?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:include: change smb_request->vuid to uint64_t
[Samba/gebeck_regimport.git] / source3 / smbd / reply.c
blob2ea41b4c41da9b5266f67b51d9f50d0e78bdd498
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44
45 /****************************************************************************
46 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
47 path or anything including wildcards.
48 We're assuming here that '/' is not the second byte in any multibyte char
49 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
50 set.
51 ****************************************************************************/
52
53 /* Custom version for processing POSIX paths. */
54 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
55
56 static NTSTATUS check_path_syntax_internal(char *path,
57 bool posix_path,
58 bool *p_last_component_contains_wcard)
59 {
60 char *d = path;
61 const char *s = path;
62 NTSTATUS ret = NT_STATUS_OK;
63 bool start_of_name_component = True;
64 bool stream_started = false;
65
66 *p_last_component_contains_wcard = False;
67
68 while (*s) {
69 if (stream_started) {
70 switch (*s) {
71 case '/':
72 case '\\':
73 return NT_STATUS_OBJECT_NAME_INVALID;
74 case ':':
75 if (s[1] == '\0') {
76 return NT_STATUS_OBJECT_NAME_INVALID;
77 }
78 if (strchr_m(&s[1], ':')) {
79 return NT_STATUS_OBJECT_NAME_INVALID;
80 }
81 break;
82 }
83 }
84
85 if ((*s == ':') && !posix_path && !stream_started) {
86 if (*p_last_component_contains_wcard) {
87 return NT_STATUS_OBJECT_NAME_INVALID;
88 }
89 /* Stream names allow more characters than file names.
90 We're overloading posix_path here to allow a wider
91 range of characters. If stream_started is true this
92 is still a Windows path even if posix_path is true.
93 JRA.
94 */
95 stream_started = true;
96 start_of_name_component = false;
97 posix_path = true;
98
99 if (s[1] == '\0') {
100 return NT_STATUS_OBJECT_NAME_INVALID;
101 }
102 }
103
104 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
105 /*
106 * Safe to assume is not the second part of a mb char
107 * as this is handled below.
108 */
109 /* Eat multiple '/' or '\\' */
110 while (IS_PATH_SEP(*s,posix_path)) {
111 s++;
112 }
113 if ((d != path) && (*s != '\0')) {
114 /* We only care about non-leading or trailing '/' or '\\' */
115 *d++ = '/';
116 }
117
118 start_of_name_component = True;
119 /* New component. */
120 *p_last_component_contains_wcard = False;
121 continue;
122 }
123
124 if (start_of_name_component) {
125 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
126 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
127
128 /*
129 * No mb char starts with '.' so we're safe checking the directory separator here.
130 */
131
132 /* If we just added a '/' - delete it */
133 if ((d > path) && (*(d-1) == '/')) {
134 *(d-1) = '\0';
135 d--;
136 }
137
138 /* Are we at the start ? Can't go back further if so. */
139 if (d <= path) {
140 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
141 break;
142 }
143 /* Go back one level... */
144 /* We know this is safe as '/' cannot be part of a mb sequence. */
145 /* NOTE - if this assumption is invalid we are not in good shape... */
146 /* Decrement d first as d points to the *next* char to write into. */
147 for (d--; d > path; d--) {
148 if (*d == '/')
149 break;
150 }
151 s += 2; /* Else go past the .. */
152 /* We're still at the start of a name component, just the previous one. */
153 continue;
154
155 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
156 if (posix_path) {
157 /* Eat the '.' */
158 s++;
159 continue;
160 }
161 }
162
163 }
164
165 if (!(*s & 0x80)) {
166 if (!posix_path) {
167 if (*s <= 0x1f || *s == '|') {
168 return NT_STATUS_OBJECT_NAME_INVALID;
169 }
170 switch (*s) {
171 case '*':
172 case '?':
173 case '<':
174 case '>':
175 case '"':
176 *p_last_component_contains_wcard = True;
177 break;
178 default:
179 break;
180 }
181 }
182 *d++ = *s++;
183 } else {
184 size_t siz;
185 /* Get the size of the next MB character. */
186 next_codepoint(s,&siz);
187 switch(siz) {
188 case 5:
189 *d++ = *s++;
190 /*fall through*/
191 case 4:
192 *d++ = *s++;
193 /*fall through*/
194 case 3:
195 *d++ = *s++;
196 /*fall through*/
197 case 2:
198 *d++ = *s++;
199 /*fall through*/
200 case 1:
201 *d++ = *s++;
202 break;
203 default:
204 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
205 *d = '\0';
206 return NT_STATUS_INVALID_PARAMETER;
207 }
208 }
209 start_of_name_component = False;
210 }
211
212 *d = '\0';
213
214 return ret;
215 }
216
217 /****************************************************************************
218 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
219 No wildcards allowed.
220 ****************************************************************************/
221
222 NTSTATUS check_path_syntax(char *path)
223 {
224 bool ignore;
225 return check_path_syntax_internal(path, False, &ignore);
226 }
227
228 /****************************************************************************
229 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
230 Wildcards allowed - p_contains_wcard returns true if the last component contained
231 a wildcard.
232 ****************************************************************************/
233
234 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
235 {
236 return check_path_syntax_internal(path, False, p_contains_wcard);
237 }
238
239 /****************************************************************************
240 Check the path for a POSIX client.
241 We're assuming here that '/' is not the second byte in any multibyte char
242 set (a safe assumption).
243 ****************************************************************************/
244
245 NTSTATUS check_path_syntax_posix(char *path)
246 {
247 bool ignore;
248 return check_path_syntax_internal(path, True, &ignore);
249 }
250
251 /****************************************************************************
252 Pull a string and check the path allowing a wilcard - provide for error return.
253 ****************************************************************************/
254
255 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
256 const char *base_ptr,
257 uint16 smb_flags2,
258 char **pp_dest,
259 const char *src,
260 size_t src_len,
261 int flags,
262 NTSTATUS *err,
263 bool *contains_wcard)
264 {
265 size_t ret;
266
267 *pp_dest = NULL;
268
269 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
270 src_len, flags);
271
272 if (!*pp_dest) {
273 *err = NT_STATUS_INVALID_PARAMETER;
274 return ret;
275 }
276
277 *contains_wcard = False;
278
279 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
280 /*
281 * For a DFS path the function parse_dfs_path()
282 * will do the path processing, just make a copy.
283 */
284 *err = NT_STATUS_OK;
285 return ret;
286 }
287
288 if (lp_posix_pathnames()) {
289 *err = check_path_syntax_posix(*pp_dest);
290 } else {
291 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
292 }
293
294 return ret;
295 }
296
297 /****************************************************************************
298 Pull a string and check the path - provide for error return.
299 ****************************************************************************/
300
301 size_t srvstr_get_path(TALLOC_CTX *ctx,
302 const char *base_ptr,
303 uint16 smb_flags2,
304 char **pp_dest,
305 const char *src,
306 size_t src_len,
307 int flags,
308 NTSTATUS *err)
309 {
310 bool ignore;
311 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
312 src_len, flags, err, &ignore);
313 }
314
315 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
316 char **pp_dest, const char *src, int flags,
317 NTSTATUS *err, bool *contains_wcard)
318 {
319 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
320 pp_dest, src, smbreq_bufrem(req, src),
321 flags, err, contains_wcard);
322 }
323
324 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
325 char **pp_dest, const char *src, int flags,
326 NTSTATUS *err)
327 {
328 bool ignore;
329 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
330 flags, err, &ignore);
331 }
332
333 /****************************************************************************
334 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
335 ****************************************************************************/
336
337 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
338 files_struct *fsp)
339 {
340 if ((fsp == NULL) || (conn == NULL)) {
341 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
342 return False;
343 }
344 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
345 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
346 return False;
347 }
348 return True;
349 }
350
351 /****************************************************************************
352 Check if we have a correct fsp pointing to a file.
353 ****************************************************************************/
354
355 bool check_fsp(connection_struct *conn, struct smb_request *req,
356 files_struct *fsp)
357 {
358 if (!check_fsp_open(conn, req, fsp)) {
359 return False;
360 }
361 if (fsp->is_directory) {
362 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
363 return False;
364 }
365 if (fsp->fh->fd == -1) {
366 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
367 return False;
368 }
369 fsp->num_smb_operations++;
370 return True;
371 }
372
373 /****************************************************************************
374 Check if we have a correct fsp pointing to a quota fake file. Replacement for
375 the CHECK_NTQUOTA_HANDLE_OK macro.
376 ****************************************************************************/
377
378 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
379 files_struct *fsp)
380 {
381 if (!check_fsp_open(conn, req, fsp)) {
382 return false;
383 }
384
385 if (fsp->is_directory) {
386 return false;
387 }
388
389 if (fsp->fake_file_handle == NULL) {
390 return false;
391 }
392
393 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
394 return false;
395 }
396
397 if (fsp->fake_file_handle->private_data == NULL) {
398 return false;
399 }
400
401 return true;
402 }
403
404 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
405 const char *name, int name_type)
406 {
407 char *trim_name;
408 char *trim_name_type;
409 const char *retarget_parm;
410 char *retarget;
411 char *p;
412 int retarget_type = 0x20;
413 int retarget_port = NBT_SMB_PORT;
414 struct sockaddr_storage retarget_addr;
415 struct sockaddr_in *in_addr;
416 bool ret = false;
417 uint8_t outbuf[10];
418
419 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
420 return false;
421 }
422
423 trim_name = talloc_strdup(talloc_tos(), name);
424 if (trim_name == NULL) {
425 goto fail;
426 }
427 trim_char(trim_name, ' ', ' ');
428
429 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
430 name_type);
431 if (trim_name_type == NULL) {
432 goto fail;
433 }
434
435 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
436 trim_name_type, NULL);
437 if (retarget_parm == NULL) {
438 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
439 trim_name, NULL);
440 }
441 if (retarget_parm == NULL) {
442 goto fail;
443 }
444
445 retarget = talloc_strdup(trim_name, retarget_parm);
446 if (retarget == NULL) {
447 goto fail;
448 }
449
450 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
451
452 p = strchr(retarget, ':');
453 if (p != NULL) {
454 *p++ = '\0';
455 retarget_port = atoi(p);
456 }
457
458 p = strchr_m(retarget, '#');
459 if (p != NULL) {
460 *p++ = '\0';
461 if (sscanf(p, "%x", &retarget_type) != 1) {
462 goto fail;
463 }
464 }
465
466 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
467 if (!ret) {
468 DEBUG(10, ("could not resolve %s\n", retarget));
469 goto fail;
470 }
471
472 if (retarget_addr.ss_family != AF_INET) {
473 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
474 goto fail;
475 }
476
477 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
478
479 _smb_setlen(outbuf, 6);
480 SCVAL(outbuf, 0, 0x84);
481 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
482 *(uint16_t *)(outbuf+8) = htons(retarget_port);
483
484 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
485 NULL)) {
486 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
487 "failed.");
488 }
489
490 ret = true;
491 fail:
492 TALLOC_FREE(trim_name);
493 return ret;
494 }
495
496 static void reply_called_name_not_present(char *outbuf)
497 {
498 smb_setlen(outbuf, 1);
499 SCVAL(outbuf, 0, 0x83);
500 SCVAL(outbuf, 4, 0x82);
501 }
502
503 /****************************************************************************
504 Reply to a (netbios-level) special message.
505 ****************************************************************************/
506
507 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
508 {
509 int msg_type = CVAL(inbuf,0);
510 int msg_flags = CVAL(inbuf,1);
511 /*
512 * We only really use 4 bytes of the outbuf, but for the smb_setlen
513 * calculation & friends (srv_send_smb uses that) we need the full smb
514 * header.
515 */
516 char outbuf[smb_size];
517
518 memset(outbuf, '\0', sizeof(outbuf));
519
520 smb_setlen(outbuf,0);
521
522 switch (msg_type) {
523 case NBSSrequest: /* session request */
524 {
525 /* inbuf_size is guarenteed to be at least 4. */
526 fstring name1,name2;
527 int name_type1, name_type2;
528 int name_len1, name_len2;
529
530 *name1 = *name2 = 0;
531
532 if (sconn->nbt.got_session) {
533 exit_server_cleanly("multiple session request not permitted");
534 }
535
536 SCVAL(outbuf,0,NBSSpositive);
537 SCVAL(outbuf,3,0);
538
539 /* inbuf_size is guaranteed to be at least 4. */
540 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
541 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
542 DEBUG(0,("Invalid name length in session request\n"));
543 reply_called_name_not_present(outbuf);
544 break;
545 }
546 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
547 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
548 DEBUG(0,("Invalid name length in session request\n"));
549 reply_called_name_not_present(outbuf);
550 break;
551 }
552
553 name_type1 = name_extract((unsigned char *)inbuf,
554 inbuf_size,(unsigned int)4,name1);
555 name_type2 = name_extract((unsigned char *)inbuf,
556 inbuf_size,(unsigned int)(4 + name_len1),name2);
557
558 if (name_type1 == -1 || name_type2 == -1) {
559 DEBUG(0,("Invalid name type in session request\n"));
560 reply_called_name_not_present(outbuf);
561 break;
562 }
563
564 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
565 name1, name_type1, name2, name_type2));
566
567 if (netbios_session_retarget(sconn, name1, name_type1)) {
568 exit_server_cleanly("retargeted client");
569 }
570
571 /*
572 * Windows NT/2k uses "*SMBSERVER" and XP uses
573 * "*SMBSERV" arrggg!!!
574 */
575 if (strequal(name1, "*SMBSERVER ")
576 || strequal(name1, "*SMBSERV ")) {
577 char *raddr;
578
579 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
580 talloc_tos());
581 if (raddr == NULL) {
582 exit_server_cleanly("could not allocate raddr");
583 }
584
585 fstrcpy(name1, raddr);
586 }
587
588 set_local_machine_name(name1, True);
589 set_remote_machine_name(name2, True);
590
591 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
592 get_local_machine_name(), get_remote_machine_name(),
593 name_type2));
594
595 if (name_type2 == 'R') {
596 /* We are being asked for a pathworks session ---
597 no thanks! */
598 reply_called_name_not_present(outbuf);
599 break;
600 }
601
602 reload_services(sconn, conn_snum_used, true);
603 reopen_logs();
604
605 sconn->nbt.got_session = true;
606 break;
607 }
608
609 case 0x89: /* session keepalive request
610 (some old clients produce this?) */
611 SCVAL(outbuf,0,NBSSkeepalive);
612 SCVAL(outbuf,3,0);
613 break;
614
615 case NBSSpositive: /* positive session response */
616 case NBSSnegative: /* negative session response */
617 case NBSSretarget: /* retarget session response */
618 DEBUG(0,("Unexpected session response\n"));
619 break;
620
621 case NBSSkeepalive: /* session keepalive */
622 default:
623 return;
624 }
625
626 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
627 msg_type, msg_flags));
628
629 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
630
631 if (CVAL(outbuf, 0) != 0x82) {
632 exit_server_cleanly("invalid netbios session");
633 }
634 return;
635 }
636
637 /****************************************************************************
638 Reply to a tcon.
639 conn POINTER CAN BE NULL HERE !
640 ****************************************************************************/
641
642 void reply_tcon(struct smb_request *req)
643 {
644 connection_struct *conn = req->conn;
645 const char *service;
646 char *service_buf = NULL;
647 char *password = NULL;
648 char *dev = NULL;
649 int pwlen=0;
650 NTSTATUS nt_status;
651 const char *p;
652 TALLOC_CTX *ctx = talloc_tos();
653 struct smbd_server_connection *sconn = req->sconn;
654
655 START_PROFILE(SMBtcon);
656
657 if (req->buflen < 4) {
658 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
659 END_PROFILE(SMBtcon);
660 return;
661 }
662
663 p = (const char *)req->buf + 1;
664 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
665 p += 1;
666 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
667 p += pwlen+1;
668 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
669 p += 1;
670
671 if (service_buf == NULL || password == NULL || dev == NULL) {
672 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
673 END_PROFILE(SMBtcon);
674 return;
675 }
676 p = strrchr_m(service_buf,'\\');
677 if (p) {
678 service = p+1;
679 } else {
680 service = service_buf;
681 }
682
683 conn = make_connection(sconn,service,dev,
684 req->vuid,&nt_status);
685 req->conn = conn;
686
687 if (!conn) {
688 reply_nterror(req, nt_status);
689 END_PROFILE(SMBtcon);
690 return;
691 }
692
693 reply_outbuf(req, 2, 0);
694 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
695 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
696 SSVAL(req->outbuf,smb_tid,conn->cnum);
697
698 DEBUG(3,("tcon service=%s cnum=%d\n",
699 service, conn->cnum));
700
701 END_PROFILE(SMBtcon);
702 return;
703 }
704
705 /****************************************************************************
706 Reply to a tcon and X.
707 conn POINTER CAN BE NULL HERE !
708 ****************************************************************************/
709
710 void reply_tcon_and_X(struct smb_request *req)
711 {
712 connection_struct *conn = req->conn;
713 const char *service = NULL;
714 TALLOC_CTX *ctx = talloc_tos();
715 /* what the cleint thinks the device is */
716 char *client_devicetype = NULL;
717 /* what the server tells the client the share represents */
718 const char *server_devicetype;
719 NTSTATUS nt_status;
720 int passlen;
721 char *path = NULL;
722 const char *p, *q;
723 uint16 tcon_flags;
724 struct smbd_server_connection *sconn = req->sconn;
725
726 START_PROFILE(SMBtconX);
727
728 if (req->wct < 4) {
729 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
730 END_PROFILE(SMBtconX);
731 return;
732 }
733
734 passlen = SVAL(req->vwv+3, 0);
735 tcon_flags = SVAL(req->vwv+2, 0);
736
737 /* we might have to close an old one */
738 if ((tcon_flags & 0x1) && conn) {
739 close_cnum(conn,req->vuid);
740 req->conn = NULL;
741 conn = NULL;
742 }
743
744 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
745 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
746 END_PROFILE(SMBtconX);
747 return;
748 }
749
750 if (sconn->smb1.negprot.encrypted_passwords) {
751 p = (const char *)req->buf + passlen;
752 } else {
753 p = (const char *)req->buf + passlen + 1;
754 }
755
756 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
757
758 if (path == NULL) {
759 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
760 END_PROFILE(SMBtconX);
761 return;
762 }
763
764 /*
765 * the service name can be either: \\server\share
766 * or share directly like on the DELL PowerVault 705
767 */
768 if (*path=='\\') {
769 q = strchr_m(path+2,'\\');
770 if (!q) {
771 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
772 END_PROFILE(SMBtconX);
773 return;
774 }
775 service = q+1;
776 } else {
777 service = path;
778 }
779
780 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
781 &client_devicetype, p,
782 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
783
784 if (client_devicetype == NULL) {
785 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
786 END_PROFILE(SMBtconX);
787 return;
788 }
789
790 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
791
792 conn = make_connection(sconn, service, client_devicetype,
793 req->vuid, &nt_status);
794 req->conn =conn;
795
796 if (!conn) {
797 reply_nterror(req, nt_status);
798 END_PROFILE(SMBtconX);
799 return;
800 }
801
802 if ( IS_IPC(conn) )
803 server_devicetype = "IPC";
804 else if ( IS_PRINT(conn) )
805 server_devicetype = "LPT1:";
806 else
807 server_devicetype = "A:";
808
809 if (get_Protocol() < PROTOCOL_NT1) {
810 reply_outbuf(req, 2, 0);
811 if (message_push_string(&req->outbuf, server_devicetype,
812 STR_TERMINATE|STR_ASCII) == -1) {
813 reply_nterror(req, NT_STATUS_NO_MEMORY);
814 END_PROFILE(SMBtconX);
815 return;
816 }
817 } else {
818 /* NT sets the fstype of IPC$ to the null string */
819 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
820
821 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
822 /* Return permissions. */
823 uint32 perm1 = 0;
824 uint32 perm2 = 0;
825
826 reply_outbuf(req, 7, 0);
827
828 if (IS_IPC(conn)) {
829 perm1 = FILE_ALL_ACCESS;
830 perm2 = FILE_ALL_ACCESS;
831 } else {
832 perm1 = conn->share_access;
833 }
834
835 SIVAL(req->outbuf, smb_vwv3, perm1);
836 SIVAL(req->outbuf, smb_vwv5, perm2);
837 } else {
838 reply_outbuf(req, 3, 0);
839 }
840
841 if ((message_push_string(&req->outbuf, server_devicetype,
842 STR_TERMINATE|STR_ASCII) == -1)
843 || (message_push_string(&req->outbuf, fstype,
844 STR_TERMINATE) == -1)) {
845 reply_nterror(req, NT_STATUS_NO_MEMORY);
846 END_PROFILE(SMBtconX);
847 return;
848 }
849
850 /* what does setting this bit do? It is set by NT4 and
851 may affect the ability to autorun mounted cdroms */
852 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
853 (lp_csc_policy(SNUM(conn)) << 2));
854
855 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
856 DEBUG(2,("Serving %s as a Dfs root\n",
857 lp_servicename(SNUM(conn)) ));
858 SSVAL(req->outbuf, smb_vwv2,
859 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
860 }
861 }
862
863 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
864 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
865
866 DEBUG(3,("tconX service=%s \n",
867 service));
868
869 /* set the incoming and outgoing tid to the just created one */
870 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
871 SSVAL(req->outbuf,smb_tid,conn->cnum);
872
873 END_PROFILE(SMBtconX);
874
875 req->tid = conn->cnum;
876 }
877
878 /****************************************************************************
879 Reply to an unknown type.
880 ****************************************************************************/
881
882 void reply_unknown_new(struct smb_request *req, uint8 type)
883 {
884 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
885 smb_fn_name(type), type, type));
886 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
887 return;
888 }
889
890 /****************************************************************************
891 Reply to an ioctl.
892 conn POINTER CAN BE NULL HERE !
893 ****************************************************************************/
894
895 void reply_ioctl(struct smb_request *req)
896 {
897 connection_struct *conn = req->conn;
898 uint16 device;
899 uint16 function;
900 uint32 ioctl_code;
901 int replysize;
902 char *p;
903
904 START_PROFILE(SMBioctl);
905
906 if (req->wct < 3) {
907 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
908 END_PROFILE(SMBioctl);
909 return;
910 }
911
912 device = SVAL(req->vwv+1, 0);
913 function = SVAL(req->vwv+2, 0);
914 ioctl_code = (device << 16) + function;
915
916 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
917
918 switch (ioctl_code) {
919 case IOCTL_QUERY_JOB_INFO:
920 replysize = 32;
921 break;
922 default:
923 reply_force_doserror(req, ERRSRV, ERRnosupport);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927
928 reply_outbuf(req, 8, replysize+1);
929 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
930 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
931 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
932 p = smb_buf(req->outbuf);
933 memset(p, '\0', replysize+1); /* valgrind-safe. */
934 p += 1; /* Allow for alignment */
935
936 switch (ioctl_code) {
937 case IOCTL_QUERY_JOB_INFO:
938 {
939 files_struct *fsp = file_fsp(
940 req, SVAL(req->vwv+0, 0));
941 if (!fsp) {
942 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
943 END_PROFILE(SMBioctl);
944 return;
945 }
946 /* Job number */
947 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
948
949 srvstr_push((char *)req->outbuf, req->flags2, p+2,
950 lp_netbios_name(), 15,
951 STR_TERMINATE|STR_ASCII);
952 if (conn) {
953 srvstr_push((char *)req->outbuf, req->flags2,
954 p+18, lp_servicename(SNUM(conn)),
955 13, STR_TERMINATE|STR_ASCII);
956 } else {
957 memset(p+18, 0, 13);
958 }
959 break;
960 }
961 }
962
963 END_PROFILE(SMBioctl);
964 return;
965 }
966
967 /****************************************************************************
968 Strange checkpath NTSTATUS mapping.
969 ****************************************************************************/
970
971 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
972 {
973 /* Strange DOS error code semantics only for checkpath... */
974 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
975 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
976 /* We need to map to ERRbadpath */
977 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
978 }
979 }
980 return status;
981 }
982
983 /****************************************************************************
984 Reply to a checkpath.
985 ****************************************************************************/
986
987 void reply_checkpath(struct smb_request *req)
988 {
989 connection_struct *conn = req->conn;
990 struct smb_filename *smb_fname = NULL;
991 char *name = NULL;
992 NTSTATUS status;
993 TALLOC_CTX *ctx = talloc_tos();
994
995 START_PROFILE(SMBcheckpath);
996
997 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
998 STR_TERMINATE, &status);
999
1000 if (!NT_STATUS_IS_OK(status)) {
1001 status = map_checkpath_error(req->flags2, status);
1002 reply_nterror(req, status);
1003 END_PROFILE(SMBcheckpath);
1004 return;
1005 }
1006
1007 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1008
1009 status = filename_convert(ctx,
1010 conn,
1011 req->flags2 & FLAGS2_DFS_PATHNAMES,
1012 name,
1013 0,
1014 NULL,
1015 &smb_fname);
1016
1017 if (!NT_STATUS_IS_OK(status)) {
1018 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1019 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1020 ERRSRV, ERRbadpath);
1021 END_PROFILE(SMBcheckpath);
1022 return;
1023 }
1024 goto path_err;
1025 }
1026
1027 if (!VALID_STAT(smb_fname->st) &&
1028 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1029 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1030 smb_fname_str_dbg(smb_fname), strerror(errno)));
1031 status = map_nt_error_from_unix(errno);
1032 goto path_err;
1033 }
1034
1035 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1036 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1037 ERRDOS, ERRbadpath);
1038 goto out;
1039 }
1040
1041 reply_outbuf(req, 0, 0);
1042
1043 path_err:
1044 /* We special case this - as when a Windows machine
1045 is parsing a path is steps through the components
1046 one at a time - if a component fails it expects
1047 ERRbadpath, not ERRbadfile.
1048 */
1049 status = map_checkpath_error(req->flags2, status);
1050 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1051 /*
1052 * Windows returns different error codes if
1053 * the parent directory is valid but not the
1054 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1055 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1056 * if the path is invalid.
