?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add some debug in s4's winbind server
[Samba/gebeck_regimport.git] / source3 / smbd / reply.c
blobe5067cca7e9d93484f0e4c220de2d65f631ac99d
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "printing.h"
29 #include "smbd/globals.h"
30 #include "fake_file.h"
31 #include "../librpc/gen_ndr/cli_spoolss.h"
32 #include "rpc_client/cli_spoolss.h"
33 #include "rpc_client/init_spoolss.h"
34 #include "rpc_server/rpc_ncacn_np.h"
35 #include "libcli/security/security.h"
36
37 /****************************************************************************
38 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
39 path or anything including wildcards.
40 We're assuming here that '/' is not the second byte in any multibyte char
41 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
42 set.
43 ****************************************************************************/
44
45 /* Custom version for processing POSIX paths. */
46 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
47
48 static NTSTATUS check_path_syntax_internal(char *path,
49 bool posix_path,
50 bool *p_last_component_contains_wcard)
51 {
52 char *d = path;
53 const char *s = path;
54 NTSTATUS ret = NT_STATUS_OK;
55 bool start_of_name_component = True;
56 bool stream_started = false;
57
58 *p_last_component_contains_wcard = False;
59
60 while (*s) {
61 if (stream_started) {
62 switch (*s) {
63 case '/':
64 case '\\':
65 return NT_STATUS_OBJECT_NAME_INVALID;
66 case ':':
67 if (s[1] == '\0') {
68 return NT_STATUS_OBJECT_NAME_INVALID;
69 }
70 if (strchr_m(&s[1], ':')) {
71 return NT_STATUS_OBJECT_NAME_INVALID;
72 }
73 break;
74 }
75 }
76
77 if ((*s == ':') && !posix_path && !stream_started) {
78 if (*p_last_component_contains_wcard) {
79 return NT_STATUS_OBJECT_NAME_INVALID;
80 }
81 /* Stream names allow more characters than file names.
82 We're overloading posix_path here to allow a wider
83 range of characters. If stream_started is true this
84 is still a Windows path even if posix_path is true.
85 JRA.
86 */
87 stream_started = true;
88 start_of_name_component = false;
89 posix_path = true;
90
91 if (s[1] == '\0') {
92 return NT_STATUS_OBJECT_NAME_INVALID;
93 }
94 }
95
96 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
97 /*
98 * Safe to assume is not the second part of a mb char
99 * as this is handled below.
100 */
101 /* Eat multiple '/' or '\\' */
102 while (IS_PATH_SEP(*s,posix_path)) {
103 s++;
104 }
105 if ((d != path) && (*s != '\0')) {
106 /* We only care about non-leading or trailing '/' or '\\' */
107 *d++ = '/';
108 }
109
110 start_of_name_component = True;
111 /* New component. */
112 *p_last_component_contains_wcard = False;
113 continue;
114 }
115
116 if (start_of_name_component) {
117 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
118 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
119
120 /*
121 * No mb char starts with '.' so we're safe checking the directory separator here.
122 */
123
124 /* If we just added a '/' - delete it */
125 if ((d > path) && (*(d-1) == '/')) {
126 *(d-1) = '\0';
127 d--;
128 }
129
130 /* Are we at the start ? Can't go back further if so. */
131 if (d <= path) {
132 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
133 break;
134 }
135 /* Go back one level... */
136 /* We know this is safe as '/' cannot be part of a mb sequence. */
137 /* NOTE - if this assumption is invalid we are not in good shape... */
138 /* Decrement d first as d points to the *next* char to write into. */
139 for (d--; d > path; d--) {
140 if (*d == '/')
141 break;
142 }
143 s += 2; /* Else go past the .. */
144 /* We're still at the start of a name component, just the previous one. */
145 continue;
146
147 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
148 if (posix_path) {
149 /* Eat the '.' */
150 s++;
151 continue;
152 }
153 }
154
155 }
156
157 if (!(*s & 0x80)) {
158 if (!posix_path) {
159 if (*s <= 0x1f || *s == '|') {
160 return NT_STATUS_OBJECT_NAME_INVALID;
161 }
162 switch (*s) {
163 case '*':
164 case '?':
165 case '<':
166 case '>':
167 case '"':
168 *p_last_component_contains_wcard = True;
169 break;
170 default:
171 break;
172 }
173 }
174 *d++ = *s++;
175 } else {
176 size_t siz;
177 /* Get the size of the next MB character. */
178 next_codepoint(s,&siz);
179 switch(siz) {
180 case 5:
181 *d++ = *s++;
182 /*fall through*/
183 case 4:
184 *d++ = *s++;
185 /*fall through*/
186 case 3:
187 *d++ = *s++;
188 /*fall through*/
189 case 2:
190 *d++ = *s++;
191 /*fall through*/
192 case 1:
193 *d++ = *s++;
194 break;
195 default:
196 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
197 *d = '\0';
198 return NT_STATUS_INVALID_PARAMETER;
199 }
200 }
201 start_of_name_component = False;
202 }
203
204 *d = '\0';
205
206 return ret;
207 }
208
209 /****************************************************************************
210 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
211 No wildcards allowed.
212 ****************************************************************************/
213
214 NTSTATUS check_path_syntax(char *path)
215 {
216 bool ignore;
217 return check_path_syntax_internal(path, False, &ignore);
218 }
219
220 /****************************************************************************
221 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
222 Wildcards allowed - p_contains_wcard returns true if the last component contained
223 a wildcard.
224 ****************************************************************************/
225
226 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
227 {
228 return check_path_syntax_internal(path, False, p_contains_wcard);
229 }
230
231 /****************************************************************************
232 Check the path for a POSIX client.
233 We're assuming here that '/' is not the second byte in any multibyte char
234 set (a safe assumption).
235 ****************************************************************************/
236
237 NTSTATUS check_path_syntax_posix(char *path)
238 {
239 bool ignore;
240 return check_path_syntax_internal(path, True, &ignore);
241 }
242
243 /****************************************************************************
244 Pull a string and check the path allowing a wilcard - provide for error return.
245 ****************************************************************************/
246
247 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
248 const char *base_ptr,
249 uint16 smb_flags2,
250 char **pp_dest,
251 const char *src,
252 size_t src_len,
253 int flags,
254 NTSTATUS *err,
255 bool *contains_wcard)
256 {
257 size_t ret;
258
259 *pp_dest = NULL;
260
261 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
262 src_len, flags);
263
264 if (!*pp_dest) {
265 *err = NT_STATUS_INVALID_PARAMETER;
266 return ret;
267 }
268
269 *contains_wcard = False;
270
271 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
272 /*
273 * For a DFS path the function parse_dfs_path()
274 * will do the path processing, just make a copy.
275 */
276 *err = NT_STATUS_OK;
277 return ret;
278 }
279
280 if (lp_posix_pathnames()) {
281 *err = check_path_syntax_posix(*pp_dest);
282 } else {
283 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
284 }
285
286 return ret;
287 }
288
289 /****************************************************************************
290 Pull a string and check the path - provide for error return.
291 ****************************************************************************/
292
293 size_t srvstr_get_path(TALLOC_CTX *ctx,
294 const char *base_ptr,
295 uint16 smb_flags2,
296 char **pp_dest,
297 const char *src,
298 size_t src_len,
299 int flags,
300 NTSTATUS *err)
301 {
302 bool ignore;
303 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
304 src_len, flags, err, &ignore);
305 }
306
307 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
308 char **pp_dest, const char *src, int flags,
309 NTSTATUS *err, bool *contains_wcard)
310 {
311 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
312 pp_dest, src, smbreq_bufrem(req, src),
313 flags, err, contains_wcard);
314 }
315
316 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
317 char **pp_dest, const char *src, int flags,
318 NTSTATUS *err)
319 {
320 bool ignore;
321 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
322 flags, err, &ignore);
323 }
324
325 /****************************************************************************
326 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
327 ****************************************************************************/
328
329 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
330 files_struct *fsp)
331 {
332 if ((fsp == NULL) || (conn == NULL)) {
333 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
334 return False;
335 }
336 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
337 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
338 return False;
339 }
340 return True;
341 }
342
343 /****************************************************************************
344 Check if we have a correct fsp pointing to a file.
345 ****************************************************************************/
346
347 bool check_fsp(connection_struct *conn, struct smb_request *req,
348 files_struct *fsp)
349 {
350 if (!check_fsp_open(conn, req, fsp)) {
351 return False;
352 }
353 if (fsp->is_directory) {
354 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
355 return False;
356 }
357 if (fsp->fh->fd == -1) {
358 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
359 return False;
360 }
361 fsp->num_smb_operations++;
362 return True;
363 }
364
365 /****************************************************************************
366 Check if we have a correct fsp pointing to a quota fake file. Replacement for
367 the CHECK_NTQUOTA_HANDLE_OK macro.
368 ****************************************************************************/
369
370 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
371 files_struct *fsp)
372 {
373 if (!check_fsp_open(conn, req, fsp)) {
374 return false;
375 }
376
377 if (fsp->is_directory) {
378 return false;
379 }
380
381 if (fsp->fake_file_handle == NULL) {
382 return false;
383 }
384
385 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
386 return false;
387 }
388
389 if (fsp->fake_file_handle->private_data == NULL) {
390 return false;
391 }
392
393 return true;
394 }
395
396 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
397 const char *name, int name_type)
398 {
399 char *trim_name;
400 char *trim_name_type;
401 const char *retarget_parm;
402 char *retarget;
403 char *p;
404 int retarget_type = 0x20;
405 int retarget_port = 139;
406 struct sockaddr_storage retarget_addr;
407 struct sockaddr_in *in_addr;
408 bool ret = false;
409 uint8_t outbuf[10];
410
411 if (get_socket_port(sconn->sock) != 139) {
412 return false;
413 }
414
415 trim_name = talloc_strdup(talloc_tos(), name);
416 if (trim_name == NULL) {
417 goto fail;
418 }
419 trim_char(trim_name, ' ', ' ');
420
421 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
422 name_type);
423 if (trim_name_type == NULL) {
424 goto fail;
425 }
426
427 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
428 trim_name_type, NULL);
429 if (retarget_parm == NULL) {
430 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
431 trim_name, NULL);
432 }
433 if (retarget_parm == NULL) {
434 goto fail;
435 }
436
437 retarget = talloc_strdup(trim_name, retarget_parm);
438 if (retarget == NULL) {
439 goto fail;
440 }
441
442 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
443
444 p = strchr(retarget, ':');
445 if (p != NULL) {
446 *p++ = '\0';
447 retarget_port = atoi(p);
448 }
449
450 p = strchr_m(retarget, '#');
451 if (p != NULL) {
452 *p++ = '\0';
453 sscanf(p, "%x", &retarget_type);
454 }
455
456 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
457 if (!ret) {
458 DEBUG(10, ("could not resolve %s\n", retarget));
459 goto fail;
460 }
461
462 if (retarget_addr.ss_family != AF_INET) {
463 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
464 goto fail;
465 }
466
467 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
468
469 _smb_setlen(outbuf, 6);
470 SCVAL(outbuf, 0, 0x84);
471 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
472 *(uint16_t *)(outbuf+8) = htons(retarget_port);
473
474 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
475 NULL)) {
476 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
477 "failed.");
478 }
479
480 ret = true;
481 fail:
482 TALLOC_FREE(trim_name);
483 return ret;
484 }
485
486 /****************************************************************************
487 Reply to a (netbios-level) special message.
488 ****************************************************************************/
489
490 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
491 {
492 int msg_type = CVAL(inbuf,0);
493 int msg_flags = CVAL(inbuf,1);
494 /*
495 * We only really use 4 bytes of the outbuf, but for the smb_setlen
496 * calculation & friends (srv_send_smb uses that) we need the full smb
497 * header.
498 */
499 char outbuf[smb_size];
500
501 memset(outbuf, '\0', sizeof(outbuf));
502
503 smb_setlen(outbuf,0);
504
505 switch (msg_type) {
506 case 0x81: /* session request */
507 {
508 /* inbuf_size is guarenteed to be at least 4. */
509 fstring name1,name2;
510 int name_type1, name_type2;
511 int name_len1, name_len2;
512
513 *name1 = *name2 = 0;
514
515 if (sconn->nbt.got_session) {
516 exit_server_cleanly("multiple session request not permitted");
517 }
518
519 SCVAL(outbuf,0,0x82);
520 SCVAL(outbuf,3,0);
521
522 /* inbuf_size is guaranteed to be at least 4. */
523 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
524 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
525 DEBUG(0,("Invalid name length in session request\n"));
526 break;
527 }
528 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
529 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
530 DEBUG(0,("Invalid name length in session request\n"));
531 break;
532 }
533
534 name_type1 = name_extract((unsigned char *)inbuf,
535 inbuf_size,(unsigned int)4,name1);
536 name_type2 = name_extract((unsigned char *)inbuf,
537 inbuf_size,(unsigned int)(4 + name_len1),name2);
538
539 if (name_type1 == -1 || name_type2 == -1) {
540 DEBUG(0,("Invalid name type in session request\n"));
541 break;
542 }
543
544 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
545 name1, name_type1, name2, name_type2));
546
547 if (netbios_session_retarget(sconn, name1, name_type1)) {
548 exit_server_cleanly("retargeted client");
549 }
550
551 /*
552 * Windows NT/2k uses "*SMBSERVER" and XP uses
553 * "*SMBSERV" arrggg!!!
554 */
555 if (strequal(name1, "*SMBSERVER ")
556 || strequal(name1, "*SMBSERV ")) {
557 fstrcpy(name1, sconn->client_id.addr);
558 }
559
560 set_local_machine_name(name1, True);
561 set_remote_machine_name(name2, True);
562
563 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
564 get_local_machine_name(), get_remote_machine_name(),
565 name_type2));
566
567 if (name_type2 == 'R') {
568 /* We are being asked for a pathworks session ---
569 no thanks! */
570 SCVAL(outbuf, 0,0x83);
571 break;
572 }
573
574 /* only add the client's machine name to the list
575 of possibly valid usernames if we are operating
576 in share mode security */
577 if (lp_security() == SEC_SHARE) {
578 add_session_user(sconn, get_remote_machine_name());
579 }
580
581 reload_services(sconn->msg_ctx, sconn->sock, True);
582 reopen_logs();
583
584 sconn->nbt.got_session = true;
585 break;
586 }
587
588 case 0x89: /* session keepalive request
589 (some old clients produce this?) */
590 SCVAL(outbuf,0,SMBkeepalive);
591 SCVAL(outbuf,3,0);
592 break;
593
594 case 0x82: /* positive session response */
595 case 0x83: /* negative session response */
596 case 0x84: /* retarget session response */
597 DEBUG(0,("Unexpected session response\n"));
598 break;
599
600 case SMBkeepalive: /* session keepalive */
601 default:
602 return;
603 }
604
605 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
606 msg_type, msg_flags));
607
608 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
609 return;
610 }
611
612 /****************************************************************************
613 Reply to a tcon.
614 conn POINTER CAN BE NULL HERE !
615 ****************************************************************************/
616
617 void reply_tcon(struct smb_request *req)
618 {
619 connection_struct *conn = req->conn;
620 const char *service;
621 char *service_buf = NULL;
622 char *password = NULL;
623 char *dev = NULL;
624 int pwlen=0;
625 NTSTATUS nt_status;
626 const char *p;
627 DATA_BLOB password_blob;
628 TALLOC_CTX *ctx = talloc_tos();
629 struct smbd_server_connection *sconn = req->sconn;
630
631 START_PROFILE(SMBtcon);
632
633 if (req->buflen < 4) {
634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
635 END_PROFILE(SMBtcon);
636 return;
637 }
638
639 p = (const char *)req->buf + 1;
640 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
641 p += 1;
642 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
643 p += pwlen+1;
644 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
645 p += 1;
646
647 if (service_buf == NULL || password == NULL || dev == NULL) {
648 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
649 END_PROFILE(SMBtcon);
650 return;
651 }
652 p = strrchr_m(service_buf,'\\');
653 if (p) {
654 service = p+1;
655 } else {
656 service = service_buf;
657 }
658
659 password_blob = data_blob(password, pwlen+1);
660
661 conn = make_connection(sconn,service,password_blob,dev,
662 req->vuid,&nt_status);
663 req->conn = conn;
664
665 data_blob_clear_free(&password_blob);
666
667 if (!conn) {
668 reply_nterror(req, nt_status);
669 END_PROFILE(SMBtcon);
670 return;
671 }
672
673 reply_outbuf(req, 2, 0);
674 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
675 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
676 SSVAL(req->outbuf,smb_tid,conn->cnum);
677
678 DEBUG(3,("tcon service=%s cnum=%d\n",
679 service, conn->cnum));
680
681 END_PROFILE(SMBtcon);
682 return;
683 }
684
685 /****************************************************************************
686 Reply to a tcon and X.
687 conn POINTER CAN BE NULL HERE !
688 ****************************************************************************/
689
690 void reply_tcon_and_X(struct smb_request *req)
691 {
692 connection_struct *conn = req->conn;
693 const char *service = NULL;
694 DATA_BLOB password;
695 TALLOC_CTX *ctx = talloc_tos();
696 /* what the cleint thinks the device is */
697 char *client_devicetype = NULL;
698 /* what the server tells the client the share represents */
699 const char *server_devicetype;
700 NTSTATUS nt_status;
701 int passlen;
702 char *path = NULL;
703 const char *p, *q;
704 uint16 tcon_flags;
705 struct smbd_server_connection *sconn = req->sconn;
706
707 START_PROFILE(SMBtconX);
708
709 if (req->wct < 4) {
710 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
711 END_PROFILE(SMBtconX);
712 return;
713 }
714
715 passlen = SVAL(req->vwv+3, 0);
716 tcon_flags = SVAL(req->vwv+2, 0);
717
718 /* we might have to close an old one */
719 if ((tcon_flags & 0x1) && conn) {
720 close_cnum(conn,req->vuid);
721 req->conn = NULL;
722 conn = NULL;
723 }
724
725 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
726 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
727 END_PROFILE(SMBtconX);
728 return;
729 }
730
731 if (sconn->smb1.negprot.encrypted_passwords) {
732 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
733 if (lp_security() == SEC_SHARE) {
734 /*
735 * Security = share always has a pad byte
736 * after the password.
737 */
738 p = (const char *)req->buf + passlen + 1;
739 } else {
740 p = (const char *)req->buf + passlen;
741 }
742 } else {
743 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
744 /* Ensure correct termination */
745 password.data[passlen]=0;
746 p = (const char *)req->buf + passlen + 1;
747 }
748
749 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
750
751 if (path == NULL) {
752 data_blob_clear_free(&password);
753 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
754 END_PROFILE(SMBtconX);
755 return;
756 }
757
758 /*
759 * the service name can be either: \\server\share
760 * or share directly like on the DELL PowerVault 705
761 */
762 if (*path=='\\') {
763 q = strchr_m(path+2,'\\');
764 if (!q) {
765 data_blob_clear_free(&password);
766 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
767 END_PROFILE(SMBtconX);
768 return;
769 }
770 service = q+1;
771 } else {
772 service = path;
773 }
774
775 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
776 &client_devicetype, p,
777 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
778
779 if (client_devicetype == NULL) {
780 data_blob_clear_free(&password);
781 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
782 END_PROFILE(SMBtconX);
783 return;
784 }
785
786 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
787
788 conn = make_connection(sconn, service, password, client_devicetype,
789 req->vuid, &nt_status);
790 req->conn =conn;
791
792 data_blob_clear_free(&password);
793
794 if (!conn) {
795 reply_nterror(req, nt_status);
796 END_PROFILE(SMBtconX);
797 return;
798 }
799
800 if ( IS_IPC(conn) )
801 server_devicetype = "IPC";
802 else if ( IS_PRINT(conn) )
803 server_devicetype = "LPT1:";
804 else
805 server_devicetype = "A:";
806
807 if (get_Protocol() < PROTOCOL_NT1) {
808 reply_outbuf(req, 2, 0);
809 if (message_push_string(&req->outbuf, server_devicetype,
810 STR_TERMINATE|STR_ASCII) == -1) {
811 reply_nterror(req, NT_STATUS_NO_MEMORY);
812 END_PROFILE(SMBtconX);
813 return;
814 }
815 } else {
816 /* NT sets the fstype of IPC$ to the null string */
817 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
818
819 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
820 /* Return permissions. */
821 uint32 perm1 = 0;
822 uint32 perm2 = 0;
823
824 reply_outbuf(req, 7, 0);
825
826 if (IS_IPC(conn)) {
827 perm1 = FILE_ALL_ACCESS;
828 perm2 = FILE_ALL_ACCESS;
829 } else {
830 perm1 = CAN_WRITE(conn) ?
831 SHARE_ALL_ACCESS :
832 SHARE_READ_ONLY;
833 }
834
835 SIVAL(req->outbuf, smb_vwv3, perm1);
836 SIVAL(req->outbuf, smb_vwv5, perm2);
837 } else {
838 reply_outbuf(req, 3, 0);
839 }
840
841 if ((message_push_string(&req->outbuf, server_devicetype,
842 STR_TERMINATE|STR_ASCII) == -1)
843 || (message_push_string(&req->outbuf, fstype,
844 STR_TERMINATE) == -1)) {
845 reply_nterror(req, NT_STATUS_NO_MEMORY);
846 END_PROFILE(SMBtconX);
847 return;
848 }
849
850 /* what does setting this bit do? It is set by NT4 and
851 may affect the ability to autorun mounted cdroms */
852 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
853 (lp_csc_policy(SNUM(conn)) << 2));
854
855 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
856 DEBUG(2,("Serving %s as a Dfs root\n",
857 lp_servicename(SNUM(conn)) ));
858 SSVAL(req->outbuf, smb_vwv2,
859 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
860 }
861 }
862
863
864 DEBUG(3,("tconX service=%s \n",
865 service));
866
867 /* set the incoming and outgoing tid to the just created one */
868 SSVAL(req->inbuf,smb_tid,conn->cnum);
869 SSVAL(req->outbuf,smb_tid,conn->cnum);
870
871 END_PROFILE(SMBtconX);
872
873 req->tid = conn->cnum;
874 chain_reply(req);
875 return;
876 }
877
878 /****************************************************************************
879 Reply to an unknown type.
880 ****************************************************************************/
881
882 void reply_unknown_new(struct smb_request *req, uint8 type)
883 {
884 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
885 smb_fn_name(type), type, type));
886 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
887 return;
888 }
889
890 /****************************************************************************
891 Reply to an ioctl.
892 conn POINTER CAN BE NULL HERE !
893 ****************************************************************************/
894
895 void reply_ioctl(struct smb_request *req)
896 {
897 connection_struct *conn = req->conn;
898 uint16 device;
899 uint16 function;
900 uint32 ioctl_code;
901 int replysize;
902 char *p;
903
904 START_PROFILE(SMBioctl);
905
906 if (req->wct < 3) {
907 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
908 END_PROFILE(SMBioctl);
909 return;
910 }
911
912 device = SVAL(req->vwv+1, 0);
913 function = SVAL(req->vwv+2, 0);
914 ioctl_code = (device << 16) + function;
915
916 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
917
918 switch (ioctl_code) {
919 case IOCTL_QUERY_JOB_INFO:
920 replysize = 32;
921 break;
922 default:
923 reply_force_doserror(req, ERRSRV, ERRnosupport);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927
928 reply_outbuf(req, 8, replysize+1);
929 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
930 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
931 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
932 p = smb_buf(req->outbuf);
933 memset(p, '\0', replysize+1); /* valgrind-safe. */
934 p += 1; /* Allow for alignment */
935
936 switch (ioctl_code) {
937 case IOCTL_QUERY_JOB_INFO:
938 {
939 files_struct *fsp = file_fsp(
940 req, SVAL(req->vwv+0, 0));
941 if (!fsp) {
942 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
943 END_PROFILE(SMBioctl);
944 return;
945 }
946 /* Job number */
947 if (fsp->print_file) {
948 SSVAL(p, 0, fsp->print_file->rap_jobid);
949 } else {
950 SSVAL(p, 0, 0);
951 }
952 srvstr_push((char *)req->outbuf, req->flags2, p+2,
953 global_myname(), 15,
954 STR_TERMINATE|STR_ASCII);
955 if (conn) {
956 srvstr_push((char *)req->outbuf, req->flags2,
957 p+18, lp_servicename(SNUM(conn)),
958 13, STR_TERMINATE|STR_ASCII);
959 } else {
960 memset(p+18, 0, 13);
961 }
962 break;
963 }
964 }
965
966 END_PROFILE(SMBioctl);
967 return;
968 }
969
970 /****************************************************************************
971 Strange checkpath NTSTATUS mapping.
972 ****************************************************************************/
973
974 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
975 {
976 /* Strange DOS error code semantics only for checkpath... */
977 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
978 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
979 /* We need to map to ERRbadpath */
980 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
981 }
982 }
983 return status;
984 }
985
986 /****************************************************************************
987 Reply to a checkpath.
988 ****************************************************************************/
989
990 void reply_checkpath(struct smb_request *req)
991 {
992 connection_struct *conn = req->conn;
993 struct smb_filename *smb_fname = NULL;
994 char *name = NULL;
995 NTSTATUS status;
996 TALLOC_CTX *ctx = talloc_tos();
997
998 START_PROFILE(SMBcheckpath);
999
1000 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1001 STR_TERMINATE, &status);
1002
1003 if (!NT_STATUS_IS_OK(status)) {
1004 status = map_checkpath_error(req->flags2, status);
1005 reply_nterror(req, status);
1006 END_PROFILE(SMBcheckpath);
1007 return;
1008 }
1009
1010 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1011
1012 status = filename_convert(ctx,
1013 conn,
1014 req->flags2 & FLAGS2_DFS_PATHNAMES,
1015 name,
1016 0,
1017 NULL,
1018 &smb_fname);
1019
1020 if (!NT_STATUS_IS_OK(status)) {
1021 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1022 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1023 ERRSRV, ERRbadpath);
1024 END_PROFILE(SMBcheckpath);
1025 return;
1026 }
1027 goto path_err;
1028 }
1029
1030 if (!VALID_STAT(smb_fname->st) &&
1031 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1032 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1033 smb_fname_str_dbg(smb_fname), strerror(errno)));
1034 status = map_nt_error_from_unix(errno);
1035 goto path_err;
1036 }
1037
1038 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1039 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1040 ERRDOS, ERRbadpath);
1041 goto out;
1042 }
1043
1044 reply_outbuf(req, 0, 0);
1045
1046 path_err:
1047 /* We special case this - as when a Windows machine
1048 is parsing a path is steps through the components
1049 one at a time - if a component fails it expects
1050 ERRbadpath, not ERRbadfile.
1051 */
1052 status = map_checkpath_error(req->flags2, status);
1053 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1054 /*
1055 * Windows returns different error codes if
1056 * the parent directory is valid but not the
1057 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1058 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1059 * if the path is invalid.
