCK;
7998 } else {
7999 locks[i].brltype = WRITE_LOCK;
8000 }
8001 }
8002
8003 /*
8004 * There is no error code marked "stupid client bug".... :-).
8005 */
8006 if(err) {
8007 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8008 END_PROFILE(SMBlockingX);
8009 return;
8010 }
8011 }
8012
8013 status = smbd_do_locking(req, fsp,
8014 locktype, lock_timeout,
8015 num_ulocks, ulocks,
8016 num_locks, locks,
8017 &async);
8018 if (!NT_STATUS_IS_OK(status)) {
8019 END_PROFILE(SMBlockingX);
8020 reply_nterror(req, status);
8021 return;
8022 }
8023 if (async) {
8024 END_PROFILE(SMBlockingX);
8025 return;
8026 }
8027
8028 reply_outbuf(req, 2, 0);
8029 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8030 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8031
8032 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8033 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8034
8035 END_PROFILE(SMBlockingX);
8036 }
8037
8038 #undef DBGC_CLASS
8039 #define DBGC_CLASS DBGC_ALL
8040
8041 /****************************************************************************
8042 Reply to a SMBreadbmpx (read block multiplex) request.
8043 Always reply with an error, if someone has a platform really needs this,
8044 please contact vl@samba.org
8045 ****************************************************************************/
8046
8047 void reply_readbmpx(struct smb_request *req)
8048 {
8049 START_PROFILE(SMBreadBmpx);
8050 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8051 END_PROFILE(SMBreadBmpx);
8052 return;
8053 }
8054
8055 /****************************************************************************
8056 Reply to a SMBreadbs (read block multiplex secondary) request.
8057 Always reply with an error, if someone has a platform really needs this,
8058 please contact vl@samba.org
8059 ****************************************************************************/
8060
8061 void reply_readbs(struct smb_request *req)
8062 {
8063 START_PROFILE(SMBreadBs);
8064 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8065 END_PROFILE(SMBreadBs);
8066 return;
8067 }
8068
8069 /****************************************************************************
8070 Reply to a SMBsetattrE.
8071 ****************************************************************************/
8072
8073 void reply_setattrE(struct smb_request *req)
8074 {
8075 connection_struct *conn = req->conn;
8076 struct smb_file_time ft;
8077 files_struct *fsp;
8078 NTSTATUS status;
8079
8080 START_PROFILE(SMBsetattrE);
8081 ZERO_STRUCT(ft);
8082
8083 if (req->wct < 7) {
8084 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8085 goto out;
8086 }
8087
8088 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8089
8090 if(!fsp || (fsp->conn != conn)) {
8091 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8092 goto out;
8093 }
8094
8095 /*
8096 * Convert the DOS times into unix times.
8097 */
8098
8099 ft.atime = convert_time_t_to_timespec(
8100 srv_make_unix_date2(req->vwv+3));
8101 ft.mtime = convert_time_t_to_timespec(
8102 srv_make_unix_date2(req->vwv+5));
8103 ft.create_time = convert_time_t_to_timespec(
8104 srv_make_unix_date2(req->vwv+1));
8105
8106 reply_outbuf(req, 0, 0);
8107
8108 /*
8109 * Patch from Ray Frush <frush@engr.colostate.edu>
8110 * Sometimes times are sent as zero - ignore them.
8111 */
8112
8113 /* Ensure we have a valid stat struct for the source. */
8114 status = vfs_stat_fsp(fsp);
8115 if (!NT_STATUS_IS_OK(status)) {
8116 reply_nterror(req, status);
8117 goto out;
8118 }
8119
8120 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8121 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8122 goto out;
8123 }
8124
8125 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8126 if (!NT_STATUS_IS_OK(status)) {
8127 reply_nterror(req, status);
8128 goto out;
8129 }
8130
8131 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8132 " createtime=%u\n",
8133 fsp_fnum_dbg(fsp),
8134 (unsigned int)ft.atime.tv_sec,
8135 (unsigned int)ft.mtime.tv_sec,
8136 (unsigned int)ft.create_time.tv_sec
8137 ));
8138 out:
8139 END_PROFILE(SMBsetattrE);
8140 return;
8141 }
8142
8143
8144 /* Back from the dead for OS/2..... JRA. */
8145
8146 /****************************************************************************
8147 Reply to a SMBwritebmpx (write block multiplex primary) request.
8148 Always reply with an error, if someone has a platform really needs this,
8149 please contact vl@samba.org
8150 ****************************************************************************/
8151
8152 void reply_writebmpx(struct smb_request *req)
8153 {
8154 START_PROFILE(SMBwriteBmpx);
8155 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8156 END_PROFILE(SMBwriteBmpx);
8157 return;
8158 }
8159
8160 /****************************************************************************
8161 Reply to a SMBwritebs (write block multiplex secondary) request.
8162 Always reply with an error, if someone has a platform really needs this,
8163 please contact vl@samba.org
8164 ****************************************************************************/
8165
8166 void reply_writebs(struct smb_request *req)
8167 {
8168 START_PROFILE(SMBwriteBs);
8169 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8170 END_PROFILE(SMBwriteBs);
8171 return;
8172 }
8173
8174 /****************************************************************************
8175 Reply to a SMBgetattrE.
8176 ****************************************************************************/
8177
8178 void reply_getattrE(struct smb_request *req)
8179 {
8180 connection_struct *conn = req->conn;
8181 int mode;
8182 files_struct *fsp;
8183 struct timespec create_ts;
8184
8185 START_PROFILE(SMBgetattrE);
8186
8187 if (req->wct < 1) {
8188 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8189 END_PROFILE(SMBgetattrE);
8190 return;
8191 }
8192
8193 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8194
8195 if(!fsp || (fsp->conn != conn)) {
8196 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8197 END_PROFILE(SMBgetattrE);
8198 return;
8199 }
8200
8201 /* Do an fstat on this file */
8202 if(fsp_stat(fsp)) {
8203 reply_nterror(req, map_nt_error_from_unix(errno));
8204 END_PROFILE(SMBgetattrE);
8205 return;
8206 }
8207
8208 mode = dos_mode(conn, fsp->fsp_name);
8209
8210 /*
8211 * Convert the times into dos times. Set create
8212 * date to be last modify date as UNIX doesn't save
8213 * this.
8214 */
8215
8216 reply_outbuf(req, 11, 0);
8217
8218 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8219 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8220 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8221 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8222 /* Should we check pending modtime here ? JRA */
8223 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8224 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8225
8226 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8227 SIVAL(req->outbuf, smb_vwv6, 0);
8228 SIVAL(req->outbuf, smb_vwv8, 0);
8229 } else {
8230 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8231 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8232 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8233 }
8234 SSVAL(req->outbuf,smb_vwv10, mode);
8235
8236 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8237
8238 END_PROFILE(SMBgetattrE);
8239 return;
8240 }
reg import