1057 */
1058 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1059 ERRDOS, ERRbadpath);
1060 goto out;
1061 }
1062
1063 reply_nterror(req, status);
1064
1065 out:
1066 TALLOC_FREE(smb_fname);
1067 END_PROFILE(SMBcheckpath);
1068 return;
1069 }
1070
1071 /****************************************************************************
1072 Reply to a getatr.
1073 ****************************************************************************/
1074
1075 void reply_getatr(struct smb_request *req)
1076 {
1077 connection_struct *conn = req->conn;
1078 struct smb_filename *smb_fname = NULL;
1079 char *fname = NULL;
1080 int mode=0;
1081 off_t size=0;
1082 time_t mtime=0;
1083 const char *p;
1084 NTSTATUS status;
1085 TALLOC_CTX *ctx = talloc_tos();
1086 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1087
1088 START_PROFILE(SMBgetatr);
1089
1090 p = (const char *)req->buf + 1;
1091 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1092 if (!NT_STATUS_IS_OK(status)) {
1093 reply_nterror(req, status);
1094 goto out;
1095 }
1096
1097 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1098 under WfWg - weird! */
1099 if (*fname == '\0') {
1100 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1101 if (!CAN_WRITE(conn)) {
1102 mode |= FILE_ATTRIBUTE_READONLY;
1103 }
1104 size = 0;
1105 mtime = 0;
1106 } else {
1107 status = filename_convert(ctx,
1108 conn,
1109 req->flags2 & FLAGS2_DFS_PATHNAMES,
1110 fname,
1111 0,
1112 NULL,
1113 &smb_fname);
1114 if (!NT_STATUS_IS_OK(status)) {
1115 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1116 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1117 ERRSRV, ERRbadpath);
1118 goto out;
1119 }
1120 reply_nterror(req, status);
1121 goto out;
1122 }
1123 if (!VALID_STAT(smb_fname->st) &&
1124 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1125 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1126 smb_fname_str_dbg(smb_fname),
1127 strerror(errno)));
1128 reply_nterror(req, map_nt_error_from_unix(errno));
1129 goto out;
1130 }
1131
1132 mode = dos_mode(conn, smb_fname);
1133 size = smb_fname->st.st_ex_size;
1134
1135 if (ask_sharemode) {
1136 struct timespec write_time_ts;
1137 struct file_id fileid;
1138
1139 ZERO_STRUCT(write_time_ts);
1140 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1141 get_file_infos(fileid, 0, NULL, &write_time_ts);
1142 if (!null_timespec(write_time_ts)) {
1143 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1144 }
1145 }
1146
1147 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1148 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1149 size = 0;
1150 }
1151 }
1152
1153 reply_outbuf(req, 10, 0);
1154
1155 SSVAL(req->outbuf,smb_vwv0,mode);
1156 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1157 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1158 } else {
1159 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1160 }
1161 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1162
1163 if (get_Protocol() >= PROTOCOL_NT1) {
1164 SSVAL(req->outbuf, smb_flg2,
1165 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1166 }
1167
1168 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1169 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1170
1171 out:
1172 TALLOC_FREE(smb_fname);
1173 TALLOC_FREE(fname);
1174 END_PROFILE(SMBgetatr);
1175 return;
1176 }
1177
1178 /****************************************************************************
1179 Reply to a setatr.
1180 ****************************************************************************/
1181
1182 void reply_setatr(struct smb_request *req)
1183 {
1184 struct smb_file_time ft;
1185 connection_struct *conn = req->conn;
1186 struct smb_filename *smb_fname = NULL;
1187 char *fname = NULL;
1188 int mode;
1189 time_t mtime;
1190 const char *p;
1191 NTSTATUS status;
1192 TALLOC_CTX *ctx = talloc_tos();
1193
1194 START_PROFILE(SMBsetatr);
1195
1196 ZERO_STRUCT(ft);
1197
1198 if (req->wct < 2) {
1199 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1200 goto out;
1201 }
1202
1203 p = (const char *)req->buf + 1;
1204 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1205 if (!NT_STATUS_IS_OK(status)) {
1206 reply_nterror(req, status);
1207 goto out;
1208 }
1209
1210 status = filename_convert(ctx,
1211 conn,
1212 req->flags2 & FLAGS2_DFS_PATHNAMES,
1213 fname,
1214 0,
1215 NULL,
1216 &smb_fname);
1217 if (!NT_STATUS_IS_OK(status)) {
1218 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1219 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1220 ERRSRV, ERRbadpath);
1221 goto out;
1222 }
1223 reply_nterror(req, status);
1224 goto out;
1225 }
1226
1227 if (smb_fname->base_name[0] == '.' &&
1228 smb_fname->base_name[1] == '\0') {
1229 /*
1230 * Not sure here is the right place to catch this
1231 * condition. Might be moved to somewhere else later -- vl
1232 */
1233 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1234 goto out;
1235 }
1236
1237 mode = SVAL(req->vwv+0, 0);
1238 mtime = srv_make_unix_date3(req->vwv+1);
1239
1240 if (mode != FILE_ATTRIBUTE_NORMAL) {
1241 if (VALID_STAT_OF_DIR(smb_fname->st))
1242 mode |= FILE_ATTRIBUTE_DIRECTORY;
1243 else
1244 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1245
1246 status = check_access(conn, NULL, smb_fname,
1247 FILE_WRITE_ATTRIBUTES);
1248 if (!NT_STATUS_IS_OK(status)) {
1249 reply_nterror(req, status);
1250 goto out;
1251 }
1252
1253 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1254 false) != 0) {
1255 reply_nterror(req, map_nt_error_from_unix(errno));
1256 goto out;
1257 }
1258 }
1259
1260 ft.mtime = convert_time_t_to_timespec(mtime);
1261 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1262 if (!NT_STATUS_IS_OK(status)) {
1263 reply_nterror(req, status);
1264 goto out;
1265 }
1266
1267 reply_outbuf(req, 0, 0);
1268
1269 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1270 mode));
1271 out:
1272 TALLOC_FREE(smb_fname);
1273 END_PROFILE(SMBsetatr);
1274 return;
1275 }
1276
1277 /****************************************************************************
1278 Reply to a dskattr.
1279 ****************************************************************************/
1280
1281 void reply_dskattr(struct smb_request *req)
1282 {
1283 connection_struct *conn = req->conn;
1284 uint64_t dfree,dsize,bsize;
1285 START_PROFILE(SMBdskattr);
1286
1287 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1288 reply_nterror(req, map_nt_error_from_unix(errno));
1289 END_PROFILE(SMBdskattr);
1290 return;
1291 }
1292
1293 reply_outbuf(req, 5, 0);
1294
1295 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1296 double total_space, free_space;
1297 /* we need to scale this to a number that DOS6 can handle. We
1298 use floating point so we can handle large drives on systems
1299 that don't have 64 bit integers
1300
1301 we end up displaying a maximum of 2G to DOS systems
1302 */
1303 total_space = dsize * (double)bsize;
1304 free_space = dfree * (double)bsize;
1305
1306 dsize = (uint64_t)((total_space+63*512) / (64*512));
1307 dfree = (uint64_t)((free_space+63*512) / (64*512));
1308
1309 if (dsize > 0xFFFF) dsize = 0xFFFF;
1310 if (dfree > 0xFFFF) dfree = 0xFFFF;
1311
1312 SSVAL(req->outbuf,smb_vwv0,dsize);
1313 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1314 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1315 SSVAL(req->outbuf,smb_vwv3,dfree);
1316 } else {
1317 SSVAL(req->outbuf,smb_vwv0,dsize);
1318 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1319 SSVAL(req->outbuf,smb_vwv2,512);
1320 SSVAL(req->outbuf,smb_vwv3,dfree);
1321 }
1322
1323 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1324
1325 END_PROFILE(SMBdskattr);
1326 return;
1327 }
1328
1329 /*
1330 * Utility function to split the filename from the directory.
1331 */
1332 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1333 char **fname_dir_out,
1334 char **fname_mask_out)
1335 {
1336 const char *p = NULL;
1337 char *fname_dir = NULL;
1338 char *fname_mask = NULL;
1339
1340 p = strrchr_m(fname_in, '/');
1341 if (!p) {
1342 fname_dir = talloc_strdup(ctx, ".");
1343 fname_mask = talloc_strdup(ctx, fname_in);
1344 } else {
1345 fname_dir = talloc_strndup(ctx, fname_in,
1346 PTR_DIFF(p, fname_in));
1347 fname_mask = talloc_strdup(ctx, p+1);
1348 }
1349
1350 if (!fname_dir || !fname_mask) {
1351 TALLOC_FREE(fname_dir);
1352 TALLOC_FREE(fname_mask);
1353 return NT_STATUS_NO_MEMORY;
1354 }
1355
1356 *fname_dir_out = fname_dir;
1357 *fname_mask_out = fname_mask;
1358 return NT_STATUS_OK;
1359 }
1360
1361 /****************************************************************************
1362 Reply to a search.
1363 Can be called from SMBsearch, SMBffirst or SMBfunique.
1364 ****************************************************************************/
1365
1366 void reply_search(struct smb_request *req)
1367 {
1368 connection_struct *conn = req->conn;
1369 char *path = NULL;
1370 const char *mask = NULL;
1371 char *directory = NULL;
1372 struct smb_filename *smb_fname = NULL;
1373 char *fname = NULL;
1374 off_t size;
1375 uint32 mode;
1376 struct timespec date;
1377 uint32 dirtype;
1378 unsigned int numentries = 0;
1379 unsigned int maxentries = 0;
1380 bool finished = False;
1381 const char *p;
1382 int status_len;
1383 char status[21];
1384 int dptr_num= -1;
1385 bool check_descend = False;
1386 bool expect_close = False;
1387 NTSTATUS nt_status;
1388 bool mask_contains_wcard = False;
1389 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1390 TALLOC_CTX *ctx = talloc_tos();
1391 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1392 struct dptr_struct *dirptr = NULL;
1393 struct smbd_server_connection *sconn = req->sconn;
1394
1395 START_PROFILE(SMBsearch);
1396
1397 if (req->wct < 2) {
1398 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1399 goto out;
1400 }
1401
1402 if (lp_posix_pathnames()) {
1403 reply_unknown_new(req, req->cmd);
1404 goto out;
1405 }
1406
1407 /* If we were called as SMBffirst then we must expect close. */
1408 if(req->cmd == SMBffirst) {
1409 expect_close = True;
1410 }
1411
1412 reply_outbuf(req, 1, 3);
1413 maxentries = SVAL(req->vwv+0, 0);
1414 dirtype = SVAL(req->vwv+1, 0);
1415 p = (const char *)req->buf + 1;
1416 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1417 &nt_status, &mask_contains_wcard);
1418 if (!NT_STATUS_IS_OK(nt_status)) {
1419 reply_nterror(req, nt_status);
1420 goto out;
1421 }
1422
1423 p++;
1424 status_len = SVAL(p, 0);
1425 p += 2;
1426
1427 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1428
1429 if (status_len == 0) {
1430 nt_status = filename_convert(ctx, conn,
1431 req->flags2 & FLAGS2_DFS_PATHNAMES,
1432 path,
1433 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1434 &mask_contains_wcard,
1435 &smb_fname);
1436 if (!NT_STATUS_IS_OK(nt_status)) {
1437 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1438 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1439 ERRSRV, ERRbadpath);
1440 goto out;
1441 }
1442 reply_nterror(req, nt_status);
1443 goto out;
1444 }
1445
1446 directory = smb_fname->base_name;
1447
1448 p = strrchr_m(directory,'/');
1449 if ((p != NULL) && (*directory != '/')) {
1450 mask = p + 1;
1451 directory = talloc_strndup(ctx, directory,
1452 PTR_DIFF(p, directory));
1453 } else {
1454 mask = directory;
1455 directory = talloc_strdup(ctx,".");
1456 }
1457
1458 if (!directory) {
1459 reply_nterror(req, NT_STATUS_NO_MEMORY);
1460 goto out;
1461 }
1462
1463 memset((char *)status,'\0',21);
1464 SCVAL(status,0,(dirtype & 0x1F));
1465
1466 nt_status = dptr_create(conn,
1467 NULL, /* req */
1468 NULL, /* fsp */
1469 directory,
1470 True,
1471 expect_close,
1472 req->smbpid,
1473 mask,
1474 mask_contains_wcard,
1475 dirtype,
1476 &dirptr);
1477 if (!NT_STATUS_IS_OK(nt_status)) {
1478 reply_nterror(req, nt_status);
1479 goto out;
1480 }
1481 dptr_num = dptr_dnum(dirptr);
1482 } else {
1483 int status_dirtype;
1484 const char *dirpath;
1485
1486 memcpy(status,p,21);
1487 status_dirtype = CVAL(status,0) & 0x1F;
1488 if (status_dirtype != (dirtype & 0x1F)) {
1489 dirtype = status_dirtype;
1490 }
1491
1492 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1493 if (!dirptr) {
1494 goto SearchEmpty;
1495 }
1496 dirpath = dptr_path(sconn, dptr_num);
1497 directory = talloc_strdup(ctx, dirpath);
1498 if (!directory) {
1499 reply_nterror(req, NT_STATUS_NO_MEMORY);
1500 goto out;
1501 }
1502
1503 mask = dptr_wcard(sconn, dptr_num);
1504 if (!mask) {
1505 goto SearchEmpty;
1506 }
1507 /*
1508 * For a 'continue' search we have no string. So
1509 * check from the initial saved string.
1510 */
1511 mask_contains_wcard = ms_has_wild(mask);
1512 dirtype = dptr_attr(sconn, dptr_num);
1513 }
1514
1515 DEBUG(4,("dptr_num is %d\n",dptr_num));
1516
1517 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1518 dptr_init_search_op(dirptr);
1519
1520 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1521 char buf[DIR_STRUCT_SIZE];
1522 memcpy(buf,status,21);
1523 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1524 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1525 reply_nterror(req, NT_STATUS_NO_MEMORY);
1526 goto out;
1527 }
1528 dptr_fill(sconn, buf+12,dptr_num);
1529 if (dptr_zero(buf+12) && (status_len==0)) {
1530 numentries = 1;
1531 } else {
1532 numentries = 0;
1533 }
1534 if (message_push_blob(&req->outbuf,
1535 data_blob_const(buf, sizeof(buf)))
1536 == -1) {
1537 reply_nterror(req, NT_STATUS_NO_MEMORY);
1538 goto out;
1539 }
1540 } else {
1541 unsigned int i;
1542 maxentries = MIN(
1543 maxentries,
1544 ((BUFFER_SIZE -
1545 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1546 /DIR_STRUCT_SIZE));
1547
1548 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1549 directory,lp_dontdescend(SNUM(conn))));
1550 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1551 check_descend = True;
1552 }
1553
1554 for (i=numentries;(i<maxentries) && !finished;i++) {
1555 finished = !get_dir_entry(ctx,
1556 dirptr,
1557 mask,
1558 dirtype,
1559 &fname,
1560 &size,
1561 &mode,
1562 &date,
1563 check_descend,
1564 ask_sharemode);
1565 if (!finished) {
1566 char buf[DIR_STRUCT_SIZE];
1567 memcpy(buf,status,21);
1568 if (!make_dir_struct(ctx,
1569 buf,
1570 mask,
1571 fname,
1572 size,
1573 mode,
1574 convert_timespec_to_time_t(date),
1575 !allow_long_path_components)) {
1576 reply_nterror(req, NT_STATUS_NO_MEMORY);
1577 goto out;
1578 }
1579 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1580 break;
1581 }
1582 if (message_push_blob(&req->outbuf,
1583 data_blob_const(buf, sizeof(buf)))
1584 == -1) {
1585 reply_nterror(req, NT_STATUS_NO_MEMORY);
1586 goto out;
1587 }
1588 numentries++;
1589 }
1590 }
1591 }
1592
1593 SearchEmpty:
1594
1595 /* If we were called as SMBffirst with smb_search_id == NULL
1596 and no entries were found then return error and close dirptr
1597 (X/Open spec) */
1598
1599 if (numentries == 0) {
1600 dptr_close(sconn, &dptr_num);
1601 } else if(expect_close && status_len == 0) {
1602 /* Close the dptr - we know it's gone */
1603 dptr_close(sconn, &dptr_num);
1604 }
1605
1606 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1607 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1608 dptr_close(sconn, &dptr_num);
1609 }
1610
1611 if ((numentries == 0) && !mask_contains_wcard) {
1612 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1613 goto out;
1614 }
1615
1616 SSVAL(req->outbuf,smb_vwv0,numentries);
1617 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1618 SCVAL(smb_buf(req->outbuf),0,5);
1619 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1620
1621 /* The replies here are never long name. */
1622 SSVAL(req->outbuf, smb_flg2,
1623 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1624 if (!allow_long_path_components) {
1625 SSVAL(req->outbuf, smb_flg2,
1626 SVAL(req->outbuf, smb_flg2)
1627 & (~FLAGS2_LONG_PATH_COMPONENTS));
1628 }
1629
1630 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1631 SSVAL(req->outbuf, smb_flg2,
1632 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1633
1634 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1635 smb_fn_name(req->cmd),
1636 mask,
1637 directory,
1638 dirtype,
1639 numentries,
1640 maxentries ));
1641 out:
1642 TALLOC_FREE(directory);
1643 TALLOC_FREE(smb_fname);
1644 END_PROFILE(SMBsearch);
1645 return;
1646 }
1647
1648 /****************************************************************************
1649 Reply to a fclose (stop directory search).
1650 ****************************************************************************/
1651
1652 void reply_fclose(struct smb_request *req)
1653 {
1654 int status_len;
1655 char status[21];
1656 int dptr_num= -2;
1657 const char *p;
1658 char *path = NULL;
1659 NTSTATUS err;
1660 bool path_contains_wcard = False;
1661 TALLOC_CTX *ctx = talloc_tos();
1662 struct smbd_server_connection *sconn = req->sconn;
1663
1664 START_PROFILE(SMBfclose);
1665
1666 if (lp_posix_pathnames()) {
1667 reply_unknown_new(req, req->cmd);
1668 END_PROFILE(SMBfclose);
1669 return;
1670 }
1671
1672 p = (const char *)req->buf + 1;
1673 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1674 &err, &path_contains_wcard);
1675 if (!NT_STATUS_IS_OK(err)) {
1676 reply_nterror(req, err);
1677 END_PROFILE(SMBfclose);
1678 return;
1679 }
1680 p++;
1681 status_len = SVAL(p,0);
1682 p += 2;
1683
1684 if (status_len == 0) {
1685 reply_force_doserror(req, ERRSRV, ERRsrverror);
1686 END_PROFILE(SMBfclose);
1687 return;
1688 }
1689
1690 memcpy(status,p,21);
1691
1692 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1693 /* Close the dptr - we know it's gone */
1694 dptr_close(sconn, &dptr_num);
1695 }
1696
1697 reply_outbuf(req, 1, 0);
1698 SSVAL(req->outbuf,smb_vwv0,0);
1699
1700 DEBUG(3,("search close\n"));
1701
1702 END_PROFILE(SMBfclose);
1703 return;
1704 }
1705
1706 /****************************************************************************
1707 Reply to an open.
1708 ****************************************************************************/
1709
1710 void reply_open(struct smb_request *req)
1711 {
1712 connection_struct *conn = req->conn;
1713 struct smb_filename *smb_fname = NULL;
1714 char *fname = NULL;
1715 uint32 fattr=0;
1716 off_t size = 0;
1717 time_t mtime=0;
1718 int info;
1719 files_struct *fsp;
1720 int oplock_request;
1721 int deny_mode;
1722 uint32 dos_attr;
1723 uint32 access_mask;
1724 uint32 share_mode;
1725 uint32 create_disposition;
1726 uint32 create_options = 0;
1727 uint32_t private_flags = 0;
1728 NTSTATUS status;
1729 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1730 TALLOC_CTX *ctx = talloc_tos();
1731
1732 START_PROFILE(SMBopen);
1733
1734 if (req->wct < 2) {
1735 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1736 goto out;
1737 }
1738
1739 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1740 deny_mode = SVAL(req->vwv+0, 0);
1741 dos_attr = SVAL(req->vwv+1, 0);
1742
1743 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1744 STR_TERMINATE, &status);
1745 if (!NT_STATUS_IS_OK(status)) {
1746 reply_nterror(req, status);
1747 goto out;
1748 }
1749
1750 status = filename_convert(ctx,
1751 conn,
1752 req->flags2 & FLAGS2_DFS_PATHNAMES,
1753 fname,
1754 0,
1755 NULL,
1756 &smb_fname);
1757 if (!NT_STATUS_IS_OK(status)) {
1758 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1759 reply_botherror(req,
1760 NT_STATUS_PATH_NOT_COVERED,
1761 ERRSRV, ERRbadpath);
1762 goto out;
1763 }
1764 reply_nterror(req, status);
1765 goto out;
1766 }
1767
1768 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1769 OPENX_FILE_EXISTS_OPEN, &access_mask,
1770 &share_mode, &create_disposition,
1771 &create_options, &private_flags)) {
1772 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1773 goto out;
1774 }
1775
1776 status = SMB_VFS_CREATE_FILE(
1777 conn, /* conn */
1778 req, /* req */
1779 0, /* root_dir_fid */
1780 smb_fname, /* fname */
1781 access_mask, /* access_mask */
1782 share_mode, /* share_access */
1783 create_disposition, /* create_disposition*/
1784 create_options, /* create_options */
1785 dos_attr, /* file_attributes */
1786 oplock_request, /* oplock_request */
1787 0, /* allocation_size */
1788 private_flags,
1789 NULL, /* sd */
1790 NULL, /* ea_list */
1791 &fsp, /* result */
1792 &info); /* pinfo */
1793
1794 if (!NT_STATUS_IS_OK(status)) {
1795 if (open_was_deferred(req->sconn, req->mid)) {
1796 /* We have re-scheduled this call. */
1797 goto out;
1798 }
1799 reply_openerror(req, status);
1800 goto out;
1801 }
1802
1803 size = smb_fname->st.st_ex_size;
1804 fattr = dos_mode(conn, smb_fname);
1805
1806 /* Deal with other possible opens having a modified
1807 write time. JRA. */
1808 if (ask_sharemode) {
1809 struct timespec write_time_ts;
1810
1811 ZERO_STRUCT(write_time_ts);
1812 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1813 if (!null_timespec(write_time_ts)) {
1814 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1815 }
1816 }
1817
1818 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1819
1820 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1821 DEBUG(3,("attempt to open a directory %s\n",
1822 fsp_str_dbg(fsp)));
1823 close_file(req, fsp, ERROR_CLOSE);
1824 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1825 ERRDOS, ERRnoaccess);
1826 goto out;
1827 }
1828
1829 reply_outbuf(req, 7, 0);
1830 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1831 SSVAL(req->outbuf,smb_vwv1,fattr);
1832 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1833 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1834 } else {
1835 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1836 }
1837 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1838 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1839
1840 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1841 SCVAL(req->outbuf,smb_flg,
1842 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1843 }
1844
1845 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1846 SCVAL(req->outbuf,smb_flg,
1847 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1848 }
1849 out:
1850 TALLOC_FREE(smb_fname);
1851 END_PROFILE(SMBopen);
1852 return;
1853 }
1854
1855 /****************************************************************************
1856 Reply to an open and X.
1857 ****************************************************************************/
1858
1859 void reply_open_and_X(struct smb_request *req)
1860 {
1861 connection_struct *conn = req->conn;
1862 struct smb_filename *smb_fname = NULL;
1863 char *fname = NULL;
1864 uint16 open_flags;
1865 int deny_mode;
1866 uint32 smb_attr;
1867 /* Breakout the oplock request bits so we can set the
1868 reply bits separately. */
1869 int ex_oplock_request;
1870 int core_oplock_request;
1871 int oplock_request;
1872 #if 0
1873 int smb_sattr = SVAL(req->vwv+4, 0);
1874 uint32 smb_time = make_unix_date3(req->vwv+6);
1875 #endif
1876 int smb_ofun;
1877 uint32 fattr=0;
1878 int mtime=0;
1879 int smb_action = 0;
1880 files_struct *fsp;
1881 NTSTATUS status;
1882 uint64_t allocation_size;
1883 ssize_t retval = -1;
1884 uint32 access_mask;
1885 uint32 share_mode;
1886 uint32 create_disposition;
1887 uint32 create_options = 0;
1888 uint32_t private_flags = 0;
1889 TALLOC_CTX *ctx = talloc_tos();
1890
1891 START_PROFILE(SMBopenX);
1892
1893 if (req->wct < 15) {
1894 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1895 goto out;
1896 }
1897
1898 open_flags = SVAL(req->vwv+2, 0);
1899 deny_mode = SVAL(req->vwv+3, 0);
1900 smb_attr = SVAL(req->vwv+5, 0);
1901 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1902 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1903 oplock_request = ex_oplock_request | core_oplock_request;
1904 smb_ofun = SVAL(req->vwv+8, 0);
1905 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1906
1907 /* If it's an IPC, pass off the pipe handler. */
1908 if (IS_IPC(conn)) {
1909 if (lp_nt_pipe_support()) {
1910 reply_open_pipe_and_X(conn, req);
1911 } else {
1912 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1913 }
1914 goto out;
1915 }
1916
1917 /* XXXX we need to handle passed times, sattr and flags */
1918 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1919 STR_TERMINATE, &status);
1920 if (!NT_STATUS_IS_OK(status)) {
1921 reply_nterror(req, status);
1922 goto out;
1923 }
1924
1925 status = filename_convert(ctx,
1926 conn,
1927 req->flags2 & FLAGS2_DFS_PATHNAMES,
1928 fname,
1929 0,
1930 NULL,
1931 &smb_fname);
1932 if (!NT_STATUS_IS_OK(status)) {
1933 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1934 reply_botherror(req,
1935 NT_STATUS_PATH_NOT_COVERED,
1936 ERRSRV, ERRbadpath);
1937 goto out;
1938 }
1939 reply_nterror(req, status);
1940 goto out;
1941 }
1942
1943 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1944 smb_ofun,
1945 &access_mask, &share_mode,
1946 &create_disposition,
1947 &create_options,
1948 &private_flags)) {
1949 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1950 goto out;
1951 }
1952
1953 status = SMB_VFS_CREATE_FILE(
1954 conn, /* conn */
1955 req, /* req */
1956 0, /* root_dir_fid */
1957 smb_fname, /* fname */
1958 access_mask, /* access_mask */
1959 share_mode, /* share_access */
1960 create_disposition, /* create_disposition*/
1961 create_options, /* create_options */
1962 smb_attr, /* file_attributes */
1963 oplock_request, /* oplock_request */
1964 0, /* allocation_size */
1965 private_flags,
1966 NULL, /* sd */
1967 NULL, /* ea_list */
1968 &fsp, /* result */
1969 &smb_action); /* pinfo */
1970
1971 if (!NT_STATUS_IS_OK(status)) {
1972 if (open_was_deferred(req->sconn, req->mid)) {
1973 /* We have re-scheduled this call. */
1974 goto out;
1975 }
1976 reply_openerror(req, status);
1977 goto out;
1978 }
1979
1980 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1981 if the file is truncated or created. */
1982 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1983 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1984 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1985 close_file(req, fsp, ERROR_CLOSE);
1986 reply_nterror(req, NT_STATUS_DISK_FULL);
1987 goto out;
1988 }
1989 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
1990 if (retval < 0) {
1991 close_file(req, fsp, ERROR_CLOSE);
1992 reply_nterror(req, NT_STATUS_DISK_FULL);
1993 goto out;
1994 }
1995 status = vfs_stat_fsp(fsp);
1996 if (!NT_STATUS_IS_OK(status)) {
1997 close_file(req, fsp, ERROR_CLOSE);
1998 reply_nterror(req, status);
1999 goto out;
2000 }
2001 }
2002
2003 fattr = dos_mode(conn, fsp->fsp_name);
2004 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2005 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2006 close_file(req, fsp, ERROR_CLOSE);
2007 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2008 goto out;
2009 }
2010
2011 /* If the caller set the extended oplock request bit
2012 and we granted one (by whatever means) - set the
2013 correct bit for extended oplock reply.
2014 */
2015
2016 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2017 smb_action |= EXTENDED_OPLOCK_GRANTED;
2018 }
2019
2020 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2021 smb_action |= EXTENDED_OPLOCK_GRANTED;
2022 }
2023
2024 /* If the caller set the core oplock request bit
2025 and we granted one (by whatever means) - set the
2026 correct bit for core oplock reply.