1060 */
1061 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1062 ERRDOS, ERRbadpath);
1063 goto out;
1064 }
1065
1066 reply_nterror(req, status);
1067
1068 out:
1069 TALLOC_FREE(smb_fname);
1070 END_PROFILE(SMBcheckpath);
1071 return;
1072 }
1073
1074 /****************************************************************************
1075 Reply to a getatr.
1076 ****************************************************************************/
1077
1078 void reply_getatr(struct smb_request *req)
1079 {
1080 connection_struct *conn = req->conn;
1081 struct smb_filename *smb_fname = NULL;
1082 char *fname = NULL;
1083 int mode=0;
1084 SMB_OFF_T size=0;
1085 time_t mtime=0;
1086 const char *p;
1087 NTSTATUS status;
1088 TALLOC_CTX *ctx = talloc_tos();
1089 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1090
1091 START_PROFILE(SMBgetatr);
1092
1093 p = (const char *)req->buf + 1;
1094 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1095 if (!NT_STATUS_IS_OK(status)) {
1096 reply_nterror(req, status);
1097 goto out;
1098 }
1099
1100 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1101 under WfWg - weird! */
1102 if (*fname == '\0') {
1103 mode = aHIDDEN | aDIR;
1104 if (!CAN_WRITE(conn)) {
1105 mode |= aRONLY;
1106 }
1107 size = 0;
1108 mtime = 0;
1109 } else {
1110 status = filename_convert(ctx,
1111 conn,
1112 req->flags2 & FLAGS2_DFS_PATHNAMES,
1113 fname,
1114 0,
1115 NULL,
1116 &smb_fname);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1119 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1120 ERRSRV, ERRbadpath);
1121 goto out;
1122 }
1123 reply_nterror(req, status);
1124 goto out;
1125 }
1126 if (!VALID_STAT(smb_fname->st) &&
1127 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1128 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1129 smb_fname_str_dbg(smb_fname),
1130 strerror(errno)));
1131 reply_nterror(req, map_nt_error_from_unix(errno));
1132 goto out;
1133 }
1134
1135 mode = dos_mode(conn, smb_fname);
1136 size = smb_fname->st.st_ex_size;
1137
1138 if (ask_sharemode) {
1139 struct timespec write_time_ts;
1140 struct file_id fileid;
1141
1142 ZERO_STRUCT(write_time_ts);
1143 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1144 get_file_infos(fileid, NULL, &write_time_ts);
1145 if (!null_timespec(write_time_ts)) {
1146 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1147 }
1148 }
1149
1150 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1151 if (mode & aDIR) {
1152 size = 0;
1153 }
1154 }
1155
1156 reply_outbuf(req, 10, 0);
1157
1158 SSVAL(req->outbuf,smb_vwv0,mode);
1159 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1160 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1161 } else {
1162 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1163 }
1164 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1165
1166 if (get_Protocol() >= PROTOCOL_NT1) {
1167 SSVAL(req->outbuf, smb_flg2,
1168 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1169 }
1170
1171 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1172 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1173
1174 out:
1175 TALLOC_FREE(smb_fname);
1176 TALLOC_FREE(fname);
1177 END_PROFILE(SMBgetatr);
1178 return;
1179 }
1180
1181 /****************************************************************************
1182 Reply to a setatr.
1183 ****************************************************************************/
1184
1185 void reply_setatr(struct smb_request *req)
1186 {
1187 struct smb_file_time ft;
1188 connection_struct *conn = req->conn;
1189 struct smb_filename *smb_fname = NULL;
1190 char *fname = NULL;
1191 int mode;
1192 time_t mtime;
1193 const char *p;
1194 NTSTATUS status;
1195 TALLOC_CTX *ctx = talloc_tos();
1196
1197 START_PROFILE(SMBsetatr);
1198
1199 ZERO_STRUCT(ft);
1200
1201 if (req->wct < 2) {
1202 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1203 goto out;
1204 }
1205
1206 p = (const char *)req->buf + 1;
1207 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1208 if (!NT_STATUS_IS_OK(status)) {
1209 reply_nterror(req, status);
1210 goto out;
1211 }
1212
1213 status = filename_convert(ctx,
1214 conn,
1215 req->flags2 & FLAGS2_DFS_PATHNAMES,
1216 fname,
1217 0,
1218 NULL,
1219 &smb_fname);
1220 if (!NT_STATUS_IS_OK(status)) {
1221 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1222 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1223 ERRSRV, ERRbadpath);
1224 goto out;
1225 }
1226 reply_nterror(req, status);
1227 goto out;
1228 }
1229
1230 if (smb_fname->base_name[0] == '.' &&
1231 smb_fname->base_name[1] == '\0') {
1232 /*
1233 * Not sure here is the right place to catch this
1234 * condition. Might be moved to somewhere else later -- vl
1235 */
1236 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1237 goto out;
1238 }
1239
1240 mode = SVAL(req->vwv+0, 0);
1241 mtime = srv_make_unix_date3(req->vwv+1);
1242
1243 ft.mtime = convert_time_t_to_timespec(mtime);
1244 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1245 if (!NT_STATUS_IS_OK(status)) {
1246 reply_nterror(req, status);
1247 goto out;
1248 }
1249
1250 if (mode != FILE_ATTRIBUTE_NORMAL) {
1251 if (VALID_STAT_OF_DIR(smb_fname->st))
1252 mode |= aDIR;
1253 else
1254 mode &= ~aDIR;
1255
1256 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1257 false) != 0) {
1258 reply_nterror(req, map_nt_error_from_unix(errno));
1259 goto out;
1260 }
1261 }
1262
1263 reply_outbuf(req, 0, 0);
1264
1265 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1266 mode));
1267 out:
1268 TALLOC_FREE(smb_fname);
1269 END_PROFILE(SMBsetatr);
1270 return;
1271 }
1272
1273 /****************************************************************************
1274 Reply to a dskattr.
1275 ****************************************************************************/
1276
1277 void reply_dskattr(struct smb_request *req)
1278 {
1279 connection_struct *conn = req->conn;
1280 uint64_t dfree,dsize,bsize;
1281 START_PROFILE(SMBdskattr);
1282
1283 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1284 reply_nterror(req, map_nt_error_from_unix(errno));
1285 END_PROFILE(SMBdskattr);
1286 return;
1287 }
1288
1289 reply_outbuf(req, 5, 0);
1290
1291 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1292 double total_space, free_space;
1293 /* we need to scale this to a number that DOS6 can handle. We
1294 use floating point so we can handle large drives on systems
1295 that don't have 64 bit integers
1296
1297 we end up displaying a maximum of 2G to DOS systems
1298 */
1299 total_space = dsize * (double)bsize;
1300 free_space = dfree * (double)bsize;
1301
1302 dsize = (uint64_t)((total_space+63*512) / (64*512));
1303 dfree = (uint64_t)((free_space+63*512) / (64*512));
1304
1305 if (dsize > 0xFFFF) dsize = 0xFFFF;
1306 if (dfree > 0xFFFF) dfree = 0xFFFF;
1307
1308 SSVAL(req->outbuf,smb_vwv0,dsize);
1309 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1310 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1311 SSVAL(req->outbuf,smb_vwv3,dfree);
1312 } else {
1313 SSVAL(req->outbuf,smb_vwv0,dsize);
1314 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1315 SSVAL(req->outbuf,smb_vwv2,512);
1316 SSVAL(req->outbuf,smb_vwv3,dfree);
1317 }
1318
1319 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1320
1321 END_PROFILE(SMBdskattr);
1322 return;
1323 }
1324
1325 /*
1326 * Utility function to split the filename from the directory.
1327 */
1328 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1329 char **fname_dir_out,
1330 char **fname_mask_out)
1331 {
1332 const char *p = NULL;
1333 char *fname_dir = NULL;
1334 char *fname_mask = NULL;
1335
1336 p = strrchr_m(fname_in, '/');
1337 if (!p) {
1338 fname_dir = talloc_strdup(ctx, ".");
1339 fname_mask = talloc_strdup(ctx, fname_in);
1340 } else {
1341 fname_dir = talloc_strndup(ctx, fname_in,
1342 PTR_DIFF(p, fname_in));
1343 fname_mask = talloc_strdup(ctx, p+1);
1344 }
1345
1346 if (!fname_dir || !fname_mask) {
1347 TALLOC_FREE(fname_dir);
1348 TALLOC_FREE(fname_mask);
1349 return NT_STATUS_NO_MEMORY;
1350 }
1351
1352 *fname_dir_out = fname_dir;
1353 *fname_mask_out = fname_mask;
1354 return NT_STATUS_OK;
1355 }
1356
1357 /****************************************************************************
1358 Reply to a search.
1359 Can be called from SMBsearch, SMBffirst or SMBfunique.
1360 ****************************************************************************/
1361
1362 void reply_search(struct smb_request *req)
1363 {
1364 connection_struct *conn = req->conn;
1365 char *path = NULL;
1366 const char *mask = NULL;
1367 char *directory = NULL;
1368 struct smb_filename *smb_fname = NULL;
1369 char *fname = NULL;
1370 SMB_OFF_T size;
1371 uint32 mode;
1372 struct timespec date;
1373 uint32 dirtype;
1374 unsigned int numentries = 0;
1375 unsigned int maxentries = 0;
1376 bool finished = False;
1377 const char *p;
1378 int status_len;
1379 char status[21];
1380 int dptr_num= -1;
1381 bool check_descend = False;
1382 bool expect_close = False;
1383 NTSTATUS nt_status;
1384 bool mask_contains_wcard = False;
1385 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1386 TALLOC_CTX *ctx = talloc_tos();
1387 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1388 struct dptr_struct *dirptr = NULL;
1389 struct smbd_server_connection *sconn = req->sconn;
1390
1391 START_PROFILE(SMBsearch);
1392
1393 if (req->wct < 2) {
1394 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1395 goto out;
1396 }
1397
1398 if (lp_posix_pathnames()) {
1399 reply_unknown_new(req, req->cmd);
1400 goto out;
1401 }
1402
1403 /* If we were called as SMBffirst then we must expect close. */
1404 if(req->cmd == SMBffirst) {
1405 expect_close = True;
1406 }
1407
1408 reply_outbuf(req, 1, 3);
1409 maxentries = SVAL(req->vwv+0, 0);
1410 dirtype = SVAL(req->vwv+1, 0);
1411 p = (const char *)req->buf + 1;
1412 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1413 &nt_status, &mask_contains_wcard);
1414 if (!NT_STATUS_IS_OK(nt_status)) {
1415 reply_nterror(req, nt_status);
1416 goto out;
1417 }
1418
1419 p++;
1420 status_len = SVAL(p, 0);
1421 p += 2;
1422
1423 /* dirtype &= ~aDIR; */
1424
1425 if (status_len == 0) {
1426 nt_status = filename_convert(ctx, conn,
1427 req->flags2 & FLAGS2_DFS_PATHNAMES,
1428 path,
1429 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1430 &mask_contains_wcard,
1431 &smb_fname);
1432 if (!NT_STATUS_IS_OK(nt_status)) {
1433 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1434 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1435 ERRSRV, ERRbadpath);
1436 goto out;
1437 }
1438 reply_nterror(req, nt_status);
1439 goto out;
1440 }
1441
1442 directory = smb_fname->base_name;
1443
1444 p = strrchr_m(directory,'/');
1445 if ((p != NULL) && (*directory != '/')) {
1446 mask = p + 1;
1447 directory = talloc_strndup(ctx, directory,
1448 PTR_DIFF(p, directory));
1449 } else {
1450 mask = directory;
1451 directory = talloc_strdup(ctx,".");
1452 }
1453
1454 if (!directory) {
1455 reply_nterror(req, NT_STATUS_NO_MEMORY);
1456 goto out;
1457 }
1458
1459 memset((char *)status,'\0',21);
1460 SCVAL(status,0,(dirtype & 0x1F));
1461
1462 nt_status = dptr_create(conn,
1463 directory,
1464 True,
1465 expect_close,
1466 req->smbpid,
1467 mask,
1468 mask_contains_wcard,
1469 dirtype,
1470 &dirptr);
1471 if (!NT_STATUS_IS_OK(nt_status)) {
1472 reply_nterror(req, nt_status);
1473 goto out;
1474 }
1475 dptr_num = dptr_dnum(dirptr);
1476 } else {
1477 int status_dirtype;
1478 const char *dirpath;
1479
1480 memcpy(status,p,21);
1481 status_dirtype = CVAL(status,0) & 0x1F;
1482 if (status_dirtype != (dirtype & 0x1F)) {
1483 dirtype = status_dirtype;
1484 }
1485
1486 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1487 if (!dirptr) {
1488 goto SearchEmpty;
1489 }
1490 dirpath = dptr_path(sconn, dptr_num);
1491 directory = talloc_strdup(ctx, dirpath);
1492 if (!directory) {
1493 reply_nterror(req, NT_STATUS_NO_MEMORY);
1494 goto out;
1495 }
1496
1497 mask = dptr_wcard(sconn, dptr_num);
1498 if (!mask) {
1499 goto SearchEmpty;
1500 }
1501 /*
1502 * For a 'continue' search we have no string. So
1503 * check from the initial saved string.
1504 */
1505 mask_contains_wcard = ms_has_wild(mask);
1506 dirtype = dptr_attr(sconn, dptr_num);
1507 }
1508
1509 DEBUG(4,("dptr_num is %d\n",dptr_num));
1510
1511 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1512 dptr_init_search_op(dirptr);
1513
1514 if ((dirtype&0x1F) == aVOLID) {
1515 char buf[DIR_STRUCT_SIZE];
1516 memcpy(buf,status,21);
1517 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1518 0,aVOLID,0,!allow_long_path_components)) {
1519 reply_nterror(req, NT_STATUS_NO_MEMORY);
1520 goto out;
1521 }
1522 dptr_fill(sconn, buf+12,dptr_num);
1523 if (dptr_zero(buf+12) && (status_len==0)) {
1524 numentries = 1;
1525 } else {
1526 numentries = 0;
1527 }
1528 if (message_push_blob(&req->outbuf,
1529 data_blob_const(buf, sizeof(buf)))
1530 == -1) {
1531 reply_nterror(req, NT_STATUS_NO_MEMORY);
1532 goto out;
1533 }
1534 } else {
1535 unsigned int i;
1536 maxentries = MIN(
1537 maxentries,
1538 ((BUFFER_SIZE -
1539 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1540 /DIR_STRUCT_SIZE));
1541
1542 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1543 directory,lp_dontdescend(SNUM(conn))));
1544 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1545 check_descend = True;
1546 }
1547
1548 for (i=numentries;(i<maxentries) && !finished;i++) {
1549 finished = !get_dir_entry(ctx,
1550 dirptr,
1551 mask,
1552 dirtype,
1553 &fname,
1554 &size,
1555 &mode,
1556 &date,
1557 check_descend,
1558 ask_sharemode);
1559 if (!finished) {
1560 char buf[DIR_STRUCT_SIZE];
1561 memcpy(buf,status,21);
1562 if (!make_dir_struct(ctx,
1563 buf,
1564 mask,
1565 fname,
1566 size,
1567 mode,
1568 convert_timespec_to_time_t(date),
1569 !allow_long_path_components)) {
1570 reply_nterror(req, NT_STATUS_NO_MEMORY);
1571 goto out;
1572 }
1573 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1574 break;
1575 }
1576 if (message_push_blob(&req->outbuf,
1577 data_blob_const(buf, sizeof(buf)))
1578 == -1) {
1579 reply_nterror(req, NT_STATUS_NO_MEMORY);
1580 goto out;
1581 }
1582 numentries++;
1583 }
1584 }
1585 }
1586
1587 SearchEmpty:
1588
1589 /* If we were called as SMBffirst with smb_search_id == NULL
1590 and no entries were found then return error and close dirptr
1591 (X/Open spec) */
1592
1593 if (numentries == 0) {
1594 dptr_close(sconn, &dptr_num);
1595 } else if(expect_close && status_len == 0) {
1596 /* Close the dptr - we know it's gone */
1597 dptr_close(sconn, &dptr_num);
1598 }
1599
1600 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1601 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1602 dptr_close(sconn, &dptr_num);
1603 }
1604
1605 if ((numentries == 0) && !mask_contains_wcard) {
1606 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1607 goto out;
1608 }
1609
1610 SSVAL(req->outbuf,smb_vwv0,numentries);
1611 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1612 SCVAL(smb_buf(req->outbuf),0,5);
1613 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1614
1615 /* The replies here are never long name. */
1616 SSVAL(req->outbuf, smb_flg2,
1617 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1618 if (!allow_long_path_components) {
1619 SSVAL(req->outbuf, smb_flg2,
1620 SVAL(req->outbuf, smb_flg2)
1621 & (~FLAGS2_LONG_PATH_COMPONENTS));
1622 }
1623
1624 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1625 SSVAL(req->outbuf, smb_flg2,
1626 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1627
1628 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1629 smb_fn_name(req->cmd),
1630 mask,
1631 directory,
1632 dirtype,
1633 numentries,
1634 maxentries ));
1635 out:
1636 TALLOC_FREE(directory);
1637 TALLOC_FREE(smb_fname);
1638 END_PROFILE(SMBsearch);
1639 return;
1640 }
1641
1642 /****************************************************************************
1643 Reply to a fclose (stop directory search).
1644 ****************************************************************************/
1645
1646 void reply_fclose(struct smb_request *req)
1647 {
1648 int status_len;
1649 char status[21];
1650 int dptr_num= -2;
1651 const char *p;
1652 char *path = NULL;
1653 NTSTATUS err;
1654 bool path_contains_wcard = False;
1655 TALLOC_CTX *ctx = talloc_tos();
1656 struct smbd_server_connection *sconn = req->sconn;
1657
1658 START_PROFILE(SMBfclose);
1659
1660 if (lp_posix_pathnames()) {
1661 reply_unknown_new(req, req->cmd);
1662 END_PROFILE(SMBfclose);
1663 return;
1664 }
1665
1666 p = (const char *)req->buf + 1;
1667 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1668 &err, &path_contains_wcard);
1669 if (!NT_STATUS_IS_OK(err)) {
1670 reply_nterror(req, err);
1671 END_PROFILE(SMBfclose);
1672 return;
1673 }
1674 p++;
1675 status_len = SVAL(p,0);
1676 p += 2;
1677
1678 if (status_len == 0) {
1679 reply_force_doserror(req, ERRSRV, ERRsrverror);
1680 END_PROFILE(SMBfclose);
1681 return;
1682 }
1683
1684 memcpy(status,p,21);
1685
1686 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1687 /* Close the dptr - we know it's gone */
1688 dptr_close(sconn, &dptr_num);
1689 }
1690
1691 reply_outbuf(req, 1, 0);
1692 SSVAL(req->outbuf,smb_vwv0,0);
1693
1694 DEBUG(3,("search close\n"));
1695
1696 END_PROFILE(SMBfclose);
1697 return;
1698 }
1699
1700 /****************************************************************************
1701 Reply to an open.
1702 ****************************************************************************/
1703
1704 void reply_open(struct smb_request *req)
1705 {
1706 connection_struct *conn = req->conn;
1707 struct smb_filename *smb_fname = NULL;
1708 char *fname = NULL;
1709 uint32 fattr=0;
1710 SMB_OFF_T size = 0;
1711 time_t mtime=0;
1712 int info;
1713 files_struct *fsp;
1714 int oplock_request;
1715 int deny_mode;
1716 uint32 dos_attr;
1717 uint32 access_mask;
1718 uint32 share_mode;
1719 uint32 create_disposition;
1720 uint32 create_options = 0;
1721 uint32_t private_flags = 0;
1722 NTSTATUS status;
1723 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1724 TALLOC_CTX *ctx = talloc_tos();
1725
1726 START_PROFILE(SMBopen);
1727
1728 if (req->wct < 2) {
1729 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1730 goto out;
1731 }
1732
1733 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1734 deny_mode = SVAL(req->vwv+0, 0);
1735 dos_attr = SVAL(req->vwv+1, 0);
1736
1737 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1738 STR_TERMINATE, &status);
1739 if (!NT_STATUS_IS_OK(status)) {
1740 reply_nterror(req, status);
1741 goto out;
1742 }
1743
1744 status = filename_convert(ctx,
1745 conn,
1746 req->flags2 & FLAGS2_DFS_PATHNAMES,
1747 fname,
1748 0,
1749 NULL,
1750 &smb_fname);
1751 if (!NT_STATUS_IS_OK(status)) {
1752 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1753 reply_botherror(req,
1754 NT_STATUS_PATH_NOT_COVERED,
1755 ERRSRV, ERRbadpath);
1756 goto out;
1757 }
1758 reply_nterror(req, status);
1759 goto out;
1760 }
1761
1762 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1763 OPENX_FILE_EXISTS_OPEN, &access_mask,
1764 &share_mode, &create_disposition,
1765 &create_options, &private_flags)) {
1766 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1767 goto out;
1768 }
1769
1770 status = SMB_VFS_CREATE_FILE(
1771 conn, /* conn */
1772 req, /* req */
1773 0, /* root_dir_fid */
1774 smb_fname, /* fname */
1775 access_mask, /* access_mask */
1776 share_mode, /* share_access */
1777 create_disposition, /* create_disposition*/
1778 create_options, /* create_options */
1779 dos_attr, /* file_attributes */
1780 oplock_request, /* oplock_request */
1781 0, /* allocation_size */
1782 private_flags,
1783 NULL, /* sd */
1784 NULL, /* ea_list */
1785 &fsp, /* result */
1786 &info); /* pinfo */
1787
1788 if (!NT_STATUS_IS_OK(status)) {
1789 if (open_was_deferred(req->mid)) {
1790 /* We have re-scheduled this call. */
1791 goto out;
1792 }
1793 reply_openerror(req, status);
1794 goto out;
1795 }
1796
1797 size = smb_fname->st.st_ex_size;
1798 fattr = dos_mode(conn, smb_fname);
1799
1800 /* Deal with other possible opens having a modified
1801 write time. JRA. */
1802 if (ask_sharemode) {
1803 struct timespec write_time_ts;
1804
1805 ZERO_STRUCT(write_time_ts);
1806 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1807 if (!null_timespec(write_time_ts)) {
1808 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1809 }
1810 }
1811
1812 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1813
1814 if (fattr & aDIR) {
1815 DEBUG(3,("attempt to open a directory %s\n",
1816 fsp_str_dbg(fsp)));
1817 close_file(req, fsp, ERROR_CLOSE);
1818 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1819 ERRDOS, ERRnoaccess);
1820 goto out;
1821 }
1822
1823 reply_outbuf(req, 7, 0);
1824 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1825 SSVAL(req->outbuf,smb_vwv1,fattr);
1826 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1827 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1828 } else {
1829 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1830 }
1831 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1832 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1833
1834 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1835 SCVAL(req->outbuf,smb_flg,
1836 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1837 }
1838
1839 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1840 SCVAL(req->outbuf,smb_flg,
1841 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1842 }
1843 out:
1844 TALLOC_FREE(smb_fname);
1845 END_PROFILE(SMBopen);
1846 return;
1847 }
1848
1849 /****************************************************************************
1850 Reply to an open and X.
1851 ****************************************************************************/
1852
1853 void reply_open_and_X(struct smb_request *req)
1854 {
1855 connection_struct *conn = req->conn;
1856 struct smb_filename *smb_fname = NULL;
1857 char *fname = NULL;
1858 uint16 open_flags;
1859 int deny_mode;
1860 uint32 smb_attr;
1861 /* Breakout the oplock request bits so we can set the
1862 reply bits separately. */
1863 int ex_oplock_request;
1864 int core_oplock_request;
1865 int oplock_request;
1866 #if 0
1867 int smb_sattr = SVAL(req->vwv+4, 0);
1868 uint32 smb_time = make_unix_date3(req->vwv+6);
1869 #endif
1870 int smb_ofun;
1871 uint32 fattr=0;
1872 int mtime=0;
1873 int smb_action = 0;
1874 files_struct *fsp;
1875 NTSTATUS status;
1876 uint64_t allocation_size;
1877 ssize_t retval = -1;
1878 uint32 access_mask;
1879 uint32 share_mode;
1880 uint32 create_disposition;
1881 uint32 create_options = 0;
1882 uint32_t private_flags = 0;
1883 TALLOC_CTX *ctx = talloc_tos();
1884
1885 START_PROFILE(SMBopenX);
1886
1887 if (req->wct < 15) {
1888 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1889 goto out;
1890 }
1891
1892 open_flags = SVAL(req->vwv+2, 0);
1893 deny_mode = SVAL(req->vwv+3, 0);
1894 smb_attr = SVAL(req->vwv+5, 0);
1895 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1896 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1897 oplock_request = ex_oplock_request | core_oplock_request;
1898 smb_ofun = SVAL(req->vwv+8, 0);
1899 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1900
1901 /* If it's an IPC, pass off the pipe handler. */
1902 if (IS_IPC(conn)) {
1903 if (lp_nt_pipe_support()) {
1904 reply_open_pipe_and_X(conn, req);
1905 } else {
1906 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1907 }
1908 goto out;
1909 }
1910
1911 /* XXXX we need to handle passed times, sattr and flags */
1912 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1913 STR_TERMINATE, &status);
1914 if (!NT_STATUS_IS_OK(status)) {
1915 reply_nterror(req, status);
1916 goto out;
1917 }
1918
1919 status = filename_convert(ctx,
1920 conn,
1921 req->flags2 & FLAGS2_DFS_PATHNAMES,
1922 fname,
1923 0,
1924 NULL,
1925 &smb_fname);
1926 if (!NT_STATUS_IS_OK(status)) {
1927 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1928 reply_botherror(req,
1929 NT_STATUS_PATH_NOT_COVERED,
1930 ERRSRV, ERRbadpath);
1931 goto out;
1932 }
1933 reply_nterror(req, status);
1934 goto out;
1935 }
1936
1937 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1938 &access_mask, &share_mode,
1939 &create_disposition,
1940 &create_options,
1941 &private_flags)) {
1942 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1943 goto out;
1944 }
1945
1946 status = SMB_VFS_CREATE_FILE(
1947 conn, /* conn */
1948 req, /* req */
1949 0, /* root_dir_fid */
1950 smb_fname, /* fname */
1951 access_mask, /* access_mask */
1952 share_mode, /* share_access */
1953 create_disposition, /* create_disposition*/
1954 create_options, /* create_options */
1955 smb_attr, /* file_attributes */
1956 oplock_request, /* oplock_request */
1957 0, /* allocation_size */
1958 private_flags,
1959 NULL, /* sd */
1960 NULL, /* ea_list */
1961 &fsp, /* result */
1962 &smb_action); /* pinfo */
1963
1964 if (!NT_STATUS_IS_OK(status)) {
1965 if (open_was_deferred(req->mid)) {
1966 /* We have re-scheduled this call. */
1967 goto out;
1968 }
1969 reply_openerror(req, status);
1970 goto out;
1971 }
1972
1973 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1974 if the file is truncated or created. */
1975 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1976 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1977 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1978 close_file(req, fsp, ERROR_CLOSE);
1979 reply_nterror(req, NT_STATUS_DISK_FULL);
1980 goto out;
1981 }
1982 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1983 if (retval < 0) {
1984 close_file(req, fsp, ERROR_CLOSE);
1985 reply_nterror(req, NT_STATUS_DISK_FULL);
1986 goto out;
1987 }
1988 status = vfs_stat_fsp(fsp);
1989 if (!NT_STATUS_IS_OK(status)) {
1990 close_file(req, fsp, ERROR_CLOSE);
1991 reply_nterror(req, status);
1992 goto out;
1993 }
1994 }
1995
1996 fattr = dos_mode(conn, fsp->fsp_name);
1997 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
1998 if (fattr & aDIR) {
1999 close_file(req, fsp, ERROR_CLOSE);
2000 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2001 goto out;
2002 }
2003
2004 /* If the caller set the extended oplock request bit
2005 and we granted one (by whatever means) - set the
2006 correct bit for extended oplock reply.
2007 */
2008
2009 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2010 smb_action |= EXTENDED_OPLOCK_GRANTED;
2011 }
2012
2013 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2014 smb_action |= EXTENDED_OPLOCK_GRANTED;
2015 }
2016
2017 /* If the caller set the core oplock request bit
2018 and we granted one (by whatever means) - set the
2019 correct bit for core oplock reply.