2027 */
2028
2029 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2030 reply_outbuf(req, 19, 0);
2031 } else {
2032 reply_outbuf(req, 15, 0);
2033 }
2034
2035 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2036 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2037
2038 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2039 SCVAL(req->outbuf, smb_flg,
2040 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2041 }
2042
2043 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2044 SCVAL(req->outbuf, smb_flg,
2045 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2046 }
2047
2048 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2049 SSVAL(req->outbuf,smb_vwv3,fattr);
2050 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2051 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2052 } else {
2053 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2054 }
2055 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2056 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2057 SSVAL(req->outbuf,smb_vwv11,smb_action);
2058
2059 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2060 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2061 }
2062
2063 out:
2064 TALLOC_FREE(smb_fname);
2065 END_PROFILE(SMBopenX);
2066 return;
2067 }
2068
2069 /****************************************************************************
2070 Reply to a SMBulogoffX.
2071 ****************************************************************************/
2072
2073 void reply_ulogoffX(struct smb_request *req)
2074 {
2075 struct smbd_server_connection *sconn = req->sconn;
2076 struct user_struct *vuser;
2077
2078 START_PROFILE(SMBulogoffX);
2079
2080 vuser = get_valid_user_struct(sconn, req->vuid);
2081
2082 if(vuser == NULL) {
2083 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2084 (unsigned long long)req->vuid));
2085
2086 req->vuid = UID_FIELD_INVALID;
2087 reply_force_doserror(req, ERRSRV, ERRbaduid);
2088 END_PROFILE(SMBulogoffX);
2089 return;
2090 }
2091
2092 /* in user level security we are supposed to close any files
2093 open by this user */
2094 if (vuser != NULL) {
2095 file_close_user(sconn, req->vuid);
2096 }
2097
2098 invalidate_vuid(sconn, req->vuid);
2099
2100 reply_outbuf(req, 2, 0);
2101 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2102 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2103
2104 DEBUG(3, ("ulogoffX vuid=%llu\n",
2105 (unsigned long long)req->vuid));
2106
2107 END_PROFILE(SMBulogoffX);
2108 req->vuid = UID_FIELD_INVALID;
2109 }
2110
2111 /****************************************************************************
2112 Reply to a mknew or a create.
2113 ****************************************************************************/
2114
2115 void reply_mknew(struct smb_request *req)
2116 {
2117 connection_struct *conn = req->conn;
2118 struct smb_filename *smb_fname = NULL;
2119 char *fname = NULL;
2120 uint32 fattr = 0;
2121 struct smb_file_time ft;
2122 files_struct *fsp;
2123 int oplock_request = 0;
2124 NTSTATUS status;
2125 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2126 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2127 uint32 create_disposition;
2128 uint32 create_options = 0;
2129 TALLOC_CTX *ctx = talloc_tos();
2130
2131 START_PROFILE(SMBcreate);
2132 ZERO_STRUCT(ft);
2133
2134 if (req->wct < 3) {
2135 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2136 goto out;
2137 }
2138
2139 fattr = SVAL(req->vwv+0, 0);
2140 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2141
2142 /* mtime. */
2143 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2144
2145 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2146 STR_TERMINATE, &status);
2147 if (!NT_STATUS_IS_OK(status)) {
2148 reply_nterror(req, status);
2149 goto out;
2150 }
2151
2152 status = filename_convert(ctx,
2153 conn,
2154 req->flags2 & FLAGS2_DFS_PATHNAMES,
2155 fname,
2156 0,
2157 NULL,
2158 &smb_fname);
2159 if (!NT_STATUS_IS_OK(status)) {
2160 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2161 reply_botherror(req,
2162 NT_STATUS_PATH_NOT_COVERED,
2163 ERRSRV, ERRbadpath);
2164 goto out;
2165 }
2166 reply_nterror(req, status);
2167 goto out;
2168 }
2169
2170 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2171 DEBUG(0,("Attempt to create file (%s) with volid set - "
2172 "please report this\n",
2173 smb_fname_str_dbg(smb_fname)));
2174 }
2175
2176 if(req->cmd == SMBmknew) {
2177 /* We should fail if file exists. */
2178 create_disposition = FILE_CREATE;
2179 } else {
2180 /* Create if file doesn't exist, truncate if it does. */
2181 create_disposition = FILE_OVERWRITE_IF;
2182 }
2183
2184 status = SMB_VFS_CREATE_FILE(
2185 conn, /* conn */
2186 req, /* req */
2187 0, /* root_dir_fid */
2188 smb_fname, /* fname */
2189 access_mask, /* access_mask */
2190 share_mode, /* share_access */
2191 create_disposition, /* create_disposition*/
2192 create_options, /* create_options */
2193 fattr, /* file_attributes */
2194 oplock_request, /* oplock_request */
2195 0, /* allocation_size */
2196 0, /* private_flags */
2197 NULL, /* sd */
2198 NULL, /* ea_list */
2199 &fsp, /* result */
2200 NULL); /* pinfo */
2201
2202 if (!NT_STATUS_IS_OK(status)) {
2203 if (open_was_deferred(req->sconn, req->mid)) {
2204 /* We have re-scheduled this call. */
2205 goto out;
2206 }
2207 reply_openerror(req, status);
2208 goto out;
2209 }
2210
2211 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2212 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2213 if (!NT_STATUS_IS_OK(status)) {
2214 END_PROFILE(SMBcreate);
2215 goto out;
2216 }
2217
2218 reply_outbuf(req, 1, 0);
2219 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2220
2221 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2222 SCVAL(req->outbuf,smb_flg,
2223 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2224 }
2225
2226 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2227 SCVAL(req->outbuf,smb_flg,
2228 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2229 }
2230
2231 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2232 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2233 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2234 (unsigned int)fattr));
2235
2236 out:
2237 TALLOC_FREE(smb_fname);
2238 END_PROFILE(SMBcreate);
2239 return;
2240 }
2241
2242 /****************************************************************************
2243 Reply to a create temporary file.
2244 ****************************************************************************/
2245
2246 void reply_ctemp(struct smb_request *req)
2247 {
2248 connection_struct *conn = req->conn;
2249 struct smb_filename *smb_fname = NULL;
2250 char *fname = NULL;
2251 uint32 fattr;
2252 files_struct *fsp;
2253 int oplock_request;
2254 int tmpfd;
2255 char *s;
2256 NTSTATUS status;
2257 TALLOC_CTX *ctx = talloc_tos();
2258
2259 START_PROFILE(SMBctemp);
2260
2261 if (req->wct < 3) {
2262 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2263 goto out;
2264 }
2265
2266 fattr = SVAL(req->vwv+0, 0);
2267 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2268
2269 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2270 STR_TERMINATE, &status);
2271 if (!NT_STATUS_IS_OK(status)) {
2272 reply_nterror(req, status);
2273 goto out;
2274 }
2275 if (*fname) {
2276 fname = talloc_asprintf(ctx,
2277 "%s/TMXXXXXX",
2278 fname);
2279 } else {
2280 fname = talloc_strdup(ctx, "TMXXXXXX");
2281 }
2282
2283 if (!fname) {
2284 reply_nterror(req, NT_STATUS_NO_MEMORY);
2285 goto out;
2286 }
2287
2288 status = filename_convert(ctx, conn,
2289 req->flags2 & FLAGS2_DFS_PATHNAMES,
2290 fname,
2291 0,
2292 NULL,
2293 &smb_fname);
2294 if (!NT_STATUS_IS_OK(status)) {
2295 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2296 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2297 ERRSRV, ERRbadpath);
2298 goto out;
2299 }
2300 reply_nterror(req, status);
2301 goto out;
2302 }
2303
2304 tmpfd = mkstemp(smb_fname->base_name);
2305 if (tmpfd == -1) {
2306 reply_nterror(req, map_nt_error_from_unix(errno));
2307 goto out;
2308 }
2309
2310 SMB_VFS_STAT(conn, smb_fname);
2311
2312 /* We should fail if file does not exist. */
2313 status = SMB_VFS_CREATE_FILE(
2314 conn, /* conn */
2315 req, /* req */
2316 0, /* root_dir_fid */
2317 smb_fname, /* fname */
2318 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2319 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2320 FILE_OPEN, /* create_disposition*/
2321 0, /* create_options */
2322 fattr, /* file_attributes */
2323 oplock_request, /* oplock_request */
2324 0, /* allocation_size */
2325 0, /* private_flags */
2326 NULL, /* sd */
2327 NULL, /* ea_list */
2328 &fsp, /* result */
2329 NULL); /* pinfo */
2330
2331 /* close fd from mkstemp() */
2332 close(tmpfd);
2333
2334 if (!NT_STATUS_IS_OK(status)) {
2335 if (open_was_deferred(req->sconn, req->mid)) {
2336 /* We have re-scheduled this call. */
2337 goto out;
2338 }
2339 reply_openerror(req, status);
2340 goto out;
2341 }
2342
2343 reply_outbuf(req, 1, 0);
2344 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2345
2346 /* the returned filename is relative to the directory */
2347 s = strrchr_m(fsp->fsp_name->base_name, '/');
2348 if (!s) {
2349 s = fsp->fsp_name->base_name;
2350 } else {
2351 s++;
2352 }
2353
2354 #if 0
2355 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2356 thing in the byte section. JRA */
2357 SSVALS(p, 0, -1); /* what is this? not in spec */
2358 #endif
2359 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2360 == -1) {
2361 reply_nterror(req, NT_STATUS_NO_MEMORY);
2362 goto out;
2363 }
2364
2365 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2366 SCVAL(req->outbuf, smb_flg,
2367 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2368 }
2369
2370 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2371 SCVAL(req->outbuf, smb_flg,
2372 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2373 }
2374
2375 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2376 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2377 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2378 out:
2379 TALLOC_FREE(smb_fname);
2380 END_PROFILE(SMBctemp);
2381 return;
2382 }
2383
2384 /*******************************************************************
2385 Check if a user is allowed to rename a file.
2386 ********************************************************************/
2387
2388 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2389 uint16 dirtype)
2390 {
2391 if (!CAN_WRITE(conn)) {
2392 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2393 }
2394
2395 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2396 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2397 /* Only bother to read the DOS attribute if we might deny the
2398 rename on the grounds of attribute missmatch. */
2399 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2400 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2401 return NT_STATUS_NO_SUCH_FILE;
2402 }
2403 }
2404
2405 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2406 if (fsp->posix_open) {
2407 return NT_STATUS_OK;
2408 }
2409
2410 /* If no pathnames are open below this
2411 directory, allow the rename. */
2412
2413 if (file_find_subpath(fsp)) {
2414 return NT_STATUS_ACCESS_DENIED;
2415 }
2416 return NT_STATUS_OK;
2417 }
2418
2419 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2420 return NT_STATUS_OK;
2421 }
2422
2423 return NT_STATUS_ACCESS_DENIED;
2424 }
2425
2426 /*******************************************************************
2427 * unlink a file with all relevant access checks
2428 *******************************************************************/
2429
2430 static NTSTATUS do_unlink(connection_struct *conn,
2431 struct smb_request *req,
2432 struct smb_filename *smb_fname,
2433 uint32 dirtype)
2434 {
2435 uint32 fattr;
2436 files_struct *fsp;
2437 uint32 dirtype_orig = dirtype;
2438 NTSTATUS status;
2439 int ret;
2440 bool posix_paths = lp_posix_pathnames();
2441
2442 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2443 smb_fname_str_dbg(smb_fname),
2444 dirtype));
2445
2446 if (!CAN_WRITE(conn)) {
2447 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2448 }
2449
2450 if (posix_paths) {
2451 ret = SMB_VFS_LSTAT(conn, smb_fname);
2452 } else {
2453 ret = SMB_VFS_STAT(conn, smb_fname);
2454 }
2455 if (ret != 0) {
2456 return map_nt_error_from_unix(errno);
2457 }
2458
2459 fattr = dos_mode(conn, smb_fname);
2460
2461 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2462 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2463 }
2464
2465 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2466 if (!dirtype) {
2467 return NT_STATUS_NO_SUCH_FILE;
2468 }
2469
2470 if (!dir_check_ftype(conn, fattr, dirtype)) {
2471 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2472 return NT_STATUS_FILE_IS_A_DIRECTORY;
2473 }
2474 return NT_STATUS_NO_SUCH_FILE;
2475 }
2476
2477 if (dirtype_orig & 0x8000) {
2478 /* These will never be set for POSIX. */
2479 return NT_STATUS_NO_SUCH_FILE;
2480 }
2481
2482 #if 0
2483 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2484 return NT_STATUS_FILE_IS_A_DIRECTORY;
2485 }
2486
2487 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2488 return NT_STATUS_NO_SUCH_FILE;
2489 }
2490
2491 if (dirtype & 0xFF00) {
2492 /* These will never be set for POSIX. */
2493 return NT_STATUS_NO_SUCH_FILE;
2494 }
2495
2496 dirtype &= 0xFF;
2497 if (!dirtype) {
2498 return NT_STATUS_NO_SUCH_FILE;
2499 }
2500
2501 /* Can't delete a directory. */
2502 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2503 return NT_STATUS_FILE_IS_A_DIRECTORY;
2504 }
2505 #endif
2506
2507 #if 0 /* JRATEST */
2508 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2509 return NT_STATUS_OBJECT_NAME_INVALID;
2510 #endif /* JRATEST */
2511
2512 /* On open checks the open itself will check the share mode, so
2513 don't do it here as we'll get it wrong. */
2514
2515 status = SMB_VFS_CREATE_FILE
2516 (conn, /* conn */
2517 req, /* req */
2518 0, /* root_dir_fid */
2519 smb_fname, /* fname */
2520 DELETE_ACCESS, /* access_mask */
2521 FILE_SHARE_NONE, /* share_access */
2522 FILE_OPEN, /* create_disposition*/
2523 FILE_NON_DIRECTORY_FILE, /* create_options */
2524 /* file_attributes */
2525 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2526 FILE_ATTRIBUTE_NORMAL,
2527 0, /* oplock_request */
2528 0, /* allocation_size */
2529 0, /* private_flags */
2530 NULL, /* sd */
2531 NULL, /* ea_list */
2532 &fsp, /* result */
2533 NULL); /* pinfo */
2534
2535 if (!NT_STATUS_IS_OK(status)) {
2536 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2537 nt_errstr(status)));
2538 return status;
2539 }
2540
2541 status = can_set_delete_on_close(fsp, fattr);
2542 if (!NT_STATUS_IS_OK(status)) {
2543 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2544 "(%s)\n",
2545 smb_fname_str_dbg(smb_fname),
2546 nt_errstr(status)));
2547 close_file(req, fsp, NORMAL_CLOSE);
2548 return status;
2549 }
2550
2551 /* The set is across all open files on this dev/inode pair. */
2552 if (!set_delete_on_close(fsp, True,
2553 conn->session_info->security_token,
2554 conn->session_info->unix_token)) {
2555 close_file(req, fsp, NORMAL_CLOSE);
2556 return NT_STATUS_ACCESS_DENIED;
2557 }
2558
2559 return close_file(req, fsp, NORMAL_CLOSE);
2560 }
2561
2562 /****************************************************************************
2563 The guts of the unlink command, split out so it may be called by the NT SMB
2564 code.
2565 ****************************************************************************/
2566
2567 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2568 uint32 dirtype, struct smb_filename *smb_fname,
2569 bool has_wild)
2570 {
2571 char *fname_dir = NULL;
2572 char *fname_mask = NULL;
2573 int count=0;
2574 NTSTATUS status = NT_STATUS_OK;
2575 TALLOC_CTX *ctx = talloc_tos();
2576
2577 /* Split up the directory from the filename/mask. */
2578 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2579 &fname_dir, &fname_mask);
2580 if (!NT_STATUS_IS_OK(status)) {
2581 goto out;
2582 }
2583
2584 /*
2585 * We should only check the mangled cache
2586 * here if unix_convert failed. This means
2587 * that the path in 'mask' doesn't exist
2588 * on the file system and so we need to look
2589 * for a possible mangle. This patch from
2590 * Tine Smukavec <valentin.smukavec@hermes.si>.
2591 */
2592
2593 if (!VALID_STAT(smb_fname->st) &&
2594 mangle_is_mangled(fname_mask, conn->params)) {
2595 char *new_mask = NULL;
2596 mangle_lookup_name_from_8_3(ctx, fname_mask,
2597 &new_mask, conn->params);
2598 if (new_mask) {
2599 TALLOC_FREE(fname_mask);
2600 fname_mask = new_mask;
2601 }
2602 }
2603
2604 if (!has_wild) {
2605
2606 /*
2607 * Only one file needs to be unlinked. Append the mask back
2608 * onto the directory.
2609 */
2610 TALLOC_FREE(smb_fname->base_name);
2611 if (ISDOT(fname_dir)) {
2612 /* Ensure we use canonical names on open. */
2613 smb_fname->base_name = talloc_asprintf(smb_fname,
2614 "%s",
2615 fname_mask);
2616 } else {
2617 smb_fname->base_name = talloc_asprintf(smb_fname,
2618 "%s/%s",
2619 fname_dir,
2620 fname_mask);
2621 }
2622 if (!smb_fname->base_name) {
2623 status = NT_STATUS_NO_MEMORY;
2624 goto out;
2625 }
2626 if (dirtype == 0) {
2627 dirtype = FILE_ATTRIBUTE_NORMAL;
2628 }
2629
2630 status = check_name(conn, smb_fname->base_name);
2631 if (!NT_STATUS_IS_OK(status)) {
2632 goto out;
2633 }
2634
2635 status = do_unlink(conn, req, smb_fname, dirtype);
2636 if (!NT_STATUS_IS_OK(status)) {
2637 goto out;
2638 }
2639
2640 count++;
2641 } else {
2642 struct smb_Dir *dir_hnd = NULL;
2643 long offset = 0;
2644 const char *dname = NULL;
2645 char *talloced = NULL;
2646
2647 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2648 status = NT_STATUS_OBJECT_NAME_INVALID;
2649 goto out;
2650 }
2651
2652 if (strequal(fname_mask,"????????.???")) {
2653 TALLOC_FREE(fname_mask);
2654 fname_mask = talloc_strdup(ctx, "*");
2655 if (!fname_mask) {
2656 status = NT_STATUS_NO_MEMORY;
2657 goto out;
2658 }
2659 }
2660
2661 status = check_name(conn, fname_dir);
2662 if (!NT_STATUS_IS_OK(status)) {
2663 goto out;
2664 }
2665
2666 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2667 dirtype);
2668 if (dir_hnd == NULL) {
2669 status = map_nt_error_from_unix(errno);
2670 goto out;
2671 }
2672
2673 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2674 the pattern matches against the long name, otherwise the short name
2675 We don't implement this yet XXXX
2676 */
2677
2678 status = NT_STATUS_NO_SUCH_FILE;
2679
2680 while ((dname = ReadDirName(dir_hnd, &offset,
2681 &smb_fname->st, &talloced))) {
2682 TALLOC_CTX *frame = talloc_stackframe();
2683
2684 if (!is_visible_file(conn, fname_dir, dname,
2685 &smb_fname->st, true)) {
2686 TALLOC_FREE(frame);
2687 TALLOC_FREE(talloced);
2688 continue;
2689 }
2690
2691 /* Quick check for "." and ".." */
2692 if (ISDOT(dname) || ISDOTDOT(dname)) {
2693 TALLOC_FREE(frame);
2694 TALLOC_FREE(talloced);
2695 continue;
2696 }
2697
2698 if(!mask_match(dname, fname_mask,
2699 conn->case_sensitive)) {
2700 TALLOC_FREE(frame);
2701 TALLOC_FREE(talloced);
2702 continue;
2703 }
2704
2705 TALLOC_FREE(smb_fname->base_name);
2706 if (ISDOT(fname_dir)) {
2707 /* Ensure we use canonical names on open. */
2708 smb_fname->base_name =
2709 talloc_asprintf(smb_fname, "%s",
2710 dname);
2711 } else {
2712 smb_fname->base_name =
2713 talloc_asprintf(smb_fname, "%s/%s",
2714 fname_dir, dname);
2715 }
2716
2717 if (!smb_fname->base_name) {
2718 TALLOC_FREE(dir_hnd);
2719 status = NT_STATUS_NO_MEMORY;
2720 TALLOC_FREE(frame);
2721 TALLOC_FREE(talloced);
2722 goto out;
2723 }
2724
2725 status = check_name(conn, smb_fname->base_name);
2726 if (!NT_STATUS_IS_OK(status)) {
2727 TALLOC_FREE(dir_hnd);
2728 TALLOC_FREE(frame);
2729 TALLOC_FREE(talloced);
2730 goto out;
2731 }
2732
2733 status = do_unlink(conn, req, smb_fname, dirtype);
2734 if (!NT_STATUS_IS_OK(status)) {
2735 TALLOC_FREE(frame);
2736 TALLOC_FREE(talloced);
2737 continue;
2738 }
2739
2740 count++;
2741 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2742 smb_fname->base_name));
2743
2744 TALLOC_FREE(frame);
2745 TALLOC_FREE(talloced);
2746 }
2747 TALLOC_FREE(dir_hnd);
2748 }
2749
2750 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2751 status = map_nt_error_from_unix(errno);
2752 }
2753
2754 out:
2755 TALLOC_FREE(fname_dir);
2756 TALLOC_FREE(fname_mask);
2757 return status;
2758 }
2759
2760 /****************************************************************************
2761 Reply to a unlink
2762 ****************************************************************************/
2763
2764 void reply_unlink(struct smb_request *req)
2765 {
2766 connection_struct *conn = req->conn;
2767 char *name = NULL;
2768 struct smb_filename *smb_fname = NULL;
2769 uint32 dirtype;
2770 NTSTATUS status;
2771 bool path_contains_wcard = False;
2772 TALLOC_CTX *ctx = talloc_tos();
2773
2774 START_PROFILE(SMBunlink);
2775
2776 if (req->wct < 1) {
2777 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2778 goto out;
2779 }
2780
2781 dirtype = SVAL(req->vwv+0, 0);
2782
2783 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2784 STR_TERMINATE, &status,
2785 &path_contains_wcard);
2786 if (!NT_STATUS_IS_OK(status)) {
2787 reply_nterror(req, status);
2788 goto out;
2789 }
2790
2791 status = filename_convert(ctx, conn,
2792 req->flags2 & FLAGS2_DFS_PATHNAMES,
2793 name,
2794 UCF_COND_ALLOW_WCARD_LCOMP,
2795 &path_contains_wcard,
2796 &smb_fname);
2797 if (!NT_STATUS_IS_OK(status)) {
2798 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2799 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2800 ERRSRV, ERRbadpath);
2801 goto out;
2802 }
2803 reply_nterror(req, status);
2804 goto out;
2805 }
2806
2807 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2808
2809 status = unlink_internals(conn, req, dirtype, smb_fname,
2810 path_contains_wcard);
2811 if (!NT_STATUS_IS_OK(status)) {
2812 if (open_was_deferred(req->sconn, req->mid)) {
2813 /* We have re-scheduled this call. */
2814 goto out;
2815 }
2816 reply_nterror(req, status);
2817 goto out;
2818 }
2819
2820 reply_outbuf(req, 0, 0);
2821 out:
2822 TALLOC_FREE(smb_fname);
2823 END_PROFILE(SMBunlink);
2824 return;
2825 }
2826
2827 /****************************************************************************
2828 Fail for readbraw.
2829 ****************************************************************************/
2830
2831 static void fail_readraw(void)
2832 {
2833 const char *errstr = talloc_asprintf(talloc_tos(),
2834 "FAIL ! reply_readbraw: socket write fail (%s)",
2835 strerror(errno));
2836 if (!errstr) {
2837 errstr = "";
2838 }
2839 exit_server_cleanly(errstr);
2840 }
2841
2842 /****************************************************************************
2843 Fake (read/write) sendfile. Returns -1 on read or write fail.
2844 ****************************************************************************/
2845
2846 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
2847 {
2848 size_t bufsize;
2849 size_t tosend = nread;
2850 char *buf;
2851
2852 if (nread == 0) {
2853 return 0;
2854 }
2855
2856 bufsize = MIN(nread, 65536);
2857
2858 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2859 return -1;
2860 }
2861
2862 while (tosend > 0) {
2863 ssize_t ret;
2864 size_t cur_read;
2865
2866 if (tosend > bufsize) {
2867 cur_read = bufsize;
2868 } else {
2869 cur_read = tosend;
2870 }
2871 ret = read_file(fsp,buf,startpos,cur_read);
2872 if (ret == -1) {
2873 SAFE_FREE(buf);
2874 return -1;
2875 }
2876
2877 /* If we had a short read, fill with zeros. */
2878 if (ret < cur_read) {
2879 memset(buf + ret, '\0', cur_read - ret);
2880 }
2881
2882 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2883 != cur_read) {
2884 char addr[INET6_ADDRSTRLEN];
2885 /*
2886 * Try and give an error message saying what
2887 * client failed.
2888 */
2889 DEBUG(0, ("write_data failed for client %s. "
2890 "Error %s\n",
2891 get_peer_addr(fsp->conn->sconn->sock, addr,
2892 sizeof(addr)),
2893 strerror(errno)));
2894 SAFE_FREE(buf);
2895 return -1;
2896 }
2897 tosend -= cur_read;
2898 startpos += cur_read;
2899 }
2900
2901 SAFE_FREE(buf);
2902 return (ssize_t)nread;
2903 }
2904
2905 /****************************************************************************
2906 Deal with the case of sendfile reading less bytes from the file than
2907 requested. Fill with zeros (all we can do).
2908 ****************************************************************************/
2909
2910 void sendfile_short_send(files_struct *fsp,
2911 ssize_t nread,
2912 size_t headersize,
2913 size_t smb_maxcnt)
2914 {
2915 #define SHORT_SEND_BUFSIZE 1024
2916 if (nread < headersize) {
2917 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2918 "header for file %s (%s). Terminating\n",
2919 fsp_str_dbg(fsp), strerror(errno)));
2920 exit_server_cleanly("sendfile_short_send failed");
2921 }
2922
2923 nread -= headersize;
2924
2925 if (nread < smb_maxcnt) {
2926 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2927 if (!buf) {
2928 exit_server_cleanly("sendfile_short_send: "
2929 "malloc failed");
2930 }
2931
2932 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2933 "with zeros !\n", fsp_str_dbg(fsp)));
2934
2935 while (nread < smb_maxcnt) {
2936 /*
2937 * We asked for the real file size and told sendfile
2938 * to not go beyond the end of the file. But it can
2939 * happen that in between our fstat call and the
2940 * sendfile call the file was truncated. This is very
2941 * bad because we have already announced the larger
2942 * number of bytes to the client.
2943 *
2944 * The best we can do now is to send 0-bytes, just as
2945 * a read from a hole in a sparse file would do.
2946 *
2947 * This should happen rarely enough that I don't care
2948 * about efficiency here :-)
2949 */
2950 size_t to_write;
2951
2952 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2953 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2954 != to_write) {
2955 char addr[INET6_ADDRSTRLEN];
2956 /*
2957 * Try and give an error message saying what
2958 * client failed.
2959 */
2960 DEBUG(0, ("write_data failed for client %s. "
2961 "Error %s\n",
2962 get_peer_addr(
2963 fsp->conn->sconn->sock, addr,
2964 sizeof(addr)),
2965 strerror(errno)));
2966 exit_server_cleanly("sendfile_short_send: "
2967 "write_data failed");
2968 }
2969 nread += to_write;
2970 }
2971 SAFE_FREE(buf);
2972 }
2973 }
2974
2975 /****************************************************************************
2976 Return a readbraw error (4 bytes of zero).
2977 ****************************************************************************/
2978
2979 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2980 {
2981 char header[4];
2982
2983 SIVAL(header,0,0);
2984
2985 smbd_lock_socket(sconn);
2986 if (write_data(sconn->sock,header,4) != 4) {
2987 char addr[INET6_ADDRSTRLEN];
2988 /*
2989 * Try and give an error message saying what
2990 * client failed.
2991 */
2992 DEBUG(0, ("write_data failed for client %s. "
2993 "Error %s\n",
2994 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2995 strerror(errno)));
2996
2997 fail_readraw();
2998 }
2999 smbd_unlock_socket(sconn);
3000 }
3001
3002 /****************************************************************************
3003 Use sendfile in readbraw.
3004 ****************************************************************************/
3005
3006 static void send_file_readbraw(connection_struct *conn,
3007 struct smb_request *req,
3008 files_struct *fsp,
3009 off_t startpos,
3010 size_t nread,
3011 ssize_t mincount)
3012 {
3013 struct smbd_server_connection *sconn = req->sconn;
3014 char *outbuf = NULL;
3015 ssize_t ret=0;
3016
3017 /*
3018 * We can only use sendfile on a non-chained packet
3019 * but we can use on a non-oplocked file. tridge proved this
3020 * on a train in Germany :-). JRA.
3021 * reply_readbraw has already checked the length.
3022 */
3023
3024 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3025 (fsp->wcp == NULL) &&
3026 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3027 ssize_t sendfile_read = -1;
3028 char header[4];
3029 DATA_BLOB header_blob;
3030
3031 _smb_setlen(header,nread);
3032 header_blob = data_blob_const(header, 4);
3033
3034 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3035 &header_blob, startpos,
3036 nread);
3037 if (sendfile_read == -1) {
3038 /* Returning ENOSYS means no data at all was sent.
3039 * Do this as a normal read. */
3040 if (errno == ENOSYS) {
3041 goto normal_readbraw;
3042 }
3043
3044 /*
3045 * Special hack for broken Linux with no working sendfile. If we
3046 * return EINTR we sent the header but not the rest of the data.
3047 * Fake this up by doing read/write calls.
3048 */
3049 if (errno == EINTR) {
3050 /* Ensure we don't do this again. */
3051 set_use_sendfile(SNUM(conn), False);
3052 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3053
3054 if (fake_sendfile(fsp, startpos, nread) == -1) {
3055 DEBUG(0,("send_file_readbraw: "
3056 "fake_sendfile failed for "
3057 "file %s (%s).\n",
3058 fsp_str_dbg(fsp),
3059 strerror(errno)));
3060 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3061 }
3062 return;
3063 }
3064
3065 DEBUG(0,("send_file_readbraw: sendfile failed for "
3066 "file %s (%s). Terminating\n",
3067 fsp_str_dbg(fsp), strerror(errno)));
3068 exit_server_cleanly("send_file_readbraw sendfile failed");
3069 } else if (sendfile_read == 0) {
3070 /*
3071 * Some sendfile implementations return 0 to indicate
3072 * that there was a short read, but nothing was
3073 * actually written to the socket. In this case,
3074 * fallback to the normal read path so the header gets
3075 * the correct byte count.