2020 */
2021
2022 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2023 reply_outbuf(req, 19, 0);
2024 } else {
2025 reply_outbuf(req, 15, 0);
2026 }
2027
2028 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2029 SCVAL(req->outbuf, smb_flg,
2030 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2031 }
2032
2033 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2034 SCVAL(req->outbuf, smb_flg,
2035 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2036 }
2037
2038 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2039 SSVAL(req->outbuf,smb_vwv3,fattr);
2040 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2041 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2042 } else {
2043 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2044 }
2045 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2046 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2047 SSVAL(req->outbuf,smb_vwv11,smb_action);
2048
2049 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2050 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2051 }
2052
2053 chain_reply(req);
2054 out:
2055 TALLOC_FREE(smb_fname);
2056 END_PROFILE(SMBopenX);
2057 return;
2058 }
2059
2060 /****************************************************************************
2061 Reply to a SMBulogoffX.
2062 ****************************************************************************/
2063
2064 void reply_ulogoffX(struct smb_request *req)
2065 {
2066 struct smbd_server_connection *sconn = req->sconn;
2067 user_struct *vuser;
2068
2069 START_PROFILE(SMBulogoffX);
2070
2071 vuser = get_valid_user_struct(sconn, req->vuid);
2072
2073 if(vuser == NULL) {
2074 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2075 req->vuid));
2076 }
2077
2078 /* in user level security we are supposed to close any files
2079 open by this user */
2080 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2081 file_close_user(sconn, req->vuid);
2082 }
2083
2084 invalidate_vuid(sconn, req->vuid);
2085
2086 reply_outbuf(req, 2, 0);
2087
2088 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2089
2090 END_PROFILE(SMBulogoffX);
2091 req->vuid = UID_FIELD_INVALID;
2092 chain_reply(req);
2093 }
2094
2095 /****************************************************************************
2096 Reply to a mknew or a create.
2097 ****************************************************************************/
2098
2099 void reply_mknew(struct smb_request *req)
2100 {
2101 connection_struct *conn = req->conn;
2102 struct smb_filename *smb_fname = NULL;
2103 char *fname = NULL;
2104 uint32 fattr = 0;
2105 struct smb_file_time ft;
2106 files_struct *fsp;
2107 int oplock_request = 0;
2108 NTSTATUS status;
2109 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2110 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2111 uint32 create_disposition;
2112 uint32 create_options = 0;
2113 TALLOC_CTX *ctx = talloc_tos();
2114
2115 START_PROFILE(SMBcreate);
2116 ZERO_STRUCT(ft);
2117
2118 if (req->wct < 3) {
2119 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2120 goto out;
2121 }
2122
2123 fattr = SVAL(req->vwv+0, 0);
2124 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2125
2126 /* mtime. */
2127 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2128
2129 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2130 STR_TERMINATE, &status);
2131 if (!NT_STATUS_IS_OK(status)) {
2132 reply_nterror(req, status);
2133 goto out;
2134 }
2135
2136 status = filename_convert(ctx,
2137 conn,
2138 req->flags2 & FLAGS2_DFS_PATHNAMES,
2139 fname,
2140 0,
2141 NULL,
2142 &smb_fname);
2143 if (!NT_STATUS_IS_OK(status)) {
2144 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2145 reply_botherror(req,
2146 NT_STATUS_PATH_NOT_COVERED,
2147 ERRSRV, ERRbadpath);
2148 goto out;
2149 }
2150 reply_nterror(req, status);
2151 goto out;
2152 }
2153
2154 if (fattr & aVOLID) {
2155 DEBUG(0,("Attempt to create file (%s) with volid set - "
2156 "please report this\n",
2157 smb_fname_str_dbg(smb_fname)));
2158 }
2159
2160 if(req->cmd == SMBmknew) {
2161 /* We should fail if file exists. */
2162 create_disposition = FILE_CREATE;
2163 } else {
2164 /* Create if file doesn't exist, truncate if it does. */
2165 create_disposition = FILE_OVERWRITE_IF;
2166 }
2167
2168 status = SMB_VFS_CREATE_FILE(
2169 conn, /* conn */
2170 req, /* req */
2171 0, /* root_dir_fid */
2172 smb_fname, /* fname */
2173 access_mask, /* access_mask */
2174 share_mode, /* share_access */
2175 create_disposition, /* create_disposition*/
2176 create_options, /* create_options */
2177 fattr, /* file_attributes */
2178 oplock_request, /* oplock_request */
2179 0, /* allocation_size */
2180 0, /* private_flags */
2181 NULL, /* sd */
2182 NULL, /* ea_list */
2183 &fsp, /* result */
2184 NULL); /* pinfo */
2185
2186 if (!NT_STATUS_IS_OK(status)) {
2187 if (open_was_deferred(req->mid)) {
2188 /* We have re-scheduled this call. */
2189 goto out;
2190 }
2191 reply_openerror(req, status);
2192 goto out;
2193 }
2194
2195 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2196 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2197 if (!NT_STATUS_IS_OK(status)) {
2198 END_PROFILE(SMBcreate);
2199 goto out;
2200 }
2201
2202 reply_outbuf(req, 1, 0);
2203 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2204
2205 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2206 SCVAL(req->outbuf,smb_flg,
2207 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2208 }
2209
2210 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2211 SCVAL(req->outbuf,smb_flg,
2212 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2213 }
2214
2215 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2216 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2217 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2218 (unsigned int)fattr));
2219
2220 out:
2221 TALLOC_FREE(smb_fname);
2222 END_PROFILE(SMBcreate);
2223 return;
2224 }
2225
2226 /****************************************************************************
2227 Reply to a create temporary file.
2228 ****************************************************************************/
2229
2230 void reply_ctemp(struct smb_request *req)
2231 {
2232 connection_struct *conn = req->conn;
2233 struct smb_filename *smb_fname = NULL;
2234 char *fname = NULL;
2235 uint32 fattr;
2236 files_struct *fsp;
2237 int oplock_request;
2238 int tmpfd;
2239 char *s;
2240 NTSTATUS status;
2241 TALLOC_CTX *ctx = talloc_tos();
2242
2243 START_PROFILE(SMBctemp);
2244
2245 if (req->wct < 3) {
2246 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2247 goto out;
2248 }
2249
2250 fattr = SVAL(req->vwv+0, 0);
2251 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2252
2253 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2254 STR_TERMINATE, &status);
2255 if (!NT_STATUS_IS_OK(status)) {
2256 reply_nterror(req, status);
2257 goto out;
2258 }
2259 if (*fname) {
2260 fname = talloc_asprintf(ctx,
2261 "%s/TMXXXXXX",
2262 fname);
2263 } else {
2264 fname = talloc_strdup(ctx, "TMXXXXXX");
2265 }
2266
2267 if (!fname) {
2268 reply_nterror(req, NT_STATUS_NO_MEMORY);
2269 goto out;
2270 }
2271
2272 status = filename_convert(ctx, conn,
2273 req->flags2 & FLAGS2_DFS_PATHNAMES,
2274 fname,
2275 0,
2276 NULL,
2277 &smb_fname);
2278 if (!NT_STATUS_IS_OK(status)) {
2279 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2280 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2281 ERRSRV, ERRbadpath);
2282 goto out;
2283 }
2284 reply_nterror(req, status);
2285 goto out;
2286 }
2287
2288 tmpfd = mkstemp(smb_fname->base_name);
2289 if (tmpfd == -1) {
2290 reply_nterror(req, map_nt_error_from_unix(errno));
2291 goto out;
2292 }
2293
2294 SMB_VFS_STAT(conn, smb_fname);
2295
2296 /* We should fail if file does not exist. */
2297 status = SMB_VFS_CREATE_FILE(
2298 conn, /* conn */
2299 req, /* req */
2300 0, /* root_dir_fid */
2301 smb_fname, /* fname */
2302 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2303 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2304 FILE_OPEN, /* create_disposition*/
2305 0, /* create_options */
2306 fattr, /* file_attributes */
2307 oplock_request, /* oplock_request */
2308 0, /* allocation_size */
2309 0, /* private_flags */
2310 NULL, /* sd */
2311 NULL, /* ea_list */
2312 &fsp, /* result */
2313 NULL); /* pinfo */
2314
2315 /* close fd from mkstemp() */
2316 close(tmpfd);
2317
2318 if (!NT_STATUS_IS_OK(status)) {
2319 if (open_was_deferred(req->mid)) {
2320 /* We have re-scheduled this call. */
2321 goto out;
2322 }
2323 reply_openerror(req, status);
2324 goto out;
2325 }
2326
2327 reply_outbuf(req, 1, 0);
2328 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2329
2330 /* the returned filename is relative to the directory */
2331 s = strrchr_m(fsp->fsp_name->base_name, '/');
2332 if (!s) {
2333 s = fsp->fsp_name->base_name;
2334 } else {
2335 s++;
2336 }
2337
2338 #if 0
2339 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2340 thing in the byte section. JRA */
2341 SSVALS(p, 0, -1); /* what is this? not in spec */
2342 #endif
2343 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2344 == -1) {
2345 reply_nterror(req, NT_STATUS_NO_MEMORY);
2346 goto out;
2347 }
2348
2349 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2350 SCVAL(req->outbuf, smb_flg,
2351 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2352 }
2353
2354 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2355 SCVAL(req->outbuf, smb_flg,
2356 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2357 }
2358
2359 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2360 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2361 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2362 out:
2363 TALLOC_FREE(smb_fname);
2364 END_PROFILE(SMBctemp);
2365 return;
2366 }
2367
2368 /*******************************************************************
2369 Check if a user is allowed to rename a file.
2370 ********************************************************************/
2371
2372 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2373 uint16 dirtype)
2374 {
2375 uint32 fmode;
2376
2377 if (!CAN_WRITE(conn)) {
2378 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2379 }
2380
2381 fmode = dos_mode(conn, fsp->fsp_name);
2382 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2383 return NT_STATUS_NO_SUCH_FILE;
2384 }
2385
2386 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2387 if (fsp->posix_open) {
2388 return NT_STATUS_OK;
2389 }
2390
2391 /* If no pathnames are open below this
2392 directory, allow the rename. */
2393
2394 if (file_find_subpath(fsp)) {
2395 return NT_STATUS_ACCESS_DENIED;
2396 }
2397 return NT_STATUS_OK;
2398 }
2399
2400 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2401 return NT_STATUS_OK;
2402 }
2403
2404 return NT_STATUS_ACCESS_DENIED;
2405 }
2406
2407 /*******************************************************************
2408 * unlink a file with all relevant access checks
2409 *******************************************************************/
2410
2411 static NTSTATUS do_unlink(connection_struct *conn,
2412 struct smb_request *req,
2413 struct smb_filename *smb_fname,
2414 uint32 dirtype)
2415 {
2416 uint32 fattr;
2417 files_struct *fsp;
2418 uint32 dirtype_orig = dirtype;
2419 NTSTATUS status;
2420 int ret;
2421 bool posix_paths = lp_posix_pathnames();
2422
2423 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2424 smb_fname_str_dbg(smb_fname),
2425 dirtype));
2426
2427 if (!CAN_WRITE(conn)) {
2428 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2429 }
2430
2431 if (posix_paths) {
2432 ret = SMB_VFS_LSTAT(conn, smb_fname);
2433 } else {
2434 ret = SMB_VFS_STAT(conn, smb_fname);
2435 }
2436 if (ret != 0) {
2437 return map_nt_error_from_unix(errno);
2438 }
2439
2440 fattr = dos_mode(conn, smb_fname);
2441
2442 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2443 dirtype = aDIR|aARCH|aRONLY;
2444 }
2445
2446 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2447 if (!dirtype) {
2448 return NT_STATUS_NO_SUCH_FILE;
2449 }
2450
2451 if (!dir_check_ftype(conn, fattr, dirtype)) {
2452 if (fattr & aDIR) {
2453 return NT_STATUS_FILE_IS_A_DIRECTORY;
2454 }
2455 return NT_STATUS_NO_SUCH_FILE;
2456 }
2457
2458 if (dirtype_orig & 0x8000) {
2459 /* These will never be set for POSIX. */
2460 return NT_STATUS_NO_SUCH_FILE;
2461 }
2462
2463 #if 0
2464 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2465 return NT_STATUS_FILE_IS_A_DIRECTORY;
2466 }
2467
2468 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2469 return NT_STATUS_NO_SUCH_FILE;
2470 }
2471
2472 if (dirtype & 0xFF00) {
2473 /* These will never be set for POSIX. */
2474 return NT_STATUS_NO_SUCH_FILE;
2475 }
2476
2477 dirtype &= 0xFF;
2478 if (!dirtype) {
2479 return NT_STATUS_NO_SUCH_FILE;
2480 }
2481
2482 /* Can't delete a directory. */
2483 if (fattr & aDIR) {
2484 return NT_STATUS_FILE_IS_A_DIRECTORY;
2485 }
2486 #endif
2487
2488 #if 0 /* JRATEST */
2489 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2490 return NT_STATUS_OBJECT_NAME_INVALID;
2491 #endif /* JRATEST */
2492
2493 /* On open checks the open itself will check the share mode, so
2494 don't do it here as we'll get it wrong. */
2495
2496 status = SMB_VFS_CREATE_FILE
2497 (conn, /* conn */
2498 req, /* req */
2499 0, /* root_dir_fid */
2500 smb_fname, /* fname */
2501 DELETE_ACCESS, /* access_mask */
2502 FILE_SHARE_NONE, /* share_access */
2503 FILE_OPEN, /* create_disposition*/
2504 FILE_NON_DIRECTORY_FILE, /* create_options */
2505 /* file_attributes */
2506 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2507 FILE_ATTRIBUTE_NORMAL,
2508 0, /* oplock_request */
2509 0, /* allocation_size */
2510 0, /* private_flags */
2511 NULL, /* sd */
2512 NULL, /* ea_list */
2513 &fsp, /* result */
2514 NULL); /* pinfo */
2515
2516 if (!NT_STATUS_IS_OK(status)) {
2517 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2518 nt_errstr(status)));
2519 return status;
2520 }
2521
2522 status = can_set_delete_on_close(fsp, fattr);
2523 if (!NT_STATUS_IS_OK(status)) {
2524 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2525 "(%s)\n",
2526 smb_fname_str_dbg(smb_fname),
2527 nt_errstr(status)));
2528 close_file(req, fsp, NORMAL_CLOSE);
2529 return status;
2530 }
2531
2532 /* The set is across all open files on this dev/inode pair. */
2533 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2534 close_file(req, fsp, NORMAL_CLOSE);
2535 return NT_STATUS_ACCESS_DENIED;
2536 }
2537
2538 return close_file(req, fsp, NORMAL_CLOSE);
2539 }
2540
2541 /****************************************************************************
2542 The guts of the unlink command, split out so it may be called by the NT SMB
2543 code.
2544 ****************************************************************************/
2545
2546 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2547 uint32 dirtype, struct smb_filename *smb_fname,
2548 bool has_wild)
2549 {
2550 char *fname_dir = NULL;
2551 char *fname_mask = NULL;
2552 int count=0;
2553 NTSTATUS status = NT_STATUS_OK;
2554 TALLOC_CTX *ctx = talloc_tos();
2555
2556 /* Split up the directory from the filename/mask. */
2557 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2558 &fname_dir, &fname_mask);
2559 if (!NT_STATUS_IS_OK(status)) {
2560 goto out;
2561 }
2562
2563 /*
2564 * We should only check the mangled cache
2565 * here if unix_convert failed. This means
2566 * that the path in 'mask' doesn't exist
2567 * on the file system and so we need to look
2568 * for a possible mangle. This patch from
2569 * Tine Smukavec <valentin.smukavec@hermes.si>.
2570 */
2571
2572 if (!VALID_STAT(smb_fname->st) &&
2573 mangle_is_mangled(fname_mask, conn->params)) {
2574 char *new_mask = NULL;
2575 mangle_lookup_name_from_8_3(ctx, fname_mask,
2576 &new_mask, conn->params);
2577 if (new_mask) {
2578 TALLOC_FREE(fname_mask);
2579 fname_mask = new_mask;
2580 }
2581 }
2582
2583 if (!has_wild) {
2584
2585 /*
2586 * Only one file needs to be unlinked. Append the mask back
2587 * onto the directory.
2588 */
2589 TALLOC_FREE(smb_fname->base_name);
2590 smb_fname->base_name = talloc_asprintf(smb_fname,
2591 "%s/%s",
2592 fname_dir,
2593 fname_mask);
2594 if (!smb_fname->base_name) {
2595 status = NT_STATUS_NO_MEMORY;
2596 goto out;
2597 }
2598 if (dirtype == 0) {
2599 dirtype = FILE_ATTRIBUTE_NORMAL;
2600 }
2601
2602 status = check_name(conn, smb_fname->base_name);
2603 if (!NT_STATUS_IS_OK(status)) {
2604 goto out;
2605 }
2606
2607 status = do_unlink(conn, req, smb_fname, dirtype);
2608 if (!NT_STATUS_IS_OK(status)) {
2609 goto out;
2610 }
2611
2612 count++;
2613 } else {
2614 struct smb_Dir *dir_hnd = NULL;
2615 long offset = 0;
2616 const char *dname = NULL;
2617 char *talloced = NULL;
2618
2619 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2620 status = NT_STATUS_OBJECT_NAME_INVALID;
2621 goto out;
2622 }
2623
2624 if (strequal(fname_mask,"????????.???")) {
2625 TALLOC_FREE(fname_mask);
2626 fname_mask = talloc_strdup(ctx, "*");
2627 if (!fname_mask) {
2628 status = NT_STATUS_NO_MEMORY;
2629 goto out;
2630 }
2631 }
2632
2633 status = check_name(conn, fname_dir);
2634 if (!NT_STATUS_IS_OK(status)) {
2635 goto out;
2636 }
2637
2638 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2639 dirtype);
2640 if (dir_hnd == NULL) {
2641 status = map_nt_error_from_unix(errno);
2642 goto out;
2643 }
2644
2645 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2646 the pattern matches against the long name, otherwise the short name
2647 We don't implement this yet XXXX
2648 */
2649
2650 status = NT_STATUS_NO_SUCH_FILE;
2651
2652 while ((dname = ReadDirName(dir_hnd, &offset,
2653 &smb_fname->st, &talloced))) {
2654 TALLOC_CTX *frame = talloc_stackframe();
2655
2656 if (!is_visible_file(conn, fname_dir, dname,
2657 &smb_fname->st, true)) {
2658 TALLOC_FREE(frame);
2659 TALLOC_FREE(talloced);
2660 continue;
2661 }
2662
2663 /* Quick check for "." and ".." */
2664 if (ISDOT(dname) || ISDOTDOT(dname)) {
2665 TALLOC_FREE(frame);
2666 TALLOC_FREE(talloced);
2667 continue;
2668 }
2669
2670 if(!mask_match(dname, fname_mask,
2671 conn->case_sensitive)) {
2672 TALLOC_FREE(frame);
2673 TALLOC_FREE(talloced);
2674 continue;
2675 }
2676
2677 TALLOC_FREE(smb_fname->base_name);
2678 smb_fname->base_name =
2679 talloc_asprintf(smb_fname, "%s/%s",
2680 fname_dir, dname);
2681
2682 if (!smb_fname->base_name) {
2683 TALLOC_FREE(dir_hnd);
2684 status = NT_STATUS_NO_MEMORY;
2685 TALLOC_FREE(frame);
2686 TALLOC_FREE(talloced);
2687 goto out;
2688 }
2689
2690 status = check_name(conn, smb_fname->base_name);
2691 if (!NT_STATUS_IS_OK(status)) {
2692 TALLOC_FREE(dir_hnd);
2693 TALLOC_FREE(frame);
2694 TALLOC_FREE(talloced);
2695 goto out;
2696 }
2697
2698 status = do_unlink(conn, req, smb_fname, dirtype);
2699 if (!NT_STATUS_IS_OK(status)) {
2700 TALLOC_FREE(frame);
2701 TALLOC_FREE(talloced);
2702 continue;
2703 }
2704
2705 count++;
2706 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2707 smb_fname->base_name));
2708
2709 TALLOC_FREE(frame);
2710 TALLOC_FREE(talloced);
2711 }
2712 TALLOC_FREE(dir_hnd);
2713 }
2714
2715 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2716 status = map_nt_error_from_unix(errno);
2717 }
2718
2719 out:
2720 TALLOC_FREE(fname_dir);
2721 TALLOC_FREE(fname_mask);
2722 return status;
2723 }
2724
2725 /****************************************************************************
2726 Reply to a unlink
2727 ****************************************************************************/
2728
2729 void reply_unlink(struct smb_request *req)
2730 {
2731 connection_struct *conn = req->conn;
2732 char *name = NULL;
2733 struct smb_filename *smb_fname = NULL;
2734 uint32 dirtype;
2735 NTSTATUS status;
2736 bool path_contains_wcard = False;
2737 TALLOC_CTX *ctx = talloc_tos();
2738
2739 START_PROFILE(SMBunlink);
2740
2741 if (req->wct < 1) {
2742 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2743 goto out;
2744 }
2745
2746 dirtype = SVAL(req->vwv+0, 0);
2747
2748 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2749 STR_TERMINATE, &status,
2750 &path_contains_wcard);
2751 if (!NT_STATUS_IS_OK(status)) {
2752 reply_nterror(req, status);
2753 goto out;
2754 }
2755
2756 status = filename_convert(ctx, conn,
2757 req->flags2 & FLAGS2_DFS_PATHNAMES,
2758 name,
2759 UCF_COND_ALLOW_WCARD_LCOMP,
2760 &path_contains_wcard,
2761 &smb_fname);
2762 if (!NT_STATUS_IS_OK(status)) {
2763 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2764 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2765 ERRSRV, ERRbadpath);
2766 goto out;
2767 }
2768 reply_nterror(req, status);
2769 goto out;
2770 }
2771
2772 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2773
2774 status = unlink_internals(conn, req, dirtype, smb_fname,
2775 path_contains_wcard);
2776 if (!NT_STATUS_IS_OK(status)) {
2777 if (open_was_deferred(req->mid)) {
2778 /* We have re-scheduled this call. */
2779 goto out;
2780 }
2781 reply_nterror(req, status);
2782 goto out;
2783 }
2784
2785 reply_outbuf(req, 0, 0);
2786 out:
2787 TALLOC_FREE(smb_fname);
2788 END_PROFILE(SMBunlink);
2789 return;
2790 }
2791
2792 /****************************************************************************
2793 Fail for readbraw.
2794 ****************************************************************************/
2795
2796 static void fail_readraw(void)
2797 {
2798 const char *errstr = talloc_asprintf(talloc_tos(),
2799 "FAIL ! reply_readbraw: socket write fail (%s)",
2800 strerror(errno));
2801 if (!errstr) {
2802 errstr = "";
2803 }
2804 exit_server_cleanly(errstr);
2805 }
2806
2807 /****************************************************************************
2808 Fake (read/write) sendfile. Returns -1 on read or write fail.
2809 ****************************************************************************/
2810
2811 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2812 {
2813 size_t bufsize;
2814 size_t tosend = nread;
2815 char *buf;
2816
2817 if (nread == 0) {
2818 return 0;
2819 }
2820
2821 bufsize = MIN(nread, 65536);
2822
2823 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2824 return -1;
2825 }
2826
2827 while (tosend > 0) {
2828 ssize_t ret;
2829 size_t cur_read;
2830
2831 if (tosend > bufsize) {
2832 cur_read = bufsize;
2833 } else {
2834 cur_read = tosend;
2835 }
2836 ret = read_file(fsp,buf,startpos,cur_read);
2837 if (ret == -1) {
2838 SAFE_FREE(buf);
2839 return -1;
2840 }
2841
2842 /* If we had a short read, fill with zeros. */
2843 if (ret < cur_read) {
2844 memset(buf + ret, '\0', cur_read - ret);
2845 }
2846
2847 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2848 != cur_read) {
2849 char addr[INET6_ADDRSTRLEN];
2850 /*
2851 * Try and give an error message saying what
2852 * client failed.
2853 */
2854 DEBUG(0, ("write_data failed for client %s. "
2855 "Error %s\n",
2856 get_peer_addr(fsp->conn->sconn->sock, addr,
2857 sizeof(addr)),
2858 strerror(errno)));
2859 SAFE_FREE(buf);
2860 return -1;
2861 }
2862 tosend -= cur_read;
2863 startpos += cur_read;
2864 }
2865
2866 SAFE_FREE(buf);
2867 return (ssize_t)nread;
2868 }
2869
2870 /****************************************************************************
2871 Deal with the case of sendfile reading less bytes from the file than
2872 requested. Fill with zeros (all we can do).
2873 ****************************************************************************/
2874
2875 void sendfile_short_send(files_struct *fsp,
2876 ssize_t nread,
2877 size_t headersize,
2878 size_t smb_maxcnt)
2879 {
2880 #define SHORT_SEND_BUFSIZE 1024
2881 if (nread < headersize) {
2882 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2883 "header for file %s (%s). Terminating\n",
2884 fsp_str_dbg(fsp), strerror(errno)));
2885 exit_server_cleanly("sendfile_short_send failed");
2886 }
2887
2888 nread -= headersize;
2889
2890 if (nread < smb_maxcnt) {
2891 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2892 if (!buf) {
2893 exit_server_cleanly("sendfile_short_send: "
2894 "malloc failed");
2895 }
2896
2897 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2898 "with zeros !\n", fsp_str_dbg(fsp)));
2899
2900 while (nread < smb_maxcnt) {
2901 /*
2902 * We asked for the real file size and told sendfile
2903 * to not go beyond the end of the file. But it can
2904 * happen that in between our fstat call and the
2905 * sendfile call the file was truncated. This is very
2906 * bad because we have already announced the larger
2907 * number of bytes to the client.
2908 *
2909 * The best we can do now is to send 0-bytes, just as
2910 * a read from a hole in a sparse file would do.
2911 *
2912 * This should happen rarely enough that I don't care
2913 * about efficiency here :-)
2914 */
2915 size_t to_write;
2916
2917 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2918 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2919 != to_write) {
2920 char addr[INET6_ADDRSTRLEN];
2921 /*
2922 * Try and give an error message saying what
2923 * client failed.
2924 */
2925 DEBUG(0, ("write_data failed for client %s. "
2926 "Error %s\n",
2927 get_peer_addr(
2928 fsp->conn->sconn->sock, addr,
2929 sizeof(addr)),
2930 strerror(errno)));
2931 exit_server_cleanly("sendfile_short_send: "
2932 "write_data failed");
2933 }
2934 nread += to_write;
2935 }
2936 SAFE_FREE(buf);
2937 }
2938 }
2939
2940 /****************************************************************************
2941 Return a readbraw error (4 bytes of zero).
2942 ****************************************************************************/
2943
2944 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2945 {
2946 char header[4];
2947
2948 SIVAL(header,0,0);
2949
2950 smbd_lock_socket(sconn);
2951 if (write_data(sconn->sock,header,4) != 4) {
2952 char addr[INET6_ADDRSTRLEN];
2953 /*
2954 * Try and give an error message saying what
2955 * client failed.
2956 */
2957 DEBUG(0, ("write_data failed for client %s. "
2958 "Error %s\n",
2959 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2960 strerror(errno)));
2961
2962 fail_readraw();
2963 }
2964 smbd_unlock_socket(sconn);
2965 }
2966
2967 /****************************************************************************
2968 Use sendfile in readbraw.
2969 ****************************************************************************/
2970
2971 static void send_file_readbraw(connection_struct *conn,
2972 struct smb_request *req,
2973 files_struct *fsp,
2974 SMB_OFF_T startpos,
2975 size_t nread,
2976 ssize_t mincount)
2977 {
2978 struct smbd_server_connection *sconn = req->sconn;
2979 char *outbuf = NULL;
2980 ssize_t ret=0;
2981
2982 /*
2983 * We can only use sendfile on a non-chained packet
2984 * but we can use on a non-oplocked file. tridge proved this
2985 * on a train in Germany :-). JRA.
2986 * reply_readbraw has already checked the length.
2987 */
2988
2989 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2990 (fsp->wcp == NULL) &&
2991 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
2992 ssize_t sendfile_read = -1;
2993 char header[4];
2994 DATA_BLOB header_blob;
2995
2996 _smb_setlen(header,nread);
2997 header_blob = data_blob_const(header, 4);
2998
2999 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3000 &header_blob, startpos,
3001 nread);
3002 if (sendfile_read == -1) {
3003 /* Returning ENOSYS means no data at all was sent.
3004 * Do this as a normal read. */
3005 if (errno == ENOSYS) {
3006 goto normal_readbraw;
3007 }
3008
3009 /*
3010 * Special hack for broken Linux with no working sendfile. If we
3011 * return EINTR we sent the header but not the rest of the data.