3076 */
3077 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3078 "bytes falling back to the normal read: "
3079 "%s\n", fsp_str_dbg(fsp)));
3080 goto normal_readbraw;
3081 }
3082
3083 /* Deal with possible short send. */
3084 if (sendfile_read != 4+nread) {
3085 sendfile_short_send(fsp, sendfile_read, 4, nread);
3086 }
3087 return;
3088 }
3089
3090 normal_readbraw:
3091
3092 outbuf = talloc_array(NULL, char, nread+4);
3093 if (!outbuf) {
3094 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3095 (unsigned)(nread+4)));
3096 reply_readbraw_error(sconn);
3097 return;
3098 }
3099
3100 if (nread > 0) {
3101 ret = read_file(fsp,outbuf+4,startpos,nread);
3102 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3103 if (ret < mincount)
3104 ret = 0;
3105 #else
3106 if (ret < nread)
3107 ret = 0;
3108 #endif
3109 }
3110
3111 _smb_setlen(outbuf,ret);
3112 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3113 char addr[INET6_ADDRSTRLEN];
3114 /*
3115 * Try and give an error message saying what
3116 * client failed.
3117 */
3118 DEBUG(0, ("write_data failed for client %s. "
3119 "Error %s\n",
3120 get_peer_addr(fsp->conn->sconn->sock, addr,
3121 sizeof(addr)),
3122 strerror(errno)));
3123
3124 fail_readraw();
3125 }
3126
3127 TALLOC_FREE(outbuf);
3128 }
3129
3130 /****************************************************************************
3131 Reply to a readbraw (core+ protocol).
3132 ****************************************************************************/
3133
3134 void reply_readbraw(struct smb_request *req)
3135 {
3136 connection_struct *conn = req->conn;
3137 struct smbd_server_connection *sconn = req->sconn;
3138 ssize_t maxcount,mincount;
3139 size_t nread = 0;
3140 off_t startpos;
3141 files_struct *fsp;
3142 struct lock_struct lock;
3143 off_t size = 0;
3144
3145 START_PROFILE(SMBreadbraw);
3146
3147 if (srv_is_signing_active(sconn) ||
3148 is_encrypted_packet(sconn, req->inbuf)) {
3149 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3150 "raw reads/writes are disallowed.");
3151 }
3152
3153 if (req->wct < 8) {
3154 reply_readbraw_error(sconn);
3155 END_PROFILE(SMBreadbraw);
3156 return;
3157 }
3158
3159 if (sconn->smb1.echo_handler.trusted_fde) {
3160 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3161 "'async smb echo handler = yes'\n"));
3162 reply_readbraw_error(sconn);
3163 END_PROFILE(SMBreadbraw);
3164 return;
3165 }
3166
3167 /*
3168 * Special check if an oplock break has been issued
3169 * and the readraw request croses on the wire, we must
3170 * return a zero length response here.
3171 */
3172
3173 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3174
3175 /*
3176 * We have to do a check_fsp by hand here, as
3177 * we must always return 4 zero bytes on error,
3178 * not a NTSTATUS.
3179 */
3180
3181 if (!fsp || !conn || conn != fsp->conn ||
3182 req->vuid != fsp->vuid ||
3183 fsp->is_directory || fsp->fh->fd == -1) {
3184 /*
3185 * fsp could be NULL here so use the value from the packet. JRA.
3186 */
3187 DEBUG(3,("reply_readbraw: fnum %d not valid "
3188 "- cache prime?\n",
3189 (int)SVAL(req->vwv+0, 0)));
3190 reply_readbraw_error(sconn);
3191 END_PROFILE(SMBreadbraw);
3192 return;
3193 }
3194
3195 /* Do a "by hand" version of CHECK_READ. */
3196 if (!(fsp->can_read ||
3197 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3198 (fsp->access_mask & FILE_EXECUTE)))) {
3199 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3200 (int)SVAL(req->vwv+0, 0)));
3201 reply_readbraw_error(sconn);
3202 END_PROFILE(SMBreadbraw);
3203 return;
3204 }
3205
3206 flush_write_cache(fsp, READRAW_FLUSH);
3207
3208 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3209 if(req->wct == 10) {
3210 /*
3211 * This is a large offset (64 bit) read.
3212 */
3213
3214 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3215
3216 if(startpos < 0) {
3217 DEBUG(0,("reply_readbraw: negative 64 bit "
3218 "readraw offset (%.0f) !\n",
3219 (double)startpos ));
3220 reply_readbraw_error(sconn);
3221 END_PROFILE(SMBreadbraw);
3222 return;
3223 }
3224 }
3225
3226 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3227 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3228
3229 /* ensure we don't overrun the packet size */
3230 maxcount = MIN(65535,maxcount);
3231
3232 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3233 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3234 &lock);
3235
3236 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3237 reply_readbraw_error(sconn);
3238 END_PROFILE(SMBreadbraw);
3239 return;
3240 }
3241
3242 if (fsp_stat(fsp) == 0) {
3243 size = fsp->fsp_name->st.st_ex_size;
3244 }
3245
3246 if (startpos >= size) {
3247 nread = 0;
3248 } else {
3249 nread = MIN(maxcount,(size - startpos));
3250 }
3251
3252 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3253 if (nread < mincount)
3254 nread = 0;
3255 #endif
3256
3257 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3258 "min=%lu nread=%lu\n",
3259 fsp->fnum, (double)startpos,
3260 (unsigned long)maxcount,
3261 (unsigned long)mincount,
3262 (unsigned long)nread ) );
3263
3264 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3265
3266 DEBUG(5,("reply_readbraw finished\n"));
3267
3268 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3269
3270 END_PROFILE(SMBreadbraw);
3271 return;
3272 }
3273
3274 #undef DBGC_CLASS
3275 #define DBGC_CLASS DBGC_LOCKING
3276
3277 /****************************************************************************
3278 Reply to a lockread (core+ protocol).
3279 ****************************************************************************/
3280
3281 void reply_lockread(struct smb_request *req)
3282 {
3283 connection_struct *conn = req->conn;
3284 ssize_t nread = -1;
3285 char *data;
3286 off_t startpos;
3287 size_t numtoread;
3288 NTSTATUS status;
3289 files_struct *fsp;
3290 struct byte_range_lock *br_lck = NULL;
3291 char *p = NULL;
3292 struct smbd_server_connection *sconn = req->sconn;
3293
3294 START_PROFILE(SMBlockread);
3295
3296 if (req->wct < 5) {
3297 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3298 END_PROFILE(SMBlockread);
3299 return;
3300 }
3301
3302 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3303
3304 if (!check_fsp(conn, req, fsp)) {
3305 END_PROFILE(SMBlockread);
3306 return;
3307 }
3308
3309 if (!CHECK_READ(fsp,req)) {
3310 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3311 END_PROFILE(SMBlockread);
3312 return;
3313 }
3314
3315 numtoread = SVAL(req->vwv+1, 0);
3316 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3317
3318 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3319
3320 reply_outbuf(req, 5, numtoread + 3);
3321
3322 data = smb_buf(req->outbuf) + 3;
3323
3324 /*
3325 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3326 * protocol request that predates the read/write lock concept.
3327 * Thus instead of asking for a read lock here we need to ask
3328 * for a write lock. JRA.
3329 * Note that the requested lock size is unaffected by max_recv.
3330 */
3331
3332 br_lck = do_lock(req->sconn->msg_ctx,
3333 fsp,
3334 (uint64_t)req->smbpid,
3335 (uint64_t)numtoread,
3336 (uint64_t)startpos,
3337 WRITE_LOCK,
3338 WINDOWS_LOCK,
3339 False, /* Non-blocking lock. */
3340 &status,
3341 NULL,
3342 NULL);
3343 TALLOC_FREE(br_lck);
3344
3345 if (NT_STATUS_V(status)) {
3346 reply_nterror(req, status);
3347 END_PROFILE(SMBlockread);
3348 return;
3349 }
3350
3351 /*
3352 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3353 */
3354
3355 if (numtoread > sconn->smb1.negprot.max_recv) {
3356 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3357 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3358 (unsigned int)numtoread,
3359 (unsigned int)sconn->smb1.negprot.max_recv));
3360 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3361 }
3362 nread = read_file(fsp,data,startpos,numtoread);
3363
3364 if (nread < 0) {
3365 reply_nterror(req, map_nt_error_from_unix(errno));
3366 END_PROFILE(SMBlockread);
3367 return;
3368 }
3369
3370 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3371
3372 SSVAL(req->outbuf,smb_vwv0,nread);
3373 SSVAL(req->outbuf,smb_vwv5,nread+3);
3374 p = smb_buf(req->outbuf);
3375 SCVAL(p,0,0); /* pad byte. */
3376 SSVAL(p,1,nread);
3377
3378 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3379 fsp->fnum, (int)numtoread, (int)nread));
3380
3381 END_PROFILE(SMBlockread);
3382 return;
3383 }
3384
3385 #undef DBGC_CLASS
3386 #define DBGC_CLASS DBGC_ALL
3387
3388 /****************************************************************************
3389 Reply to a read.
3390 ****************************************************************************/
3391
3392 void reply_read(struct smb_request *req)
3393 {
3394 connection_struct *conn = req->conn;
3395 size_t numtoread;
3396 ssize_t nread = 0;
3397 char *data;
3398 off_t startpos;
3399 int outsize = 0;
3400 files_struct *fsp;
3401 struct lock_struct lock;
3402 struct smbd_server_connection *sconn = req->sconn;
3403
3404 START_PROFILE(SMBread);
3405
3406 if (req->wct < 3) {
3407 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3408 END_PROFILE(SMBread);
3409 return;
3410 }
3411
3412 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3413
3414 if (!check_fsp(conn, req, fsp)) {
3415 END_PROFILE(SMBread);
3416 return;
3417 }
3418
3419 if (!CHECK_READ(fsp,req)) {
3420 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3421 END_PROFILE(SMBread);
3422 return;
3423 }
3424
3425 numtoread = SVAL(req->vwv+1, 0);
3426 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3427
3428 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3429
3430 /*
3431 * The requested read size cannot be greater than max_recv. JRA.
3432 */
3433 if (numtoread > sconn->smb1.negprot.max_recv) {
3434 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3435 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3436 (unsigned int)numtoread,
3437 (unsigned int)sconn->smb1.negprot.max_recv));
3438 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3439 }
3440
3441 reply_outbuf(req, 5, numtoread+3);
3442
3443 data = smb_buf(req->outbuf) + 3;
3444
3445 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3446 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3447 &lock);
3448
3449 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3450 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3451 END_PROFILE(SMBread);
3452 return;
3453 }
3454
3455 if (numtoread > 0)
3456 nread = read_file(fsp,data,startpos,numtoread);
3457
3458 if (nread < 0) {
3459 reply_nterror(req, map_nt_error_from_unix(errno));
3460 goto strict_unlock;
3461 }
3462
3463 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3464
3465 SSVAL(req->outbuf,smb_vwv0,nread);
3466 SSVAL(req->outbuf,smb_vwv5,nread+3);
3467 SCVAL(smb_buf(req->outbuf),0,1);
3468 SSVAL(smb_buf(req->outbuf),1,nread);
3469
3470 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3471 fsp->fnum, (int)numtoread, (int)nread ) );
3472
3473 strict_unlock:
3474 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3475
3476 END_PROFILE(SMBread);
3477 return;
3478 }
3479
3480 /****************************************************************************
3481 Setup readX header.
3482 ****************************************************************************/
3483
3484 static int setup_readX_header(struct smb_request *req, char *outbuf,
3485 size_t smb_maxcnt)
3486 {
3487 int outsize;
3488
3489 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3490
3491 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3492
3493 SCVAL(outbuf,smb_vwv0,0xFF);
3494 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3495 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3496 SSVAL(outbuf,smb_vwv6,
3497 (smb_wct - 4) /* offset from smb header to wct */
3498 + 1 /* the wct field */
3499 + 12 * sizeof(uint16_t) /* vwv */
3500 + 2); /* the buflen field */
3501 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3502 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3503 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3504 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3505 return outsize;
3506 }
3507
3508 /****************************************************************************
3509 Reply to a read and X - possibly using sendfile.
3510 ****************************************************************************/
3511
3512 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3513 files_struct *fsp, off_t startpos,
3514 size_t smb_maxcnt)
3515 {
3516 ssize_t nread = -1;
3517 struct lock_struct lock;
3518 int saved_errno = 0;
3519
3520 if(fsp_stat(fsp) == -1) {
3521 reply_nterror(req, map_nt_error_from_unix(errno));
3522 return;
3523 }
3524
3525 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3526 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3527 &lock);
3528
3529 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3530 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3531 return;
3532 }
3533
3534 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3535 (startpos > fsp->fsp_name->st.st_ex_size)
3536 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3537 /*
3538 * We already know that we would do a short read, so don't
3539 * try the sendfile() path.
3540 */
3541 goto nosendfile_read;
3542 }
3543
3544 /*
3545 * We can only use sendfile on a non-chained packet
3546 * but we can use on a non-oplocked file. tridge proved this
3547 * on a train in Germany :-). JRA.
3548 */
3549
3550 if (!req_is_in_chain(req) &&
3551 !is_encrypted_packet(req->sconn, req->inbuf) &&
3552 (fsp->base_fsp == NULL) &&
3553 (fsp->wcp == NULL) &&
3554 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3555 uint8 headerbuf[smb_size + 12 * 2];
3556 DATA_BLOB header;
3557
3558 /*
3559 * Set up the packet header before send. We
3560 * assume here the sendfile will work (get the
3561 * correct amount of data).
3562 */
3563
3564 header = data_blob_const(headerbuf, sizeof(headerbuf));
3565
3566 construct_reply_common_req(req, (char *)headerbuf);
3567 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3568
3569 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3570 startpos, smb_maxcnt);
3571 if (nread == -1) {
3572 /* Returning ENOSYS means no data at all was sent.
3573 Do this as a normal read. */
3574 if (errno == ENOSYS) {
3575 goto normal_read;
3576 }
3577
3578 /*
3579 * Special hack for broken Linux with no working sendfile. If we
3580 * return EINTR we sent the header but not the rest of the data.
3581 * Fake this up by doing read/write calls.
3582 */
3583
3584 if (errno == EINTR) {
3585 /* Ensure we don't do this again. */
3586 set_use_sendfile(SNUM(conn), False);
3587 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3588 nread = fake_sendfile(fsp, startpos,
3589 smb_maxcnt);
3590 if (nread == -1) {
3591 DEBUG(0,("send_file_readX: "
3592 "fake_sendfile failed for "
3593 "file %s (%s).\n",
3594 fsp_str_dbg(fsp),
3595 strerror(errno)));
3596 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3597 }
3598 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3599 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3600 /* No outbuf here means successful sendfile. */
3601 goto strict_unlock;
3602 }
3603
3604 DEBUG(0,("send_file_readX: sendfile failed for file "
3605 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3606 strerror(errno)));
3607 exit_server_cleanly("send_file_readX sendfile failed");
3608 } else if (nread == 0) {
3609 /*
3610 * Some sendfile implementations return 0 to indicate
3611 * that there was a short read, but nothing was
3612 * actually written to the socket. In this case,
3613 * fallback to the normal read path so the header gets
3614 * the correct byte count.
3615 */
3616 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3617 "falling back to the normal read: %s\n",
3618 fsp_str_dbg(fsp)));
3619 goto normal_read;
3620 }
3621
3622 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3623 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3624
3625 /* Deal with possible short send. */
3626 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3627 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3628 }
3629 /* No outbuf here means successful sendfile. */
3630 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3631 SMB_PERFCOUNT_END(&req->pcd);
3632 goto strict_unlock;
3633 }
3634
3635 normal_read:
3636
3637 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3638 uint8 headerbuf[smb_size + 2*12];
3639
3640 construct_reply_common_req(req, (char *)headerbuf);
3641 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3642
3643 /* Send out the header. */
3644 if (write_data(req->sconn->sock, (char *)headerbuf,
3645 sizeof(headerbuf)) != sizeof(headerbuf)) {
3646
3647 char addr[INET6_ADDRSTRLEN];
3648 /*
3649 * Try and give an error message saying what
3650 * client failed.
3651 */
3652 DEBUG(0, ("write_data failed for client %s. "
3653 "Error %s\n",
3654 get_peer_addr(req->sconn->sock, addr,
3655 sizeof(addr)),
3656 strerror(errno)));
3657
3658 DEBUG(0,("send_file_readX: write_data failed for file "
3659 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3660 strerror(errno)));
3661 exit_server_cleanly("send_file_readX sendfile failed");
3662 }
3663 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3664 if (nread == -1) {
3665 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3666 "file %s (%s).\n", fsp_str_dbg(fsp),
3667 strerror(errno)));
3668 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3669 }
3670 goto strict_unlock;
3671 }
3672
3673 nosendfile_read:
3674
3675 reply_outbuf(req, 12, smb_maxcnt);
3676 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3677 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3678
3679 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3680 saved_errno = errno;
3681
3682 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3683
3684 if (nread < 0) {
3685 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3686 return;
3687 }
3688
3689 setup_readX_header(req, (char *)req->outbuf, nread);
3690
3691 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3692 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3693 return;
3694
3695 strict_unlock:
3696 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3697 TALLOC_FREE(req->outbuf);
3698 return;
3699 }
3700
3701 /****************************************************************************
3702 Reply to a read and X.
3703 ****************************************************************************/
3704
3705 void reply_read_and_X(struct smb_request *req)
3706 {
3707 struct smbd_server_connection *sconn = req->sconn;
3708 connection_struct *conn = req->conn;
3709 files_struct *fsp;
3710 off_t startpos;
3711 size_t smb_maxcnt;
3712 bool big_readX = False;
3713 #if 0
3714 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3715 #endif
3716
3717 START_PROFILE(SMBreadX);
3718
3719 if ((req->wct != 10) && (req->wct != 12)) {
3720 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3721 return;
3722 }
3723
3724 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3725 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3726 smb_maxcnt = SVAL(req->vwv+5, 0);
3727
3728 /* If it's an IPC, pass off the pipe handler. */
3729 if (IS_IPC(conn)) {
3730 reply_pipe_read_and_X(req);
3731 END_PROFILE(SMBreadX);
3732 return;
3733 }
3734
3735 if (!check_fsp(conn, req, fsp)) {
3736 END_PROFILE(SMBreadX);
3737 return;
3738 }
3739
3740 if (!CHECK_READ(fsp,req)) {
3741 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3742 END_PROFILE(SMBreadX);
3743 return;
3744 }
3745
3746 if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3747 (get_remote_arch() == RA_SAMBA)) {
3748 /*
3749 * This is Samba only behavior (up to Samba 3.6)!
3750 *
3751 * Windows 2008 R2 ignores the upper_size,
3752 * so we do unless unix extentions are active
3753 * or "smbclient" is talking to us.
3754 */
3755 size_t upper_size = SVAL(req->vwv+7, 0);
3756 smb_maxcnt |= (upper_size<<16);
3757 if (upper_size > 1) {
3758 /* Can't do this on a chained packet. */
3759 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3760 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3761 END_PROFILE(SMBreadX);
3762 return;
3763 }
3764 /* We currently don't do this on signed or sealed data. */
3765 if (srv_is_signing_active(req->sconn) ||
3766 is_encrypted_packet(req->sconn, req->inbuf)) {
3767 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3768 END_PROFILE(SMBreadX);
3769 return;
3770 }
3771 /* Is there room in the reply for this data ? */
3772 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3773 reply_nterror(req,
3774 NT_STATUS_INVALID_PARAMETER);
3775 END_PROFILE(SMBreadX);
3776 return;
3777 }
3778 big_readX = True;
3779 }
3780 }
3781
3782 if (req->wct == 12) {
3783 /*
3784 * This is a large offset (64 bit) read.
3785 */
3786 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
3787
3788 }
3789
3790 if (!big_readX) {
3791 NTSTATUS status = schedule_aio_read_and_X(conn,
3792 req,
3793 fsp,
3794 startpos,
3795 smb_maxcnt);
3796 if (NT_STATUS_IS_OK(status)) {
3797 /* Read scheduled - we're done. */
3798 goto out;
3799 }
3800 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3801 /* Real error - report to client. */
3802 END_PROFILE(SMBreadX);
3803 reply_nterror(req, status);
3804 return;
3805 }
3806 /* NT_STATUS_RETRY - fall back to sync read. */
3807 }
3808
3809 smbd_lock_socket(req->sconn);
3810 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3811 smbd_unlock_socket(req->sconn);
3812
3813 out:
3814 END_PROFILE(SMBreadX);
3815 return;
3816 }
3817
3818 /****************************************************************************
3819 Error replies to writebraw must have smb_wct == 1. Fix this up.
3820 ****************************************************************************/
3821
3822 void error_to_writebrawerr(struct smb_request *req)
3823 {
3824 uint8 *old_outbuf = req->outbuf;
3825
3826 reply_outbuf(req, 1, 0);
3827
3828 memcpy(req->outbuf, old_outbuf, smb_size);
3829 TALLOC_FREE(old_outbuf);
3830 }
3831
3832 /****************************************************************************
3833 Read 4 bytes of a smb packet and return the smb length of the packet.
3834 Store the result in the buffer. This version of the function will
3835 never return a session keepalive (length of zero).
3836 Timeout is in milliseconds.
3837 ****************************************************************************/
3838
3839 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3840 size_t *len)
3841 {
3842 uint8_t msgtype = NBSSkeepalive;
3843
3844 while (msgtype == NBSSkeepalive) {
3845 NTSTATUS status;
3846
3847 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3848 len);
3849 if (!NT_STATUS_IS_OK(status)) {
3850 char addr[INET6_ADDRSTRLEN];
3851 /* Try and give an error message
3852 * saying what client failed. */
3853 DEBUG(0, ("read_fd_with_timeout failed for "
3854 "client %s read error = %s.\n",
3855 get_peer_addr(fd,addr,sizeof(addr)),
3856 nt_errstr(status)));
3857 return status;
3858 }
3859
3860 msgtype = CVAL(inbuf, 0);
3861 }
3862
3863 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3864 (unsigned long)len));
3865
3866 return NT_STATUS_OK;
3867 }
3868
3869 /****************************************************************************
3870 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3871 ****************************************************************************/
3872
3873 void reply_writebraw(struct smb_request *req)
3874 {
3875 connection_struct *conn = req->conn;
3876 char *buf = NULL;
3877 ssize_t nwritten=0;
3878 ssize_t total_written=0;
3879 size_t numtowrite=0;
3880 size_t tcount;
3881 off_t startpos;
3882 const char *data=NULL;
3883 bool write_through;
3884 files_struct *fsp;
3885 struct lock_struct lock;
3886 NTSTATUS status;
3887
3888 START_PROFILE(SMBwritebraw);
3889
3890 /*
3891 * If we ever reply with an error, it must have the SMB command
3892 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3893 * we're finished.
3894 */
3895 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3896
3897 if (srv_is_signing_active(req->sconn)) {
3898 END_PROFILE(SMBwritebraw);
3899 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3900 "raw reads/writes are disallowed.");
3901 }
3902
3903 if (req->wct < 12) {
3904 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3905 error_to_writebrawerr(req);
3906 END_PROFILE(SMBwritebraw);
3907 return;
3908 }
3909
3910 if (req->sconn->smb1.echo_handler.trusted_fde) {
3911 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3912 "'async smb echo handler = yes'\n"));
3913 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3914 error_to_writebrawerr(req);
3915 END_PROFILE(SMBwritebraw);
3916 return;
3917 }
3918
3919 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3920 if (!check_fsp(conn, req, fsp)) {
3921 error_to_writebrawerr(req);
3922 END_PROFILE(SMBwritebraw);
3923 return;
3924 }
3925
3926 if (!CHECK_WRITE(fsp)) {
3927 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3928 error_to_writebrawerr(req);
3929 END_PROFILE(SMBwritebraw);
3930 return;
3931 }
3932
3933 tcount = IVAL(req->vwv+1, 0);
3934 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3935 write_through = BITSETW(req->vwv+7,0);
3936
3937 /* We have to deal with slightly different formats depending
3938 on whether we are using the core+ or lanman1.0 protocol */
3939
3940 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3941 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
3942 data = smb_buf_const(req->inbuf);
3943 } else {
3944 numtowrite = SVAL(req->vwv+10, 0);
3945 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3946 }
3947
3948 /* Ensure we don't write bytes past the end of this packet. */
3949 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3950 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3951 error_to_writebrawerr(req);
3952 END_PROFILE(SMBwritebraw);
3953 return;
3954 }
3955
3956 if (!fsp->print_file) {
3957 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3958 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3959 &lock);
3960
3961 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3962 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3963 error_to_writebrawerr(req);
3964 END_PROFILE(SMBwritebraw);
3965 return;
3966 }
3967 }
3968
3969 if (numtowrite>0) {
3970 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3971 }
3972
3973 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3974 "wrote=%d sync=%d\n",
3975 fsp->fnum, (double)startpos, (int)numtowrite,
3976 (int)nwritten, (int)write_through));
3977
3978 if (nwritten < (ssize_t)numtowrite) {
3979 reply_nterror(req, NT_STATUS_DISK_FULL);
3980 error_to_writebrawerr(req);
3981 goto strict_unlock;
3982 }
3983
3984 total_written = nwritten;
3985
3986 /* Allocate a buffer of 64k + length. */
3987 buf = talloc_array(NULL, char, 65540);
3988 if (!buf) {
3989 reply_nterror(req, NT_STATUS_NO_MEMORY);
3990 error_to_writebrawerr(req);
3991 goto strict_unlock;
3992 }
3993
3994 /* Return a SMBwritebraw message to the redirector to tell
3995 * it to send more bytes */
3996
3997 memcpy(buf, req->inbuf, smb_size);
3998 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3999 SCVAL(buf,smb_com,SMBwritebraw);
4000 SSVALS(buf,smb_vwv0,0xFFFF);
4001 show_msg(buf);
4002 if (!srv_send_smb(req->sconn,
4003 buf,
4004 false, 0, /* no signing */
4005 IS_CONN_ENCRYPTED(conn),
4006 &req->pcd)) {
4007 exit_server_cleanly("reply_writebraw: srv_send_smb "
4008 "failed.");
4009 }
4010
4011 /* Now read the raw data into the buffer and write it */
4012 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4013 &numtowrite);
4014 if (!NT_STATUS_IS_OK(status)) {
4015 exit_server_cleanly("secondary writebraw failed");
4016 }
4017
4018 /* Set up outbuf to return the correct size */
4019 reply_outbuf(req, 1, 0);
4020
4021 if (numtowrite != 0) {
4022
4023 if (numtowrite > 0xFFFF) {
4024 DEBUG(0,("reply_writebraw: Oversize secondary write "
4025 "raw requested (%u). Terminating\n",
4026 (unsigned int)numtowrite ));
4027 exit_server_cleanly("secondary writebraw failed");
4028 }
4029
4030 if (tcount > nwritten+numtowrite) {
4031 DEBUG(3,("reply_writebraw: Client overestimated the "
4032 "write %d %d %d\n",
4033 (int)tcount,(int)nwritten,(int)numtowrite));
4034 }
4035
4036 status = read_data(req->sconn->sock, buf+4, numtowrite);
4037
4038 if (!NT_STATUS_IS_OK(status)) {
4039 char addr[INET6_ADDRSTRLEN];
4040 /* Try and give an error message
4041 * saying what client failed. */
4042 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4043 "raw read failed (%s) for client %s. "
4044 "Terminating\n", nt_errstr(status),
4045 get_peer_addr(req->sconn->sock, addr,
4046 sizeof(addr))));
4047 exit_server_cleanly("secondary writebraw failed");
4048 }
4049
4050 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4051 if (nwritten == -1) {
4052 TALLOC_FREE(buf);
4053 reply_nterror(req, map_nt_error_from_unix(errno));
4054 error_to_writebrawerr(req);
4055 goto strict_unlock;
4056 }
4057
4058 if (nwritten < (ssize_t)numtowrite) {
4059 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4060 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4061 }
4062
4063 if (nwritten > 0) {
4064 total_written += nwritten;
4065 }
4066 }
4067
4068 TALLOC_FREE(buf);
4069 SSVAL(req->outbuf,smb_vwv0,total_written);
4070
4071 status = sync_file(conn, fsp, write_through);
4072 if (!NT_STATUS_IS_OK(status)) {
4073 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4074 fsp_str_dbg(fsp), nt_errstr(status)));
4075 reply_nterror(req, status);
4076 error_to_writebrawerr(req);
4077 goto strict_unlock;
4078 }
4079
4080 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4081 "wrote=%d\n",
4082 fsp->fnum, (double)startpos, (int)numtowrite,
4083 (int)total_written));
4084
4085 if (!fsp->print_file) {
4086 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4087 }
4088
4089 /* We won't return a status if write through is not selected - this
4090 * follows what WfWg does */
4091 END_PROFILE(SMBwritebraw);
4092
4093 if (!write_through && total_written==tcount) {
4094
4095 #if RABBIT_PELLET_FIX
4096 /*
4097 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4098 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4099 * JRA.