3012 * Fake this up by doing read/write calls.
3013 */
3014 if (errno == EINTR) {
3015 /* Ensure we don't do this again. */
3016 set_use_sendfile(SNUM(conn), False);
3017 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3018
3019 if (fake_sendfile(fsp, startpos, nread) == -1) {
3020 DEBUG(0,("send_file_readbraw: "
3021 "fake_sendfile failed for "
3022 "file %s (%s).\n",
3023 fsp_str_dbg(fsp),
3024 strerror(errno)));
3025 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3026 }
3027 return;
3028 }
3029
3030 DEBUG(0,("send_file_readbraw: sendfile failed for "
3031 "file %s (%s). Terminating\n",
3032 fsp_str_dbg(fsp), strerror(errno)));
3033 exit_server_cleanly("send_file_readbraw sendfile failed");
3034 } else if (sendfile_read == 0) {
3035 /*
3036 * Some sendfile implementations return 0 to indicate
3037 * that there was a short read, but nothing was
3038 * actually written to the socket. In this case,
3039 * fallback to the normal read path so the header gets
3040 * the correct byte count.
3041 */
3042 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3043 "bytes falling back to the normal read: "
3044 "%s\n", fsp_str_dbg(fsp)));
3045 goto normal_readbraw;
3046 }
3047
3048 /* Deal with possible short send. */
3049 if (sendfile_read != 4+nread) {
3050 sendfile_short_send(fsp, sendfile_read, 4, nread);
3051 }
3052 return;
3053 }
3054
3055 normal_readbraw:
3056
3057 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3058 if (!outbuf) {
3059 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3060 (unsigned)(nread+4)));
3061 reply_readbraw_error(sconn);
3062 return;
3063 }
3064
3065 if (nread > 0) {
3066 ret = read_file(fsp,outbuf+4,startpos,nread);
3067 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3068 if (ret < mincount)
3069 ret = 0;
3070 #else
3071 if (ret < nread)
3072 ret = 0;
3073 #endif
3074 }
3075
3076 _smb_setlen(outbuf,ret);
3077 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3078 char addr[INET6_ADDRSTRLEN];
3079 /*
3080 * Try and give an error message saying what
3081 * client failed.
3082 */
3083 DEBUG(0, ("write_data failed for client %s. "
3084 "Error %s\n",
3085 get_peer_addr(fsp->conn->sconn->sock, addr,
3086 sizeof(addr)),
3087 strerror(errno)));
3088
3089 fail_readraw();
3090 }
3091
3092 TALLOC_FREE(outbuf);
3093 }
3094
3095 /****************************************************************************
3096 Reply to a readbraw (core+ protocol).
3097 ****************************************************************************/
3098
3099 void reply_readbraw(struct smb_request *req)
3100 {
3101 connection_struct *conn = req->conn;
3102 struct smbd_server_connection *sconn = req->sconn;
3103 ssize_t maxcount,mincount;
3104 size_t nread = 0;
3105 SMB_OFF_T startpos;
3106 files_struct *fsp;
3107 struct lock_struct lock;
3108 SMB_OFF_T size = 0;
3109
3110 START_PROFILE(SMBreadbraw);
3111
3112 if (srv_is_signing_active(sconn) ||
3113 is_encrypted_packet(req->inbuf)) {
3114 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3115 "raw reads/writes are disallowed.");
3116 }
3117
3118 if (req->wct < 8) {
3119 reply_readbraw_error(sconn);
3120 END_PROFILE(SMBreadbraw);
3121 return;
3122 }
3123
3124 if (sconn->smb1.echo_handler.trusted_fde) {
3125 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3126 "'async smb echo handler = yes'\n"));
3127 reply_readbraw_error(sconn);
3128 END_PROFILE(SMBreadbraw);
3129 return;
3130 }
3131
3132 /*
3133 * Special check if an oplock break has been issued
3134 * and the readraw request croses on the wire, we must
3135 * return a zero length response here.
3136 */
3137
3138 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3139
3140 /*
3141 * We have to do a check_fsp by hand here, as
3142 * we must always return 4 zero bytes on error,
3143 * not a NTSTATUS.
3144 */
3145
3146 if (!fsp || !conn || conn != fsp->conn ||
3147 req->vuid != fsp->vuid ||
3148 fsp->is_directory || fsp->fh->fd == -1) {
3149 /*
3150 * fsp could be NULL here so use the value from the packet. JRA.
3151 */
3152 DEBUG(3,("reply_readbraw: fnum %d not valid "
3153 "- cache prime?\n",
3154 (int)SVAL(req->vwv+0, 0)));
3155 reply_readbraw_error(sconn);
3156 END_PROFILE(SMBreadbraw);
3157 return;
3158 }
3159
3160 /* Do a "by hand" version of CHECK_READ. */
3161 if (!(fsp->can_read ||
3162 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3163 (fsp->access_mask & FILE_EXECUTE)))) {
3164 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3165 (int)SVAL(req->vwv+0, 0)));
3166 reply_readbraw_error(sconn);
3167 END_PROFILE(SMBreadbraw);
3168 return;
3169 }
3170
3171 flush_write_cache(fsp, READRAW_FLUSH);
3172
3173 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3174 if(req->wct == 10) {
3175 /*
3176 * This is a large offset (64 bit) read.
3177 */
3178 #ifdef LARGE_SMB_OFF_T
3179
3180 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3181
3182 #else /* !LARGE_SMB_OFF_T */
3183
3184 /*
3185 * Ensure we haven't been sent a >32 bit offset.
3186 */
3187
3188 if(IVAL(req->vwv+8, 0) != 0) {
3189 DEBUG(0,("reply_readbraw: large offset "
3190 "(%x << 32) used and we don't support "
3191 "64 bit offsets.\n",
3192 (unsigned int)IVAL(req->vwv+8, 0) ));
3193 reply_readbraw_error();
3194 END_PROFILE(SMBreadbraw);
3195 return;
3196 }
3197
3198 #endif /* LARGE_SMB_OFF_T */
3199
3200 if(startpos < 0) {
3201 DEBUG(0,("reply_readbraw: negative 64 bit "
3202 "readraw offset (%.0f) !\n",
3203 (double)startpos ));
3204 reply_readbraw_error(sconn);
3205 END_PROFILE(SMBreadbraw);
3206 return;
3207 }
3208 }
3209
3210 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3211 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3212
3213 /* ensure we don't overrun the packet size */
3214 maxcount = MIN(65535,maxcount);
3215
3216 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3217 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3218 &lock);
3219
3220 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3221 reply_readbraw_error(sconn);
3222 END_PROFILE(SMBreadbraw);
3223 return;
3224 }
3225
3226 if (fsp_stat(fsp) == 0) {
3227 size = fsp->fsp_name->st.st_ex_size;
3228 }
3229
3230 if (startpos >= size) {
3231 nread = 0;
3232 } else {
3233 nread = MIN(maxcount,(size - startpos));
3234 }
3235
3236 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3237 if (nread < mincount)
3238 nread = 0;
3239 #endif
3240
3241 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3242 "min=%lu nread=%lu\n",
3243 fsp->fnum, (double)startpos,
3244 (unsigned long)maxcount,
3245 (unsigned long)mincount,
3246 (unsigned long)nread ) );
3247
3248 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3249
3250 DEBUG(5,("reply_readbraw finished\n"));
3251
3252 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3253
3254 END_PROFILE(SMBreadbraw);
3255 return;
3256 }
3257
3258 #undef DBGC_CLASS
3259 #define DBGC_CLASS DBGC_LOCKING
3260
3261 /****************************************************************************
3262 Reply to a lockread (core+ protocol).
3263 ****************************************************************************/
3264
3265 void reply_lockread(struct smb_request *req)
3266 {
3267 connection_struct *conn = req->conn;
3268 ssize_t nread = -1;
3269 char *data;
3270 SMB_OFF_T startpos;
3271 size_t numtoread;
3272 NTSTATUS status;
3273 files_struct *fsp;
3274 struct byte_range_lock *br_lck = NULL;
3275 char *p = NULL;
3276 struct smbd_server_connection *sconn = req->sconn;
3277
3278 START_PROFILE(SMBlockread);
3279
3280 if (req->wct < 5) {
3281 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3282 END_PROFILE(SMBlockread);
3283 return;
3284 }
3285
3286 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3287
3288 if (!check_fsp(conn, req, fsp)) {
3289 END_PROFILE(SMBlockread);
3290 return;
3291 }
3292
3293 if (!CHECK_READ(fsp,req)) {
3294 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3295 END_PROFILE(SMBlockread);
3296 return;
3297 }
3298
3299 numtoread = SVAL(req->vwv+1, 0);
3300 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3301
3302 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3303
3304 reply_outbuf(req, 5, numtoread + 3);
3305
3306 data = smb_buf(req->outbuf) + 3;
3307
3308 /*
3309 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3310 * protocol request that predates the read/write lock concept.
3311 * Thus instead of asking for a read lock here we need to ask
3312 * for a write lock. JRA.
3313 * Note that the requested lock size is unaffected by max_recv.
3314 */
3315
3316 br_lck = do_lock(req->sconn->msg_ctx,
3317 fsp,
3318 (uint64_t)req->smbpid,
3319 (uint64_t)numtoread,
3320 (uint64_t)startpos,
3321 WRITE_LOCK,
3322 WINDOWS_LOCK,
3323 False, /* Non-blocking lock. */
3324 &status,
3325 NULL,
3326 NULL);
3327 TALLOC_FREE(br_lck);
3328
3329 if (NT_STATUS_V(status)) {
3330 reply_nterror(req, status);
3331 END_PROFILE(SMBlockread);
3332 return;
3333 }
3334
3335 /*
3336 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3337 */
3338
3339 if (numtoread > sconn->smb1.negprot.max_recv) {
3340 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3341 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3342 (unsigned int)numtoread,
3343 (unsigned int)sconn->smb1.negprot.max_recv));
3344 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3345 }
3346 nread = read_file(fsp,data,startpos,numtoread);
3347
3348 if (nread < 0) {
3349 reply_nterror(req, map_nt_error_from_unix(errno));
3350 END_PROFILE(SMBlockread);
3351 return;
3352 }
3353
3354 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3355
3356 SSVAL(req->outbuf,smb_vwv0,nread);
3357 SSVAL(req->outbuf,smb_vwv5,nread+3);
3358 p = smb_buf(req->outbuf);
3359 SCVAL(p,0,0); /* pad byte. */
3360 SSVAL(p,1,nread);
3361
3362 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3363 fsp->fnum, (int)numtoread, (int)nread));
3364
3365 END_PROFILE(SMBlockread);
3366 return;
3367 }
3368
3369 #undef DBGC_CLASS
3370 #define DBGC_CLASS DBGC_ALL
3371
3372 /****************************************************************************
3373 Reply to a read.
3374 ****************************************************************************/
3375
3376 void reply_read(struct smb_request *req)
3377 {
3378 connection_struct *conn = req->conn;
3379 size_t numtoread;
3380 ssize_t nread = 0;
3381 char *data;
3382 SMB_OFF_T startpos;
3383 int outsize = 0;
3384 files_struct *fsp;
3385 struct lock_struct lock;
3386 struct smbd_server_connection *sconn = req->sconn;
3387
3388 START_PROFILE(SMBread);
3389
3390 if (req->wct < 3) {
3391 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3392 END_PROFILE(SMBread);
3393 return;
3394 }
3395
3396 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3397
3398 if (!check_fsp(conn, req, fsp)) {
3399 END_PROFILE(SMBread);
3400 return;
3401 }
3402
3403 if (!CHECK_READ(fsp,req)) {
3404 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3405 END_PROFILE(SMBread);
3406 return;
3407 }
3408
3409 numtoread = SVAL(req->vwv+1, 0);
3410 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3411
3412 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3413
3414 /*
3415 * The requested read size cannot be greater than max_recv. JRA.
3416 */
3417 if (numtoread > sconn->smb1.negprot.max_recv) {
3418 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3419 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3420 (unsigned int)numtoread,
3421 (unsigned int)sconn->smb1.negprot.max_recv));
3422 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3423 }
3424
3425 reply_outbuf(req, 5, numtoread+3);
3426
3427 data = smb_buf(req->outbuf) + 3;
3428
3429 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3430 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3431 &lock);
3432
3433 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3434 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3435 END_PROFILE(SMBread);
3436 return;
3437 }
3438
3439 if (numtoread > 0)
3440 nread = read_file(fsp,data,startpos,numtoread);
3441
3442 if (nread < 0) {
3443 reply_nterror(req, map_nt_error_from_unix(errno));
3444 goto strict_unlock;
3445 }
3446
3447 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3448
3449 SSVAL(req->outbuf,smb_vwv0,nread);
3450 SSVAL(req->outbuf,smb_vwv5,nread+3);
3451 SCVAL(smb_buf(req->outbuf),0,1);
3452 SSVAL(smb_buf(req->outbuf),1,nread);
3453
3454 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3455 fsp->fnum, (int)numtoread, (int)nread ) );
3456
3457 strict_unlock:
3458 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3459
3460 END_PROFILE(SMBread);
3461 return;
3462 }
3463
3464 /****************************************************************************
3465 Setup readX header.
3466 ****************************************************************************/
3467
3468 static int setup_readX_header(struct smb_request *req, char *outbuf,
3469 size_t smb_maxcnt)
3470 {
3471 int outsize;
3472 char *data;
3473
3474 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3475 data = smb_buf(outbuf);
3476
3477 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3478
3479 SCVAL(outbuf,smb_vwv0,0xFF);
3480 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3481 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3482 SSVAL(outbuf,smb_vwv6,
3483 req_wct_ofs(req)
3484 + 1 /* the wct field */
3485 + 12 * sizeof(uint16_t) /* vwv */
3486 + 2); /* the buflen field */
3487 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3488 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3489 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3490 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3491 return outsize;
3492 }
3493
3494 /****************************************************************************
3495 Reply to a read and X - possibly using sendfile.
3496 ****************************************************************************/
3497
3498 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3499 files_struct *fsp, SMB_OFF_T startpos,
3500 size_t smb_maxcnt)
3501 {
3502 ssize_t nread = -1;
3503 struct lock_struct lock;
3504 int saved_errno = 0;
3505
3506 if(fsp_stat(fsp) == -1) {
3507 reply_nterror(req, map_nt_error_from_unix(errno));
3508 return;
3509 }
3510
3511 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3512 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3513 &lock);
3514
3515 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3516 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3517 return;
3518 }
3519
3520 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3521 (startpos > fsp->fsp_name->st.st_ex_size)
3522 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3523 /*
3524 * We already know that we would do a short read, so don't
3525 * try the sendfile() path.
3526 */
3527 goto nosendfile_read;
3528 }
3529
3530 /*
3531 * We can only use sendfile on a non-chained packet
3532 * but we can use on a non-oplocked file. tridge proved this
3533 * on a train in Germany :-). JRA.
3534 */
3535
3536 if (!req_is_in_chain(req) &&
3537 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3538 (fsp->wcp == NULL) &&
3539 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3540 uint8 headerbuf[smb_size + 12 * 2];
3541 DATA_BLOB header;
3542
3543 /*
3544 * Set up the packet header before send. We
3545 * assume here the sendfile will work (get the
3546 * correct amount of data).
3547 */
3548
3549 header = data_blob_const(headerbuf, sizeof(headerbuf));
3550
3551 construct_reply_common_req(req, (char *)headerbuf);
3552 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3553
3554 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3555 startpos, smb_maxcnt);
3556 if (nread == -1) {
3557 /* Returning ENOSYS means no data at all was sent.
3558 Do this as a normal read. */
3559 if (errno == ENOSYS) {
3560 goto normal_read;
3561 }
3562
3563 /*
3564 * Special hack for broken Linux with no working sendfile. If we
3565 * return EINTR we sent the header but not the rest of the data.
3566 * Fake this up by doing read/write calls.
3567 */
3568
3569 if (errno == EINTR) {
3570 /* Ensure we don't do this again. */
3571 set_use_sendfile(SNUM(conn), False);
3572 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3573 nread = fake_sendfile(fsp, startpos,
3574 smb_maxcnt);
3575 if (nread == -1) {
3576 DEBUG(0,("send_file_readX: "
3577 "fake_sendfile failed for "
3578 "file %s (%s).\n",
3579 fsp_str_dbg(fsp),
3580 strerror(errno)));
3581 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3582 }
3583 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3584 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3585 /* No outbuf here means successful sendfile. */
3586 goto strict_unlock;
3587 }
3588
3589 DEBUG(0,("send_file_readX: sendfile failed for file "
3590 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3591 strerror(errno)));
3592 exit_server_cleanly("send_file_readX sendfile failed");
3593 } else if (nread == 0) {
3594 /*
3595 * Some sendfile implementations return 0 to indicate
3596 * that there was a short read, but nothing was
3597 * actually written to the socket. In this case,
3598 * fallback to the normal read path so the header gets
3599 * the correct byte count.
3600 */
3601 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3602 "falling back to the normal read: %s\n",
3603 fsp_str_dbg(fsp)));
3604 goto normal_read;
3605 }
3606
3607 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3608 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3609
3610 /* Deal with possible short send. */
3611 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3612 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3613 }
3614 /* No outbuf here means successful sendfile. */
3615 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3616 SMB_PERFCOUNT_END(&req->pcd);
3617 goto strict_unlock;
3618 }
3619
3620 normal_read:
3621
3622 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3623 uint8 headerbuf[smb_size + 2*12];
3624
3625 construct_reply_common_req(req, (char *)headerbuf);
3626 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3627
3628 /* Send out the header. */
3629 if (write_data(req->sconn->sock, (char *)headerbuf,
3630 sizeof(headerbuf)) != sizeof(headerbuf)) {
3631
3632 char addr[INET6_ADDRSTRLEN];
3633 /*
3634 * Try and give an error message saying what
3635 * client failed.
3636 */
3637 DEBUG(0, ("write_data failed for client %s. "
3638 "Error %s\n",
3639 get_peer_addr(req->sconn->sock, addr,
3640 sizeof(addr)),
3641 strerror(errno)));
3642
3643 DEBUG(0,("send_file_readX: write_data failed for file "
3644 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3645 strerror(errno)));
3646 exit_server_cleanly("send_file_readX sendfile failed");
3647 }
3648 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3649 if (nread == -1) {
3650 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3651 "file %s (%s).\n", fsp_str_dbg(fsp),
3652 strerror(errno)));
3653 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3654 }
3655 goto strict_unlock;
3656 }
3657
3658 nosendfile_read:
3659
3660 reply_outbuf(req, 12, smb_maxcnt);
3661
3662 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3663 saved_errno = errno;
3664
3665 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3666
3667 if (nread < 0) {
3668 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3669 return;
3670 }
3671
3672 setup_readX_header(req, (char *)req->outbuf, nread);
3673
3674 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3675 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3676
3677 chain_reply(req);
3678 return;
3679
3680 strict_unlock:
3681 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3682 TALLOC_FREE(req->outbuf);
3683 return;
3684 }
3685
3686 /****************************************************************************
3687 Reply to a read and X.
3688 ****************************************************************************/
3689
3690 void reply_read_and_X(struct smb_request *req)
3691 {
3692 connection_struct *conn = req->conn;
3693 files_struct *fsp;
3694 SMB_OFF_T startpos;
3695 size_t smb_maxcnt;
3696 bool big_readX = False;
3697 #if 0
3698 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3699 #endif
3700
3701 START_PROFILE(SMBreadX);
3702
3703 if ((req->wct != 10) && (req->wct != 12)) {
3704 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3705 return;
3706 }
3707
3708 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3709 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3710 smb_maxcnt = SVAL(req->vwv+5, 0);
3711
3712 /* If it's an IPC, pass off the pipe handler. */
3713 if (IS_IPC(conn)) {
3714 reply_pipe_read_and_X(req);
3715 END_PROFILE(SMBreadX);
3716 return;
3717 }
3718
3719 if (!check_fsp(conn, req, fsp)) {
3720 END_PROFILE(SMBreadX);
3721 return;
3722 }
3723
3724 if (!CHECK_READ(fsp,req)) {
3725 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3726 END_PROFILE(SMBreadX);
3727 return;
3728 }
3729
3730 if (global_client_caps & CAP_LARGE_READX) {
3731 size_t upper_size = SVAL(req->vwv+7, 0);
3732 smb_maxcnt |= (upper_size<<16);
3733 if (upper_size > 1) {
3734 /* Can't do this on a chained packet. */
3735 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3736 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3737 END_PROFILE(SMBreadX);
3738 return;
3739 }
3740 /* We currently don't do this on signed or sealed data. */
3741 if (srv_is_signing_active(req->sconn) ||
3742 is_encrypted_packet(req->inbuf)) {
3743 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3744 END_PROFILE(SMBreadX);
3745 return;
3746 }
3747 /* Is there room in the reply for this data ? */
3748 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3749 reply_nterror(req,
3750 NT_STATUS_INVALID_PARAMETER);
3751 END_PROFILE(SMBreadX);
3752 return;
3753 }
3754 big_readX = True;
3755 }
3756 }
3757
3758 if (req->wct == 12) {
3759 #ifdef LARGE_SMB_OFF_T
3760 /*
3761 * This is a large offset (64 bit) read.
3762 */
3763 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3764
3765 #else /* !LARGE_SMB_OFF_T */
3766
3767 /*
3768 * Ensure we haven't been sent a >32 bit offset.
3769 */
3770
3771 if(IVAL(req->vwv+10, 0) != 0) {
3772 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3773 "used and we don't support 64 bit offsets.\n",
3774 (unsigned int)IVAL(req->vwv+10, 0) ));
3775 END_PROFILE(SMBreadX);
3776 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3777 return;
3778 }
3779
3780 #endif /* LARGE_SMB_OFF_T */
3781
3782 }
3783
3784 if (!big_readX) {
3785 NTSTATUS status = schedule_aio_read_and_X(conn,
3786 req,
3787 fsp,
3788 startpos,
3789 smb_maxcnt);
3790 if (NT_STATUS_IS_OK(status)) {
3791 /* Read scheduled - we're done. */
3792 goto out;
3793 }
3794 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3795 /* Real error - report to client. */
3796 END_PROFILE(SMBreadX);
3797 reply_nterror(req, status);
3798 return;
3799 }
3800 /* NT_STATUS_RETRY - fall back to sync read. */
3801 }
3802
3803 smbd_lock_socket(req->sconn);
3804 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3805 smbd_unlock_socket(req->sconn);
3806
3807 out:
3808 END_PROFILE(SMBreadX);
3809 return;
3810 }
3811
3812 /****************************************************************************
3813 Error replies to writebraw must have smb_wct == 1. Fix this up.
3814 ****************************************************************************/
3815
3816 void error_to_writebrawerr(struct smb_request *req)
3817 {
3818 uint8 *old_outbuf = req->outbuf;
3819
3820 reply_outbuf(req, 1, 0);
3821
3822 memcpy(req->outbuf, old_outbuf, smb_size);
3823 TALLOC_FREE(old_outbuf);
3824 }
3825
3826 /****************************************************************************
3827 Read 4 bytes of a smb packet and return the smb length of the packet.
3828 Store the result in the buffer. This version of the function will
3829 never return a session keepalive (length of zero).
3830 Timeout is in milliseconds.
3831 ****************************************************************************/
3832
3833 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3834 size_t *len)
3835 {
3836 uint8_t msgtype = SMBkeepalive;
3837
3838 while (msgtype == SMBkeepalive) {
3839 NTSTATUS status;
3840
3841 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3842 len);
3843 if (!NT_STATUS_IS_OK(status)) {
3844 char addr[INET6_ADDRSTRLEN];
3845 /* Try and give an error message
3846 * saying what client failed. */
3847 DEBUG(0, ("read_fd_with_timeout failed for "
3848 "client %s read error = %s.\n",
3849 get_peer_addr(fd,addr,sizeof(addr)),
3850 nt_errstr(status)));
3851 return status;
3852 }
3853
3854 msgtype = CVAL(inbuf, 0);
3855 }
3856
3857 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3858 (unsigned long)len));
3859
3860 return NT_STATUS_OK;
3861 }
3862
3863 /****************************************************************************
3864 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3865 ****************************************************************************/
3866
3867 void reply_writebraw(struct smb_request *req)
3868 {
3869 connection_struct *conn = req->conn;
3870 char *buf = NULL;
3871 ssize_t nwritten=0;
3872 ssize_t total_written=0;
3873 size_t numtowrite=0;
3874 size_t tcount;
3875 SMB_OFF_T startpos;
3876 char *data=NULL;
3877 bool write_through;
3878 files_struct *fsp;
3879 struct lock_struct lock;
3880 NTSTATUS status;
3881
3882 START_PROFILE(SMBwritebraw);
3883
3884 /*
3885 * If we ever reply with an error, it must have the SMB command
3886 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3887 * we're finished.
3888 */
3889 SCVAL(req->inbuf,smb_com,SMBwritec);
3890
3891 if (srv_is_signing_active(req->sconn)) {
3892 END_PROFILE(SMBwritebraw);
3893 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3894 "raw reads/writes are disallowed.");
3895 }
3896
3897 if (req->wct < 12) {
3898 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3899 error_to_writebrawerr(req);
3900 END_PROFILE(SMBwritebraw);
3901 return;
3902 }
3903
3904 if (req->sconn->smb1.echo_handler.trusted_fde) {
3905 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3906 "'async smb echo handler = yes'\n"));
3907 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3908 error_to_writebrawerr(req);
3909 END_PROFILE(SMBwritebraw);
3910 return;
3911 }
3912
3913 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3914 if (!check_fsp(conn, req, fsp)) {
3915 error_to_writebrawerr(req);
3916 END_PROFILE(SMBwritebraw);
3917 return;
3918 }
3919
3920 if (!CHECK_WRITE(fsp)) {
3921 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3922 error_to_writebrawerr(req);
3923 END_PROFILE(SMBwritebraw);
3924 return;
3925 }
3926
3927 tcount = IVAL(req->vwv+1, 0);
3928 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3929 write_through = BITSETW(req->vwv+7,0);
3930
3931 /* We have to deal with slightly different formats depending
3932 on whether we are using the core+ or lanman1.0 protocol */
3933
3934 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3935 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3936 data = smb_buf(req->inbuf);
3937 } else {
3938 numtowrite = SVAL(req->vwv+10, 0);
3939 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3940 }
3941
3942 /* Ensure we don't write bytes past the end of this packet. */
3943 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3944 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3945 error_to_writebrawerr(req);
3946 END_PROFILE(SMBwritebraw);
3947 return;
3948 }
3949
3950 if (!fsp->print_file) {
3951 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3952 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3953 &lock);
3954
3955 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3956 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3957 error_to_writebrawerr(req);
3958 END_PROFILE(SMBwritebraw);
3959 return;
3960 }
3961 }
3962
3963 if (numtowrite>0) {
3964 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3965 }
3966
3967 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3968 "wrote=%d sync=%d\n",
3969 fsp->fnum, (double)startpos, (int)numtowrite,
3970 (int)nwritten, (int)write_through));
3971
3972 if (nwritten < (ssize_t)numtowrite) {
3973 reply_nterror(req, NT_STATUS_DISK_FULL);
3974 error_to_writebrawerr(req);
3975 goto strict_unlock;
3976 }
3977
3978 total_written = nwritten;
3979
3980 /* Allocate a buffer of 64k + length. */
3981 buf = TALLOC_ARRAY(NULL, char, 65540);
3982 if (!buf) {
3983 reply_nterror(req, NT_STATUS_NO_MEMORY);
3984 error_to_writebrawerr(req);
3985 goto strict_unlock;
3986 }
3987
3988 /* Return a SMBwritebraw message to the redirector to tell
3989 * it to send more bytes */
3990
3991 memcpy(buf, req->inbuf, smb_size);
3992 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3993 SCVAL(buf,smb_com,SMBwritebraw);
3994 SSVALS(buf,smb_vwv0,0xFFFF);
3995 show_msg(buf);
3996 if (!srv_send_smb(req->sconn,
3997 buf,
3998 false, 0, /* no signing */
3999 IS_CONN_ENCRYPTED(conn),
4000 &req->pcd)) {
4001 exit_server_cleanly("reply_writebraw: srv_send_smb "
4002 "failed.");
4003 }
4004
4005 /* Now read the raw data into the buffer and write it */
4006 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4007 &numtowrite);
4008 if (!NT_STATUS_IS_OK(status)) {
4009 exit_server_cleanly("secondary writebraw failed");
4010 }
4011
4012 /* Set up outbuf to return the correct size */
4013 reply_outbuf(req, 1, 0);
4014
4015 if (numtowrite != 0) {
4016
4017 if (numtowrite > 0xFFFF) {
4018 DEBUG(0,("reply_writebraw: Oversize secondary write "
4019 "raw requested (%u). Terminating\n",
4020 (unsigned int)numtowrite ));
4021 exit_server_cleanly("secondary writebraw failed");
4022 }
4023
4024 if (tcount > nwritten+numtowrite) {
4025 DEBUG(3,("reply_writebraw: Client overestimated the "
4026 "write %d %d %d\n",
4027 (int)tcount,(int)nwritten,(int)numtowrite));
4028 }
4029
4030 status = read_data(req->sconn->sock, buf+4, numtowrite);
4031
4032 if (!NT_STATUS_IS_OK(status)) {
4033 char addr[INET6_ADDRSTRLEN];
4034 /* Try and give an error message
4035 * saying what client failed. */
4036 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4037 "raw read failed (%s) for client %s. "
4038 "Terminating\n", nt_errstr(status),
4039 get_peer_addr(req->sconn->sock, addr,
4040 sizeof(addr))));
4041 exit_server_cleanly("secondary writebraw failed");
4042 }
4043
4044 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4045 if (nwritten == -1) {
4046 TALLOC_FREE(buf);
4047 reply_nterror(req, map_nt_error_from_unix(errno));
4048 error_to_writebrawerr(req);
4049 goto strict_unlock;
4050 }
4051
4052 if (nwritten < (ssize_t)numtowrite) {
4053 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4054 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4055 }
4056
4057 if (nwritten > 0) {
4058 total_written += nwritten;
4059 }
4060 }
4061
4062 TALLOC_FREE(buf);
4063 SSVAL(req->outbuf,smb_vwv0,total_written);
4064
4065 status = sync_file(conn, fsp, write_through);
4066 if (!NT_STATUS_IS_OK(status)) {
4067 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4068 fsp_str_dbg(fsp), nt_errstr(status)));
4069 reply_nterror(req, status);
4070 error_to_writebrawerr(req);
4071 goto strict_unlock;
4072 }
4073
4074 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4075 "wrote=%d\n",
4076 fsp->fnum, (double)startpos, (int)numtowrite,
4077 (int)total_written));
4078
4079 if (!fsp->print_file) {
4080 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4081 }
4082
4083 /* We won't return a status if write through is not selected - this
4084 * follows what WfWg does */
4085 END_PROFILE(SMBwritebraw);
4086
4087 if (!write_through && total_written==tcount) {
4088
4089 #if RABBIT_PELLET_FIX
4090 /*
4091 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4092 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4093 * JRA.
4094 */
4095 if (!send_keepalive(req->sconn->sock)) {
4096 exit_server_cleanly("reply_writebraw: send of "
4097 "keepalive failed");
4098 }
4099 #endif
4100 TALLOC_FREE(req->outbuf);
4101 }
4102 return;
4103
4104 strict_unlock:
4105 if (!fsp->print_file) {
4106 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4107 }
4108
4109 END_PROFILE(SMBwritebraw);
4110 return;
4111 }
4112
4113 #undef DBGC_CLASS
4114 #define DBGC_CLASS DBGC_LOCKING
4115
4116 /****************************************************************************
4117 Reply to a writeunlock (core+).
4118 ****************************************************************************/
4119
4120 void reply_writeunlock(struct smb_request *req)
4121 {
4122 connection_struct *conn = req->conn;
4123 ssize_t nwritten = -1;
4124 size_t numtowrite;
4125 SMB_OFF_T startpos;
4126 const char *data;
4127 NTSTATUS status = NT_STATUS_OK;
4128 files_struct *fsp;
4129 struct lock_struct lock;
4130 int saved_errno = 0;
4131
4132 START_PROFILE(SMBwriteunlock);
4133
4134 if (req->wct < 5) {
4135 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4136 END_PROFILE(SMBwriteunlock);
4137 return;
4138 }
4139
4140 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4141
4142 if (!check_fsp(conn, req, fsp)) {
4143 END_PROFILE(SMBwriteunlock);
4144 return;
4145 }
4146
4147 if (!CHECK_WRITE(fsp)) {
4148 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4149 END_PROFILE(SMBwriteunlock);
4150 return;
4151 }
4152
4153 numtowrite = SVAL(req->vwv+1, 0);
4154 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4155 data = (const char *)req->buf + 3;
4156
4157 if (!fsp->print_file && numtowrite > 0) {
4158 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4159 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4160 &lock);
4161
4162 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4163 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4164 END_PROFILE(SMBwriteunlock);
4165 return;
4166 }
4167 }
4168
4169 /* The special X/Open SMB protocol handling of
4170 zero length writes is *NOT* done for
4171 this call */
4172 if(numtowrite == 0) {
4173 nwritten = 0;
4174 } else {
4175 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4176 saved_errno = errno;
4177 }
4178
4179 status = sync_file(conn, fsp, False /* write through */);
4180 if (!NT_STATUS_IS_OK(status)) {
4181 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4182 fsp_str_dbg(fsp), nt_errstr(status)));
4183 reply_nterror(req, status);
4184 goto strict_unlock;
4185 }
4186
4187 if(nwritten < 0) {
4188 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4189 goto strict_unlock;
4190 }
4191
4192 if((nwritten < numtowrite) && (numtowrite != 0)) {
4193 reply_nterror(req, NT_STATUS_DISK_FULL);
4194 goto strict_unlock;
4195 }
4196
4197 if (numtowrite && !fsp->print_file) {
4198 status = do_unlock(req->sconn->msg_ctx,
4199 fsp,
4200 (uint64_t)req->smbpid,
4201 (uint64_t)numtowrite,
4202 (uint64_t)startpos,
4203 WINDOWS_LOCK);
4204
4205 if (NT_STATUS_V(status)) {
4206 reply_nterror(req, status);
4207 goto strict_unlock;
4208 }
4209 }
4210
4211 reply_outbuf(req, 1, 0);
4212
4213 SSVAL(req->outbuf,smb_vwv0,nwritten);
4214
4215 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4216 fsp->fnum, (int)numtowrite, (int)nwritten));
4217
4218 strict_unlock:
4219 if (numtowrite && !fsp->print_file) {
4220 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4221 }
4222
4223 END_PROFILE(SMBwriteunlock);
4224 return;
4225 }
4226
4227 #undef DBGC_CLASS
4228 #define DBGC_CLASS DBGC_ALL
4229
4230 /****************************************************************************
4231 Reply to a write.
4232 ****************************************************************************/
4233
4234 void reply_write(struct smb_request *req)
4235 {
4236 connection_struct *conn = req->conn;
4237 size_t numtowrite;
4238 ssize_t nwritten = -1;
4239 SMB_OFF_T startpos;
4240 const char *data;
4241 files_struct *fsp;
4242 struct lock_struct lock;
4243 NTSTATUS status;
4244 int saved_errno = 0;
4245
4246 START_PROFILE(SMBwrite);
4247
4248 if (req->wct < 5) {
4249 END_PROFILE(SMBwrite);
4250 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4251 return;
4252 }
4253
4254 /* If it's an IPC, pass off the pipe handler. */
4255 if (IS_IPC(conn)) {
4256 reply_pipe_write(req);
4257 END_PROFILE(SMBwrite);
4258 return;
4259 }
4260
4261 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4262
4263 if (!check_fsp(conn, req, fsp)) {
4264 END_PROFILE(SMBwrite);
4265 return;
4266 }
4267
4268 if (!CHECK_WRITE(fsp)) {
4269 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4270 END_PROFILE(SMBwrite);
4271 return;
4272 }
4273
4274 numtowrite = SVAL(req->vwv+1, 0);
4275 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4276 data = (const char *)req->buf + 3;
4277
4278 if (!fsp->print_file) {
4279 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4280 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4281 &lock);
4282
4283 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4284 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4285 END_PROFILE(SMBwrite);
4286 return;
4287 }
4288 }
4289
4290 /*
4291 * X/Open SMB protocol says that if smb_vwv1 is
4292 * zero then the file size should be extended or
4293 * truncated to the size given in smb_vwv[2-3].
4294 */
4295
4296 if(numtowrite == 0) {
4297 /*
4298 * This is actually an allocate call, and set EOF. JRA.
4299 */
4300 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4301 if (nwritten < 0) {
4302 reply_nterror(req, NT_STATUS_DISK_FULL);
4303 goto strict_unlock;
4304 }
4305 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4306 if (nwritten < 0) {
4307 reply_nterror(req, NT_STATUS_DISK_FULL);
4308 goto strict_unlock;
4309 }
4310 trigger_write_time_update_immediate(fsp);
4311 } else {
4312 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4313 }
4314
4315 status = sync_file(conn, fsp, False);
4316 if (!NT_STATUS_IS_OK(status)) {
4317 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4318 fsp_str_dbg(fsp), nt_errstr(status)));
4319 reply_nterror(req, status);
4320 goto strict_unlock;
4321 }
4322
4323 if(nwritten < 0) {
4324 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4325 goto strict_unlock;
4326 }
4327
4328 if((nwritten == 0) && (numtowrite != 0)) {
4329 reply_nterror(req, NT_STATUS_DISK_FULL);
4330 goto strict_unlock;
4331 }
4332
4333 reply_outbuf(req, 1, 0);
4334
4335 SSVAL(req->outbuf,smb_vwv0,nwritten);
4336
4337 if (nwritten < (ssize_t)numtowrite) {
4338 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4339 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4340 }
4341
4342 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4343
4344 strict_unlock:
4345 if (!fsp->print_file) {
4346 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4347 }
4348
4349 END_PROFILE(SMBwrite);
4350 return;
4351 }
4352
4353 /****************************************************************************
4354 Ensure a buffer is a valid writeX for recvfile purposes.
4355 ****************************************************************************/
4356
4357 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4358 (2*14) + /* word count (including bcc) */ \
4359 1 /* pad byte */)
4360
4361 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4362 const uint8_t *inbuf)
4363 {
4364 size_t numtowrite;
4365 connection_struct *conn = NULL;
4366 unsigned int doff = 0;
4367 size_t len = smb_len_large(inbuf);
4368
4369 if (is_encrypted_packet(inbuf)) {
4370 /* Can't do this on encrypted
4371 * connections. */
4372 return false;
4373 }
4374
4375 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4376 return false;
4377 }
4378
4379 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4380 CVAL(inbuf,smb_wct) != 14) {
4381 DEBUG(10,("is_valid_writeX_buffer: chained or "
4382 "invalid word length.\n"));
4383 return false;
4384 }
4385
4386 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4387 if (conn == NULL) {
4388 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4389 return false;
4390 }
4391 if (IS_IPC(conn)) {
4392 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4393 return false;
4394 }
4395 if (IS_PRINT(conn)) {
4396 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4397 return false;
4398 }
4399 doff = SVAL(inbuf,smb_vwv11);
4400
4401 numtowrite = SVAL(inbuf,smb_vwv10);
4402
4403 if (len > doff && len - doff > 0xFFFF) {
4404 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4405 }
4406
4407 if (numtowrite == 0) {
4408 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4409 return false;
4410 }
4411
4412 /* Ensure the sizes match up. */
4413 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4414 /* no pad byte...old smbclient :-( */
4415 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4416 (unsigned int)doff,
4417 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4418 return false;
4419 }
4420
4421 if (len - doff != numtowrite) {
4422 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4423 "len = %u, doff = %u, numtowrite = %u\n",
4424 (unsigned int)len,
4425 (unsigned int)doff,
4426 (unsigned int)numtowrite ));
4427 return false;
4428 }
4429
4430 DEBUG(10,("is_valid_writeX_buffer: true "
4431 "len = %u, doff = %u, numtowrite = %u\n",
4432 (unsigned int)len,
4433 (unsigned int)doff,
4434 (unsigned int)numtowrite ));
4435
4436 return true;
4437 }
4438
4439 /****************************************************************************
4440 Reply to a write and X.
4441 ****************************************************************************/
4442
4443 void reply_write_and_X(struct smb_request *req)
4444 {
4445 connection_struct *conn = req->conn;
4446 files_struct *fsp;
4447 struct lock_struct lock;
4448 SMB_OFF_T startpos;
4449 size_t numtowrite;
4450 bool write_through;
4451 ssize_t nwritten;
4452 unsigned int smb_doff;
4453 unsigned int smblen;
4454 char *data;
4455 NTSTATUS status;
4456 int saved_errno = 0;
4457
4458 START_PROFILE(SMBwriteX);
4459
4460 if ((req->wct != 12) && (req->wct != 14)) {
4461 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4462 END_PROFILE(SMBwriteX);
4463 return;
4464 }
4465
4466 numtowrite = SVAL(req->vwv+10, 0);
4467 smb_doff = SVAL(req->vwv+11, 0);
4468 smblen = smb_len(req->inbuf);
4469
4470 if (req->unread_bytes > 0xFFFF ||
4471 (smblen > smb_doff &&
4472 smblen - smb_doff > 0xFFFF)) {
4473 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4474 }
4475
4476 if (req->unread_bytes) {
4477 /* Can't do a recvfile write on IPC$ */
4478 if (IS_IPC(conn)) {
4479 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4480 END_PROFILE(SMBwriteX);
4481 return;
4482 }
4483 if (numtowrite != req->unread_bytes) {
4484 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4485 END_PROFILE(SMBwriteX);
4486 return;
4487 }
4488 } else {
4489 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4490 smb_doff + numtowrite > smblen) {
4491 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4492 END_PROFILE(SMBwriteX);
4493 return;
4494 }
4495 }
4496
4497 /* If it's an IPC, pass off the pipe handler. */
4498 if (IS_IPC(conn)) {
4499 if (req->unread_bytes) {
4500 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4501 END_PROFILE(SMBwriteX);
4502 return;
4503 }
4504 reply_pipe_write_and_X(req);
4505 END_PROFILE(SMBwriteX);
4506 return;
4507 }
4508
4509 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4510 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4511 write_through = BITSETW(req->vwv+7,0);
4512
4513 if (!check_fsp(conn, req, fsp)) {
4514 END_PROFILE(SMBwriteX);
4515 return;
4516 }
4517
4518 if (!CHECK_WRITE(fsp)) {
4519 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4520 END_PROFILE(SMBwriteX);
4521 return;
4522 }
4523
4524 data = smb_base(req->inbuf) + smb_doff;
4525
4526 if(req->wct == 14) {
4527 #ifdef LARGE_SMB_OFF_T
4528 /*
4529 * This is a large offset (64 bit) write.
4530 */
4531 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4532
4533 #else /* !LARGE_SMB_OFF_T */
4534
4535 /*
4536 * Ensure we haven't been sent a >32 bit offset.
4537 */
4538
4539 if(IVAL(req->vwv+12, 0) != 0) {
4540 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4541 "used and we don't support 64 bit offsets.\n",
4542 (unsigned int)IVAL(req->vwv+12, 0) ));
4543 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4544 END_PROFILE(SMBwriteX);
4545 return;
4546 }
4547
4548 #endif /* LARGE_SMB_OFF_T */
4549 }
4550
4551 /* X/Open SMB protocol says that, unlike SMBwrite
4552 if the length is zero then NO truncation is
4553 done, just a write of zero. To truncate a file,
4554 use SMBwrite. */
4555
4556 if(numtowrite == 0) {
4557 nwritten = 0;
4558 } else {
4559 if (req->unread_bytes == 0) {
4560 status = schedule_aio_write_and_X(conn,
4561 req,
4562 fsp,
4563 data,
4564 startpos,
4565 numtowrite);
4566
4567 if (NT_STATUS_IS_OK(status)) {
4568 /* write scheduled - we're done. */
4569 goto out;
4570 }
4571 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4572 /* Real error - report to client. */
4573 reply_nterror(req, status);
4574 goto out;
4575 }
4576 /* NT_STATUS_RETRY - fall through to sync write. */
4577 }
4578
4579 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4580 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4581 &lock);
4582
4583 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4584 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4585 goto out;
4586 }
4587
4588 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4589 saved_errno = errno;
4590
4591 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4592 }
4593
4594 if(nwritten < 0) {
4595 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4596 goto out;
4597 }
4598
4599 if((nwritten == 0) && (numtowrite != 0)) {
4600 reply_nterror(req, NT_STATUS_DISK_FULL);
4601 goto out;
4602 }
4603
4604 reply_outbuf(req, 6, 0);
4605 SSVAL(req->outbuf,smb_vwv2,nwritten);
4606 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4607
4608 if (nwritten < (ssize_t)numtowrite) {
4609 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4610 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4611 }
4612
4613 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4614 fsp->fnum, (int)numtowrite, (int)nwritten));
4615
4616 status = sync_file(conn, fsp, write_through);
4617 if (!NT_STATUS_IS_OK(status)) {
4618 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4619 fsp_str_dbg(fsp), nt_errstr(status)));
4620 reply_nterror(req, status);
4621 goto out;
4622 }
4623
4624 END_PROFILE(SMBwriteX);
4625 chain_reply(req);
4626 return;
4627
4628 out:
4629 END_PROFILE(SMBwriteX);
4630 return;
4631 }
4632
4633 /****************************************************************************
4634 Reply to a lseek.
4635 ****************************************************************************/
4636
4637 void reply_lseek(struct smb_request *req)
4638 {
4639 connection_struct *conn = req->conn;
4640 SMB_OFF_T startpos;
4641 SMB_OFF_T res= -1;
4642 int mode,umode;
4643 files_struct *fsp;
4644
4645 START_PROFILE(SMBlseek);
4646
4647 if (req->wct < 4) {
4648 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4649 END_PROFILE(SMBlseek);
4650 return;
4651 }
4652
4653 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4654
4655 if (!check_fsp(conn, req, fsp)) {
4656 return;
4657 }
4658
4659 flush_write_cache(fsp, SEEK_FLUSH);
4660
4661 mode = SVAL(req->vwv+1, 0) & 3;
4662 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4663 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4664
4665 switch (mode) {
4666 case 0:
4667 umode = SEEK_SET;
4668 res = startpos;
4669 break;
4670 case 1:
4671 umode = SEEK_CUR;
4672 res = fsp->fh->pos + startpos;
4673 break;
4674 case 2:
4675 umode = SEEK_END;
4676 break;
4677 default:
4678 umode = SEEK_SET;
4679 res = startpos;
4680 break;
4681 }
4682
4683 if (umode == SEEK_END) {
4684 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4685 if(errno == EINVAL) {
4686 SMB_OFF_T current_pos = startpos;
4687
4688 if(fsp_stat(fsp) == -1) {
4689 reply_nterror(req,
4690 map_nt_error_from_unix(errno));
4691 END_PROFILE(SMBlseek);
4692 return;
4693 }
4694
4695 current_pos += fsp->fsp_name->st.st_ex_size;
4696 if(current_pos < 0)
4697 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4698 }
4699 }
4700
4701 if(res == -1) {
4702 reply_nterror(req, map_nt_error_from_unix(errno));
4703 END_PROFILE(SMBlseek);
4704 return;
4705 }
4706 }
4707
4708 fsp->fh->pos = res;
4709
4710 reply_outbuf(req, 2, 0);
4711 SIVAL(req->outbuf,smb_vwv0,res);
4712
4713 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4714 fsp->fnum, (double)startpos, (double)res, mode));
4715
4716 END_PROFILE(SMBlseek);
4717 return;
4718 }
4719
4720 /****************************************************************************
4721 Reply to a flush.
4722 ****************************************************************************/
4723
4724 void reply_flush(struct smb_request *req)
4725 {
4726 connection_struct *conn = req->conn;
4727 uint16 fnum;
4728 files_struct *fsp;
4729
4730 START_PROFILE(SMBflush);
4731
4732 if (req->wct < 1) {
4733 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4734 return;
4735 }
4736
4737 fnum = SVAL(req->vwv+0, 0);
4738 fsp = file_fsp(req, fnum);
4739
4740 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4741 return;
4742 }
4743
4744 if (!fsp) {
4745 file_sync_all(conn);
4746 } else {
4747 NTSTATUS status = sync_file(conn, fsp, True);
4748 if (!NT_STATUS_IS_OK(status)) {
4749 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4750 fsp_str_dbg(fsp), nt_errstr(status)));
4751 reply_nterror(req, status);
4752 END_PROFILE(SMBflush);
4753 return;
4754 }
4755 }
4756
4757 reply_outbuf(req, 0, 0);
4758
4759 DEBUG(3,("flush\n"));
4760 END_PROFILE(SMBflush);
4761 return;
4762 }
4763
4764 /****************************************************************************
4765 Reply to a exit.
4766 conn POINTER CAN BE NULL HERE !
4767 ****************************************************************************/
4768
4769 void reply_exit(struct smb_request *req)
4770 {
4771 START_PROFILE(SMBexit);
4772
4773 file_close_pid(req->sconn, req->smbpid, req->vuid);
4774
4775 reply_outbuf(req, 0, 0);
4776
4777 DEBUG(3,("exit\n"));
4778
4779 END_PROFILE(SMBexit);
4780 return;
4781 }
4782
4783 /****************************************************************************
4784 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4785 ****************************************************************************/
4786
4787 void reply_close(struct smb_request *req)
4788 {
4789 connection_struct *conn = req->conn;
4790 NTSTATUS status = NT_STATUS_OK;
4791 files_struct *fsp = NULL;
4792 START_PROFILE(SMBclose);
4793
4794 if (req->wct < 3) {
4795 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4796 END_PROFILE(SMBclose);
4797 return;
4798 }
4799
4800 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4801
4802 /*
4803 * We can only use check_fsp if we know it's not a directory.
4804 */
4805
4806 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4807 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4808 END_PROFILE(SMBclose);
4809 return;
4810 }
4811
4812 if(fsp->is_directory) {
4813 /*
4814 * Special case - close NT SMB directory handle.
4815 */
4816 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4817 status = close_file(req, fsp, NORMAL_CLOSE);
4818 } else {
4819 time_t t;
4820 /*
4821 * Close ordinary file.
4822 */
4823
4824 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4825 fsp->fh->fd, fsp->fnum,
4826 conn->num_files_open));
4827
4828 /*
4829 * Take care of any time sent in the close.
4830 */
4831
4832 t = srv_make_unix_date3(req->vwv+1);
4833 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4834
4835 /*
4836 * close_file() returns the unix errno if an error
4837 * was detected on close - normally this is due to
4838 * a disk full error. If not then it was probably an I/O error.
4839 */
4840
4841 status = close_file(req, fsp, NORMAL_CLOSE);
4842 }
4843
4844 if (!NT_STATUS_IS_OK(status)) {
4845 reply_nterror(req, status);
4846 END_PROFILE(SMBclose);
4847 return;
4848 }
4849
4850 reply_outbuf(req, 0, 0);
4851 END_PROFILE(SMBclose);
4852 return;
4853 }
4854
4855 /****************************************************************************
4856 Reply to a writeclose (Core+ protocol).
4857 ****************************************************************************/
4858
4859 void reply_writeclose(struct smb_request *req)
4860 {
4861 connection_struct *conn = req->conn;
4862 size_t numtowrite;
4863 ssize_t nwritten = -1;
4864 NTSTATUS close_status = NT_STATUS_OK;
4865 SMB_OFF_T startpos;
4866 const char *data;
4867 struct timespec mtime;
4868 files_struct *fsp;
4869 struct lock_struct lock;
4870
4871 START_PROFILE(SMBwriteclose);
4872
4873 if (req->wct < 6) {
4874 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4875 END_PROFILE(SMBwriteclose);
4876 return;
4877 }
4878
4879 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4880
4881 if (!check_fsp(conn, req, fsp)) {
4882 END_PROFILE(SMBwriteclose);
4883 return;
4884 }
4885 if (!CHECK_WRITE(fsp)) {
4886 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4887 END_PROFILE(SMBwriteclose);
4888 return;
4889 }
4890
4891 numtowrite = SVAL(req->vwv+1, 0);
4892 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4893 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4894 data = (const char *)req->buf + 1;
4895
4896 if (!fsp->print_file) {
4897 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4898 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4899 &lock);
4900
4901 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4902 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4903 END_PROFILE(SMBwriteclose);
4904 return;
4905 }
4906 }
4907
4908 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4909
4910 set_close_write_time(fsp, mtime);
4911
4912 /*
4913 * More insanity. W2K only closes the file if writelen > 0.
4914 * JRA.
4915 */
4916
4917 if (numtowrite) {
4918 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4919 "file %s\n", fsp_str_dbg(fsp)));
4920 close_status = close_file(req, fsp, NORMAL_CLOSE);
4921 }
4922
4923 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4924 fsp->fnum, (int)numtowrite, (int)nwritten,
4925 conn->num_files_open));
4926
4927 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4928 reply_nterror(req, NT_STATUS_DISK_FULL);
4929 goto strict_unlock;
4930 }
4931
4932 if(!NT_STATUS_IS_OK(close_status)) {
4933 reply_nterror(req, close_status);
4934 goto strict_unlock;
4935 }
4936
4937 reply_outbuf(req, 1, 0);
4938
4939 SSVAL(req->outbuf,smb_vwv0,nwritten);
4940
4941 strict_unlock:
4942 if (numtowrite && !fsp->print_file) {
4943 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4944 }
4945
4946 END_PROFILE(SMBwriteclose);
4947 return;
4948 }
4949
4950 #undef DBGC_CLASS
4951 #define DBGC_CLASS DBGC_LOCKING
4952
4953 /****************************************************************************
4954 Reply to a lock.
4955 ****************************************************************************/
4956
4957 void reply_lock(struct smb_request *req)
4958 {
4959 connection_struct *conn = req->conn;
4960 uint64_t count,offset;
4961 NTSTATUS status;
4962 files_struct *fsp;
4963 struct byte_range_lock *br_lck = NULL;
4964
4965 START_PROFILE(SMBlock);
4966
4967 if (req->wct < 5) {
4968 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4969 END_PROFILE(SMBlock);
4970 return;
4971 }
4972
4973 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4974
4975 if (!check_fsp(conn, req, fsp)) {
4976 END_PROFILE(SMBlock);
4977 return;
4978 }
4979
4980 count = (uint64_t)IVAL(req->vwv+1, 0);
4981 offset = (uint64_t)IVAL(req->vwv+3, 0);
4982
4983 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4984 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4985
4986 br_lck = do_lock(req->sconn->msg_ctx,
4987 fsp,
4988 (uint64_t)req->smbpid,
4989 count,
4990 offset,
4991 WRITE_LOCK,
4992 WINDOWS_LOCK,
4993 False, /* Non-blocking lock. */
4994 &status,
4995 NULL,
4996 NULL);
4997
4998 TALLOC_FREE(br_lck);
4999
5000 if (NT_STATUS_V(status)) {
5001 reply_nterror(req, status);
5002 END_PROFILE(SMBlock);
5003 return;
5004 }
5005
5006 reply_outbuf(req, 0, 0);
5007
5008 END_PROFILE(SMBlock);
5009 return;
5010 }
5011
5012 /****************************************************************************
5013 Reply to a unlock.
5014 ****************************************************************************/
5015
5016 void reply_unlock(struct smb_request *req)
5017 {
5018 connection_struct *conn = req->conn;
5019 uint64_t count,offset;
5020 NTSTATUS status;
5021 files_struct *fsp;
5022
5023 START_PROFILE(SMBunlock);
5024
5025 if (req->wct < 5) {
5026 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5027 END_PROFILE(SMBunlock);
5028 return;
5029 }
5030
5031 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5032
5033 if (!check_fsp(conn, req, fsp)) {
5034 END_PROFILE(SMBunlock);
5035 return;
5036 }
5037
5038 count = (uint64_t)IVAL(req->vwv+1, 0);
5039 offset = (uint64_t)IVAL(req->vwv+3, 0);
5040
5041 status = do_unlock(req->sconn->msg_ctx,
5042 fsp,
5043 (uint64_t)req->smbpid,
5044 count,
5045 offset,
5046 WINDOWS_LOCK);
5047
5048 if (NT_STATUS_V(status)) {
5049 reply_nterror(req, status);
5050 END_PROFILE(SMBunlock);
5051 return;
5052 }
5053
5054 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5055 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5056
5057 reply_outbuf(req, 0, 0);
5058
5059 END_PROFILE(SMBunlock);
5060 return;
5061 }
5062
5063 #undef DBGC_CLASS
5064 #define DBGC_CLASS DBGC_ALL
5065
5066 /****************************************************************************
5067 Reply to a tdis.
5068 conn POINTER CAN BE NULL HERE !