4100 */
4101 if (!send_keepalive(req->sconn->sock)) {
4102 exit_server_cleanly("reply_writebraw: send of "
4103 "keepalive failed");
4104 }
4105 #endif
4106 TALLOC_FREE(req->outbuf);
4107 }
4108 return;
4109
4110 strict_unlock:
4111 if (!fsp->print_file) {
4112 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4113 }
4114
4115 END_PROFILE(SMBwritebraw);
4116 return;
4117 }
4118
4119 #undef DBGC_CLASS
4120 #define DBGC_CLASS DBGC_LOCKING
4121
4122 /****************************************************************************
4123 Reply to a writeunlock (core+).
4124 ****************************************************************************/
4125
4126 void reply_writeunlock(struct smb_request *req)
4127 {
4128 connection_struct *conn = req->conn;
4129 ssize_t nwritten = -1;
4130 size_t numtowrite;
4131 off_t startpos;
4132 const char *data;
4133 NTSTATUS status = NT_STATUS_OK;
4134 files_struct *fsp;
4135 struct lock_struct lock;
4136 int saved_errno = 0;
4137
4138 START_PROFILE(SMBwriteunlock);
4139
4140 if (req->wct < 5) {
4141 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4142 END_PROFILE(SMBwriteunlock);
4143 return;
4144 }
4145
4146 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4147
4148 if (!check_fsp(conn, req, fsp)) {
4149 END_PROFILE(SMBwriteunlock);
4150 return;
4151 }
4152
4153 if (!CHECK_WRITE(fsp)) {
4154 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4155 END_PROFILE(SMBwriteunlock);
4156 return;
4157 }
4158
4159 numtowrite = SVAL(req->vwv+1, 0);
4160 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4161 data = (const char *)req->buf + 3;
4162
4163 if (!fsp->print_file && numtowrite > 0) {
4164 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4165 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4166 &lock);
4167
4168 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4169 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4170 END_PROFILE(SMBwriteunlock);
4171 return;
4172 }
4173 }
4174
4175 /* The special X/Open SMB protocol handling of
4176 zero length writes is *NOT* done for
4177 this call */
4178 if(numtowrite == 0) {
4179 nwritten = 0;
4180 } else {
4181 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4182 saved_errno = errno;
4183 }
4184
4185 status = sync_file(conn, fsp, False /* write through */);
4186 if (!NT_STATUS_IS_OK(status)) {
4187 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4188 fsp_str_dbg(fsp), nt_errstr(status)));
4189 reply_nterror(req, status);
4190 goto strict_unlock;
4191 }
4192
4193 if(nwritten < 0) {
4194 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4195 goto strict_unlock;
4196 }
4197
4198 if((nwritten < numtowrite) && (numtowrite != 0)) {
4199 reply_nterror(req, NT_STATUS_DISK_FULL);
4200 goto strict_unlock;
4201 }
4202
4203 if (numtowrite && !fsp->print_file) {
4204 status = do_unlock(req->sconn->msg_ctx,
4205 fsp,
4206 (uint64_t)req->smbpid,
4207 (uint64_t)numtowrite,
4208 (uint64_t)startpos,
4209 WINDOWS_LOCK);
4210
4211 if (NT_STATUS_V(status)) {
4212 reply_nterror(req, status);
4213 goto strict_unlock;
4214 }
4215 }
4216
4217 reply_outbuf(req, 1, 0);
4218
4219 SSVAL(req->outbuf,smb_vwv0,nwritten);
4220
4221 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4222 fsp->fnum, (int)numtowrite, (int)nwritten));
4223
4224 strict_unlock:
4225 if (numtowrite && !fsp->print_file) {
4226 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4227 }
4228
4229 END_PROFILE(SMBwriteunlock);
4230 return;
4231 }
4232
4233 #undef DBGC_CLASS
4234 #define DBGC_CLASS DBGC_ALL
4235
4236 /****************************************************************************
4237 Reply to a write.
4238 ****************************************************************************/
4239
4240 void reply_write(struct smb_request *req)
4241 {
4242 connection_struct *conn = req->conn;
4243 size_t numtowrite;
4244 ssize_t nwritten = -1;
4245 off_t startpos;
4246 const char *data;
4247 files_struct *fsp;
4248 struct lock_struct lock;
4249 NTSTATUS status;
4250 int saved_errno = 0;
4251
4252 START_PROFILE(SMBwrite);
4253
4254 if (req->wct < 5) {
4255 END_PROFILE(SMBwrite);
4256 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4257 return;
4258 }
4259
4260 /* If it's an IPC, pass off the pipe handler. */
4261 if (IS_IPC(conn)) {
4262 reply_pipe_write(req);
4263 END_PROFILE(SMBwrite);
4264 return;
4265 }
4266
4267 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4268
4269 if (!check_fsp(conn, req, fsp)) {
4270 END_PROFILE(SMBwrite);
4271 return;
4272 }
4273
4274 if (!CHECK_WRITE(fsp)) {
4275 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4276 END_PROFILE(SMBwrite);
4277 return;
4278 }
4279
4280 numtowrite = SVAL(req->vwv+1, 0);
4281 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4282 data = (const char *)req->buf + 3;
4283
4284 if (!fsp->print_file) {
4285 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4286 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4287 &lock);
4288
4289 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4290 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4291 END_PROFILE(SMBwrite);
4292 return;
4293 }
4294 }
4295
4296 /*
4297 * X/Open SMB protocol says that if smb_vwv1 is
4298 * zero then the file size should be extended or
4299 * truncated to the size given in smb_vwv[2-3].
4300 */
4301
4302 if(numtowrite == 0) {
4303 /*
4304 * This is actually an allocate call, and set EOF. JRA.
4305 */
4306 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4307 if (nwritten < 0) {
4308 reply_nterror(req, NT_STATUS_DISK_FULL);
4309 goto strict_unlock;
4310 }
4311 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4312 if (nwritten < 0) {
4313 reply_nterror(req, NT_STATUS_DISK_FULL);
4314 goto strict_unlock;
4315 }
4316 trigger_write_time_update_immediate(fsp);
4317 } else {
4318 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4319 }
4320
4321 status = sync_file(conn, fsp, False);
4322 if (!NT_STATUS_IS_OK(status)) {
4323 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4324 fsp_str_dbg(fsp), nt_errstr(status)));
4325 reply_nterror(req, status);
4326 goto strict_unlock;
4327 }
4328
4329 if(nwritten < 0) {
4330 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4331 goto strict_unlock;
4332 }
4333
4334 if((nwritten == 0) && (numtowrite != 0)) {
4335 reply_nterror(req, NT_STATUS_DISK_FULL);
4336 goto strict_unlock;
4337 }
4338
4339 reply_outbuf(req, 1, 0);
4340
4341 SSVAL(req->outbuf,smb_vwv0,nwritten);
4342
4343 if (nwritten < (ssize_t)numtowrite) {
4344 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4345 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4346 }
4347
4348 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4349
4350 strict_unlock:
4351 if (!fsp->print_file) {
4352 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4353 }
4354
4355 END_PROFILE(SMBwrite);
4356 return;
4357 }
4358
4359 /****************************************************************************
4360 Ensure a buffer is a valid writeX for recvfile purposes.
4361 ****************************************************************************/
4362
4363 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4364 (2*14) + /* word count (including bcc) */ \
4365 1 /* pad byte */)
4366
4367 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4368 const uint8_t *inbuf)
4369 {
4370 size_t numtowrite;
4371 connection_struct *conn = NULL;
4372 unsigned int doff = 0;
4373 size_t len = smb_len_large(inbuf);
4374
4375 if (is_encrypted_packet(sconn, inbuf)) {
4376 /* Can't do this on encrypted
4377 * connections. */
4378 return false;
4379 }
4380
4381 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4382 return false;
4383 }
4384
4385 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4386 CVAL(inbuf,smb_wct) != 14) {
4387 DEBUG(10,("is_valid_writeX_buffer: chained or "
4388 "invalid word length.\n"));
4389 return false;
4390 }
4391
4392 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4393 if (conn == NULL) {
4394 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4395 return false;
4396 }
4397 if (IS_IPC(conn)) {
4398 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4399 return false;
4400 }
4401 if (IS_PRINT(conn)) {
4402 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4403 return false;
4404 }
4405 doff = SVAL(inbuf,smb_vwv11);
4406
4407 numtowrite = SVAL(inbuf,smb_vwv10);
4408
4409 if (len > doff && len - doff > 0xFFFF) {
4410 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4411 }
4412
4413 if (numtowrite == 0) {
4414 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4415 return false;
4416 }
4417
4418 /* Ensure the sizes match up. */
4419 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4420 /* no pad byte...old smbclient :-( */
4421 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4422 (unsigned int)doff,
4423 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4424 return false;
4425 }
4426
4427 if (len - doff != numtowrite) {
4428 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4429 "len = %u, doff = %u, numtowrite = %u\n",
4430 (unsigned int)len,
4431 (unsigned int)doff,
4432 (unsigned int)numtowrite ));
4433 return false;
4434 }
4435
4436 DEBUG(10,("is_valid_writeX_buffer: true "
4437 "len = %u, doff = %u, numtowrite = %u\n",
4438 (unsigned int)len,
4439 (unsigned int)doff,
4440 (unsigned int)numtowrite ));
4441
4442 return true;
4443 }
4444
4445 /****************************************************************************
4446 Reply to a write and X.
4447 ****************************************************************************/
4448
4449 void reply_write_and_X(struct smb_request *req)
4450 {
4451 connection_struct *conn = req->conn;
4452 files_struct *fsp;
4453 struct lock_struct lock;
4454 off_t startpos;
4455 size_t numtowrite;
4456 bool write_through;
4457 ssize_t nwritten;
4458 unsigned int smb_doff;
4459 unsigned int smblen;
4460 const char *data;
4461 NTSTATUS status;
4462 int saved_errno = 0;
4463
4464 START_PROFILE(SMBwriteX);
4465
4466 if ((req->wct != 12) && (req->wct != 14)) {
4467 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4468 goto out;
4469 }
4470
4471 numtowrite = SVAL(req->vwv+10, 0);
4472 smb_doff = SVAL(req->vwv+11, 0);
4473 smblen = smb_len(req->inbuf);
4474
4475 if (req->unread_bytes > 0xFFFF ||
4476 (smblen > smb_doff &&
4477 smblen - smb_doff > 0xFFFF)) {
4478 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4479 }
4480
4481 if (req->unread_bytes) {
4482 /* Can't do a recvfile write on IPC$ */
4483 if (IS_IPC(conn)) {
4484 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4485 goto out;
4486 }
4487 if (numtowrite != req->unread_bytes) {
4488 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4489 goto out;
4490 }
4491 } else {
4492 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4493 smb_doff + numtowrite > smblen) {
4494 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4495 goto out;
4496 }
4497 }
4498
4499 /* If it's an IPC, pass off the pipe handler. */
4500 if (IS_IPC(conn)) {
4501 if (req->unread_bytes) {
4502 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4503 goto out;
4504 }
4505 reply_pipe_write_and_X(req);
4506 goto out;
4507 }
4508
4509 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4510 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4511 write_through = BITSETW(req->vwv+7,0);
4512
4513 if (!check_fsp(conn, req, fsp)) {
4514 goto out;
4515 }
4516
4517 if (!CHECK_WRITE(fsp)) {
4518 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4519 goto out;
4520 }
4521
4522 data = smb_base(req->inbuf) + smb_doff;
4523
4524 if(req->wct == 14) {
4525 /*
4526 * This is a large offset (64 bit) write.
4527 */
4528 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4529
4530 }
4531
4532 /* X/Open SMB protocol says that, unlike SMBwrite
4533 if the length is zero then NO truncation is
4534 done, just a write of zero. To truncate a file,
4535 use SMBwrite. */
4536
4537 if(numtowrite == 0) {
4538 nwritten = 0;
4539 } else {
4540 if (req->unread_bytes == 0) {
4541 status = schedule_aio_write_and_X(conn,
4542 req,
4543 fsp,
4544 data,
4545 startpos,
4546 numtowrite);
4547
4548 if (NT_STATUS_IS_OK(status)) {
4549 /* write scheduled - we're done. */
4550 goto out;
4551 }
4552 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4553 /* Real error - report to client. */
4554 reply_nterror(req, status);
4555 goto out;
4556 }
4557 /* NT_STATUS_RETRY - fall through to sync write. */
4558 }
4559
4560 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4561 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4562 &lock);
4563
4564 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4565 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4566 goto out;
4567 }
4568
4569 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4570 saved_errno = errno;
4571
4572 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4573 }
4574
4575 if(nwritten < 0) {
4576 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4577 goto out;
4578 }
4579
4580 if((nwritten == 0) && (numtowrite != 0)) {
4581 reply_nterror(req, NT_STATUS_DISK_FULL);
4582 goto out;
4583 }
4584
4585 reply_outbuf(req, 6, 0);
4586 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4587 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4588 SSVAL(req->outbuf,smb_vwv2,nwritten);
4589 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4590
4591 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4592 fsp->fnum, (int)numtowrite, (int)nwritten));
4593
4594 status = sync_file(conn, fsp, write_through);
4595 if (!NT_STATUS_IS_OK(status)) {
4596 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4597 fsp_str_dbg(fsp), nt_errstr(status)));
4598 reply_nterror(req, status);
4599 goto out;
4600 }
4601
4602 END_PROFILE(SMBwriteX);
4603 return;
4604
4605 out:
4606 if (req->unread_bytes) {
4607 /* writeX failed. drain socket. */
4608 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4609 req->unread_bytes) {
4610 smb_panic("failed to drain pending bytes");
4611 }
4612 req->unread_bytes = 0;
4613 }
4614
4615 END_PROFILE(SMBwriteX);
4616 return;
4617 }
4618
4619 /****************************************************************************
4620 Reply to a lseek.
4621 ****************************************************************************/
4622
4623 void reply_lseek(struct smb_request *req)
4624 {
4625 connection_struct *conn = req->conn;
4626 off_t startpos;
4627 off_t res= -1;
4628 int mode,umode;
4629 files_struct *fsp;
4630
4631 START_PROFILE(SMBlseek);
4632
4633 if (req->wct < 4) {
4634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4635 END_PROFILE(SMBlseek);
4636 return;
4637 }
4638
4639 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4640
4641 if (!check_fsp(conn, req, fsp)) {
4642 return;
4643 }
4644
4645 flush_write_cache(fsp, SEEK_FLUSH);
4646
4647 mode = SVAL(req->vwv+1, 0) & 3;
4648 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4649 startpos = (off_t)IVALS(req->vwv+2, 0);
4650
4651 switch (mode) {
4652 case 0:
4653 umode = SEEK_SET;
4654 res = startpos;
4655 break;
4656 case 1:
4657 umode = SEEK_CUR;
4658 res = fsp->fh->pos + startpos;
4659 break;
4660 case 2:
4661 umode = SEEK_END;
4662 break;
4663 default:
4664 umode = SEEK_SET;
4665 res = startpos;
4666 break;
4667 }
4668
4669 if (umode == SEEK_END) {
4670 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4671 if(errno == EINVAL) {
4672 off_t current_pos = startpos;
4673
4674 if(fsp_stat(fsp) == -1) {
4675 reply_nterror(req,
4676 map_nt_error_from_unix(errno));
4677 END_PROFILE(SMBlseek);
4678 return;
4679 }
4680
4681 current_pos += fsp->fsp_name->st.st_ex_size;
4682 if(current_pos < 0)
4683 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4684 }
4685 }
4686
4687 if(res == -1) {
4688 reply_nterror(req, map_nt_error_from_unix(errno));
4689 END_PROFILE(SMBlseek);
4690 return;
4691 }
4692 }
4693
4694 fsp->fh->pos = res;
4695
4696 reply_outbuf(req, 2, 0);
4697 SIVAL(req->outbuf,smb_vwv0,res);
4698
4699 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4700 fsp->fnum, (double)startpos, (double)res, mode));
4701
4702 END_PROFILE(SMBlseek);
4703 return;
4704 }
4705
4706 /****************************************************************************
4707 Reply to a flush.
4708 ****************************************************************************/
4709
4710 void reply_flush(struct smb_request *req)
4711 {
4712 connection_struct *conn = req->conn;
4713 uint16 fnum;
4714 files_struct *fsp;
4715
4716 START_PROFILE(SMBflush);
4717
4718 if (req->wct < 1) {
4719 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4720 return;
4721 }
4722
4723 fnum = SVAL(req->vwv+0, 0);
4724 fsp = file_fsp(req, fnum);
4725
4726 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4727 return;
4728 }
4729
4730 if (!fsp) {
4731 file_sync_all(conn);
4732 } else {
4733 NTSTATUS status = sync_file(conn, fsp, True);
4734 if (!NT_STATUS_IS_OK(status)) {
4735 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4736 fsp_str_dbg(fsp), nt_errstr(status)));
4737 reply_nterror(req, status);
4738 END_PROFILE(SMBflush);
4739 return;
4740 }
4741 }
4742
4743 reply_outbuf(req, 0, 0);
4744
4745 DEBUG(3,("flush\n"));
4746 END_PROFILE(SMBflush);
4747 return;
4748 }
4749
4750 /****************************************************************************
4751 Reply to a exit.
4752 conn POINTER CAN BE NULL HERE !
4753 ****************************************************************************/
4754
4755 void reply_exit(struct smb_request *req)
4756 {
4757 START_PROFILE(SMBexit);
4758
4759 file_close_pid(req->sconn, req->smbpid, req->vuid);
4760
4761 reply_outbuf(req, 0, 0);
4762
4763 DEBUG(3,("exit\n"));
4764
4765 END_PROFILE(SMBexit);
4766 return;
4767 }
4768
4769 /****************************************************************************
4770 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4771 ****************************************************************************/
4772
4773 void reply_close(struct smb_request *req)
4774 {
4775 connection_struct *conn = req->conn;
4776 NTSTATUS status = NT_STATUS_OK;
4777 files_struct *fsp = NULL;
4778 START_PROFILE(SMBclose);
4779
4780 if (req->wct < 3) {
4781 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4782 END_PROFILE(SMBclose);
4783 return;
4784 }
4785
4786 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4787
4788 /*
4789 * We can only use check_fsp if we know it's not a directory.
4790 */
4791
4792 if (!check_fsp_open(conn, req, fsp)) {
4793 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4794 END_PROFILE(SMBclose);
4795 return;
4796 }
4797
4798 if(fsp->is_directory) {
4799 /*
4800 * Special case - close NT SMB directory handle.
4801 */
4802 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4803 status = close_file(req, fsp, NORMAL_CLOSE);
4804 } else {
4805 time_t t;
4806 /*
4807 * Close ordinary file.
4808 */
4809
4810 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4811 fsp->fh->fd, fsp->fnum,
4812 conn->num_files_open));
4813
4814 /*
4815 * Take care of any time sent in the close.
4816 */
4817
4818 t = srv_make_unix_date3(req->vwv+1);
4819 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4820
4821 /*
4822 * close_file() returns the unix errno if an error
4823 * was detected on close - normally this is due to
4824 * a disk full error. If not then it was probably an I/O error.
4825 */
4826
4827 status = close_file(req, fsp, NORMAL_CLOSE);
4828 }
4829
4830 if (!NT_STATUS_IS_OK(status)) {
4831 reply_nterror(req, status);
4832 END_PROFILE(SMBclose);
4833 return;
4834 }
4835
4836 reply_outbuf(req, 0, 0);
4837 END_PROFILE(SMBclose);
4838 return;
4839 }
4840
4841 /****************************************************************************
4842 Reply to a writeclose (Core+ protocol).
4843 ****************************************************************************/
4844
4845 void reply_writeclose(struct smb_request *req)
4846 {
4847 connection_struct *conn = req->conn;
4848 size_t numtowrite;
4849 ssize_t nwritten = -1;
4850 NTSTATUS close_status = NT_STATUS_OK;
4851 off_t startpos;
4852 const char *data;
4853 struct timespec mtime;
4854 files_struct *fsp;
4855 struct lock_struct lock;
4856
4857 START_PROFILE(SMBwriteclose);
4858
4859 if (req->wct < 6) {
4860 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4861 END_PROFILE(SMBwriteclose);
4862 return;
4863 }
4864
4865 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4866
4867 if (!check_fsp(conn, req, fsp)) {
4868 END_PROFILE(SMBwriteclose);
4869 return;
4870 }
4871 if (!CHECK_WRITE(fsp)) {
4872 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4873 END_PROFILE(SMBwriteclose);
4874 return;
4875 }
4876
4877 numtowrite = SVAL(req->vwv+1, 0);
4878 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4879 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4880 data = (const char *)req->buf + 1;
4881
4882 if (!fsp->print_file) {
4883 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4884 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4885 &lock);
4886
4887 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4888 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4889 END_PROFILE(SMBwriteclose);
4890 return;
4891 }
4892 }
4893
4894 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4895
4896 set_close_write_time(fsp, mtime);
4897
4898 /*
4899 * More insanity. W2K only closes the file if writelen > 0.
4900 * JRA.
4901 */
4902
4903 if (numtowrite) {
4904 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4905 "file %s\n", fsp_str_dbg(fsp)));
4906 close_status = close_file(req, fsp, NORMAL_CLOSE);
4907 }
4908
4909 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4910 fsp->fnum, (int)numtowrite, (int)nwritten,
4911 conn->num_files_open));
4912
4913 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4914 reply_nterror(req, NT_STATUS_DISK_FULL);
4915 goto strict_unlock;
4916 }
4917
4918 if(!NT_STATUS_IS_OK(close_status)) {
4919 reply_nterror(req, close_status);
4920 goto strict_unlock;
4921 }
4922
4923 reply_outbuf(req, 1, 0);
4924
4925 SSVAL(req->outbuf,smb_vwv0,nwritten);
4926
4927 strict_unlock:
4928 if (numtowrite && !fsp->print_file) {
4929 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4930 }
4931
4932 END_PROFILE(SMBwriteclose);
4933 return;
4934 }
4935
4936 #undef DBGC_CLASS
4937 #define DBGC_CLASS DBGC_LOCKING
4938
4939 /****************************************************************************
4940 Reply to a lock.
4941 ****************************************************************************/
4942
4943 void reply_lock(struct smb_request *req)
4944 {
4945 connection_struct *conn = req->conn;
4946 uint64_t count,offset;
4947 NTSTATUS status;
4948 files_struct *fsp;
4949 struct byte_range_lock *br_lck = NULL;
4950
4951 START_PROFILE(SMBlock);
4952
4953 if (req->wct < 5) {
4954 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4955 END_PROFILE(SMBlock);
4956 return;
4957 }
4958
4959 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4960
4961 if (!check_fsp(conn, req, fsp)) {
4962 END_PROFILE(SMBlock);
4963 return;
4964 }
4965
4966 count = (uint64_t)IVAL(req->vwv+1, 0);
4967 offset = (uint64_t)IVAL(req->vwv+3, 0);
4968
4969 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4970 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4971
4972 br_lck = do_lock(req->sconn->msg_ctx,
4973 fsp,
4974 (uint64_t)req->smbpid,
4975 count,
4976 offset,
4977 WRITE_LOCK,
4978 WINDOWS_LOCK,
4979 False, /* Non-blocking lock. */
4980 &status,
4981 NULL,
4982 NULL);
4983
4984 TALLOC_FREE(br_lck);
4985
4986 if (NT_STATUS_V(status)) {
4987 reply_nterror(req, status);
4988 END_PROFILE(SMBlock);
4989 return;
4990 }
4991
4992 reply_outbuf(req, 0, 0);
4993
4994 END_PROFILE(SMBlock);
4995 return;
4996 }
4997
4998 /****************************************************************************
4999 Reply to a unlock.
5000 ****************************************************************************/
5001
5002 void reply_unlock(struct smb_request *req)
5003 {
5004 connection_struct *conn = req->conn;
5005 uint64_t count,offset;
5006 NTSTATUS status;
5007 files_struct *fsp;
5008
5009 START_PROFILE(SMBunlock);
5010
5011 if (req->wct < 5) {
5012 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5013 END_PROFILE(SMBunlock);
5014 return;
5015 }
5016
5017 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5018
5019 if (!check_fsp(conn, req, fsp)) {
5020 END_PROFILE(SMBunlock);
5021 return;
5022 }
5023
5024 count = (uint64_t)IVAL(req->vwv+1, 0);
5025 offset = (uint64_t)IVAL(req->vwv+3, 0);
5026
5027 status = do_unlock(req->sconn->msg_ctx,
5028 fsp,
5029 (uint64_t)req->smbpid,
5030 count,
5031 offset,
5032 WINDOWS_LOCK);
5033
5034 if (NT_STATUS_V(status)) {
5035 reply_nterror(req, status);
5036 END_PROFILE(SMBunlock);
5037 return;
5038 }
5039
5040 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5041 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5042
5043 reply_outbuf(req, 0, 0);
5044
5045 END_PROFILE(SMBunlock);
5046 return;
5047 }
5048
5049 #undef DBGC_CLASS
5050 #define DBGC_CLASS DBGC_ALL
5051
5052 /****************************************************************************
5053 Reply to a tdis.
5054 conn POINTER CAN BE NULL HERE !
5055 ****************************************************************************/
5056
5057 void reply_tdis(struct smb_request *req)
5058 {
5059 connection_struct *conn = req->conn;
5060 START_PROFILE(SMBtdis);
5061
5062 if (!conn) {
5063 DEBUG(4,("Invalid connection in tdis\n"));
5064 reply_force_doserror(req, ERRSRV, ERRinvnid);
5065 END_PROFILE(SMBtdis);
5066 return;
5067 }
5068
5069 close_cnum(conn,req->vuid);
5070 req->conn = NULL;
5071
5072 reply_outbuf(req, 0, 0);
5073 END_PROFILE(SMBtdis);
5074 return;
5075 }
5076
5077 /****************************************************************************
5078 Reply to a echo.
5079 conn POINTER CAN BE NULL HERE !
5080 ****************************************************************************/
5081
5082 void reply_echo(struct smb_request *req)
5083 {
5084 connection_struct *conn = req->conn;
5085 struct smb_perfcount_data local_pcd;
5086 struct smb_perfcount_data *cur_pcd;
5087 int smb_reverb;
5088 int seq_num;
5089
5090 START_PROFILE(SMBecho);
5091
5092 smb_init_perfcount_data(&local_pcd);
5093
5094 if (req->wct < 1) {
5095 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5096 END_PROFILE(SMBecho);
5097 return;
5098 }
5099
5100 smb_reverb = SVAL(req->vwv+0, 0);
5101
5102 reply_outbuf(req, 1, req->buflen);
5103
5104 /* copy any incoming data back out */
5105 if (req->buflen > 0) {
5106 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5107 }
5108
5109 if (smb_reverb > 100) {
5110 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5111 smb_reverb = 100;
5112 }
5113
5114 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5115
5116 /* this makes sure we catch the request pcd */
5117 if (seq_num == smb_reverb) {
5118 cur_pcd = &req->pcd;
5119 } else {
5120 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5121 cur_pcd = &local_pcd;
5122 }
5123
5124 SSVAL(req->outbuf,smb_vwv0,seq_num);
5125
5126 show_msg((char *)req->outbuf);
5127 if (!srv_send_smb(req->sconn,
5128 (char *)req->outbuf,
5129 true, req->seqnum+1,
5130 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5131 cur_pcd))
5132 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5133 }
5134
5135 DEBUG(3,("echo %d times\n", smb_reverb));
5136
5137 TALLOC_FREE(req->outbuf);
5138
5139 END_PROFILE(SMBecho);
5140 return;
5141 }
5142
5143 /****************************************************************************
5144 Reply to a printopen.
5145 ****************************************************************************/
5146
5147 void reply_printopen(struct smb_request *req)
5148 {
5149 connection_struct *conn = req->conn;
5150 files_struct *fsp;
5151 NTSTATUS status;
5152
5153 START_PROFILE(SMBsplopen);
5154
5155 if (req->wct < 2) {
5156 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5157 END_PROFILE(SMBsplopen);
5158 return;
5159 }
5160
5161 if (!CAN_PRINT(conn)) {
5162 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5163 END_PROFILE(SMBsplopen);
5164 return;
5165 }
5166
5167 status = file_new(req, conn, &fsp);
5168 if(!NT_STATUS_IS_OK(status)) {
5169 reply_nterror(req, status);
5170 END_PROFILE(SMBsplopen);
5171 return;
5172 }
5173
5174 /* Open for exclusive use, write only. */
5175 status = print_spool_open(fsp, NULL, req->vuid);
5176
5177 if (!NT_STATUS_IS_OK(status)) {
5178 file_free(req, fsp);
5179 reply_nterror(req, status);
5180 END_PROFILE(SMBsplopen);
5181 return;
5182 }
5183
5184 reply_outbuf(req, 1, 0);
5185 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5186
5187 DEBUG(3,("openprint fd=%d fnum=%d\n",
5188 fsp->fh->fd, fsp->fnum));
5189
5190 END_PROFILE(SMBsplopen);
5191 return;
5192 }
5193
5194 /****************************************************************************
5195 Reply to a printclose.
5196 ****************************************************************************/
5197
5198 void reply_printclose(struct smb_request *req)
5199 {
5200 connection_struct *conn = req->conn;
5201 files_struct *fsp;
5202 NTSTATUS status;
5203
5204 START_PROFILE(SMBsplclose);
5205
5206 if (req->wct < 1) {
5207 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5208 END_PROFILE(SMBsplclose);
5209 return;
5210 }
5211
5212 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5213
5214 if (!check_fsp(conn, req, fsp)) {
5215 END_PROFILE(SMBsplclose);
5216 return;
5217 }
5218
5219 if (!CAN_PRINT(conn)) {
5220 reply_force_doserror(req, ERRSRV, ERRerror);
5221 END_PROFILE(SMBsplclose);
5222 return;
5223 }
5224
5225 DEBUG(3,("printclose fd=%d fnum=%d\n",
5226 fsp->fh->fd,fsp->fnum));
5227
5228 status = close_file(req, fsp, NORMAL_CLOSE);
5229
5230 if(!NT_STATUS_IS_OK(status)) {
5231 reply_nterror(req, status);
5232 END_PROFILE(SMBsplclose);
5233 return;
5234 }
5235
5236 reply_outbuf(req, 0, 0);
5237
5238 END_PROFILE(SMBsplclose);
5239 return;
5240 }
5241
5242 /****************************************************************************
5243 Reply to a printqueue.
5244 ****************************************************************************/
5245
5246 void reply_printqueue(struct smb_request *req)
5247 {
5248 connection_struct *conn = req->conn;
5249 int max_count;
5250 int start_index;
5251
5252 START_PROFILE(SMBsplretq);
5253
5254 if (req->wct < 2) {
5255 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5256 END_PROFILE(SMBsplretq);
5257 return;
5258 }
5259
5260 max_count = SVAL(req->vwv+0, 0);
5261 start_index = SVAL(req->vwv+1, 0);
5262
5263 /* we used to allow the client to get the cnum wrong, but that
5264 is really quite gross and only worked when there was only
5265 one printer - I think we should now only accept it if they
5266 get it right (tridge) */
5267 if (!CAN_PRINT(conn)) {
5268 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5269 END_PROFILE(SMBsplretq);
5270 return;
5271 }
5272
5273 reply_outbuf(req, 2, 3);
5274 SSVAL(req->outbuf,smb_vwv0,0);
5275 SSVAL(req->outbuf,smb_vwv1,0);
5276 SCVAL(smb_buf(req->outbuf),0,1);
5277 SSVAL(smb_buf(req->outbuf),1,0);
5278
5279 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5280 start_index, max_count));
5281
5282 {
5283 TALLOC_CTX *mem_ctx = talloc_tos();
5284 NTSTATUS status;
5285 WERROR werr;
5286 const char *sharename = lp_servicename(SNUM(conn));
5287 struct rpc_pipe_client *cli = NULL;
5288 struct dcerpc_binding_handle *b = NULL;
5289 struct policy_handle handle;
5290 struct spoolss_DevmodeContainer devmode_ctr;
5291 union spoolss_JobInfo *info;
5292 uint32_t count;
5293 uint32_t num_to_get;
5294 uint32_t first;
5295 uint32_t i;
5296
5297 ZERO_STRUCT(handle);
5298
5299 status = rpc_pipe_open_interface(conn,
5300 &ndr_table_spoolss.syntax_id,
5301 conn->session_info,
5302 conn->sconn->remote_address,
5303 conn->sconn->msg_ctx,
5304 &cli);
5305 if (!NT_STATUS_IS_OK(status)) {
5306 DEBUG(0, ("reply_printqueue: "
5307 "could not connect to spoolss: %s\n",
5308 nt_errstr(status)));
5309 reply_nterror(req, status);
5310 goto out;
5311 }
5312 b = cli->binding_handle;
5313
5314 ZERO_STRUCT(devmode_ctr);
5315
5316 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5317 sharename,
5318 NULL, devmode_ctr,
5319 SEC_FLAG_MAXIMUM_ALLOWED,
5320 &handle,
5321 &werr);
5322 if (!NT_STATUS_IS_OK(status)) {
5323 reply_nterror(req, status);
5324 goto out;
5325 }
5326 if (!W_ERROR_IS_OK(werr)) {
5327 reply_nterror(req, werror_to_ntstatus(werr));
5328 goto out;
5329 }
5330
5331 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5332 &handle,
5333 0, /* firstjob */
5334 0xff, /* numjobs */
5335 2, /* level */
5336 0, /* offered */
5337 &count,
5338 &info);
5339 if (!W_ERROR_IS_OK(werr)) {
5340 reply_nterror(req, werror_to_ntstatus(werr));
5341 goto out;
5342 }
5343
5344 if (max_count > 0) {
5345 first = start_index;
5346 } else {
5347 first = start_index + max_count + 1;
5348 }
5349
5350 if (first >= count) {
5351 num_to_get = first;
5352 } else {
5353 num_to_get = first + MIN(ABS(max_count), count - first);
5354 }
5355
5356 for (i = first; i < num_to_get; i++) {
5357 char blob[28];
5358 char *p = blob;
5359 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5360 int qstatus;
5361 uint16_t qrapjobid = pjobid_to_rap(sharename,
5362 info[i].info2.job_id);
5363
5364 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5365 qstatus = 2;
5366 } else {
5367 qstatus = 3;
5368 }
5369
5370 srv_put_dos_date2(p, 0, qtime);
5371 SCVAL(p, 4, qstatus);
5372 SSVAL(p, 5, qrapjobid);
5373 SIVAL(p, 7, info[i].info2.size);
5374 SCVAL(p, 11, 0);
5375 srvstr_push(blob, req->flags2, p+12,
5376 info[i].info2.notify_name, 16, STR_ASCII);
5377
5378 if (message_push_blob(
5379 &req->outbuf,
5380 data_blob_const(
5381 blob, sizeof(blob))) == -1) {
5382 reply_nterror(req, NT_STATUS_NO_MEMORY);
5383 goto out;
5384 }
5385 }
5386
5387 if (count > 0) {
5388 SSVAL(req->outbuf,smb_vwv0,count);
5389 SSVAL(req->outbuf,smb_vwv1,
5390 (max_count>0?first+count:first-1));
5391 SCVAL(smb_buf(req->outbuf),0,1);
5392 SSVAL(smb_buf(req->outbuf),1,28*count);
5393 }
5394
5395
5396 DEBUG(3, ("%u entries returned in queue\n",
5397 (unsigned)count));
5398
5399 out:
5400 if (b && is_valid_policy_hnd(&handle)) {
5401 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5402 }
5403
5404 }
5405
5406 END_PROFILE(SMBsplretq);
5407 return;
5408 }
5409
5410 /****************************************************************************
5411 Reply to a printwrite.
5412 ****************************************************************************/
5413
5414 void reply_printwrite(struct smb_request *req)
5415 {
5416 connection_struct *conn = req->conn;
5417 int numtowrite;
5418 const char *data;
5419 files_struct *fsp;
5420
5421 START_PROFILE(SMBsplwr);
5422
5423 if (req->wct < 1) {
5424 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5425 END_PROFILE(SMBsplwr);
5426 return;
5427 }
5428
5429 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5430
5431 if (!check_fsp(conn, req, fsp)) {
5432 END_PROFILE(SMBsplwr);
5433 return;
5434 }
5435
5436 if (!fsp->print_file) {
5437 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5438 END_PROFILE(SMBsplwr);
5439 return;
5440 }
5441
5442 if (!CHECK_WRITE(fsp)) {
5443 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5444 END_PROFILE(SMBsplwr);
5445 return;
5446 }
5447
5448 numtowrite = SVAL(req->buf, 1);
5449
5450 if (req->buflen < numtowrite + 3) {
5451 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5452 END_PROFILE(SMBsplwr);
5453 return;
5454 }
5455
5456 data = (const char *)req->buf + 3;
5457
5458 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5459 reply_nterror(req, map_nt_error_from_unix(errno));
5460 END_PROFILE(SMBsplwr);
5461 return;
5462 }
5463
5464 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5465
5466 END_PROFILE(SMBsplwr);
5467 return;
5468 }
5469
5470 /****************************************************************************
5471 Reply to a mkdir.
5472 ****************************************************************************/
5473
5474 void reply_mkdir(struct smb_request *req)
5475 {
5476 connection_struct *conn = req->conn;
5477 struct smb_filename *smb_dname = NULL;
5478 char *directory = NULL;
5479 NTSTATUS status;
5480 TALLOC_CTX *ctx = talloc_tos();
5481
5482 START_PROFILE(SMBmkdir);
5483
5484 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5485 STR_TERMINATE, &status);
5486 if (!NT_STATUS_IS_OK(status)) {
5487 reply_nterror(req, status);
5488 goto out;
5489 }
5490
5491 status = filename_convert(ctx, conn,
5492 req->flags2 & FLAGS2_DFS_PATHNAMES,
5493 directory,
5494 0,
5495 NULL,
5496 &smb_dname);
5497 if (!NT_STATUS_IS_OK(status)) {
5498 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5499 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5500 ERRSRV, ERRbadpath);
5501 goto out;
5502 }
5503 reply_nterror(req, status);
5504 goto out;
5505 }
5506
5507 status = create_directory(conn, req, smb_dname);
5508
5509 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5510
5511 if (!NT_STATUS_IS_OK(status)) {
5512
5513 if (!use_nt_status()
5514 && NT_STATUS_EQUAL(status,
5515 NT_STATUS_OBJECT_NAME_COLLISION)) {
5516 /*
5517 * Yes, in the DOS error code case we get a
5518 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5519 * samba4 torture test.
5520 */
5521 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5522 }
5523
5524 reply_nterror(req, status);
5525 goto out;
5526 }
5527
5528 reply_outbuf(req, 0, 0);
5529
5530 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5531 out:
5532 TALLOC_FREE(smb_dname);
5533 END_PROFILE(SMBmkdir);
5534 return;
5535 }
5536
5537 /****************************************************************************
5538 Reply to a rmdir.
5539 ****************************************************************************/
5540
5541 void reply_rmdir(struct smb_request *req)
5542 {
5543 connection_struct *conn = req->conn;
5544 struct smb_filename *smb_dname = NULL;
5545 char *directory = NULL;
5546 NTSTATUS status;
5547 TALLOC_CTX *ctx = talloc_tos();
5548 files_struct *fsp = NULL;
5549 int info = 0;
5550 struct smbd_server_connection *sconn = req->sconn;
5551
5552 START_PROFILE(SMBrmdir);
5553
5554 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5555 STR_TERMINATE, &status);
5556 if (!NT_STATUS_IS_OK(status)) {
5557 reply_nterror(req, status);
5558 goto out;
5559 }
5560
5561 status = filename_convert(ctx, conn,
5562 req->flags2 & FLAGS2_DFS_PATHNAMES,
5563 directory,
5564 0,
5565 NULL,
5566 &smb_dname);
5567 if (!NT_STATUS_IS_OK(status)) {
5568 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5569 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5570 ERRSRV, ERRbadpath);
5571 goto out;
5572 }
5573 reply_nterror(req, status);
5574 goto out;
5575 }
5576
5577 if (is_ntfs_stream_smb_fname(smb_dname)) {
5578 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5579 goto out;
5580 }
5581
5582 status = SMB_VFS_CREATE_FILE(
5583 conn, /* conn */
5584 req, /* req */
5585 0, /* root_dir_fid */
5586 smb_dname, /* fname */
5587 DELETE_ACCESS, /* access_mask */
5588 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5589 FILE_SHARE_DELETE),
5590 FILE_OPEN, /* create_disposition*/
5591 FILE_DIRECTORY_FILE, /* create_options */
5592 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5593 0, /* oplock_request */
5594 0, /* allocation_size */
5595 0, /* private_flags */
5596 NULL, /* sd */
5597 NULL, /* ea_list */
5598 &fsp, /* result */
5599 &info); /* pinfo */
5600
5601 if (!NT_STATUS_IS_OK(status)) {
5602 if (open_was_deferred(req->sconn, req->mid)) {
5603 /* We have re-scheduled this call. */
5604 goto out;
5605 }
5606 reply_nterror(req, status);
5607 goto out;
5608 }
5609
5610 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5611 if (!NT_STATUS_IS_OK(status)) {
5612 close_file(req, fsp, ERROR_CLOSE);
5613 reply_nterror(req, status);
5614 goto out;
5615 }
5616
5617 if (!set_delete_on_close(fsp, true,
5618 conn->session_info->security_token,
5619 conn->session_info->unix_token)) {
5620 close_file(req, fsp, ERROR_CLOSE);
5621 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5622 goto out;
5623 }
5624
5625 status = close_file(req, fsp, NORMAL_CLOSE);
5626 if (!NT_STATUS_IS_OK(status)) {
5627 reply_nterror(req, status);
5628 } else {
5629 reply_outbuf(req, 0, 0);
5630 }
5631
5632 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5633
5634 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5635 out:
5636 TALLOC_FREE(smb_dname);
5637 END_PROFILE(SMBrmdir);
5638 return;
5639 }
5640
5641 /*******************************************************************
5642 Resolve wildcards in a filename rename.
5643 ********************************************************************/
5644
5645 static bool resolve_wildcards(TALLOC_CTX *ctx,
5646 const char *name1,
5647 const char *name2,
5648 char **pp_newname)
5649 {
5650 char *name2_copy = NULL;
5651 char *root1 = NULL;
5652 char *root2 = NULL;
5653 char *ext1 = NULL;
5654 char *ext2 = NULL;
5655 char *p,*p2, *pname1, *pname2;
5656
5657 name2_copy = talloc_strdup(ctx, name2);
5658 if (!name2_copy) {
5659 return False;
5660 }
5661
5662 pname1 = strrchr_m(name1,'/');
5663 pname2 = strrchr_m(name2_copy,'/');
5664
5665 if (!pname1 || !pname2) {
5666 return False;
5667 }
5668
5669 /* Truncate the copy of name2 at the last '/' */
5670 *pname2 = '\0';
5671
5672 /* Now go past the '/' */
5673 pname1++;
5674 pname2++;
5675
5676 root1 = talloc_strdup(ctx, pname1);
5677 root2 = talloc_strdup(ctx, pname2);
5678
5679 if (!root1 || !root2) {
5680 return False;
5681 }
5682
5683 p = strrchr_m(root1,'.');
5684 if (p) {
5685 *p = 0;
5686 ext1 = talloc_strdup(ctx, p+1);
5687 } else {
5688 ext1 = talloc_strdup(ctx, "");
5689 }
5690 p = strrchr_m(root2,'.');
5691 if (p) {
5692 *p = 0;
5693 ext2 = talloc_strdup(ctx, p+1);
5694 } else {
5695 ext2 = talloc_strdup(ctx, "");
5696 }
5697
5698 if (!ext1 || !ext2) {
5699 return False;
5700 }
5701
5702 p = root1;
5703 p2 = root2;
5704 while (*p2) {
5705 if (*p2 == '?') {
5706 /* Hmmm. Should this be mb-aware ? */
5707 *p2 = *p;
5708 p2++;
5709 } else if (*p2 == '*') {
5710 *p2 = '\0';
5711 root2 = talloc_asprintf(ctx, "%s%s",
5712 root2,
5713 p);
5714 if (!root2) {
5715 return False;
5716 }
5717 break;
5718 } else {
5719 p2++;
5720 }
5721 if (*p) {
5722 p++;
5723 }
5724 }
5725
5726 p = ext1;
5727 p2 = ext2;
5728 while (*p2) {
5729 if (*p2 == '?') {
5730 /* Hmmm. Should this be mb-aware ? */
5731 *p2 = *p;
5732 p2++;
5733 } else if (*p2 == '*') {
5734 *p2 = '\0';
5735 ext2 = talloc_asprintf(ctx, "%s%s",
5736 ext2,
5737 p);
5738 if (!ext2) {
5739 return False;
5740 }
5741 break;
5742 } else {
5743 p2++;
5744 }
5745 if (*p) {
5746 p++;
5747 }
5748 }
5749
5750 if (*ext2) {
5751 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5752 name2_copy,
5753 root2,
5754 ext2);
5755 } else {
5756 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5757 name2_copy,
5758 root2);
5759 }
5760
5761 if (!*pp_newname) {
5762 return False;
5763 }
5764
5765 return True;
5766 }
5767
5768 /****************************************************************************
5769 Ensure open files have their names updated. Updated to notify other smbd's
5770 asynchronously.
5771 ****************************************************************************/
5772
5773 static void rename_open_files(connection_struct *conn,
5774 struct share_mode_lock *lck,
5775 uint32_t orig_name_hash,
5776 const struct smb_filename *smb_fname_dst)
5777 {
5778 files_struct *fsp;
5779 bool did_rename = False;
5780 NTSTATUS status;
5781 uint32_t new_name_hash = 0;
5782
5783 for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
5784 fsp = file_find_di_next(fsp)) {
5785 /* fsp_name is a relative path under the fsp. To change this for other
5786 sharepaths we need to manipulate relative paths. */
5787 /* TODO - create the absolute path and manipulate the newname
5788 relative to the sharepath. */
5789 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5790 continue;
5791 }
5792 if (fsp->name_hash != orig_name_hash) {
5793 continue;
5794 }
5795 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5796 "(file_id %s) from %s -> %s\n", fsp->fnum,
5797 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5798 smb_fname_str_dbg(smb_fname_dst)));
5799
5800 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5801 if (NT_STATUS_IS_OK(status)) {
5802 did_rename = True;
5803 new_name_hash = fsp->name_hash;
5804 }
5805 }
5806
5807 if (!did_rename) {
5808 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5809 "for %s\n", file_id_string_tos(&lck->data->id),
5810 smb_fname_str_dbg(smb_fname_dst)));
5811 }
5812
5813 /* Send messages to all smbd's (not ourself) that the name has changed. */
5814 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5815 orig_name_hash, new_name_hash,
5816 smb_fname_dst);
5817
5818 }
5819
5820 /****************************************************************************
5821 We need to check if the source path is a parent directory of the destination
5822 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5823 refuse the rename with a sharing violation. Under UNIX the above call can
5824 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5825 probably need to check that the client is a Windows one before disallowing
5826 this as a UNIX client (one with UNIX extensions) can know the source is a
5827 symlink and make this decision intelligently. Found by an excellent bug
5828 report from <AndyLiebman@aol.com>.
5829 ****************************************************************************/
5830
5831 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5832 const struct smb_filename *smb_fname_dst)
5833 {
5834 const char *psrc = smb_fname_src->base_name;
5835 const char *pdst = smb_fname_dst->base_name;
5836 size_t slen;
5837
5838 if (psrc[0] == '.' && psrc[1] == '/') {
5839 psrc += 2;
5840 }
5841 if (pdst[0] == '.' && pdst[1] == '/') {
5842 pdst += 2;
5843 }
5844 if ((slen = strlen(psrc)) > strlen(pdst)) {
5845 return False;
5846 }
5847 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5848 }
5849
5850 /*
5851 * Do the notify calls from a rename
5852 */
5853
5854 static void notify_rename(connection_struct *conn, bool is_dir,
5855 const struct smb_filename *smb_fname_src,
5856 const struct smb_filename *smb_fname_dst)
5857 {
5858 char *parent_dir_src = NULL;
5859 char *parent_dir_dst = NULL;
5860 uint32 mask;
5861
5862 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5863 : FILE_NOTIFY_CHANGE_FILE_NAME;
5864
5865 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5866 &parent_dir_src, NULL) ||
5867 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5868 &parent_dir_dst, NULL)) {
5869 goto out;
5870 }
5871
5872 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5873 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5874 smb_fname_src->base_name);
5875 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5876 smb_fname_dst->base_name);
5877 }
5878 else {
5879 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5880 smb_fname_src->base_name);
5881 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5882 smb_fname_dst->base_name);
5883 }
5884
5885 /* this is a strange one. w2k3 gives an additional event for
5886 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5887 files, but not directories */
5888 if (!is_dir) {
5889 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5890 FILE_NOTIFY_CHANGE_ATTRIBUTES
5891 |FILE_NOTIFY_CHANGE_CREATION,
5892 smb_fname_dst->base_name);
5893 }
5894 out:
5895 TALLOC_FREE(parent_dir_src);
5896 TALLOC_FREE(parent_dir_dst);
5897 }
5898
5899 /****************************************************************************
5900 Returns an error if the parent directory for a filename is open in an
5901 incompatible way.
5902 ****************************************************************************/
5903
5904 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5905 const struct smb_filename *smb_fname_dst_in)
5906 {
5907 char *parent_dir = NULL;
5908 struct smb_filename smb_fname_parent;
5909 struct file_id id;
5910 files_struct *fsp = NULL;
5911 int ret;
5912
5913 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5914 &parent_dir, NULL)) {
5915 return NT_STATUS_NO_MEMORY;
5916 }
5917 ZERO_STRUCT(smb_fname_parent);
5918 smb_fname_parent.base_name = parent_dir;
5919
5920 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
5921 if (ret == -1) {
5922 return map_nt_error_from_unix(errno);
5923 }
5924
5925 /*
5926 * We're only checking on this smbd here, mostly good
5927 * enough.. and will pass tests.
5928 */
5929
5930 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
5931 for (fsp = file_find_di_first(conn->sconn, id); fsp;
5932 fsp = file_find_di_next(fsp)) {
5933 if (fsp->access_mask & DELETE_ACCESS) {
5934 return NT_STATUS_SHARING_VIOLATION;
5935 }
5936 }
5937 return NT_STATUS_OK;
5938 }
5939
5940 /****************************************************************************
5941 Rename an open file - given an fsp.
5942 ****************************************************************************/
5943
5944 NTSTATUS rename_internals_fsp(connection_struct *conn,
5945 files_struct *fsp,
5946 const struct smb_filename *smb_fname_dst_in,
5947 uint32 attrs,
5948 bool replace_if_exists)
5949 {
5950 TALLOC_CTX *ctx = talloc_tos();
5951 struct smb_filename *smb_fname_dst = NULL;
5952 NTSTATUS status = NT_STATUS_OK;
5953 struct share_mode_lock *lck = NULL;
5954 bool dst_exists, old_is_stream, new_is_stream;
5955
5956 status = check_name(conn, smb_fname_dst_in->base_name);
5957 if (!NT_STATUS_IS_OK(status)) {
5958 return status;
5959 }
5960
5961 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
5962 if (!NT_STATUS_IS_OK(status)) {
5963 return status;
5964 }
5965
5966 /* Make a copy of the dst smb_fname structs */
5967
5968 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5969 if (!NT_STATUS_IS_OK(status)) {
5970 goto out;
5971 }
5972
5973 /*
5974 * Check for special case with case preserving and not
5975 * case sensitive. If the old last component differs from the original
5976 * last component only by case, then we should allow
5977 * the rename (user is trying to change the case of the
5978 * filename).
5979 */
5980 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5981 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5982 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5983 char *last_slash;
5984 char *fname_dst_lcomp_base_mod = NULL;
5985 struct smb_filename *smb_fname_orig_lcomp = NULL;
5986
5987 /*
5988 * Get the last component of the destination name.
5989 */
5990 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5991 if (last_slash) {
5992 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5993 } else {
5994 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
5995 }
5996 if (!fname_dst_lcomp_base_mod) {
5997 status = NT_STATUS_NO_MEMORY;
5998 goto out;
5999 }
6000
6001 /*
6002 * Create an smb_filename struct using the original last
6003 * component of the destination.
6004 */
6005 status = create_synthetic_smb_fname_split(ctx,
6006 smb_fname_dst->original_lcomp, NULL,
6007 &smb_fname_orig_lcomp);
6008 if (!NT_STATUS_IS_OK(status)) {
6009 TALLOC_FREE(fname_dst_lcomp_base_mod);
6010 goto out;
6011 }
6012
6013 /* If the base names only differ by case, use original. */
6014 if(!strcsequal(fname_dst_lcomp_base_mod,
6015 smb_fname_orig_lcomp->base_name)) {
6016 char *tmp;
6017 /*
6018 * Replace the modified last component with the
6019 * original.
6020 */
6021 if (last_slash) {
6022 *last_slash = '\0'; /* Truncate at the '/' */
6023 tmp = talloc_asprintf(smb_fname_dst,
6024 "%s/%s",
6025 smb_fname_dst->base_name,
6026 smb_fname_orig_lcomp->base_name);
6027 } else {
6028 tmp = talloc_asprintf(smb_fname_dst,
6029 "%s",
6030 smb_fname_orig_lcomp->base_name);
6031 }
6032 if (tmp == NULL) {
6033 status = NT_STATUS_NO_MEMORY;
6034 TALLOC_FREE(fname_dst_lcomp_base_mod);
6035 TALLOC_FREE(smb_fname_orig_lcomp);
6036 goto out;
6037 }
6038 TALLOC_FREE(smb_fname_dst->base_name);
6039 smb_fname_dst->base_name = tmp;
6040 }
6041
6042 /* If the stream_names only differ by case, use original. */
6043 if(!strcsequal(smb_fname_dst->stream_name,
6044 smb_fname_orig_lcomp->stream_name)) {
6045 char *tmp = NULL;
6046 /* Use the original stream. */
6047 tmp = talloc_strdup(smb_fname_dst,
6048 smb_fname_orig_lcomp->stream_name);
6049 if (tmp == NULL) {
6050 status = NT_STATUS_NO_MEMORY;
6051 TALLOC_FREE(fname_dst_lcomp_base_mod);
6052 TALLOC_FREE(smb_fname_orig_lcomp);
6053 goto out;
6054 }
6055 TALLOC_FREE(smb_fname_dst->stream_name);
6056 smb_fname_dst->stream_name = tmp;
6057 }
6058 TALLOC_FREE(fname_dst_lcomp_base_mod);
6059 TALLOC_FREE(smb_fname_orig_lcomp);
6060 }
6061
6062 /*
6063 * If the src and dest names are identical - including case,
6064 * don't do the rename, just return success.