5069 ****************************************************************************/
5070
5071 void reply_tdis(struct smb_request *req)
5072 {
5073 connection_struct *conn = req->conn;
5074 START_PROFILE(SMBtdis);
5075
5076 if (!conn) {
5077 DEBUG(4,("Invalid connection in tdis\n"));
5078 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5079 END_PROFILE(SMBtdis);
5080 return;
5081 }
5082
5083 conn->used = False;
5084
5085 close_cnum(conn,req->vuid);
5086 req->conn = NULL;
5087
5088 reply_outbuf(req, 0, 0);
5089 END_PROFILE(SMBtdis);
5090 return;
5091 }
5092
5093 /****************************************************************************
5094 Reply to a echo.
5095 conn POINTER CAN BE NULL HERE !
5096 ****************************************************************************/
5097
5098 void reply_echo(struct smb_request *req)
5099 {
5100 connection_struct *conn = req->conn;
5101 struct smb_perfcount_data local_pcd;
5102 struct smb_perfcount_data *cur_pcd;
5103 int smb_reverb;
5104 int seq_num;
5105
5106 START_PROFILE(SMBecho);
5107
5108 smb_init_perfcount_data(&local_pcd);
5109
5110 if (req->wct < 1) {
5111 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5112 END_PROFILE(SMBecho);
5113 return;
5114 }
5115
5116 smb_reverb = SVAL(req->vwv+0, 0);
5117
5118 reply_outbuf(req, 1, req->buflen);
5119
5120 /* copy any incoming data back out */
5121 if (req->buflen > 0) {
5122 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5123 }
5124
5125 if (smb_reverb > 100) {
5126 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5127 smb_reverb = 100;
5128 }
5129
5130 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5131
5132 /* this makes sure we catch the request pcd */
5133 if (seq_num == smb_reverb) {
5134 cur_pcd = &req->pcd;
5135 } else {
5136 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5137 cur_pcd = &local_pcd;
5138 }
5139
5140 SSVAL(req->outbuf,smb_vwv0,seq_num);
5141
5142 show_msg((char *)req->outbuf);
5143 if (!srv_send_smb(req->sconn,
5144 (char *)req->outbuf,
5145 true, req->seqnum+1,
5146 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5147 cur_pcd))
5148 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5149 }
5150
5151 DEBUG(3,("echo %d times\n", smb_reverb));
5152
5153 TALLOC_FREE(req->outbuf);
5154
5155 END_PROFILE(SMBecho);
5156 return;
5157 }
5158
5159 /****************************************************************************
5160 Reply to a printopen.
5161 ****************************************************************************/
5162
5163 void reply_printopen(struct smb_request *req)
5164 {
5165 connection_struct *conn = req->conn;
5166 files_struct *fsp;
5167 NTSTATUS status;
5168
5169 START_PROFILE(SMBsplopen);
5170
5171 if (req->wct < 2) {
5172 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5173 END_PROFILE(SMBsplopen);
5174 return;
5175 }
5176
5177 if (!CAN_PRINT(conn)) {
5178 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5179 END_PROFILE(SMBsplopen);
5180 return;
5181 }
5182
5183 status = file_new(req, conn, &fsp);
5184 if(!NT_STATUS_IS_OK(status)) {
5185 reply_nterror(req, status);
5186 END_PROFILE(SMBsplopen);
5187 return;
5188 }
5189
5190 /* Open for exclusive use, write only. */
5191 status = print_spool_open(fsp, NULL, req->vuid);
5192
5193 if (!NT_STATUS_IS_OK(status)) {
5194 file_free(req, fsp);
5195 reply_nterror(req, status);
5196 END_PROFILE(SMBsplopen);
5197 return;
5198 }
5199
5200 reply_outbuf(req, 1, 0);
5201 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5202
5203 DEBUG(3,("openprint fd=%d fnum=%d\n",
5204 fsp->fh->fd, fsp->fnum));
5205
5206 END_PROFILE(SMBsplopen);
5207 return;
5208 }
5209
5210 /****************************************************************************
5211 Reply to a printclose.
5212 ****************************************************************************/
5213
5214 void reply_printclose(struct smb_request *req)
5215 {
5216 connection_struct *conn = req->conn;
5217 files_struct *fsp;
5218 NTSTATUS status;
5219
5220 START_PROFILE(SMBsplclose);
5221
5222 if (req->wct < 1) {
5223 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5224 END_PROFILE(SMBsplclose);
5225 return;
5226 }
5227
5228 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5229
5230 if (!check_fsp(conn, req, fsp)) {
5231 END_PROFILE(SMBsplclose);
5232 return;
5233 }
5234
5235 if (!CAN_PRINT(conn)) {
5236 reply_force_doserror(req, ERRSRV, ERRerror);
5237 END_PROFILE(SMBsplclose);
5238 return;
5239 }
5240
5241 DEBUG(3,("printclose fd=%d fnum=%d\n",
5242 fsp->fh->fd,fsp->fnum));
5243
5244 status = close_file(req, fsp, NORMAL_CLOSE);
5245
5246 if(!NT_STATUS_IS_OK(status)) {
5247 reply_nterror(req, status);
5248 END_PROFILE(SMBsplclose);
5249 return;
5250 }
5251
5252 reply_outbuf(req, 0, 0);
5253
5254 END_PROFILE(SMBsplclose);
5255 return;
5256 }
5257
5258 /****************************************************************************
5259 Reply to a printqueue.
5260 ****************************************************************************/
5261
5262 void reply_printqueue(struct smb_request *req)
5263 {
5264 connection_struct *conn = req->conn;
5265 int max_count;
5266 int start_index;
5267
5268 START_PROFILE(SMBsplretq);
5269
5270 if (req->wct < 2) {
5271 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5272 END_PROFILE(SMBsplretq);
5273 return;
5274 }
5275
5276 max_count = SVAL(req->vwv+0, 0);
5277 start_index = SVAL(req->vwv+1, 0);
5278
5279 /* we used to allow the client to get the cnum wrong, but that
5280 is really quite gross and only worked when there was only
5281 one printer - I think we should now only accept it if they
5282 get it right (tridge) */
5283 if (!CAN_PRINT(conn)) {
5284 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5285 END_PROFILE(SMBsplretq);
5286 return;
5287 }
5288
5289 reply_outbuf(req, 2, 3);
5290 SSVAL(req->outbuf,smb_vwv0,0);
5291 SSVAL(req->outbuf,smb_vwv1,0);
5292 SCVAL(smb_buf(req->outbuf),0,1);
5293 SSVAL(smb_buf(req->outbuf),1,0);
5294
5295 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5296 start_index, max_count));
5297
5298 {
5299 TALLOC_CTX *mem_ctx = talloc_tos();
5300 NTSTATUS status;
5301 WERROR werr;
5302 const char *sharename = lp_servicename(SNUM(conn));
5303 struct rpc_pipe_client *cli = NULL;
5304 struct policy_handle handle;
5305 struct spoolss_DevmodeContainer devmode_ctr;
5306 union spoolss_JobInfo *info;
5307 uint32_t count;
5308 uint32_t num_to_get;
5309 uint32_t first;
5310 uint32_t i;
5311
5312 ZERO_STRUCT(handle);
5313
5314 status = rpc_pipe_open_interface(conn,
5315 &ndr_table_spoolss.syntax_id,
5316 conn->server_info,
5317 &conn->sconn->client_id,
5318 conn->sconn->msg_ctx,
5319 &cli);
5320 if (!NT_STATUS_IS_OK(status)) {
5321 DEBUG(0, ("reply_printqueue: "
5322 "could not connect to spoolss: %s\n",
5323 nt_errstr(status)));
5324 reply_nterror(req, status);
5325 goto out;
5326 }
5327
5328 ZERO_STRUCT(devmode_ctr);
5329
5330 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
5331 sharename,
5332 NULL, devmode_ctr,
5333 SEC_FLAG_MAXIMUM_ALLOWED,
5334 &handle,
5335 &werr);
5336 if (!NT_STATUS_IS_OK(status)) {
5337 reply_nterror(req, status);
5338 goto out;
5339 }
5340 if (!W_ERROR_IS_OK(werr)) {
5341 reply_nterror(req, werror_to_ntstatus(werr));
5342 goto out;
5343 }
5344
5345 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5346 &handle,
5347 0, /* firstjob */
5348 0xff, /* numjobs */
5349 2, /* level */
5350 0, /* offered */
5351 &count,
5352 &info);
5353 if (!W_ERROR_IS_OK(werr)) {
5354 reply_nterror(req, werror_to_ntstatus(werr));
5355 goto out;
5356 }
5357
5358 if (max_count > 0) {
5359 first = start_index;
5360 } else {
5361 first = start_index + max_count + 1;
5362 }
5363
5364 if (first >= count) {
5365 num_to_get = first;
5366 } else {
5367 num_to_get = first + MIN(ABS(max_count), count - first);
5368 }
5369
5370 for (i = first; i < num_to_get; i++) {
5371 char blob[28];
5372 char *p = blob;
5373 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5374 int qstatus;
5375 uint16_t qrapjobid = pjobid_to_rap(sharename,
5376 info[i].info2.job_id);
5377
5378 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5379 qstatus = 2;
5380 } else {
5381 qstatus = 3;
5382 }
5383
5384 srv_put_dos_date2(p, 0, qtime);
5385 SCVAL(p, 4, qstatus);
5386 SSVAL(p, 5, qrapjobid);
5387 SIVAL(p, 7, info[i].info2.size);
5388 SCVAL(p, 11, 0);
5389 srvstr_push(blob, req->flags2, p+12,
5390 info[i].info2.notify_name, 16, STR_ASCII);
5391
5392 if (message_push_blob(
5393 &req->outbuf,
5394 data_blob_const(
5395 blob, sizeof(blob))) == -1) {
5396 reply_nterror(req, NT_STATUS_NO_MEMORY);
5397 goto out;
5398 }
5399 }
5400
5401 if (count > 0) {
5402 SSVAL(req->outbuf,smb_vwv0,count);
5403 SSVAL(req->outbuf,smb_vwv1,
5404 (max_count>0?first+count:first-1));
5405 SCVAL(smb_buf(req->outbuf),0,1);
5406 SSVAL(smb_buf(req->outbuf),1,28*count);
5407 }
5408
5409
5410 DEBUG(3, ("%u entries returned in queue\n",
5411 (unsigned)count));
5412
5413 out:
5414 if (cli && is_valid_policy_hnd(&handle)) {
5415 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
5416 }
5417
5418 }
5419
5420 END_PROFILE(SMBsplretq);
5421 return;
5422 }
5423
5424 /****************************************************************************
5425 Reply to a printwrite.
5426 ****************************************************************************/
5427
5428 void reply_printwrite(struct smb_request *req)
5429 {
5430 connection_struct *conn = req->conn;
5431 int numtowrite;
5432 const char *data;
5433 files_struct *fsp;
5434
5435 START_PROFILE(SMBsplwr);
5436
5437 if (req->wct < 1) {
5438 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5439 END_PROFILE(SMBsplwr);
5440 return;
5441 }
5442
5443 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5444
5445 if (!check_fsp(conn, req, fsp)) {
5446 END_PROFILE(SMBsplwr);
5447 return;
5448 }
5449
5450 if (!fsp->print_file) {
5451 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5452 END_PROFILE(SMBsplwr);
5453 return;
5454 }
5455
5456 if (!CHECK_WRITE(fsp)) {
5457 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5458 END_PROFILE(SMBsplwr);
5459 return;
5460 }
5461
5462 numtowrite = SVAL(req->buf, 1);
5463
5464 if (req->buflen < numtowrite + 3) {
5465 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5466 END_PROFILE(SMBsplwr);
5467 return;
5468 }
5469
5470 data = (const char *)req->buf + 3;
5471
5472 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5473 reply_nterror(req, map_nt_error_from_unix(errno));
5474 END_PROFILE(SMBsplwr);
5475 return;
5476 }
5477
5478 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5479
5480 END_PROFILE(SMBsplwr);
5481 return;
5482 }
5483
5484 /****************************************************************************
5485 Reply to a mkdir.
5486 ****************************************************************************/
5487
5488 void reply_mkdir(struct smb_request *req)
5489 {
5490 connection_struct *conn = req->conn;
5491 struct smb_filename *smb_dname = NULL;
5492 char *directory = NULL;
5493 NTSTATUS status;
5494 TALLOC_CTX *ctx = talloc_tos();
5495
5496 START_PROFILE(SMBmkdir);
5497
5498 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5499 STR_TERMINATE, &status);
5500 if (!NT_STATUS_IS_OK(status)) {
5501 reply_nterror(req, status);
5502 goto out;
5503 }
5504
5505 status = filename_convert(ctx, conn,
5506 req->flags2 & FLAGS2_DFS_PATHNAMES,
5507 directory,
5508 0,
5509 NULL,
5510 &smb_dname);
5511 if (!NT_STATUS_IS_OK(status)) {
5512 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5513 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5514 ERRSRV, ERRbadpath);
5515 goto out;
5516 }
5517 reply_nterror(req, status);
5518 goto out;
5519 }
5520
5521 status = create_directory(conn, req, smb_dname);
5522
5523 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5524
5525 if (!NT_STATUS_IS_OK(status)) {
5526
5527 if (!use_nt_status()
5528 && NT_STATUS_EQUAL(status,
5529 NT_STATUS_OBJECT_NAME_COLLISION)) {
5530 /*
5531 * Yes, in the DOS error code case we get a
5532 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5533 * samba4 torture test.
5534 */
5535 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5536 }
5537
5538 reply_nterror(req, status);
5539 goto out;
5540 }
5541
5542 reply_outbuf(req, 0, 0);
5543
5544 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5545 out:
5546 TALLOC_FREE(smb_dname);
5547 END_PROFILE(SMBmkdir);
5548 return;
5549 }
5550
5551 /****************************************************************************
5552 Reply to a rmdir.
5553 ****************************************************************************/
5554
5555 void reply_rmdir(struct smb_request *req)
5556 {
5557 connection_struct *conn = req->conn;
5558 struct smb_filename *smb_dname = NULL;
5559 char *directory = NULL;
5560 NTSTATUS status;
5561 TALLOC_CTX *ctx = talloc_tos();
5562 files_struct *fsp = NULL;
5563 int info = 0;
5564 struct smbd_server_connection *sconn = req->sconn;
5565
5566 START_PROFILE(SMBrmdir);
5567
5568 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5569 STR_TERMINATE, &status);
5570 if (!NT_STATUS_IS_OK(status)) {
5571 reply_nterror(req, status);
5572 goto out;
5573 }
5574
5575 status = filename_convert(ctx, conn,
5576 req->flags2 & FLAGS2_DFS_PATHNAMES,
5577 directory,
5578 0,
5579 NULL,
5580 &smb_dname);
5581 if (!NT_STATUS_IS_OK(status)) {
5582 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5583 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5584 ERRSRV, ERRbadpath);
5585 goto out;
5586 }
5587 reply_nterror(req, status);
5588 goto out;
5589 }
5590
5591 if (is_ntfs_stream_smb_fname(smb_dname)) {
5592 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5593 goto out;
5594 }
5595
5596 status = SMB_VFS_CREATE_FILE(
5597 conn, /* conn */
5598 req, /* req */
5599 0, /* root_dir_fid */
5600 smb_dname, /* fname */
5601 DELETE_ACCESS, /* access_mask */
5602 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5603 FILE_SHARE_DELETE),
5604 FILE_OPEN, /* create_disposition*/
5605 FILE_DIRECTORY_FILE, /* create_options */
5606 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5607 0, /* oplock_request */
5608 0, /* allocation_size */
5609 0, /* private_flags */
5610 NULL, /* sd */
5611 NULL, /* ea_list */
5612 &fsp, /* result */
5613 &info); /* pinfo */
5614
5615 if (!NT_STATUS_IS_OK(status)) {
5616 if (open_was_deferred(req->mid)) {
5617 /* We have re-scheduled this call. */
5618 goto out;
5619 }
5620 reply_nterror(req, status);
5621 goto out;
5622 }
5623
5624 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5625 if (!NT_STATUS_IS_OK(status)) {
5626 close_file(req, fsp, ERROR_CLOSE);
5627 reply_nterror(req, status);
5628 goto out;
5629 }
5630
5631 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5632 close_file(req, fsp, ERROR_CLOSE);
5633 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5634 goto out;
5635 }
5636
5637 status = close_file(req, fsp, NORMAL_CLOSE);
5638 if (!NT_STATUS_IS_OK(status)) {
5639 reply_nterror(req, status);
5640 } else {
5641 reply_outbuf(req, 0, 0);
5642 }
5643
5644 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5645
5646 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5647 out:
5648 TALLOC_FREE(smb_dname);
5649 END_PROFILE(SMBrmdir);
5650 return;
5651 }
5652
5653 /*******************************************************************
5654 Resolve wildcards in a filename rename.
5655 ********************************************************************/
5656
5657 static bool resolve_wildcards(TALLOC_CTX *ctx,
5658 const char *name1,
5659 const char *name2,
5660 char **pp_newname)
5661 {
5662 char *name2_copy = NULL;
5663 char *root1 = NULL;
5664 char *root2 = NULL;
5665 char *ext1 = NULL;
5666 char *ext2 = NULL;
5667 char *p,*p2, *pname1, *pname2;
5668
5669 name2_copy = talloc_strdup(ctx, name2);
5670 if (!name2_copy) {
5671 return False;
5672 }
5673
5674 pname1 = strrchr_m(name1,'/');
5675 pname2 = strrchr_m(name2_copy,'/');
5676
5677 if (!pname1 || !pname2) {
5678 return False;
5679 }
5680
5681 /* Truncate the copy of name2 at the last '/' */
5682 *pname2 = '\0';
5683
5684 /* Now go past the '/' */
5685 pname1++;
5686 pname2++;
5687
5688 root1 = talloc_strdup(ctx, pname1);
5689 root2 = talloc_strdup(ctx, pname2);
5690
5691 if (!root1 || !root2) {
5692 return False;
5693 }
5694
5695 p = strrchr_m(root1,'.');
5696 if (p) {
5697 *p = 0;
5698 ext1 = talloc_strdup(ctx, p+1);
5699 } else {
5700 ext1 = talloc_strdup(ctx, "");
5701 }
5702 p = strrchr_m(root2,'.');
5703 if (p) {
5704 *p = 0;
5705 ext2 = talloc_strdup(ctx, p+1);
5706 } else {
5707 ext2 = talloc_strdup(ctx, "");
5708 }
5709
5710 if (!ext1 || !ext2) {
5711 return False;
5712 }
5713
5714 p = root1;
5715 p2 = root2;
5716 while (*p2) {
5717 if (*p2 == '?') {
5718 /* Hmmm. Should this be mb-aware ? */
5719 *p2 = *p;
5720 p2++;
5721 } else if (*p2 == '*') {
5722 *p2 = '\0';
5723 root2 = talloc_asprintf(ctx, "%s%s",
5724 root2,
5725 p);
5726 if (!root2) {
5727 return False;
5728 }
5729 break;
5730 } else {
5731 p2++;
5732 }
5733 if (*p) {
5734 p++;
5735 }
5736 }
5737
5738 p = ext1;
5739 p2 = ext2;
5740 while (*p2) {
5741 if (*p2 == '?') {
5742 /* Hmmm. Should this be mb-aware ? */
5743 *p2 = *p;
5744 p2++;
5745 } else if (*p2 == '*') {
5746 *p2 = '\0';
5747 ext2 = talloc_asprintf(ctx, "%s%s",
5748 ext2,
5749 p);
5750 if (!ext2) {
5751 return False;
5752 }
5753 break;
5754 } else {
5755 p2++;
5756 }
5757 if (*p) {
5758 p++;
5759 }
5760 }
5761
5762 if (*ext2) {
5763 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5764 name2_copy,
5765 root2,
5766 ext2);
5767 } else {
5768 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5769 name2_copy,
5770 root2);
5771 }
5772
5773 if (!*pp_newname) {
5774 return False;
5775 }
5776
5777 return True;
5778 }
5779
5780 /****************************************************************************
5781 Ensure open files have their names updated. Updated to notify other smbd's
5782 asynchronously.
5783 ****************************************************************************/
5784
5785 static void rename_open_files(connection_struct *conn,
5786 struct share_mode_lock *lck,
5787 const struct smb_filename *smb_fname_dst)
5788 {
5789 files_struct *fsp;
5790 bool did_rename = False;
5791 NTSTATUS status;
5792
5793 for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5794 fsp = file_find_di_next(fsp)) {
5795 /* fsp_name is a relative path under the fsp. To change this for other
5796 sharepaths we need to manipulate relative paths. */
5797 /* TODO - create the absolute path and manipulate the newname
5798 relative to the sharepath. */
5799 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5800 continue;
5801 }
5802 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5803 "(file_id %s) from %s -> %s\n", fsp->fnum,
5804 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5805 smb_fname_str_dbg(smb_fname_dst)));
5806
5807 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5808 if (NT_STATUS_IS_OK(status)) {
5809 did_rename = True;
5810 }
5811 }
5812
5813 if (!did_rename) {
5814 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5815 "for %s\n", file_id_string_tos(&lck->id),
5816 smb_fname_str_dbg(smb_fname_dst)));
5817 }
5818
5819 /* Send messages to all smbd's (not ourself) that the name has changed. */
5820 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5821 smb_fname_dst);
5822
5823 }
5824
5825 /****************************************************************************
5826 We need to check if the source path is a parent directory of the destination
5827 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5828 refuse the rename with a sharing violation. Under UNIX the above call can
5829 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5830 probably need to check that the client is a Windows one before disallowing
5831 this as a UNIX client (one with UNIX extensions) can know the source is a
5832 symlink and make this decision intelligently. Found by an excellent bug
5833 report from <AndyLiebman@aol.com>.
5834 ****************************************************************************/
5835
5836 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5837 const struct smb_filename *smb_fname_dst)
5838 {
5839 const char *psrc = smb_fname_src->base_name;
5840 const char *pdst = smb_fname_dst->base_name;
5841 size_t slen;
5842
5843 if (psrc[0] == '.' && psrc[1] == '/') {
5844 psrc += 2;
5845 }
5846 if (pdst[0] == '.' && pdst[1] == '/') {
5847 pdst += 2;
5848 }
5849 if ((slen = strlen(psrc)) > strlen(pdst)) {
5850 return False;
5851 }
5852 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5853 }
5854
5855 /*
5856 * Do the notify calls from a rename
5857 */
5858
5859 static void notify_rename(connection_struct *conn, bool is_dir,
5860 const struct smb_filename *smb_fname_src,
5861 const struct smb_filename *smb_fname_dst)
5862 {
5863 char *parent_dir_src = NULL;
5864 char *parent_dir_dst = NULL;
5865 uint32 mask;
5866
5867 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5868 : FILE_NOTIFY_CHANGE_FILE_NAME;
5869
5870 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5871 &parent_dir_src, NULL) ||
5872 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5873 &parent_dir_dst, NULL)) {
5874 goto out;
5875 }
5876
5877 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5878 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5879 smb_fname_src->base_name);
5880 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5881 smb_fname_dst->base_name);
5882 }
5883 else {
5884 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5885 smb_fname_src->base_name);
5886 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5887 smb_fname_dst->base_name);
5888 }
5889
5890 /* this is a strange one. w2k3 gives an additional event for
5891 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5892 files, but not directories */
5893 if (!is_dir) {
5894 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5895 FILE_NOTIFY_CHANGE_ATTRIBUTES
5896 |FILE_NOTIFY_CHANGE_CREATION,
5897 smb_fname_dst->base_name);
5898 }
5899 out:
5900 TALLOC_FREE(parent_dir_src);
5901 TALLOC_FREE(parent_dir_dst);
5902 }
5903
5904 /****************************************************************************
5905 Rename an open file - given an fsp.
5906 ****************************************************************************/
5907
5908 NTSTATUS rename_internals_fsp(connection_struct *conn,
5909 files_struct *fsp,
5910 const struct smb_filename *smb_fname_dst_in,
5911 uint32 attrs,
5912 bool replace_if_exists)
5913 {
5914 TALLOC_CTX *ctx = talloc_tos();
5915 struct smb_filename *smb_fname_dst = NULL;
5916 NTSTATUS status = NT_STATUS_OK;
5917 struct share_mode_lock *lck = NULL;
5918 bool dst_exists, old_is_stream, new_is_stream;
5919
5920 status = check_name(conn, smb_fname_dst_in->base_name);
5921 if (!NT_STATUS_IS_OK(status)) {
5922 return status;
5923 }
5924
5925 /* Make a copy of the dst smb_fname structs */
5926
5927 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5928 if (!NT_STATUS_IS_OK(status)) {
5929 goto out;
5930 }
5931
5932 /* Ensure the dst smb_fname contains a '/' */
5933 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5934 char * tmp;
5935 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5936 smb_fname_dst->base_name);
5937 if (!tmp) {
5938 status = NT_STATUS_NO_MEMORY;
5939 goto out;
5940 }
5941 TALLOC_FREE(smb_fname_dst->base_name);
5942 smb_fname_dst->base_name = tmp;
5943 }
5944
5945 /*
5946 * Check for special case with case preserving and not
5947 * case sensitive. If the old last component differs from the original
5948 * last component only by case, then we should allow
5949 * the rename (user is trying to change the case of the
5950 * filename).
5951 */
5952 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5953 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5954 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5955 char *last_slash;
5956 char *fname_dst_lcomp_base_mod = NULL;
5957 struct smb_filename *smb_fname_orig_lcomp = NULL;
5958
5959 /*
5960 * Get the last component of the destination name. Note that
5961 * we guarantee that destination name contains a '/' character
5962 * above.
5963 */
5964 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5965 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5966 if (!fname_dst_lcomp_base_mod) {
5967 status = NT_STATUS_NO_MEMORY;
5968 goto out;
5969 }
5970
5971 /*
5972 * Create an smb_filename struct using the original last
5973 * component of the destination.
5974 */
5975 status = create_synthetic_smb_fname_split(ctx,
5976 smb_fname_dst->original_lcomp, NULL,
5977 &smb_fname_orig_lcomp);
5978 if (!NT_STATUS_IS_OK(status)) {
5979 TALLOC_FREE(fname_dst_lcomp_base_mod);
5980 goto out;
5981 }
5982
5983 /* If the base names only differ by case, use original. */
5984 if(!strcsequal(fname_dst_lcomp_base_mod,
5985 smb_fname_orig_lcomp->base_name)) {
5986 char *tmp;
5987 /*
5988 * Replace the modified last component with the
5989 * original.