6065 */
6066
6067 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6068 strcsequal(fsp->fsp_name->stream_name,
6069 smb_fname_dst->stream_name)) {
6070 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6071 "- returning success\n",
6072 smb_fname_str_dbg(smb_fname_dst)));
6073 status = NT_STATUS_OK;
6074 goto out;
6075 }
6076
6077 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6078 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6079
6080 /* Return the correct error code if both names aren't streams. */
6081 if (!old_is_stream && new_is_stream) {
6082 status = NT_STATUS_OBJECT_NAME_INVALID;
6083 goto out;
6084 }
6085
6086 if (old_is_stream && !new_is_stream) {
6087 status = NT_STATUS_INVALID_PARAMETER;
6088 goto out;
6089 }
6090
6091 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6092
6093 if(!replace_if_exists && dst_exists) {
6094 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6095 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6096 smb_fname_str_dbg(smb_fname_dst)));
6097 status = NT_STATUS_OBJECT_NAME_COLLISION;
6098 goto out;
6099 }
6100
6101 if (dst_exists) {
6102 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6103 &smb_fname_dst->st);
6104 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6105 fileid);
6106 /* The file can be open when renaming a stream */
6107 if (dst_fsp && !new_is_stream) {
6108 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6109 status = NT_STATUS_ACCESS_DENIED;
6110 goto out;
6111 }
6112 }
6113
6114 /* Ensure we have a valid stat struct for the source. */
6115 status = vfs_stat_fsp(fsp);
6116 if (!NT_STATUS_IS_OK(status)) {
6117 goto out;
6118 }
6119
6120 status = can_rename(conn, fsp, attrs);
6121
6122 if (!NT_STATUS_IS_OK(status)) {
6123 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6124 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6125 smb_fname_str_dbg(smb_fname_dst)));
6126 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6127 status = NT_STATUS_ACCESS_DENIED;
6128 goto out;
6129 }
6130
6131 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6132 status = NT_STATUS_ACCESS_DENIED;
6133 }
6134
6135 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6136
6137 /*
6138 * We have the file open ourselves, so not being able to get the
6139 * corresponding share mode lock is a fatal error.
6140 */
6141
6142 SMB_ASSERT(lck != NULL);
6143
6144 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6145 uint32 create_options = fsp->fh->private_options;
6146
6147 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6148 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6149 smb_fname_str_dbg(smb_fname_dst)));
6150
6151 if (!lp_posix_pathnames() &&
6152 (lp_map_archive(SNUM(conn)) ||
6153 lp_store_dos_attributes(SNUM(conn)))) {
6154 /* We must set the archive bit on the newly
6155 renamed file. */
6156 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6157 uint32_t old_dosmode = dos_mode(conn,
6158 smb_fname_dst);
6159 file_set_dosmode(conn,
6160 smb_fname_dst,
6161 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6162 NULL,
6163 true);
6164 }
6165 }
6166
6167 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6168 smb_fname_dst);
6169
6170 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6171
6172 /*
6173 * A rename acts as a new file create w.r.t. allowing an initial delete
6174 * on close, probably because in Windows there is a new handle to the
6175 * new file. If initial delete on close was requested but not
6176 * originally set, we need to set it here. This is probably not 100% correct,
6177 * but will work for the CIFSFS client which in non-posix mode
6178 * depends on these semantics. JRA.
6179 */
6180
6181 if (create_options & FILE_DELETE_ON_CLOSE) {
6182 status = can_set_delete_on_close(fsp, 0);
6183
6184 if (NT_STATUS_IS_OK(status)) {
6185 /* Note that here we set the *inital* delete on close flag,
6186 * not the regular one. The magic gets handled in close. */
6187 fsp->initial_delete_on_close = True;
6188 }
6189 }
6190 TALLOC_FREE(lck);
6191 status = NT_STATUS_OK;
6192 goto out;
6193 }
6194
6195 TALLOC_FREE(lck);
6196
6197 if (errno == ENOTDIR || errno == EISDIR) {
6198 status = NT_STATUS_OBJECT_NAME_COLLISION;
6199 } else {
6200 status = map_nt_error_from_unix(errno);
6201 }
6202
6203 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6204 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6205 smb_fname_str_dbg(smb_fname_dst)));
6206
6207 out:
6208 TALLOC_FREE(smb_fname_dst);
6209
6210 return status;
6211 }
6212
6213 /****************************************************************************
6214 The guts of the rename command, split out so it may be called by the NT SMB
6215 code.
6216 ****************************************************************************/
6217
6218 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6219 connection_struct *conn,
6220 struct smb_request *req,
6221 struct smb_filename *smb_fname_src,
6222 struct smb_filename *smb_fname_dst,
6223 uint32 attrs,
6224 bool replace_if_exists,
6225 bool src_has_wild,
6226 bool dest_has_wild,
6227 uint32_t access_mask)
6228 {
6229 char *fname_src_dir = NULL;
6230 char *fname_src_mask = NULL;
6231 int count=0;
6232 NTSTATUS status = NT_STATUS_OK;
6233 struct smb_Dir *dir_hnd = NULL;
6234 const char *dname = NULL;
6235 char *talloced = NULL;
6236 long offset = 0;
6237 int create_options = 0;
6238 bool posix_pathnames = lp_posix_pathnames();
6239
6240 /*
6241 * Split the old name into directory and last component
6242 * strings. Note that unix_convert may have stripped off a
6243 * leading ./ from both name and newname if the rename is
6244 * at the root of the share. We need to make sure either both
6245 * name and newname contain a / character or neither of them do
6246 * as this is checked in resolve_wildcards().
6247 */
6248
6249 /* Split up the directory from the filename/mask. */
6250 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6251 &fname_src_dir, &fname_src_mask);
6252 if (!NT_STATUS_IS_OK(status)) {
6253 status = NT_STATUS_NO_MEMORY;
6254 goto out;
6255 }
6256
6257 /*
6258 * We should only check the mangled cache
6259 * here if unix_convert failed. This means
6260 * that the path in 'mask' doesn't exist
6261 * on the file system and so we need to look
6262 * for a possible mangle. This patch from
6263 * Tine Smukavec <valentin.smukavec@hermes.si>.
6264 */
6265
6266 if (!VALID_STAT(smb_fname_src->st) &&
6267 mangle_is_mangled(fname_src_mask, conn->params)) {
6268 char *new_mask = NULL;
6269 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6270 conn->params);
6271 if (new_mask) {
6272 TALLOC_FREE(fname_src_mask);
6273 fname_src_mask = new_mask;
6274 }
6275 }
6276
6277 if (!src_has_wild) {
6278 files_struct *fsp;
6279
6280 /*
6281 * Only one file needs to be renamed. Append the mask back
6282 * onto the directory.
6283 */
6284 TALLOC_FREE(smb_fname_src->base_name);
6285 if (ISDOT(fname_src_dir)) {
6286 /* Ensure we use canonical names on open. */
6287 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6288 "%s",
6289 fname_src_mask);
6290 } else {
6291 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6292 "%s/%s",
6293 fname_src_dir,
6294 fname_src_mask);
6295 }
6296 if (!smb_fname_src->base_name) {
6297 status = NT_STATUS_NO_MEMORY;
6298 goto out;
6299 }
6300
6301 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6302 "case_preserve = %d, short case preserve = %d, "
6303 "directory = %s, newname = %s, "
6304 "last_component_dest = %s\n",
6305 conn->case_sensitive, conn->case_preserve,
6306 conn->short_case_preserve,
6307 smb_fname_str_dbg(smb_fname_src),
6308 smb_fname_str_dbg(smb_fname_dst),
6309 smb_fname_dst->original_lcomp));
6310
6311 /* The dest name still may have wildcards. */
6312 if (dest_has_wild) {
6313 char *fname_dst_mod = NULL;
6314 if (!resolve_wildcards(smb_fname_dst,
6315 smb_fname_src->base_name,
6316 smb_fname_dst->base_name,
6317 &fname_dst_mod)) {
6318 DEBUG(6, ("rename_internals: resolve_wildcards "
6319 "%s %s failed\n",
6320 smb_fname_src->base_name,
6321 smb_fname_dst->base_name));
6322 status = NT_STATUS_NO_MEMORY;
6323 goto out;
6324 }
6325 TALLOC_FREE(smb_fname_dst->base_name);
6326 smb_fname_dst->base_name = fname_dst_mod;
6327 }
6328
6329 ZERO_STRUCT(smb_fname_src->st);
6330 if (posix_pathnames) {
6331 SMB_VFS_LSTAT(conn, smb_fname_src);
6332 } else {
6333 SMB_VFS_STAT(conn, smb_fname_src);
6334 }
6335
6336 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6337 create_options |= FILE_DIRECTORY_FILE;
6338 }
6339
6340 status = SMB_VFS_CREATE_FILE(
6341 conn, /* conn */
6342 req, /* req */
6343 0, /* root_dir_fid */
6344 smb_fname_src, /* fname */
6345 access_mask, /* access_mask */
6346 (FILE_SHARE_READ | /* share_access */
6347 FILE_SHARE_WRITE),
6348 FILE_OPEN, /* create_disposition*/
6349 create_options, /* create_options */
6350 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6351 0, /* oplock_request */
6352 0, /* allocation_size */
6353 0, /* private_flags */
6354 NULL, /* sd */
6355 NULL, /* ea_list */
6356 &fsp, /* result */
6357 NULL); /* pinfo */
6358
6359 if (!NT_STATUS_IS_OK(status)) {
6360 DEBUG(3, ("Could not open rename source %s: %s\n",
6361 smb_fname_str_dbg(smb_fname_src),
6362 nt_errstr(status)));
6363 goto out;
6364 }
6365
6366 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6367 attrs, replace_if_exists);
6368
6369 close_file(req, fsp, NORMAL_CLOSE);
6370
6371 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6372 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6373 smb_fname_str_dbg(smb_fname_dst)));
6374
6375 goto out;
6376 }
6377
6378 /*
6379 * Wildcards - process each file that matches.
6380 */
6381 if (strequal(fname_src_mask, "????????.???")) {
6382 TALLOC_FREE(fname_src_mask);
6383 fname_src_mask = talloc_strdup(ctx, "*");
6384 if (!fname_src_mask) {
6385 status = NT_STATUS_NO_MEMORY;
6386 goto out;
6387 }
6388 }
6389
6390 status = check_name(conn, fname_src_dir);
6391 if (!NT_STATUS_IS_OK(status)) {
6392 goto out;
6393 }
6394
6395 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6396 attrs);
6397 if (dir_hnd == NULL) {
6398 status = map_nt_error_from_unix(errno);
6399 goto out;
6400 }
6401
6402 status = NT_STATUS_NO_SUCH_FILE;
6403 /*
6404 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6405 * - gentest fix. JRA
6406 */
6407
6408 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6409 &talloced))) {
6410 files_struct *fsp = NULL;
6411 char *destname = NULL;
6412 bool sysdir_entry = False;
6413
6414 /* Quick check for "." and ".." */
6415 if (ISDOT(dname) || ISDOTDOT(dname)) {
6416 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6417 sysdir_entry = True;
6418 } else {
6419 TALLOC_FREE(talloced);
6420 continue;
6421 }
6422 }
6423
6424 if (!is_visible_file(conn, fname_src_dir, dname,
6425 &smb_fname_src->st, false)) {
6426 TALLOC_FREE(talloced);
6427 continue;
6428 }
6429
6430 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6431 TALLOC_FREE(talloced);
6432 continue;
6433 }
6434
6435 if (sysdir_entry) {
6436 status = NT_STATUS_OBJECT_NAME_INVALID;
6437 break;
6438 }
6439
6440 TALLOC_FREE(smb_fname_src->base_name);
6441 if (ISDOT(fname_src_dir)) {
6442 /* Ensure we use canonical names on open. */
6443 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6444 "%s",
6445 dname);
6446 } else {
6447 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6448 "%s/%s",
6449 fname_src_dir,
6450 dname);
6451 }
6452 if (!smb_fname_src->base_name) {
6453 status = NT_STATUS_NO_MEMORY;
6454 goto out;
6455 }
6456
6457 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6458 smb_fname_dst->base_name,
6459 &destname)) {
6460 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6461 smb_fname_src->base_name, destname));
6462 TALLOC_FREE(talloced);
6463 continue;
6464 }
6465 if (!destname) {
6466 status = NT_STATUS_NO_MEMORY;
6467 goto out;
6468 }
6469
6470 TALLOC_FREE(smb_fname_dst->base_name);
6471 smb_fname_dst->base_name = destname;
6472
6473 ZERO_STRUCT(smb_fname_src->st);
6474 if (posix_pathnames) {
6475 SMB_VFS_LSTAT(conn, smb_fname_src);
6476 } else {
6477 SMB_VFS_STAT(conn, smb_fname_src);
6478 }
6479
6480 create_options = 0;
6481
6482 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6483 create_options |= FILE_DIRECTORY_FILE;
6484 }
6485
6486 status = SMB_VFS_CREATE_FILE(
6487 conn, /* conn */
6488 req, /* req */
6489 0, /* root_dir_fid */
6490 smb_fname_src, /* fname */
6491 access_mask, /* access_mask */
6492 (FILE_SHARE_READ | /* share_access */
6493 FILE_SHARE_WRITE),
6494 FILE_OPEN, /* create_disposition*/
6495 create_options, /* create_options */
6496 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6497 0, /* oplock_request */
6498 0, /* allocation_size */
6499 0, /* private_flags */
6500 NULL, /* sd */
6501 NULL, /* ea_list */
6502 &fsp, /* result */
6503 NULL); /* pinfo */
6504
6505 if (!NT_STATUS_IS_OK(status)) {
6506 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6507 "returned %s rename %s -> %s\n",
6508 nt_errstr(status),
6509 smb_fname_str_dbg(smb_fname_src),
6510 smb_fname_str_dbg(smb_fname_dst)));
6511 break;
6512 }
6513
6514 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6515 dname);
6516 if (!smb_fname_dst->original_lcomp) {
6517 status = NT_STATUS_NO_MEMORY;
6518 goto out;
6519 }
6520
6521 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6522 attrs, replace_if_exists);
6523
6524 close_file(req, fsp, NORMAL_CLOSE);
6525
6526 if (!NT_STATUS_IS_OK(status)) {
6527 DEBUG(3, ("rename_internals_fsp returned %s for "
6528 "rename %s -> %s\n", nt_errstr(status),
6529 smb_fname_str_dbg(smb_fname_src),
6530 smb_fname_str_dbg(smb_fname_dst)));
6531 break;
6532 }
6533
6534 count++;
6535
6536 DEBUG(3,("rename_internals: doing rename on %s -> "
6537 "%s\n", smb_fname_str_dbg(smb_fname_src),
6538 smb_fname_str_dbg(smb_fname_src)));
6539 TALLOC_FREE(talloced);
6540 }
6541 TALLOC_FREE(dir_hnd);
6542
6543 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6544 status = map_nt_error_from_unix(errno);
6545 }
6546
6547 out:
6548 TALLOC_FREE(talloced);
6549 TALLOC_FREE(fname_src_dir);
6550 TALLOC_FREE(fname_src_mask);
6551 return status;
6552 }
6553
6554 /****************************************************************************
6555 Reply to a mv.
6556 ****************************************************************************/
6557
6558 void reply_mv(struct smb_request *req)
6559 {
6560 connection_struct *conn = req->conn;
6561 char *name = NULL;
6562 char *newname = NULL;
6563 const char *p;
6564 uint32 attrs;
6565 NTSTATUS status;
6566 bool src_has_wcard = False;
6567 bool dest_has_wcard = False;
6568 TALLOC_CTX *ctx = talloc_tos();
6569 struct smb_filename *smb_fname_src = NULL;
6570 struct smb_filename *smb_fname_dst = NULL;
6571 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6572 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6573 bool stream_rename = false;
6574
6575 START_PROFILE(SMBmv);
6576
6577 if (req->wct < 1) {
6578 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6579 goto out;
6580 }
6581
6582 attrs = SVAL(req->vwv+0, 0);
6583
6584 p = (const char *)req->buf + 1;
6585 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6586 &status, &src_has_wcard);
6587 if (!NT_STATUS_IS_OK(status)) {
6588 reply_nterror(req, status);
6589 goto out;
6590 }
6591 p++;
6592 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6593 &status, &dest_has_wcard);
6594 if (!NT_STATUS_IS_OK(status)) {
6595 reply_nterror(req, status);
6596 goto out;
6597 }
6598
6599 if (!lp_posix_pathnames()) {
6600 /* The newname must begin with a ':' if the
6601 name contains a ':'. */
6602 if (strchr_m(name, ':')) {
6603 if (newname[0] != ':') {
6604 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6605 goto out;
6606 }
6607 stream_rename = true;
6608 }
6609 }
6610
6611 status = filename_convert(ctx,
6612 conn,
6613 req->flags2 & FLAGS2_DFS_PATHNAMES,
6614 name,
6615 src_ucf_flags,
6616 &src_has_wcard,
6617 &smb_fname_src);
6618
6619 if (!NT_STATUS_IS_OK(status)) {
6620 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6621 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6622 ERRSRV, ERRbadpath);
6623 goto out;
6624 }
6625 reply_nterror(req, status);
6626 goto out;
6627 }
6628
6629 status = filename_convert(ctx,
6630 conn,
6631 req->flags2 & FLAGS2_DFS_PATHNAMES,
6632 newname,
6633 dst_ucf_flags,
6634 &dest_has_wcard,
6635 &smb_fname_dst);
6636
6637 if (!NT_STATUS_IS_OK(status)) {
6638 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6639 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6640 ERRSRV, ERRbadpath);
6641 goto out;
6642 }
6643 reply_nterror(req, status);
6644 goto out;
6645 }
6646
6647 if (stream_rename) {
6648 /* smb_fname_dst->base_name must be the same as
6649 smb_fname_src->base_name. */
6650 TALLOC_FREE(smb_fname_dst->base_name);
6651 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6652 smb_fname_src->base_name);
6653 if (!smb_fname_dst->base_name) {
6654 reply_nterror(req, NT_STATUS_NO_MEMORY);
6655 goto out;
6656 }
6657 }
6658
6659 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6660 smb_fname_str_dbg(smb_fname_dst)));
6661
6662 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6663 attrs, False, src_has_wcard, dest_has_wcard,
6664 DELETE_ACCESS);
6665 if (!NT_STATUS_IS_OK(status)) {
6666 if (open_was_deferred(req->sconn, req->mid)) {
6667 /* We have re-scheduled this call. */
6668 goto out;
6669 }
6670 reply_nterror(req, status);
6671 goto out;
6672 }
6673
6674 reply_outbuf(req, 0, 0);
6675 out:
6676 TALLOC_FREE(smb_fname_src);
6677 TALLOC_FREE(smb_fname_dst);
6678 END_PROFILE(SMBmv);
6679 return;
6680 }
6681
6682 /*******************************************************************
6683 Copy a file as part of a reply_copy.
6684 ******************************************************************/
6685
6686 /*
6687 * TODO: check error codes on all callers
6688 */
6689
6690 NTSTATUS copy_file(TALLOC_CTX *ctx,
6691 connection_struct *conn,
6692 struct smb_filename *smb_fname_src,
6693 struct smb_filename *smb_fname_dst,
6694 int ofun,
6695 int count,
6696 bool target_is_directory)
6697 {
6698 struct smb_filename *smb_fname_dst_tmp = NULL;
6699 off_t ret=-1;
6700 files_struct *fsp1,*fsp2;
6701 uint32 dosattrs;
6702 uint32 new_create_disposition;
6703 NTSTATUS status;
6704
6705
6706 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6707 if (!NT_STATUS_IS_OK(status)) {
6708 return status;
6709 }
6710
6711 /*
6712 * If the target is a directory, extract the last component from the
6713 * src filename and append it to the dst filename
6714 */
6715 if (target_is_directory) {
6716 const char *p;
6717
6718 /* dest/target can't be a stream if it's a directory. */
6719 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6720
6721 p = strrchr_m(smb_fname_src->base_name,'/');
6722 if (p) {
6723 p++;
6724 } else {
6725 p = smb_fname_src->base_name;
6726 }
6727 smb_fname_dst_tmp->base_name =
6728 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6729 p);
6730 if (!smb_fname_dst_tmp->base_name) {
6731 status = NT_STATUS_NO_MEMORY;
6732 goto out;
6733 }
6734 }
6735
6736 status = vfs_file_exist(conn, smb_fname_src);
6737 if (!NT_STATUS_IS_OK(status)) {
6738 goto out;
6739 }
6740
6741 if (!target_is_directory && count) {
6742 new_create_disposition = FILE_OPEN;
6743 } else {
6744 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6745 0, ofun,
6746 NULL, NULL,
6747 &new_create_disposition,
6748 NULL,
6749 NULL)) {
6750 status = NT_STATUS_INVALID_PARAMETER;
6751 goto out;
6752 }
6753 }
6754
6755 /* Open the src file for reading. */
6756 status = SMB_VFS_CREATE_FILE(
6757 conn, /* conn */
6758 NULL, /* req */
6759 0, /* root_dir_fid */
6760 smb_fname_src, /* fname */
6761 FILE_GENERIC_READ, /* access_mask */
6762 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6763 FILE_OPEN, /* create_disposition*/
6764 0, /* create_options */
6765 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6766 INTERNAL_OPEN_ONLY, /* oplock_request */
6767 0, /* allocation_size */
6768 0, /* private_flags */
6769 NULL, /* sd */
6770 NULL, /* ea_list */
6771 &fsp1, /* result */
6772 NULL); /* psbuf */
6773
6774 if (!NT_STATUS_IS_OK(status)) {
6775 goto out;
6776 }
6777
6778 dosattrs = dos_mode(conn, smb_fname_src);
6779
6780 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6781 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6782 }
6783
6784 /* Open the dst file for writing. */
6785 status = SMB_VFS_CREATE_FILE(
6786 conn, /* conn */
6787 NULL, /* req */
6788 0, /* root_dir_fid */
6789 smb_fname_dst, /* fname */
6790 FILE_GENERIC_WRITE, /* access_mask */
6791 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6792 new_create_disposition, /* create_disposition*/
6793 0, /* create_options */
6794 dosattrs, /* file_attributes */
6795 INTERNAL_OPEN_ONLY, /* oplock_request */
6796 0, /* allocation_size */
6797 0, /* private_flags */
6798 NULL, /* sd */
6799 NULL, /* ea_list */
6800 &fsp2, /* result */
6801 NULL); /* psbuf */
6802
6803 if (!NT_STATUS_IS_OK(status)) {
6804 close_file(NULL, fsp1, ERROR_CLOSE);
6805 goto out;
6806 }
6807
6808 if (ofun & OPENX_FILE_EXISTS_OPEN) {
6809 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6810 if (ret == -1) {
6811 DEBUG(0, ("error - vfs lseek returned error %s\n",
6812 strerror(errno)));
6813 status = map_nt_error_from_unix(errno);
6814 close_file(NULL, fsp1, ERROR_CLOSE);
6815 close_file(NULL, fsp2, ERROR_CLOSE);
6816 goto out;
6817 }
6818 }
6819
6820 /* Do the actual copy. */
6821 if (smb_fname_src->st.st_ex_size) {
6822 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6823 } else {
6824 ret = 0;
6825 }
6826
6827 close_file(NULL, fsp1, NORMAL_CLOSE);
6828
6829 /* Ensure the modtime is set correctly on the destination file. */
6830 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6831
6832 /*
6833 * As we are opening fsp1 read-only we only expect
6834 * an error on close on fsp2 if we are out of space.
6835 * Thus we don't look at the error return from the
6836 * close of fsp1.
6837 */
6838 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6839
6840 if (!NT_STATUS_IS_OK(status)) {
6841 goto out;
6842 }
6843
6844 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
6845 status = NT_STATUS_DISK_FULL;
6846 goto out;
6847 }
6848
6849 status = NT_STATUS_OK;
6850
6851 out:
6852 TALLOC_FREE(smb_fname_dst_tmp);
6853 return status;
6854 }
6855
6856 /****************************************************************************
6857 Reply to a file copy.
6858 ****************************************************************************/
6859
6860 void reply_copy(struct smb_request *req)
6861 {
6862 connection_struct *conn = req->conn;
6863 struct smb_filename *smb_fname_src = NULL;
6864 struct smb_filename *smb_fname_dst = NULL;
6865 char *fname_src = NULL;
6866 char *fname_dst = NULL;
6867 char *fname_src_mask = NULL;
6868 char *fname_src_dir = NULL;
6869 const char *p;
6870 int count=0;
6871 int error = ERRnoaccess;
6872 int tid2;
6873 int ofun;
6874 int flags;
6875 bool target_is_directory=False;
6876 bool source_has_wild = False;
6877 bool dest_has_wild = False;
6878 NTSTATUS status;
6879 TALLOC_CTX *ctx = talloc_tos();
6880
6881 START_PROFILE(SMBcopy);
6882
6883 if (req->wct < 3) {
6884 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6885 goto out;
6886 }
6887
6888 tid2 = SVAL(req->vwv+0, 0);
6889 ofun = SVAL(req->vwv+1, 0);
6890 flags = SVAL(req->vwv+2, 0);
6891
6892 p = (const char *)req->buf;
6893 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6894 &status, &source_has_wild);
6895 if (!NT_STATUS_IS_OK(status)) {
6896 reply_nterror(req, status);
6897 goto out;
6898 }
6899 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6900 &status, &dest_has_wild);
6901 if (!NT_STATUS_IS_OK(status)) {
6902 reply_nterror(req, status);
6903 goto out;
6904 }
6905
6906 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6907
6908 if (tid2 != conn->cnum) {
6909 /* can't currently handle inter share copies XXXX */
6910 DEBUG(3,("Rejecting inter-share copy\n"));
6911 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6912 goto out;
6913 }
6914
6915 status = filename_convert(ctx, conn,
6916 req->flags2 & FLAGS2_DFS_PATHNAMES,
6917 fname_src,
6918 UCF_COND_ALLOW_WCARD_LCOMP,
6919 &source_has_wild,
6920 &smb_fname_src);
6921 if (!NT_STATUS_IS_OK(status)) {
6922 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6923 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6924 ERRSRV, ERRbadpath);
6925 goto out;
6926 }
6927 reply_nterror(req, status);
6928 goto out;
6929 }
6930
6931 status = filename_convert(ctx, conn,
6932 req->flags2 & FLAGS2_DFS_PATHNAMES,
6933 fname_dst,
6934 UCF_COND_ALLOW_WCARD_LCOMP,
6935 &dest_has_wild,
6936 &smb_fname_dst);
6937 if (!NT_STATUS_IS_OK(status)) {
6938 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6939 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6940 ERRSRV, ERRbadpath);
6941 goto out;
6942 }
6943 reply_nterror(req, status);
6944 goto out;
6945 }
6946
6947 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6948
6949 if ((flags&1) && target_is_directory) {
6950 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6951 goto out;
6952 }
6953
6954 if ((flags&2) && !target_is_directory) {
6955 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6956 goto out;
6957 }
6958
6959 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6960 /* wants a tree copy! XXXX */
6961 DEBUG(3,("Rejecting tree copy\n"));
6962 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6963 goto out;
6964 }
6965
6966 /* Split up the directory from the filename/mask. */
6967 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6968 &fname_src_dir, &fname_src_mask);
6969 if (!NT_STATUS_IS_OK(status)) {
6970 reply_nterror(req, NT_STATUS_NO_MEMORY);
6971 goto out;
6972 }
6973
6974 /*
6975 * We should only check the mangled cache
6976 * here if unix_convert failed. This means
6977 * that the path in 'mask' doesn't exist
6978 * on the file system and so we need to look
6979 * for a possible mangle. This patch from
6980 * Tine Smukavec <valentin.smukavec@hermes.si>.
6981 */
6982 if (!VALID_STAT(smb_fname_src->st) &&
6983 mangle_is_mangled(fname_src_mask, conn->params)) {
6984 char *new_mask = NULL;
6985 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6986 &new_mask, conn->params);
6987
6988 /* Use demangled name if one was successfully found. */
6989 if (new_mask) {
6990 TALLOC_FREE(fname_src_mask);
6991 fname_src_mask = new_mask;
6992 }
6993 }
6994
6995 if (!source_has_wild) {
6996
6997 /*
6998 * Only one file needs to be copied. Append the mask back onto
6999 * the directory.
7000 */
7001 TALLOC_FREE(smb_fname_src->base_name);
7002 if (ISDOT(fname_src_dir)) {
7003 /* Ensure we use canonical names on open. */
7004 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7005 "%s",
7006 fname_src_mask);
7007 } else {
7008 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7009 "%s/%s",
7010 fname_src_dir,
7011 fname_src_mask);
7012 }
7013 if (!smb_fname_src->base_name) {
7014 reply_nterror(req, NT_STATUS_NO_MEMORY);
7015 goto out;
7016 }
7017
7018 if (dest_has_wild) {
7019 char *fname_dst_mod = NULL;
7020 if (!resolve_wildcards(smb_fname_dst,
7021 smb_fname_src->base_name,
7022 smb_fname_dst->base_name,
7023 &fname_dst_mod)) {
7024 reply_nterror(req, NT_STATUS_NO_MEMORY);
7025 goto out;
7026 }
7027 TALLOC_FREE(smb_fname_dst->base_name);
7028 smb_fname_dst->base_name = fname_dst_mod;
7029 }
7030
7031 status = check_name(conn, smb_fname_src->base_name);
7032 if (!NT_STATUS_IS_OK(status)) {
7033 reply_nterror(req, status);
7034 goto out;
7035 }
7036
7037 status = check_name(conn, smb_fname_dst->base_name);
7038 if (!NT_STATUS_IS_OK(status)) {
7039 reply_nterror(req, status);
7040 goto out;
7041 }
7042
7043 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7044 ofun, count, target_is_directory);
7045
7046 if(!NT_STATUS_IS_OK(status)) {
7047 reply_nterror(req, status);
7048 goto out;
7049 } else {
7050 count++;
7051 }
7052 } else {
7053 struct smb_Dir *dir_hnd = NULL;
7054 const char *dname = NULL;
7055 char *talloced = NULL;
7056 long offset = 0;
7057
7058 /*
7059 * There is a wildcard that requires us to actually read the
7060 * src dir and copy each file matching the mask to the dst.