5990 */
5991 *last_slash = '\0'; /* Truncate at the '/' */
5992 tmp = talloc_asprintf(smb_fname_dst,
5993 "%s/%s",
5994 smb_fname_dst->base_name,
5995 smb_fname_orig_lcomp->base_name);
5996 if (tmp == NULL) {
5997 status = NT_STATUS_NO_MEMORY;
5998 TALLOC_FREE(fname_dst_lcomp_base_mod);
5999 TALLOC_FREE(smb_fname_orig_lcomp);
6000 goto out;
6001 }
6002 TALLOC_FREE(smb_fname_dst->base_name);
6003 smb_fname_dst->base_name = tmp;
6004 }
6005
6006 /* If the stream_names only differ by case, use original. */
6007 if(!strcsequal(smb_fname_dst->stream_name,
6008 smb_fname_orig_lcomp->stream_name)) {
6009 char *tmp = NULL;
6010 /* Use the original stream. */
6011 tmp = talloc_strdup(smb_fname_dst,
6012 smb_fname_orig_lcomp->stream_name);
6013 if (tmp == NULL) {
6014 status = NT_STATUS_NO_MEMORY;
6015 TALLOC_FREE(fname_dst_lcomp_base_mod);
6016 TALLOC_FREE(smb_fname_orig_lcomp);
6017 goto out;
6018 }
6019 TALLOC_FREE(smb_fname_dst->stream_name);
6020 smb_fname_dst->stream_name = tmp;
6021 }
6022 TALLOC_FREE(fname_dst_lcomp_base_mod);
6023 TALLOC_FREE(smb_fname_orig_lcomp);
6024 }
6025
6026 /*
6027 * If the src and dest names are identical - including case,
6028 * don't do the rename, just return success.
6029 */
6030
6031 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6032 strcsequal(fsp->fsp_name->stream_name,
6033 smb_fname_dst->stream_name)) {
6034 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6035 "- returning success\n",
6036 smb_fname_str_dbg(smb_fname_dst)));
6037 status = NT_STATUS_OK;
6038 goto out;
6039 }
6040
6041 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6042 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6043
6044 /* Return the correct error code if both names aren't streams. */
6045 if (!old_is_stream && new_is_stream) {
6046 status = NT_STATUS_OBJECT_NAME_INVALID;
6047 goto out;
6048 }
6049
6050 if (old_is_stream && !new_is_stream) {
6051 status = NT_STATUS_INVALID_PARAMETER;
6052 goto out;
6053 }
6054
6055 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6056
6057 if(!replace_if_exists && dst_exists) {
6058 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6059 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6060 smb_fname_str_dbg(smb_fname_dst)));
6061 status = NT_STATUS_OBJECT_NAME_COLLISION;
6062 goto out;
6063 }
6064
6065 if (dst_exists) {
6066 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6067 &smb_fname_dst->st);
6068 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6069 fileid);
6070 /* The file can be open when renaming a stream */
6071 if (dst_fsp && !new_is_stream) {
6072 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6073 status = NT_STATUS_ACCESS_DENIED;
6074 goto out;
6075 }
6076 }
6077
6078 /* Ensure we have a valid stat struct for the source. */
6079 status = vfs_stat_fsp(fsp);
6080 if (!NT_STATUS_IS_OK(status)) {
6081 goto out;
6082 }
6083
6084 status = can_rename(conn, fsp, attrs);
6085
6086 if (!NT_STATUS_IS_OK(status)) {
6087 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6088 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6089 smb_fname_str_dbg(smb_fname_dst)));
6090 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6091 status = NT_STATUS_ACCESS_DENIED;
6092 goto out;
6093 }
6094
6095 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6096 status = NT_STATUS_ACCESS_DENIED;
6097 }
6098
6099 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6100 NULL);
6101
6102 /*
6103 * We have the file open ourselves, so not being able to get the
6104 * corresponding share mode lock is a fatal error.
6105 */
6106
6107 SMB_ASSERT(lck != NULL);
6108
6109 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6110 uint32 create_options = fsp->fh->private_options;
6111
6112 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6113 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6114 smb_fname_str_dbg(smb_fname_dst)));
6115
6116 if (!lp_posix_pathnames() &&
6117 (lp_map_archive(SNUM(conn)) ||
6118 lp_store_dos_attributes(SNUM(conn)))) {
6119 /* We must set the archive bit on the newly
6120 renamed file. */
6121 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6122 uint32_t old_dosmode = dos_mode(conn,
6123 smb_fname_dst);
6124 file_set_dosmode(conn,
6125 smb_fname_dst,
6126 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6127 NULL,
6128 true);
6129 }
6130 }
6131
6132 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6133 smb_fname_dst);
6134
6135 rename_open_files(conn, lck, smb_fname_dst);
6136
6137 /*
6138 * A rename acts as a new file create w.r.t. allowing an initial delete
6139 * on close, probably because in Windows there is a new handle to the
6140 * new file. If initial delete on close was requested but not
6141 * originally set, we need to set it here. This is probably not 100% correct,
6142 * but will work for the CIFSFS client which in non-posix mode
6143 * depends on these semantics. JRA.
6144 */
6145
6146 if (create_options & FILE_DELETE_ON_CLOSE) {
6147 status = can_set_delete_on_close(fsp, 0);
6148
6149 if (NT_STATUS_IS_OK(status)) {
6150 /* Note that here we set the *inital* delete on close flag,
6151 * not the regular one. The magic gets handled in close. */
6152 fsp->initial_delete_on_close = True;
6153 }
6154 }
6155 TALLOC_FREE(lck);
6156 status = NT_STATUS_OK;
6157 goto out;
6158 }
6159
6160 TALLOC_FREE(lck);
6161
6162 if (errno == ENOTDIR || errno == EISDIR) {
6163 status = NT_STATUS_OBJECT_NAME_COLLISION;
6164 } else {
6165 status = map_nt_error_from_unix(errno);
6166 }
6167
6168 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6169 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6170 smb_fname_str_dbg(smb_fname_dst)));
6171
6172 out:
6173 TALLOC_FREE(smb_fname_dst);
6174
6175 return status;
6176 }
6177
6178 /****************************************************************************
6179 The guts of the rename command, split out so it may be called by the NT SMB
6180 code.
6181 ****************************************************************************/
6182
6183 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6184 connection_struct *conn,
6185 struct smb_request *req,
6186 struct smb_filename *smb_fname_src,
6187 struct smb_filename *smb_fname_dst,
6188 uint32 attrs,
6189 bool replace_if_exists,
6190 bool src_has_wild,
6191 bool dest_has_wild,
6192 uint32_t access_mask)
6193 {
6194 char *fname_src_dir = NULL;
6195 char *fname_src_mask = NULL;
6196 int count=0;
6197 NTSTATUS status = NT_STATUS_OK;
6198 struct smb_Dir *dir_hnd = NULL;
6199 const char *dname = NULL;
6200 char *talloced = NULL;
6201 long offset = 0;
6202 int create_options = 0;
6203 bool posix_pathnames = lp_posix_pathnames();
6204
6205 /*
6206 * Split the old name into directory and last component
6207 * strings. Note that unix_convert may have stripped off a
6208 * leading ./ from both name and newname if the rename is
6209 * at the root of the share. We need to make sure either both
6210 * name and newname contain a / character or neither of them do
6211 * as this is checked in resolve_wildcards().
6212 */
6213
6214 /* Split up the directory from the filename/mask. */
6215 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6216 &fname_src_dir, &fname_src_mask);
6217 if (!NT_STATUS_IS_OK(status)) {
6218 status = NT_STATUS_NO_MEMORY;
6219 goto out;
6220 }
6221
6222 /*
6223 * We should only check the mangled cache
6224 * here if unix_convert failed. This means
6225 * that the path in 'mask' doesn't exist
6226 * on the file system and so we need to look
6227 * for a possible mangle. This patch from
6228 * Tine Smukavec <valentin.smukavec@hermes.si>.
6229 */
6230
6231 if (!VALID_STAT(smb_fname_src->st) &&
6232 mangle_is_mangled(fname_src_mask, conn->params)) {
6233 char *new_mask = NULL;
6234 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6235 conn->params);
6236 if (new_mask) {
6237 TALLOC_FREE(fname_src_mask);
6238 fname_src_mask = new_mask;
6239 }
6240 }
6241
6242 if (!src_has_wild) {
6243 files_struct *fsp;
6244
6245 /*
6246 * Only one file needs to be renamed. Append the mask back
6247 * onto the directory.
6248 */
6249 TALLOC_FREE(smb_fname_src->base_name);
6250 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6251 "%s/%s",
6252 fname_src_dir,
6253 fname_src_mask);
6254 if (!smb_fname_src->base_name) {
6255 status = NT_STATUS_NO_MEMORY;
6256 goto out;
6257 }
6258
6259 /* Ensure dst fname contains a '/' also */
6260 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6261 char *tmp;
6262 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6263 smb_fname_dst->base_name);
6264 if (!tmp) {
6265 status = NT_STATUS_NO_MEMORY;
6266 goto out;
6267 }
6268 TALLOC_FREE(smb_fname_dst->base_name);
6269 smb_fname_dst->base_name = tmp;
6270 }
6271
6272 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6273 "case_preserve = %d, short case preserve = %d, "
6274 "directory = %s, newname = %s, "
6275 "last_component_dest = %s\n",
6276 conn->case_sensitive, conn->case_preserve,
6277 conn->short_case_preserve,
6278 smb_fname_str_dbg(smb_fname_src),
6279 smb_fname_str_dbg(smb_fname_dst),
6280 smb_fname_dst->original_lcomp));
6281
6282 /* The dest name still may have wildcards. */
6283 if (dest_has_wild) {
6284 char *fname_dst_mod = NULL;
6285 if (!resolve_wildcards(smb_fname_dst,
6286 smb_fname_src->base_name,
6287 smb_fname_dst->base_name,
6288 &fname_dst_mod)) {
6289 DEBUG(6, ("rename_internals: resolve_wildcards "
6290 "%s %s failed\n",
6291 smb_fname_src->base_name,
6292 smb_fname_dst->base_name));
6293 status = NT_STATUS_NO_MEMORY;
6294 goto out;
6295 }
6296 TALLOC_FREE(smb_fname_dst->base_name);
6297 smb_fname_dst->base_name = fname_dst_mod;
6298 }
6299
6300 ZERO_STRUCT(smb_fname_src->st);
6301 if (posix_pathnames) {
6302 SMB_VFS_LSTAT(conn, smb_fname_src);
6303 } else {
6304 SMB_VFS_STAT(conn, smb_fname_src);
6305 }
6306
6307 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6308 create_options |= FILE_DIRECTORY_FILE;
6309 }
6310
6311 status = SMB_VFS_CREATE_FILE(
6312 conn, /* conn */
6313 req, /* req */
6314 0, /* root_dir_fid */
6315 smb_fname_src, /* fname */
6316 access_mask, /* access_mask */
6317 (FILE_SHARE_READ | /* share_access */
6318 FILE_SHARE_WRITE),
6319 FILE_OPEN, /* create_disposition*/
6320 create_options, /* create_options */
6321 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6322 0, /* oplock_request */
6323 0, /* allocation_size */
6324 0, /* private_flags */
6325 NULL, /* sd */
6326 NULL, /* ea_list */
6327 &fsp, /* result */
6328 NULL); /* pinfo */
6329
6330 if (!NT_STATUS_IS_OK(status)) {
6331 DEBUG(3, ("Could not open rename source %s: %s\n",
6332 smb_fname_str_dbg(smb_fname_src),
6333 nt_errstr(status)));
6334 goto out;
6335 }
6336
6337 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6338 attrs, replace_if_exists);
6339
6340 close_file(req, fsp, NORMAL_CLOSE);
6341
6342 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6343 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6344 smb_fname_str_dbg(smb_fname_dst)));
6345
6346 goto out;
6347 }
6348
6349 /*
6350 * Wildcards - process each file that matches.
6351 */
6352 if (strequal(fname_src_mask, "????????.???")) {
6353 TALLOC_FREE(fname_src_mask);
6354 fname_src_mask = talloc_strdup(ctx, "*");
6355 if (!fname_src_mask) {
6356 status = NT_STATUS_NO_MEMORY;
6357 goto out;
6358 }
6359 }
6360
6361 status = check_name(conn, fname_src_dir);
6362 if (!NT_STATUS_IS_OK(status)) {
6363 goto out;
6364 }
6365
6366 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6367 attrs);
6368 if (dir_hnd == NULL) {
6369 status = map_nt_error_from_unix(errno);
6370 goto out;
6371 }
6372
6373 status = NT_STATUS_NO_SUCH_FILE;
6374 /*
6375 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6376 * - gentest fix. JRA
6377 */
6378
6379 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6380 &talloced))) {
6381 files_struct *fsp = NULL;
6382 char *destname = NULL;
6383 bool sysdir_entry = False;
6384
6385 /* Quick check for "." and ".." */
6386 if (ISDOT(dname) || ISDOTDOT(dname)) {
6387 if (attrs & aDIR) {
6388 sysdir_entry = True;
6389 } else {
6390 TALLOC_FREE(talloced);
6391 continue;
6392 }
6393 }
6394
6395 if (!is_visible_file(conn, fname_src_dir, dname,
6396 &smb_fname_src->st, false)) {
6397 TALLOC_FREE(talloced);
6398 continue;
6399 }
6400
6401 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6402 TALLOC_FREE(talloced);
6403 continue;
6404 }
6405
6406 if (sysdir_entry) {
6407 status = NT_STATUS_OBJECT_NAME_INVALID;
6408 break;
6409 }
6410
6411 TALLOC_FREE(smb_fname_src->base_name);
6412 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6413 "%s/%s",
6414 fname_src_dir,
6415 dname);
6416 if (!smb_fname_src->base_name) {
6417 status = NT_STATUS_NO_MEMORY;
6418 goto out;
6419 }
6420
6421 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6422 smb_fname_dst->base_name,
6423 &destname)) {
6424 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6425 smb_fname_src->base_name, destname));
6426 TALLOC_FREE(talloced);
6427 continue;
6428 }
6429 if (!destname) {
6430 status = NT_STATUS_NO_MEMORY;
6431 goto out;
6432 }
6433
6434 TALLOC_FREE(smb_fname_dst->base_name);
6435 smb_fname_dst->base_name = destname;
6436
6437 ZERO_STRUCT(smb_fname_src->st);
6438 if (posix_pathnames) {
6439 SMB_VFS_LSTAT(conn, smb_fname_src);
6440 } else {
6441 SMB_VFS_STAT(conn, smb_fname_src);
6442 }
6443
6444 create_options = 0;
6445
6446 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6447 create_options |= FILE_DIRECTORY_FILE;
6448 }
6449
6450 status = SMB_VFS_CREATE_FILE(
6451 conn, /* conn */
6452 req, /* req */
6453 0, /* root_dir_fid */
6454 smb_fname_src, /* fname */
6455 access_mask, /* access_mask */
6456 (FILE_SHARE_READ | /* share_access */
6457 FILE_SHARE_WRITE),
6458 FILE_OPEN, /* create_disposition*/
6459 create_options, /* create_options */
6460 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6461 0, /* oplock_request */
6462 0, /* allocation_size */
6463 0, /* private_flags */
6464 NULL, /* sd */
6465 NULL, /* ea_list */
6466 &fsp, /* result */
6467 NULL); /* pinfo */
6468
6469 if (!NT_STATUS_IS_OK(status)) {
6470 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6471 "returned %s rename %s -> %s\n",
6472 nt_errstr(status),
6473 smb_fname_str_dbg(smb_fname_src),
6474 smb_fname_str_dbg(smb_fname_dst)));
6475 break;
6476 }
6477
6478 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6479 dname);
6480 if (!smb_fname_dst->original_lcomp) {
6481 status = NT_STATUS_NO_MEMORY;
6482 goto out;
6483 }
6484
6485 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6486 attrs, replace_if_exists);
6487
6488 close_file(req, fsp, NORMAL_CLOSE);
6489
6490 if (!NT_STATUS_IS_OK(status)) {
6491 DEBUG(3, ("rename_internals_fsp returned %s for "
6492 "rename %s -> %s\n", nt_errstr(status),
6493 smb_fname_str_dbg(smb_fname_src),
6494 smb_fname_str_dbg(smb_fname_dst)));
6495 break;
6496 }
6497
6498 count++;
6499
6500 DEBUG(3,("rename_internals: doing rename on %s -> "
6501 "%s\n", smb_fname_str_dbg(smb_fname_src),
6502 smb_fname_str_dbg(smb_fname_src)));
6503 TALLOC_FREE(talloced);
6504 }
6505 TALLOC_FREE(dir_hnd);
6506
6507 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6508 status = map_nt_error_from_unix(errno);
6509 }
6510
6511 out:
6512 TALLOC_FREE(talloced);
6513 TALLOC_FREE(fname_src_dir);
6514 TALLOC_FREE(fname_src_mask);
6515 return status;
6516 }
6517
6518 /****************************************************************************
6519 Reply to a mv.
6520 ****************************************************************************/
6521
6522 void reply_mv(struct smb_request *req)
6523 {
6524 connection_struct *conn = req->conn;
6525 char *name = NULL;
6526 char *newname = NULL;
6527 const char *p;
6528 uint32 attrs;
6529 NTSTATUS status;
6530 bool src_has_wcard = False;
6531 bool dest_has_wcard = False;
6532 TALLOC_CTX *ctx = talloc_tos();
6533 struct smb_filename *smb_fname_src = NULL;
6534 struct smb_filename *smb_fname_dst = NULL;
6535
6536 START_PROFILE(SMBmv);
6537
6538 if (req->wct < 1) {
6539 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6540 goto out;
6541 }
6542
6543 attrs = SVAL(req->vwv+0, 0);
6544
6545 p = (const char *)req->buf + 1;
6546 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6547 &status, &src_has_wcard);
6548 if (!NT_STATUS_IS_OK(status)) {
6549 reply_nterror(req, status);
6550 goto out;
6551 }
6552 p++;
6553 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6554 &status, &dest_has_wcard);
6555 if (!NT_STATUS_IS_OK(status)) {
6556 reply_nterror(req, status);
6557 goto out;
6558 }
6559
6560 status = filename_convert(ctx,
6561 conn,
6562 req->flags2 & FLAGS2_DFS_PATHNAMES,
6563 name,
6564 UCF_COND_ALLOW_WCARD_LCOMP,
6565 &src_has_wcard,
6566 &smb_fname_src);
6567
6568 if (!NT_STATUS_IS_OK(status)) {
6569 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6570 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6571 ERRSRV, ERRbadpath);
6572 goto out;
6573 }
6574 reply_nterror(req, status);
6575 goto out;
6576 }
6577
6578 status = filename_convert(ctx,
6579 conn,
6580 req->flags2 & FLAGS2_DFS_PATHNAMES,
6581 newname,
6582 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6583 &dest_has_wcard,
6584 &smb_fname_dst);
6585
6586 if (!NT_STATUS_IS_OK(status)) {
6587 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6588 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6589 ERRSRV, ERRbadpath);
6590 goto out;
6591 }
6592 reply_nterror(req, status);
6593 goto out;
6594 }
6595
6596 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6597 smb_fname_str_dbg(smb_fname_dst)));
6598
6599 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6600 attrs, False, src_has_wcard, dest_has_wcard,
6601 DELETE_ACCESS);
6602 if (!NT_STATUS_IS_OK(status)) {
6603 if (open_was_deferred(req->mid)) {
6604 /* We have re-scheduled this call. */
6605 goto out;
6606 }
6607 reply_nterror(req, status);
6608 goto out;
6609 }
6610
6611 reply_outbuf(req, 0, 0);
6612 out:
6613 TALLOC_FREE(smb_fname_src);
6614 TALLOC_FREE(smb_fname_dst);
6615 END_PROFILE(SMBmv);
6616 return;
6617 }
6618
6619 /*******************************************************************
6620 Copy a file as part of a reply_copy.
6621 ******************************************************************/
6622
6623 /*
6624 * TODO: check error codes on all callers
6625 */
6626
6627 NTSTATUS copy_file(TALLOC_CTX *ctx,
6628 connection_struct *conn,
6629 struct smb_filename *smb_fname_src,
6630 struct smb_filename *smb_fname_dst,
6631 int ofun,
6632 int count,
6633 bool target_is_directory)
6634 {
6635 struct smb_filename *smb_fname_dst_tmp = NULL;
6636 SMB_OFF_T ret=-1;
6637 files_struct *fsp1,*fsp2;
6638 uint32 dosattrs;
6639 uint32 new_create_disposition;
6640 NTSTATUS status;
6641
6642
6643 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6644 if (!NT_STATUS_IS_OK(status)) {
6645 return status;
6646 }
6647
6648 /*
6649 * If the target is a directory, extract the last component from the
6650 * src filename and append it to the dst filename
6651 */
6652 if (target_is_directory) {
6653 const char *p;
6654
6655 /* dest/target can't be a stream if it's a directory. */
6656 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6657
6658 p = strrchr_m(smb_fname_src->base_name,'/');
6659 if (p) {
6660 p++;
6661 } else {
6662 p = smb_fname_src->base_name;
6663 }
6664 smb_fname_dst_tmp->base_name =
6665 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6666 p);
6667 if (!smb_fname_dst_tmp->base_name) {
6668 status = NT_STATUS_NO_MEMORY;
6669 goto out;
6670 }
6671 }
6672
6673 status = vfs_file_exist(conn, smb_fname_src);
6674 if (!NT_STATUS_IS_OK(status)) {
6675 goto out;
6676 }
6677
6678 if (!target_is_directory && count) {
6679 new_create_disposition = FILE_OPEN;
6680 } else {
6681 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6682 NULL, NULL,
6683 &new_create_disposition,
6684 NULL,
6685 NULL)) {
6686 status = NT_STATUS_INVALID_PARAMETER;
6687 goto out;
6688 }
6689 }
6690
6691 /* Open the src file for reading. */
6692 status = SMB_VFS_CREATE_FILE(
6693 conn, /* conn */
6694 NULL, /* req */
6695 0, /* root_dir_fid */
6696 smb_fname_src, /* fname */
6697 FILE_GENERIC_READ, /* access_mask */
6698 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6699 FILE_OPEN, /* create_disposition*/
6700 0, /* create_options */
6701 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6702 INTERNAL_OPEN_ONLY, /* oplock_request */
6703 0, /* allocation_size */
6704 0, /* private_flags */
6705 NULL, /* sd */
6706 NULL, /* ea_list */
6707 &fsp1, /* result */
6708 NULL); /* psbuf */
6709
6710 if (!NT_STATUS_IS_OK(status)) {
6711 goto out;
6712 }
6713
6714 dosattrs = dos_mode(conn, smb_fname_src);
6715
6716 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6717 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6718 }
6719
6720 /* Open the dst file for writing. */
6721 status = SMB_VFS_CREATE_FILE(
6722 conn, /* conn */
6723 NULL, /* req */
6724 0, /* root_dir_fid */
6725 smb_fname_dst, /* fname */
6726 FILE_GENERIC_WRITE, /* access_mask */
6727 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6728 new_create_disposition, /* create_disposition*/
6729 0, /* create_options */
6730 dosattrs, /* file_attributes */
6731 INTERNAL_OPEN_ONLY, /* oplock_request */
6732 0, /* allocation_size */
6733 0, /* private_flags */
6734 NULL, /* sd */
6735 NULL, /* ea_list */
6736 &fsp2, /* result */
6737 NULL); /* psbuf */
6738
6739 if (!NT_STATUS_IS_OK(status)) {
6740 close_file(NULL, fsp1, ERROR_CLOSE);
6741 goto out;
6742 }
6743
6744 if ((ofun&3) == 1) {
6745 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6746 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6747 /*
6748 * Stop the copy from occurring.
6749 */
6750 ret = -1;
6751 smb_fname_src->st.st_ex_size = 0;
6752 }
6753 }
6754
6755 /* Do the actual copy. */
6756 if (smb_fname_src->st.st_ex_size) {
6757 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6758 }
6759
6760 close_file(NULL, fsp1, NORMAL_CLOSE);
6761
6762 /* Ensure the modtime is set correctly on the destination file. */
6763 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6764
6765 /*
6766 * As we are opening fsp1 read-only we only expect
6767 * an error on close on fsp2 if we are out of space.
6768 * Thus we don't look at the error return from the
6769 * close of fsp1.
6770 */
6771 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6772
6773 if (!NT_STATUS_IS_OK(status)) {
6774 goto out;
6775 }
6776
6777 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6778 status = NT_STATUS_DISK_FULL;
6779 goto out;
6780 }
6781
6782 status = NT_STATUS_OK;
6783
6784 out:
6785 TALLOC_FREE(smb_fname_dst_tmp);
6786 return status;
6787 }
6788
6789 /****************************************************************************
6790 Reply to a file copy.
6791 ****************************************************************************/
6792
6793 void reply_copy(struct smb_request *req)
6794 {
6795 connection_struct *conn = req->conn;
6796 struct smb_filename *smb_fname_src = NULL;
6797 struct smb_filename *smb_fname_dst = NULL;
6798 char *fname_src = NULL;
6799 char *fname_dst = NULL;
6800 char *fname_src_mask = NULL;
6801 char *fname_src_dir = NULL;
6802 const char *p;
6803 int count=0;
6804 int error = ERRnoaccess;
6805 int tid2;
6806 int ofun;
6807 int flags;
6808 bool target_is_directory=False;
6809 bool source_has_wild = False;
6810 bool dest_has_wild = False;
6811 NTSTATUS status;
6812 TALLOC_CTX *ctx = talloc_tos();
6813
6814 START_PROFILE(SMBcopy);
6815
6816 if (req->wct < 3) {
6817 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6818 goto out;
6819 }
6820
6821 tid2 = SVAL(req->vwv+0, 0);
6822 ofun = SVAL(req->vwv+1, 0);
6823 flags = SVAL(req->vwv+2, 0);
6824
6825 p = (const char *)req->buf;
6826 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6827 &status, &source_has_wild);
6828 if (!NT_STATUS_IS_OK(status)) {
6829 reply_nterror(req, status);
6830 goto out;
6831 }
6832 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6833 &status, &dest_has_wild);
6834 if (!NT_STATUS_IS_OK(status)) {
6835 reply_nterror(req, status);
6836 goto out;
6837 }
6838
6839 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6840
6841 if (tid2 != conn->cnum) {
6842 /* can't currently handle inter share copies XXXX */
6843 DEBUG(3,("Rejecting inter-share copy\n"));
6844 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6845 goto out;
6846 }
6847
6848 status = filename_convert(ctx, conn,
6849 req->flags2 & FLAGS2_DFS_PATHNAMES,
6850 fname_src,
6851 UCF_COND_ALLOW_WCARD_LCOMP,
6852 &source_has_wild,
6853 &smb_fname_src);
6854 if (!NT_STATUS_IS_OK(status)) {
6855 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6856 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6857 ERRSRV, ERRbadpath);
6858 goto out;
6859 }
6860 reply_nterror(req, status);
6861 goto out;
6862 }
6863
6864 status = filename_convert(ctx, conn,
6865 req->flags2 & FLAGS2_DFS_PATHNAMES,
6866 fname_dst,
6867 UCF_COND_ALLOW_WCARD_LCOMP,
6868 &dest_has_wild,
6869 &smb_fname_dst);
6870 if (!NT_STATUS_IS_OK(status)) {
6871 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6872 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6873 ERRSRV, ERRbadpath);
6874 goto out;
6875 }
6876 reply_nterror(req, status);
6877 goto out;
6878 }
6879
6880 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6881
6882 if ((flags&1) && target_is_directory) {
6883 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6884 goto out;
6885 }
6886
6887 if ((flags&2) && !target_is_directory) {
6888 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6889 goto out;
6890 }
6891
6892 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6893 /* wants a tree copy! XXXX */
6894 DEBUG(3,("Rejecting tree copy\n"));
6895 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6896 goto out;
6897 }
6898
6899 /* Split up the directory from the filename/mask. */
6900 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6901 &fname_src_dir, &fname_src_mask);
6902 if (!NT_STATUS_IS_OK(status)) {
6903 reply_nterror(req, NT_STATUS_NO_MEMORY);
6904 goto out;
6905 }
6906
6907 /*
6908 * We should only check the mangled cache
6909 * here if unix_convert failed. This means
6910 * that the path in 'mask' doesn't exist
6911 * on the file system and so we need to look
6912 * for a possible mangle. This patch from
6913 * Tine Smukavec <valentin.smukavec@hermes.si>.