7061 * Right now streams won't be copied, but this could
7062 * presumably be added with a nested loop for reach dir entry.
7063 */
7064 SMB_ASSERT(!smb_fname_src->stream_name);
7065 SMB_ASSERT(!smb_fname_dst->stream_name);
7066
7067 smb_fname_src->stream_name = NULL;
7068 smb_fname_dst->stream_name = NULL;
7069
7070 if (strequal(fname_src_mask,"????????.???")) {
7071 TALLOC_FREE(fname_src_mask);
7072 fname_src_mask = talloc_strdup(ctx, "*");
7073 if (!fname_src_mask) {
7074 reply_nterror(req, NT_STATUS_NO_MEMORY);
7075 goto out;
7076 }
7077 }
7078
7079 status = check_name(conn, fname_src_dir);
7080 if (!NT_STATUS_IS_OK(status)) {
7081 reply_nterror(req, status);
7082 goto out;
7083 }
7084
7085 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7086 if (dir_hnd == NULL) {
7087 status = map_nt_error_from_unix(errno);
7088 reply_nterror(req, status);
7089 goto out;
7090 }
7091
7092 error = ERRbadfile;
7093
7094 /* Iterate over the src dir copying each entry to the dst. */
7095 while ((dname = ReadDirName(dir_hnd, &offset,
7096 &smb_fname_src->st, &talloced))) {
7097 char *destname = NULL;
7098
7099 if (ISDOT(dname) || ISDOTDOT(dname)) {
7100 TALLOC_FREE(talloced);
7101 continue;
7102 }
7103
7104 if (!is_visible_file(conn, fname_src_dir, dname,
7105 &smb_fname_src->st, false)) {
7106 TALLOC_FREE(talloced);
7107 continue;
7108 }
7109
7110 if(!mask_match(dname, fname_src_mask,
7111 conn->case_sensitive)) {
7112 TALLOC_FREE(talloced);
7113 continue;
7114 }
7115
7116 error = ERRnoaccess;
7117
7118 /* Get the src smb_fname struct setup. */
7119 TALLOC_FREE(smb_fname_src->base_name);
7120 if (ISDOT(fname_src_dir)) {
7121 /* Ensure we use canonical names on open. */
7122 smb_fname_src->base_name =
7123 talloc_asprintf(smb_fname_src, "%s",
7124 dname);
7125 } else {
7126 smb_fname_src->base_name =
7127 talloc_asprintf(smb_fname_src, "%s/%s",
7128 fname_src_dir, dname);
7129 }
7130
7131 if (!smb_fname_src->base_name) {
7132 TALLOC_FREE(dir_hnd);
7133 TALLOC_FREE(talloced);
7134 reply_nterror(req, NT_STATUS_NO_MEMORY);
7135 goto out;
7136 }
7137
7138 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7139 smb_fname_dst->base_name,
7140 &destname)) {
7141 TALLOC_FREE(talloced);
7142 continue;
7143 }
7144 if (!destname) {
7145 TALLOC_FREE(dir_hnd);
7146 TALLOC_FREE(talloced);
7147 reply_nterror(req, NT_STATUS_NO_MEMORY);
7148 goto out;
7149 }
7150
7151 TALLOC_FREE(smb_fname_dst->base_name);
7152 smb_fname_dst->base_name = destname;
7153
7154 status = check_name(conn, smb_fname_src->base_name);
7155 if (!NT_STATUS_IS_OK(status)) {
7156 TALLOC_FREE(dir_hnd);
7157 TALLOC_FREE(talloced);
7158 reply_nterror(req, status);
7159 goto out;
7160 }
7161
7162 status = check_name(conn, smb_fname_dst->base_name);
7163 if (!NT_STATUS_IS_OK(status)) {
7164 TALLOC_FREE(dir_hnd);
7165 TALLOC_FREE(talloced);
7166 reply_nterror(req, status);
7167 goto out;
7168 }
7169
7170 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7171 smb_fname_src->base_name,
7172 smb_fname_dst->base_name));
7173
7174 status = copy_file(ctx, conn, smb_fname_src,
7175 smb_fname_dst, ofun, count,
7176 target_is_directory);
7177 if (NT_STATUS_IS_OK(status)) {
7178 count++;
7179 }
7180
7181 TALLOC_FREE(talloced);
7182 }
7183 TALLOC_FREE(dir_hnd);
7184 }
7185
7186 if (count == 0) {
7187 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7188 goto out;
7189 }
7190
7191 reply_outbuf(req, 1, 0);
7192 SSVAL(req->outbuf,smb_vwv0,count);
7193 out:
7194 TALLOC_FREE(smb_fname_src);
7195 TALLOC_FREE(smb_fname_dst);
7196 TALLOC_FREE(fname_src);
7197 TALLOC_FREE(fname_dst);
7198 TALLOC_FREE(fname_src_mask);
7199 TALLOC_FREE(fname_src_dir);
7200
7201 END_PROFILE(SMBcopy);
7202 return;
7203 }
7204
7205 #undef DBGC_CLASS
7206 #define DBGC_CLASS DBGC_LOCKING
7207
7208 /****************************************************************************
7209 Get a lock pid, dealing with large count requests.
7210 ****************************************************************************/
7211
7212 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7213 bool large_file_format)
7214 {
7215 if(!large_file_format)
7216 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7217 else
7218 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7219 }
7220
7221 /****************************************************************************
7222 Get a lock count, dealing with large count requests.
7223 ****************************************************************************/
7224
7225 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7226 bool large_file_format)
7227 {
7228 uint64_t count = 0;
7229
7230 if(!large_file_format) {
7231 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7232 } else {
7233
7234 #if defined(HAVE_LONGLONG)
7235 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7236 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7237 #else /* HAVE_LONGLONG */
7238
7239 /*
7240 * NT4.x seems to be broken in that it sends large file (64 bit)
7241 * lockingX calls even if the CAP_LARGE_FILES was *not*
7242 * negotiated. For boxes without large unsigned ints truncate the
7243 * lock count by dropping the top 32 bits.
7244 */
7245
7246 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7247 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7248 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7249 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7250 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7251 }
7252
7253 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7254 #endif /* HAVE_LONGLONG */
7255 }
7256
7257 return count;
7258 }
7259
7260 #if !defined(HAVE_LONGLONG)
7261 /****************************************************************************
7262 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7263 ****************************************************************************/
7264
7265 static uint32 map_lock_offset(uint32 high, uint32 low)
7266 {
7267 unsigned int i;
7268 uint32 mask = 0;
7269 uint32 highcopy = high;
7270
7271 /*
7272 * Try and find out how many significant bits there are in high.
7273 */
7274
7275 for(i = 0; highcopy; i++)
7276 highcopy >>= 1;
7277
7278 /*
7279 * We use 31 bits not 32 here as POSIX
7280 * lock offsets may not be negative.
7281 */
7282
7283 mask = (~0) << (31 - i);
7284
7285 if(low & mask)
7286 return 0; /* Fail. */
7287
7288 high <<= (31 - i);
7289
7290 return (high|low);
7291 }
7292 #endif /* !defined(HAVE_LONGLONG) */
7293
7294 /****************************************************************************
7295 Get a lock offset, dealing with large offset requests.
7296 ****************************************************************************/
7297
7298 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7299 bool large_file_format, bool *err)
7300 {
7301 uint64_t offset = 0;
7302
7303 *err = False;
7304
7305 if(!large_file_format) {
7306 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7307 } else {
7308
7309 #if defined(HAVE_LONGLONG)
7310 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7311 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7312 #else /* HAVE_LONGLONG */
7313
7314 /*
7315 * NT4.x seems to be broken in that it sends large file (64 bit)
7316 * lockingX calls even if the CAP_LARGE_FILES was *not*
7317 * negotiated. For boxes without large unsigned ints mangle the
7318 * lock offset by mapping the top 32 bits onto the lower 32.
7319 */
7320
7321 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7322 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7323 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7324 uint32 new_low = 0;
7325
7326 if((new_low = map_lock_offset(high, low)) == 0) {
7327 *err = True;
7328 return (uint64_t)-1;
7329 }
7330
7331 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7332 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7333 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7334 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7335 }
7336
7337 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7338 #endif /* HAVE_LONGLONG */
7339 }
7340
7341 return offset;
7342 }
7343
7344 NTSTATUS smbd_do_locking(struct smb_request *req,
7345 files_struct *fsp,
7346 uint8_t type,
7347 int32_t timeout,
7348 uint16_t num_ulocks,
7349 struct smbd_lock_element *ulocks,
7350 uint16_t num_locks,
7351 struct smbd_lock_element *locks,
7352 bool *async)
7353 {
7354 connection_struct *conn = req->conn;
7355 int i;
7356 NTSTATUS status = NT_STATUS_OK;
7357
7358 *async = false;
7359
7360 /* Data now points at the beginning of the list
7361 of smb_unlkrng structs */
7362 for(i = 0; i < (int)num_ulocks; i++) {
7363 struct smbd_lock_element *e = &ulocks[i];
7364
7365 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7366 "pid %u, file %s\n",
7367 (double)e->offset,
7368 (double)e->count,
7369 (unsigned int)e->smblctx,
7370 fsp_str_dbg(fsp)));
7371
7372 if (e->brltype != UNLOCK_LOCK) {
7373 /* this can only happen with SMB2 */
7374 return NT_STATUS_INVALID_PARAMETER;
7375 }
7376
7377 status = do_unlock(req->sconn->msg_ctx,
7378 fsp,
7379 e->smblctx,
7380 e->count,
7381 e->offset,
7382 WINDOWS_LOCK);
7383
7384 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7385 nt_errstr(status)));
7386
7387 if (!NT_STATUS_IS_OK(status)) {
7388 return status;
7389 }
7390 }
7391
7392 /* Setup the timeout in seconds. */
7393
7394 if (!lp_blocking_locks(SNUM(conn))) {
7395 timeout = 0;
7396 }
7397
7398 /* Data now points at the beginning of the list
7399 of smb_lkrng structs */
7400
7401 for(i = 0; i < (int)num_locks; i++) {
7402 struct smbd_lock_element *e = &locks[i];
7403
7404 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7405 "%llu, file %s timeout = %d\n",
7406 (double)e->offset,
7407 (double)e->count,
7408 (unsigned long long)e->smblctx,
7409 fsp_str_dbg(fsp),
7410 (int)timeout));
7411
7412 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7413 struct blocking_lock_record *blr = NULL;
7414
7415 if (num_locks > 1) {
7416 /*
7417 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7418 * if the lock vector contains one entry. When given mutliple cancel
7419 * requests in a single PDU we expect the server to return an
7420 * error. Windows servers seem to accept the request but only
7421 * cancel the first lock.
7422 * JRA - Do what Windows does (tm) :-).
7423 */
7424
7425 #if 0
7426 /* MS-CIFS (2.2.4.32.1) behavior. */
7427 return NT_STATUS_DOS(ERRDOS,
7428 ERRcancelviolation);
7429 #else
7430 /* Windows behavior. */
7431 if (i != 0) {
7432 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7433 "cancel request\n"));
7434 continue;
7435 }
7436 #endif
7437 }
7438
7439 if (lp_blocking_locks(SNUM(conn))) {
7440
7441 /* Schedule a message to ourselves to
7442 remove the blocking lock record and
7443 return the right error. */
7444
7445 blr = blocking_lock_cancel_smb1(fsp,
7446 e->smblctx,
7447 e->offset,
7448 e->count,
7449 WINDOWS_LOCK,
7450 type,
7451 NT_STATUS_FILE_LOCK_CONFLICT);
7452 if (blr == NULL) {
7453 return NT_STATUS_DOS(
7454 ERRDOS,
7455 ERRcancelviolation);
7456 }
7457 }
7458 /* Remove a matching pending lock. */
7459 status = do_lock_cancel(fsp,
7460 e->smblctx,
7461 e->count,
7462 e->offset,
7463 WINDOWS_LOCK,
7464 blr);
7465 } else {
7466 bool blocking_lock = timeout ? true : false;
7467 bool defer_lock = false;
7468 struct byte_range_lock *br_lck;
7469 uint64_t block_smblctx;
7470
7471 br_lck = do_lock(req->sconn->msg_ctx,
7472 fsp,
7473 e->smblctx,
7474 e->count,
7475 e->offset,
7476 e->brltype,
7477 WINDOWS_LOCK,
7478 blocking_lock,
7479 &status,
7480 &block_smblctx,
7481 NULL);
7482
7483 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7484 /* Windows internal resolution for blocking locks seems
7485 to be about 200ms... Don't wait for less than that. JRA. */
7486 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7487 timeout = lp_lock_spin_time();
7488 }
7489 defer_lock = true;
7490 }
7491
7492 /* If a lock sent with timeout of zero would fail, and
7493 * this lock has been requested multiple times,
7494 * according to brl_lock_failed() we convert this
7495 * request to a blocking lock with a timeout of between
7496 * 150 - 300 milliseconds.
7497 *
7498 * If lp_lock_spin_time() has been set to 0, we skip
7499 * this blocking retry and fail immediately.
7500 *
7501 * Replacement for do_lock_spin(). JRA. */
7502
7503 if (!req->sconn->using_smb2 &&
7504 br_lck && lp_blocking_locks(SNUM(conn)) &&
7505 lp_lock_spin_time() && !blocking_lock &&
7506 NT_STATUS_EQUAL((status),
7507 NT_STATUS_FILE_LOCK_CONFLICT))
7508 {
7509 defer_lock = true;
7510 timeout = lp_lock_spin_time();
7511 }
7512
7513 if (br_lck && defer_lock) {
7514 /*
7515 * A blocking lock was requested. Package up
7516 * this smb into a queued request and push it
7517 * onto the blocking lock queue.
7518 */
7519 if(push_blocking_lock_request(br_lck,
7520 req,
7521 fsp,
7522 timeout,
7523 i,
7524 e->smblctx,
7525 e->brltype,
7526 WINDOWS_LOCK,
7527 e->offset,
7528 e->count,
7529 block_smblctx)) {
7530 TALLOC_FREE(br_lck);
7531 *async = true;
7532 return NT_STATUS_OK;
7533 }
7534 }
7535
7536 TALLOC_FREE(br_lck);
7537 }
7538
7539 if (!NT_STATUS_IS_OK(status)) {
7540 break;
7541 }
7542 }
7543
7544 /* If any of the above locks failed, then we must unlock
7545 all of the previous locks (X/Open spec). */
7546
7547 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7548
7549 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7550 i = -1; /* we want to skip the for loop */
7551 }
7552
7553 /*
7554 * Ensure we don't do a remove on the lock that just failed,
7555 * as under POSIX rules, if we have a lock already there, we
7556 * will delete it (and we shouldn't) .....
7557 */
7558 for(i--; i >= 0; i--) {
7559 struct smbd_lock_element *e = &locks[i];
7560
7561 do_unlock(req->sconn->msg_ctx,
7562 fsp,
7563 e->smblctx,
7564 e->count,
7565 e->offset,
7566 WINDOWS_LOCK);
7567 }
7568 return status;
7569 }
7570
7571 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7572 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7573
7574 return NT_STATUS_OK;
7575 }
7576
7577 /****************************************************************************
7578 Reply to a lockingX request.
7579 ****************************************************************************/
7580
7581 void reply_lockingX(struct smb_request *req)
7582 {
7583 connection_struct *conn = req->conn;
7584 files_struct *fsp;
7585 unsigned char locktype;
7586 unsigned char oplocklevel;
7587 uint16 num_ulocks;
7588 uint16 num_locks;
7589 int32 lock_timeout;
7590 int i;
7591 const uint8_t *data;
7592 bool large_file_format;
7593 bool err;
7594 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7595 struct smbd_lock_element *ulocks;
7596 struct smbd_lock_element *locks;
7597 bool async = false;
7598
7599 START_PROFILE(SMBlockingX);
7600
7601 if (req->wct < 8) {
7602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7603 END_PROFILE(SMBlockingX);
7604 return;
7605 }
7606
7607 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7608 locktype = CVAL(req->vwv+3, 0);
7609 oplocklevel = CVAL(req->vwv+3, 1);
7610 num_ulocks = SVAL(req->vwv+6, 0);
7611 num_locks = SVAL(req->vwv+7, 0);
7612 lock_timeout = IVAL(req->vwv+4, 0);
7613 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7614
7615 if (!check_fsp(conn, req, fsp)) {
7616 END_PROFILE(SMBlockingX);
7617 return;
7618 }
7619
7620 data = req->buf;
7621
7622 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7623 /* we don't support these - and CANCEL_LOCK makes w2k
7624 and XP reboot so I don't really want to be
7625 compatible! (tridge) */
7626 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7627 END_PROFILE(SMBlockingX);
7628 return;
7629 }
7630
7631 /* Check if this is an oplock break on a file
7632 we have granted an oplock on.
7633 */
7634 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7635 /* Client can insist on breaking to none. */
7636 bool break_to_none = (oplocklevel == 0);
7637 bool result;
7638
7639 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7640 "for fnum = %d\n", (unsigned int)oplocklevel,
7641 fsp->fnum ));
7642
7643 /*
7644 * Make sure we have granted an exclusive or batch oplock on
7645 * this file.
7646 */
7647
7648 if (fsp->oplock_type == 0) {
7649
7650 /* The Samba4 nbench simulator doesn't understand
7651 the difference between break to level2 and break
7652 to none from level2 - it sends oplock break
7653 replies in both cases. Don't keep logging an error
7654 message here - just ignore it. JRA. */
7655
7656 DEBUG(5,("reply_lockingX: Error : oplock break from "
7657 "client for fnum = %d (oplock=%d) and no "
7658 "oplock granted on this file (%s).\n",
7659 fsp->fnum, fsp->oplock_type,
7660 fsp_str_dbg(fsp)));
7661
7662 /* if this is a pure oplock break request then don't
7663 * send a reply */
7664 if (num_locks == 0 && num_ulocks == 0) {
7665 END_PROFILE(SMBlockingX);
7666 return;
7667 } else {
7668 END_PROFILE(SMBlockingX);
7669 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7670 return;
7671 }
7672 }
7673
7674 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7675 (break_to_none)) {
7676 result = remove_oplock(fsp);
7677 } else {
7678 result = downgrade_oplock(fsp);
7679 }
7680
7681 if (!result) {
7682 DEBUG(0, ("reply_lockingX: error in removing "
7683 "oplock on file %s\n", fsp_str_dbg(fsp)));
7684 /* Hmmm. Is this panic justified? */
7685 smb_panic("internal tdb error");
7686 }
7687
7688 reply_to_oplock_break_requests(fsp);
7689
7690 /* if this is a pure oplock break request then don't send a
7691 * reply */
7692 if (num_locks == 0 && num_ulocks == 0) {
7693 /* Sanity check - ensure a pure oplock break is not a
7694 chained request. */
7695 if(CVAL(req->vwv+0, 0) != 0xff)
7696 DEBUG(0,("reply_lockingX: Error : pure oplock "
7697 "break is a chained %d request !\n",
7698 (unsigned int)CVAL(req->vwv+0, 0)));
7699 END_PROFILE(SMBlockingX);
7700 return;
7701 }
7702 }
7703
7704 if (req->buflen <
7705 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7706 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7707 END_PROFILE(SMBlockingX);
7708 return;
7709 }
7710
7711 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7712 if (ulocks == NULL) {
7713 reply_nterror(req, NT_STATUS_NO_MEMORY);
7714 END_PROFILE(SMBlockingX);
7715 return;
7716 }
7717
7718 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7719 if (locks == NULL) {
7720 reply_nterror(req, NT_STATUS_NO_MEMORY);
7721 END_PROFILE(SMBlockingX);
7722 return;
7723 }
7724
7725 /* Data now points at the beginning of the list
7726 of smb_unlkrng structs */
7727 for(i = 0; i < (int)num_ulocks; i++) {
7728 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7729 ulocks[i].count = get_lock_count(data, i, large_file_format);
7730 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7731 ulocks[i].brltype = UNLOCK_LOCK;
7732
7733 /*
7734 * There is no error code marked "stupid client bug".... :-).
7735 */
7736 if(err) {
7737 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7738 END_PROFILE(SMBlockingX);
7739 return;
7740 }
7741 }
7742
7743 /* Now do any requested locks */
7744 data += ((large_file_format ? 20 : 10)*num_ulocks);
7745
7746 /* Data now points at the beginning of the list
7747 of smb_lkrng structs */
7748
7749 for(i = 0; i < (int)num_locks; i++) {
7750 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7751 locks[i].count = get_lock_count(data, i, large_file_format);
7752 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7753
7754 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7755 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7756 locks[i].brltype = PENDING_READ_LOCK;
7757 } else {
7758 locks[i].brltype = READ_LOCK;
7759 }
7760 } else {
7761 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7762 locks[i].brltype = PENDING_WRITE_LOCK;
7763 } else {
7764 locks[i].brltype = WRITE_LOCK;
7765 }
7766 }
7767
7768 /*
7769 * There is no error code marked "stupid client bug".... :-).
7770 */
7771 if(err) {
7772 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7773 END_PROFILE(SMBlockingX);
7774 return;
7775 }
7776 }
7777
7778 status = smbd_do_locking(req, fsp,
7779 locktype, lock_timeout,
7780 num_ulocks, ulocks,
7781 num_locks, locks,
7782 &async);
7783 if (!NT_STATUS_IS_OK(status)) {
7784 END_PROFILE(SMBlockingX);
7785 reply_nterror(req, status);
7786 return;
7787 }
7788 if (async) {
7789 END_PROFILE(SMBlockingX);
7790 return;
7791 }
7792
7793 reply_outbuf(req, 2, 0);
7794 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
7795 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
7796
7797 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7798 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7799
7800 END_PROFILE(SMBlockingX);
7801 }
7802
7803 #undef DBGC_CLASS
7804 #define DBGC_CLASS DBGC_ALL
7805
7806 /****************************************************************************
7807 Reply to a SMBreadbmpx (read block multiplex) request.
7808 Always reply with an error, if someone has a platform really needs this,
7809 please contact vl@samba.org
7810 ****************************************************************************/
7811
7812 void reply_readbmpx(struct smb_request *req)
7813 {
7814 START_PROFILE(SMBreadBmpx);
7815 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7816 END_PROFILE(SMBreadBmpx);
7817 return;
7818 }
7819
7820 /****************************************************************************
7821 Reply to a SMBreadbs (read block multiplex secondary) request.
7822 Always reply with an error, if someone has a platform really needs this,
7823 please contact vl@samba.org
7824 ****************************************************************************/
7825
7826 void reply_readbs(struct smb_request *req)
7827 {
7828 START_PROFILE(SMBreadBs);
7829 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7830 END_PROFILE(SMBreadBs);
7831 return;
7832 }
7833
7834 /****************************************************************************
7835 Reply to a SMBsetattrE.
7836 ****************************************************************************/
7837
7838 void reply_setattrE(struct smb_request *req)
7839 {
7840 connection_struct *conn = req->conn;
7841 struct smb_file_time ft;
7842 files_struct *fsp;
7843 NTSTATUS status;
7844
7845 START_PROFILE(SMBsetattrE);
7846 ZERO_STRUCT(ft);
7847
7848 if (req->wct < 7) {
7849 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7850 goto out;
7851 }
7852
7853 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7854
7855 if(!fsp || (fsp->conn != conn)) {
7856 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7857 goto out;
7858 }
7859
7860 /*
7861 * Convert the DOS times into unix times.
7862 */
7863
7864 ft.atime = convert_time_t_to_timespec(
7865 srv_make_unix_date2(req->vwv+3));
7866 ft.mtime = convert_time_t_to_timespec(
7867 srv_make_unix_date2(req->vwv+5));
7868 ft.create_time = convert_time_t_to_timespec(
7869 srv_make_unix_date2(req->vwv+1));
7870
7871 reply_outbuf(req, 0, 0);
7872
7873 /*
7874 * Patch from Ray Frush <frush@engr.colostate.edu>
7875 * Sometimes times are sent as zero - ignore them.
7876 */
7877
7878 /* Ensure we have a valid stat struct for the source. */
7879 status = vfs_stat_fsp(fsp);
7880 if (!NT_STATUS_IS_OK(status)) {
7881 reply_nterror(req, status);
7882 goto out;
7883 }
7884
7885 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
7886 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7887 goto out;
7888 }
7889
7890 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7891 if (!NT_STATUS_IS_OK(status)) {
7892 reply_nterror(req, status);
7893 goto out;
7894 }
7895
7896 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7897 " createtime=%u\n",
7898 fsp->fnum,
7899 (unsigned int)ft.atime.tv_sec,
7900 (unsigned int)ft.mtime.tv_sec,
7901 (unsigned int)ft.create_time.tv_sec
7902 ));
7903 out:
7904 END_PROFILE(SMBsetattrE);
7905 return;
7906 }
7907
7908
7909 /* Back from the dead for OS/2..... JRA. */
7910
7911 /****************************************************************************
7912 Reply to a SMBwritebmpx (write block multiplex primary) request.
7913 Always reply with an error, if someone has a platform really needs this,
7914 please contact vl@samba.org
7915 ****************************************************************************/
7916
7917 void reply_writebmpx(struct smb_request *req)
7918 {
7919 START_PROFILE(SMBwriteBmpx);
7920 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7921 END_PROFILE(SMBwriteBmpx);
7922 return;
7923 }
7924
7925 /****************************************************************************
7926 Reply to a SMBwritebs (write block multiplex secondary) request.
7927 Always reply with an error, if someone has a platform really needs this,
7928 please contact vl@samba.org
7929 ****************************************************************************/
7930
7931 void reply_writebs(struct smb_request *req)
7932 {
7933 START_PROFILE(SMBwriteBs);
7934 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7935 END_PROFILE(SMBwriteBs);
7936 return;
7937 }
7938
7939 /****************************************************************************
7940 Reply to a SMBgetattrE.
7941 ****************************************************************************/
7942
7943 void reply_getattrE(struct smb_request *req)
7944 {
7945 connection_struct *conn = req->conn;
7946 int mode;
7947 files_struct *fsp;
7948 struct timespec create_ts;
7949
7950 START_PROFILE(SMBgetattrE);
7951
7952 if (req->wct < 1) {
7953 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7954 END_PROFILE(SMBgetattrE);
7955 return;
7956 }
7957
7958 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7959
7960 if(!fsp || (fsp->conn != conn)) {
7961 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7962 END_PROFILE(SMBgetattrE);
7963 return;
7964 }
7965
7966 /* Do an fstat on this file */
7967 if(fsp_stat(fsp)) {
7968 reply_nterror(req, map_nt_error_from_unix(errno));
7969 END_PROFILE(SMBgetattrE);
7970 return;
7971 }
7972
7973 mode = dos_mode(conn, fsp->fsp_name);
7974
7975 /*
7976 * Convert the times into dos times. Set create
7977 * date to be last modify date as UNIX doesn't save
7978 * this.
7979 */
7980
7981 reply_outbuf(req, 11, 0);
7982
7983 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7984 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7985 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7986 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7987 /* Should we check pending modtime here ? JRA */
7988 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7989 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7990
7991 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
7992 SIVAL(req->outbuf, smb_vwv6, 0);
7993 SIVAL(req->outbuf, smb_vwv8, 0);
7994 } else {
7995 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7996 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7997 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7998 }
7999 SSVAL(req->outbuf,smb_vwv10, mode);
8000
8001 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8002
8003 END_PROFILE(SMBgetattrE);
8004 return;
8005 }
reg import