6914 */
6915 if (!VALID_STAT(smb_fname_src->st) &&
6916 mangle_is_mangled(fname_src_mask, conn->params)) {
6917 char *new_mask = NULL;
6918 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6919 &new_mask, conn->params);
6920
6921 /* Use demangled name if one was successfully found. */
6922 if (new_mask) {
6923 TALLOC_FREE(fname_src_mask);
6924 fname_src_mask = new_mask;
6925 }
6926 }
6927
6928 if (!source_has_wild) {
6929
6930 /*
6931 * Only one file needs to be copied. Append the mask back onto
6932 * the directory.
6933 */
6934 TALLOC_FREE(smb_fname_src->base_name);
6935 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6936 "%s/%s",
6937 fname_src_dir,
6938 fname_src_mask);
6939 if (!smb_fname_src->base_name) {
6940 reply_nterror(req, NT_STATUS_NO_MEMORY);
6941 goto out;
6942 }
6943
6944 if (dest_has_wild) {
6945 char *fname_dst_mod = NULL;
6946 if (!resolve_wildcards(smb_fname_dst,
6947 smb_fname_src->base_name,
6948 smb_fname_dst->base_name,
6949 &fname_dst_mod)) {
6950 reply_nterror(req, NT_STATUS_NO_MEMORY);
6951 goto out;
6952 }
6953 TALLOC_FREE(smb_fname_dst->base_name);
6954 smb_fname_dst->base_name = fname_dst_mod;
6955 }
6956
6957 status = check_name(conn, smb_fname_src->base_name);
6958 if (!NT_STATUS_IS_OK(status)) {
6959 reply_nterror(req, status);
6960 goto out;
6961 }
6962
6963 status = check_name(conn, smb_fname_dst->base_name);
6964 if (!NT_STATUS_IS_OK(status)) {
6965 reply_nterror(req, status);
6966 goto out;
6967 }
6968
6969 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6970 ofun, count, target_is_directory);
6971
6972 if(!NT_STATUS_IS_OK(status)) {
6973 reply_nterror(req, status);
6974 goto out;
6975 } else {
6976 count++;
6977 }
6978 } else {
6979 struct smb_Dir *dir_hnd = NULL;
6980 const char *dname = NULL;
6981 char *talloced = NULL;
6982 long offset = 0;
6983
6984 /*
6985 * There is a wildcard that requires us to actually read the
6986 * src dir and copy each file matching the mask to the dst.
6987 * Right now streams won't be copied, but this could
6988 * presumably be added with a nested loop for reach dir entry.
6989 */
6990 SMB_ASSERT(!smb_fname_src->stream_name);
6991 SMB_ASSERT(!smb_fname_dst->stream_name);
6992
6993 smb_fname_src->stream_name = NULL;
6994 smb_fname_dst->stream_name = NULL;
6995
6996 if (strequal(fname_src_mask,"????????.???")) {
6997 TALLOC_FREE(fname_src_mask);
6998 fname_src_mask = talloc_strdup(ctx, "*");
6999 if (!fname_src_mask) {
7000 reply_nterror(req, NT_STATUS_NO_MEMORY);
7001 goto out;
7002 }
7003 }
7004
7005 status = check_name(conn, fname_src_dir);
7006 if (!NT_STATUS_IS_OK(status)) {
7007 reply_nterror(req, status);
7008 goto out;
7009 }
7010
7011 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7012 if (dir_hnd == NULL) {
7013 status = map_nt_error_from_unix(errno);
7014 reply_nterror(req, status);
7015 goto out;
7016 }
7017
7018 error = ERRbadfile;
7019
7020 /* Iterate over the src dir copying each entry to the dst. */
7021 while ((dname = ReadDirName(dir_hnd, &offset,
7022 &smb_fname_src->st, &talloced))) {
7023 char *destname = NULL;
7024
7025 if (ISDOT(dname) || ISDOTDOT(dname)) {
7026 TALLOC_FREE(talloced);
7027 continue;
7028 }
7029
7030 if (!is_visible_file(conn, fname_src_dir, dname,
7031 &smb_fname_src->st, false)) {
7032 TALLOC_FREE(talloced);
7033 continue;
7034 }
7035
7036 if(!mask_match(dname, fname_src_mask,
7037 conn->case_sensitive)) {
7038 TALLOC_FREE(talloced);
7039 continue;
7040 }
7041
7042 error = ERRnoaccess;
7043
7044 /* Get the src smb_fname struct setup. */
7045 TALLOC_FREE(smb_fname_src->base_name);
7046 smb_fname_src->base_name =
7047 talloc_asprintf(smb_fname_src, "%s/%s",
7048 fname_src_dir, dname);
7049
7050 if (!smb_fname_src->base_name) {
7051 TALLOC_FREE(dir_hnd);
7052 TALLOC_FREE(talloced);
7053 reply_nterror(req, NT_STATUS_NO_MEMORY);
7054 goto out;
7055 }
7056
7057 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7058 smb_fname_dst->base_name,
7059 &destname)) {
7060 TALLOC_FREE(talloced);
7061 continue;
7062 }
7063 if (!destname) {
7064 TALLOC_FREE(dir_hnd);
7065 TALLOC_FREE(talloced);
7066 reply_nterror(req, NT_STATUS_NO_MEMORY);
7067 goto out;
7068 }
7069
7070 TALLOC_FREE(smb_fname_dst->base_name);
7071 smb_fname_dst->base_name = destname;
7072
7073 status = check_name(conn, smb_fname_src->base_name);
7074 if (!NT_STATUS_IS_OK(status)) {
7075 TALLOC_FREE(dir_hnd);
7076 TALLOC_FREE(talloced);
7077 reply_nterror(req, status);
7078 goto out;
7079 }
7080
7081 status = check_name(conn, smb_fname_dst->base_name);
7082 if (!NT_STATUS_IS_OK(status)) {
7083 TALLOC_FREE(dir_hnd);
7084 TALLOC_FREE(talloced);
7085 reply_nterror(req, status);
7086 goto out;
7087 }
7088
7089 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7090 smb_fname_src->base_name,
7091 smb_fname_dst->base_name));
7092
7093 status = copy_file(ctx, conn, smb_fname_src,
7094 smb_fname_dst, ofun, count,
7095 target_is_directory);
7096 if (NT_STATUS_IS_OK(status)) {
7097 count++;
7098 }
7099
7100 TALLOC_FREE(talloced);
7101 }
7102 TALLOC_FREE(dir_hnd);
7103 }
7104
7105 if (count == 0) {
7106 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7107 goto out;
7108 }
7109
7110 reply_outbuf(req, 1, 0);
7111 SSVAL(req->outbuf,smb_vwv0,count);
7112 out:
7113 TALLOC_FREE(smb_fname_src);
7114 TALLOC_FREE(smb_fname_dst);
7115 TALLOC_FREE(fname_src);
7116 TALLOC_FREE(fname_dst);
7117 TALLOC_FREE(fname_src_mask);
7118 TALLOC_FREE(fname_src_dir);
7119
7120 END_PROFILE(SMBcopy);
7121 return;
7122 }
7123
7124 #undef DBGC_CLASS
7125 #define DBGC_CLASS DBGC_LOCKING
7126
7127 /****************************************************************************
7128 Get a lock pid, dealing with large count requests.
7129 ****************************************************************************/
7130
7131 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7132 bool large_file_format)
7133 {
7134 if(!large_file_format)
7135 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7136 else
7137 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7138 }
7139
7140 /****************************************************************************
7141 Get a lock count, dealing with large count requests.
7142 ****************************************************************************/
7143
7144 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7145 bool large_file_format)
7146 {
7147 uint64_t count = 0;
7148
7149 if(!large_file_format) {
7150 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7151 } else {
7152
7153 #if defined(HAVE_LONGLONG)
7154 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7155 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7156 #else /* HAVE_LONGLONG */
7157
7158 /*
7159 * NT4.x seems to be broken in that it sends large file (64 bit)
7160 * lockingX calls even if the CAP_LARGE_FILES was *not*
7161 * negotiated. For boxes without large unsigned ints truncate the
7162 * lock count by dropping the top 32 bits.
7163 */
7164
7165 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7166 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7167 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7168 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7169 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7170 }
7171
7172 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7173 #endif /* HAVE_LONGLONG */
7174 }
7175
7176 return count;
7177 }
7178
7179 #if !defined(HAVE_LONGLONG)
7180 /****************************************************************************
7181 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7182 ****************************************************************************/
7183
7184 static uint32 map_lock_offset(uint32 high, uint32 low)
7185 {
7186 unsigned int i;
7187 uint32 mask = 0;
7188 uint32 highcopy = high;
7189
7190 /*
7191 * Try and find out how many significant bits there are in high.
7192 */
7193
7194 for(i = 0; highcopy; i++)
7195 highcopy >>= 1;
7196
7197 /*
7198 * We use 31 bits not 32 here as POSIX
7199 * lock offsets may not be negative.
7200 */
7201
7202 mask = (~0) << (31 - i);
7203
7204 if(low & mask)
7205 return 0; /* Fail. */
7206
7207 high <<= (31 - i);
7208
7209 return (high|low);
7210 }
7211 #endif /* !defined(HAVE_LONGLONG) */
7212
7213 /****************************************************************************
7214 Get a lock offset, dealing with large offset requests.
7215 ****************************************************************************/
7216
7217 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7218 bool large_file_format, bool *err)
7219 {
7220 uint64_t offset = 0;
7221
7222 *err = False;
7223
7224 if(!large_file_format) {
7225 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7226 } else {
7227
7228 #if defined(HAVE_LONGLONG)
7229 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7230 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7231 #else /* HAVE_LONGLONG */
7232
7233 /*
7234 * NT4.x seems to be broken in that it sends large file (64 bit)
7235 * lockingX calls even if the CAP_LARGE_FILES was *not*
7236 * negotiated. For boxes without large unsigned ints mangle the
7237 * lock offset by mapping the top 32 bits onto the lower 32.
7238 */
7239
7240 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7241 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7242 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7243 uint32 new_low = 0;
7244
7245 if((new_low = map_lock_offset(high, low)) == 0) {
7246 *err = True;
7247 return (uint64_t)-1;
7248 }
7249
7250 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7251 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7252 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7253 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7254 }
7255
7256 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7257 #endif /* HAVE_LONGLONG */
7258 }
7259
7260 return offset;
7261 }
7262
7263 NTSTATUS smbd_do_locking(struct smb_request *req,
7264 files_struct *fsp,
7265 uint8_t type,
7266 int32_t timeout,
7267 uint16_t num_ulocks,
7268 struct smbd_lock_element *ulocks,
7269 uint16_t num_locks,
7270 struct smbd_lock_element *locks,
7271 bool *async)
7272 {
7273 connection_struct *conn = req->conn;
7274 int i;
7275 NTSTATUS status = NT_STATUS_OK;
7276
7277 *async = false;
7278
7279 /* Data now points at the beginning of the list
7280 of smb_unlkrng structs */
7281 for(i = 0; i < (int)num_ulocks; i++) {
7282 struct smbd_lock_element *e = &ulocks[i];
7283
7284 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7285 "pid %u, file %s\n",
7286 (double)e->offset,
7287 (double)e->count,
7288 (unsigned int)e->smblctx,
7289 fsp_str_dbg(fsp)));
7290
7291 if (e->brltype != UNLOCK_LOCK) {
7292 /* this can only happen with SMB2 */
7293 return NT_STATUS_INVALID_PARAMETER;
7294 }
7295
7296 status = do_unlock(req->sconn->msg_ctx,
7297 fsp,
7298 e->smblctx,
7299 e->count,
7300 e->offset,
7301 WINDOWS_LOCK);
7302
7303 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7304 nt_errstr(status)));
7305
7306 if (!NT_STATUS_IS_OK(status)) {
7307 return status;
7308 }
7309 }
7310
7311 /* Setup the timeout in seconds. */
7312
7313 if (!lp_blocking_locks(SNUM(conn))) {
7314 timeout = 0;
7315 }
7316
7317 /* Data now points at the beginning of the list
7318 of smb_lkrng structs */
7319
7320 for(i = 0; i < (int)num_locks; i++) {
7321 struct smbd_lock_element *e = &locks[i];
7322
7323 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7324 "%llu, file %s timeout = %d\n",
7325 (double)e->offset,
7326 (double)e->count,
7327 (unsigned long long)e->smblctx,
7328 fsp_str_dbg(fsp),
7329 (int)timeout));
7330
7331 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7332 struct blocking_lock_record *blr = NULL;
7333
7334 if (num_locks > 1) {
7335 /*
7336 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7337 * if the lock vector contains one entry. When given mutliple cancel
7338 * requests in a single PDU we expect the server to return an
7339 * error. Windows servers seem to accept the request but only
7340 * cancel the first lock.
7341 * JRA - Do what Windows does (tm) :-).
7342 */
7343
7344 #if 0
7345 /* MS-CIFS (2.2.4.32.1) behavior. */
7346 return NT_STATUS_DOS(ERRDOS,
7347 ERRcancelviolation);
7348 #else
7349 /* Windows behavior. */
7350 if (i != 0) {
7351 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7352 "cancel request\n"));
7353 continue;
7354 }
7355 #endif
7356 }
7357
7358 if (lp_blocking_locks(SNUM(conn))) {
7359
7360 /* Schedule a message to ourselves to
7361 remove the blocking lock record and
7362 return the right error. */
7363
7364 blr = blocking_lock_cancel_smb1(fsp,
7365 e->smblctx,
7366 e->offset,
7367 e->count,
7368 WINDOWS_LOCK,
7369 type,
7370 NT_STATUS_FILE_LOCK_CONFLICT);
7371 if (blr == NULL) {
7372 return NT_STATUS_DOS(
7373 ERRDOS,
7374 ERRcancelviolation);
7375 }
7376 }
7377 /* Remove a matching pending lock. */
7378 status = do_lock_cancel(fsp,
7379 e->smblctx,
7380 e->count,
7381 e->offset,
7382 WINDOWS_LOCK,
7383 blr);
7384 } else {
7385 bool blocking_lock = timeout ? true : false;
7386 bool defer_lock = false;
7387 struct byte_range_lock *br_lck;
7388 uint64_t block_smblctx;
7389
7390 br_lck = do_lock(req->sconn->msg_ctx,
7391 fsp,
7392 e->smblctx,
7393 e->count,
7394 e->offset,
7395 e->brltype,
7396 WINDOWS_LOCK,
7397 blocking_lock,
7398 &status,
7399 &block_smblctx,
7400 NULL);
7401
7402 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7403 /* Windows internal resolution for blocking locks seems
7404 to be about 200ms... Don't wait for less than that. JRA. */
7405 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7406 timeout = lp_lock_spin_time();
7407 }
7408 defer_lock = true;
7409 }
7410
7411 /* If a lock sent with timeout of zero would fail, and
7412 * this lock has been requested multiple times,
7413 * according to brl_lock_failed() we convert this
7414 * request to a blocking lock with a timeout of between
7415 * 150 - 300 milliseconds.
7416 *
7417 * If lp_lock_spin_time() has been set to 0, we skip
7418 * this blocking retry and fail immediately.
7419 *
7420 * Replacement for do_lock_spin(). JRA. */
7421
7422 if (!req->sconn->using_smb2 &&
7423 br_lck && lp_blocking_locks(SNUM(conn)) &&
7424 lp_lock_spin_time() && !blocking_lock &&
7425 NT_STATUS_EQUAL((status),
7426 NT_STATUS_FILE_LOCK_CONFLICT))
7427 {
7428 defer_lock = true;
7429 timeout = lp_lock_spin_time();
7430 }
7431
7432 if (br_lck && defer_lock) {
7433 /*
7434 * A blocking lock was requested. Package up
7435 * this smb into a queued request and push it
7436 * onto the blocking lock queue.
7437 */
7438 if(push_blocking_lock_request(br_lck,
7439 req,
7440 fsp,
7441 timeout,
7442 i,
7443 e->smblctx,
7444 e->brltype,
7445 WINDOWS_LOCK,
7446 e->offset,
7447 e->count,
7448 block_smblctx)) {
7449 TALLOC_FREE(br_lck);
7450 *async = true;
7451 return NT_STATUS_OK;
7452 }
7453 }
7454
7455 TALLOC_FREE(br_lck);
7456 }
7457
7458 if (!NT_STATUS_IS_OK(status)) {
7459 break;
7460 }
7461 }
7462
7463 /* If any of the above locks failed, then we must unlock
7464 all of the previous locks (X/Open spec). */
7465
7466 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7467
7468 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7469 i = -1; /* we want to skip the for loop */
7470 }
7471
7472 /*
7473 * Ensure we don't do a remove on the lock that just failed,
7474 * as under POSIX rules, if we have a lock already there, we
7475 * will delete it (and we shouldn't) .....
7476 */
7477 for(i--; i >= 0; i--) {
7478 struct smbd_lock_element *e = &locks[i];
7479
7480 do_unlock(req->sconn->msg_ctx,
7481 fsp,
7482 e->smblctx,
7483 e->count,
7484 e->offset,
7485 WINDOWS_LOCK);
7486 }
7487 return status;
7488 }
7489
7490 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7491 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7492
7493 return NT_STATUS_OK;
7494 }
7495
7496 /****************************************************************************
7497 Reply to a lockingX request.
7498 ****************************************************************************/
7499
7500 void reply_lockingX(struct smb_request *req)
7501 {
7502 connection_struct *conn = req->conn;
7503 files_struct *fsp;
7504 unsigned char locktype;
7505 unsigned char oplocklevel;
7506 uint16 num_ulocks;
7507 uint16 num_locks;
7508 int32 lock_timeout;
7509 int i;
7510 const uint8_t *data;
7511 bool large_file_format;
7512 bool err;
7513 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7514 struct smbd_lock_element *ulocks;
7515 struct smbd_lock_element *locks;
7516 bool async = false;
7517
7518 START_PROFILE(SMBlockingX);
7519
7520 if (req->wct < 8) {
7521 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7522 END_PROFILE(SMBlockingX);
7523 return;
7524 }
7525
7526 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7527 locktype = CVAL(req->vwv+3, 0);
7528 oplocklevel = CVAL(req->vwv+3, 1);
7529 num_ulocks = SVAL(req->vwv+6, 0);
7530 num_locks = SVAL(req->vwv+7, 0);
7531 lock_timeout = IVAL(req->vwv+4, 0);
7532 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7533
7534 if (!check_fsp(conn, req, fsp)) {
7535 END_PROFILE(SMBlockingX);
7536 return;
7537 }
7538
7539 data = req->buf;
7540
7541 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7542 /* we don't support these - and CANCEL_LOCK makes w2k
7543 and XP reboot so I don't really want to be
7544 compatible! (tridge) */
7545 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7546 END_PROFILE(SMBlockingX);
7547 return;
7548 }
7549
7550 /* Check if this is an oplock break on a file
7551 we have granted an oplock on.
7552 */
7553 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7554 /* Client can insist on breaking to none. */
7555 bool break_to_none = (oplocklevel == 0);
7556 bool result;
7557
7558 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7559 "for fnum = %d\n", (unsigned int)oplocklevel,
7560 fsp->fnum ));
7561
7562 /*
7563 * Make sure we have granted an exclusive or batch oplock on
7564 * this file.
7565 */
7566
7567 if (fsp->oplock_type == 0) {
7568
7569 /* The Samba4 nbench simulator doesn't understand
7570 the difference between break to level2 and break
7571 to none from level2 - it sends oplock break
7572 replies in both cases. Don't keep logging an error
7573 message here - just ignore it. JRA. */
7574
7575 DEBUG(5,("reply_lockingX: Error : oplock break from "
7576 "client for fnum = %d (oplock=%d) and no "
7577 "oplock granted on this file (%s).\n",
7578 fsp->fnum, fsp->oplock_type,
7579 fsp_str_dbg(fsp)));
7580
7581 /* if this is a pure oplock break request then don't
7582 * send a reply */
7583 if (num_locks == 0 && num_ulocks == 0) {
7584 END_PROFILE(SMBlockingX);
7585 return;
7586 } else {
7587 END_PROFILE(SMBlockingX);
7588 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7589 return;
7590 }
7591 }
7592
7593 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7594 (break_to_none)) {
7595 result = remove_oplock(fsp);
7596 } else {
7597 result = downgrade_oplock(fsp);
7598 }
7599
7600 if (!result) {
7601 DEBUG(0, ("reply_lockingX: error in removing "
7602 "oplock on file %s\n", fsp_str_dbg(fsp)));
7603 /* Hmmm. Is this panic justified? */
7604 smb_panic("internal tdb error");
7605 }
7606
7607 reply_to_oplock_break_requests(fsp);
7608
7609 /* if this is a pure oplock break request then don't send a
7610 * reply */
7611 if (num_locks == 0 && num_ulocks == 0) {
7612 /* Sanity check - ensure a pure oplock break is not a
7613 chained request. */
7614 if(CVAL(req->vwv+0, 0) != 0xff)
7615 DEBUG(0,("reply_lockingX: Error : pure oplock "
7616 "break is a chained %d request !\n",
7617 (unsigned int)CVAL(req->vwv+0, 0)));
7618 END_PROFILE(SMBlockingX);
7619 return;
7620 }
7621 }
7622
7623 if (req->buflen <
7624 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7625 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7626 END_PROFILE(SMBlockingX);
7627 return;
7628 }
7629
7630 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7631 if (ulocks == NULL) {
7632 reply_nterror(req, NT_STATUS_NO_MEMORY);
7633 END_PROFILE(SMBlockingX);
7634 return;
7635 }
7636
7637 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7638 if (locks == NULL) {
7639 reply_nterror(req, NT_STATUS_NO_MEMORY);
7640 END_PROFILE(SMBlockingX);
7641 return;
7642 }
7643
7644 /* Data now points at the beginning of the list
7645 of smb_unlkrng structs */
7646 for(i = 0; i < (int)num_ulocks; i++) {
7647 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7648 ulocks[i].count = get_lock_count(data, i, large_file_format);
7649 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7650 ulocks[i].brltype = UNLOCK_LOCK;
7651
7652 /*
7653 * There is no error code marked "stupid client bug".... :-).
7654 */
7655 if(err) {
7656 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7657 END_PROFILE(SMBlockingX);
7658 return;
7659 }
7660 }
7661
7662 /* Now do any requested locks */
7663 data += ((large_file_format ? 20 : 10)*num_ulocks);
7664
7665 /* Data now points at the beginning of the list
7666 of smb_lkrng structs */
7667
7668 for(i = 0; i < (int)num_locks; i++) {
7669 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7670 locks[i].count = get_lock_count(data, i, large_file_format);
7671 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7672
7673 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7674 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7675 locks[i].brltype = PENDING_READ_LOCK;
7676 } else {
7677 locks[i].brltype = READ_LOCK;
7678 }
7679 } else {
7680 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7681 locks[i].brltype = PENDING_WRITE_LOCK;
7682 } else {
7683 locks[i].brltype = WRITE_LOCK;
7684 }
7685 }
7686
7687 /*
7688 * There is no error code marked "stupid client bug".... :-).
7689 */
7690 if(err) {
7691 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7692 END_PROFILE(SMBlockingX);
7693 return;
7694 }
7695 }
7696
7697 status = smbd_do_locking(req, fsp,
7698 locktype, lock_timeout,
7699 num_ulocks, ulocks,
7700 num_locks, locks,
7701 &async);
7702 if (!NT_STATUS_IS_OK(status)) {
7703 END_PROFILE(SMBlockingX);
7704 reply_nterror(req, status);
7705 return;
7706 }
7707 if (async) {
7708 END_PROFILE(SMBlockingX);
7709 return;
7710 }
7711
7712 reply_outbuf(req, 2, 0);
7713
7714 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7715 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7716
7717 END_PROFILE(SMBlockingX);
7718 chain_reply(req);
7719 }
7720
7721 #undef DBGC_CLASS
7722 #define DBGC_CLASS DBGC_ALL
7723
7724 /****************************************************************************
7725 Reply to a SMBreadbmpx (read block multiplex) request.
7726 Always reply with an error, if someone has a platform really needs this,
7727 please contact vl@samba.org
7728 ****************************************************************************/
7729
7730 void reply_readbmpx(struct smb_request *req)
7731 {
7732 START_PROFILE(SMBreadBmpx);
7733 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7734 END_PROFILE(SMBreadBmpx);
7735 return;
7736 }
7737
7738 /****************************************************************************
7739 Reply to a SMBreadbs (read block multiplex secondary) request.
7740 Always reply with an error, if someone has a platform really needs this,
7741 please contact vl@samba.org
7742 ****************************************************************************/
7743
7744 void reply_readbs(struct smb_request *req)
7745 {
7746 START_PROFILE(SMBreadBs);
7747 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7748 END_PROFILE(SMBreadBs);
7749 return;
7750 }
7751
7752 /****************************************************************************
7753 Reply to a SMBsetattrE.
7754 ****************************************************************************/
7755
7756 void reply_setattrE(struct smb_request *req)
7757 {
7758 connection_struct *conn = req->conn;
7759 struct smb_file_time ft;
7760 files_struct *fsp;
7761 NTSTATUS status;
7762
7763 START_PROFILE(SMBsetattrE);
7764 ZERO_STRUCT(ft);
7765
7766 if (req->wct < 7) {
7767 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7768 goto out;
7769 }
7770
7771 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7772
7773 if(!fsp || (fsp->conn != conn)) {
7774 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7775 goto out;
7776 }
7777
7778 /*
7779 * Convert the DOS times into unix times.
7780 */
7781
7782 ft.atime = convert_time_t_to_timespec(
7783 srv_make_unix_date2(req->vwv+3));
7784 ft.mtime = convert_time_t_to_timespec(
7785 srv_make_unix_date2(req->vwv+5));
7786 ft.create_time = convert_time_t_to_timespec(
7787 srv_make_unix_date2(req->vwv+1));
7788
7789 reply_outbuf(req, 0, 0);
7790
7791 /*
7792 * Patch from Ray Frush <frush@engr.colostate.edu>
7793 * Sometimes times are sent as zero - ignore them.
7794 */
7795
7796 /* Ensure we have a valid stat struct for the source. */
7797 status = vfs_stat_fsp(fsp);
7798 if (!NT_STATUS_IS_OK(status)) {
7799 reply_nterror(req, status);
7800 goto out;
7801 }
7802
7803 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7804 if (!NT_STATUS_IS_OK(status)) {
7805 reply_nterror(req, status);
7806 goto out;
7807 }
7808
7809 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7810 " createtime=%u\n",
7811 fsp->fnum,
7812 (unsigned int)ft.atime.tv_sec,
7813 (unsigned int)ft.mtime.tv_sec,
7814 (unsigned int)ft.create_time.tv_sec
7815 ));
7816 out:
7817 END_PROFILE(SMBsetattrE);
7818 return;
7819 }
7820
7821
7822 /* Back from the dead for OS/2..... JRA. */
7823
7824 /****************************************************************************
7825 Reply to a SMBwritebmpx (write block multiplex primary) request.
7826 Always reply with an error, if someone has a platform really needs this,
7827 please contact vl@samba.org
7828 ****************************************************************************/
7829
7830 void reply_writebmpx(struct smb_request *req)
7831 {
7832 START_PROFILE(SMBwriteBmpx);
7833 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7834 END_PROFILE(SMBwriteBmpx);
7835 return;
7836 }
7837
7838 /****************************************************************************
7839 Reply to a SMBwritebs (write block multiplex secondary) request.
7840 Always reply with an error, if someone has a platform really needs this,
7841 please contact vl@samba.org
7842 ****************************************************************************/
7843
7844 void reply_writebs(struct smb_request *req)
7845 {
7846 START_PROFILE(SMBwriteBs);
7847 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7848 END_PROFILE(SMBwriteBs);
7849 return;
7850 }
7851
7852 /****************************************************************************
7853 Reply to a SMBgetattrE.
7854 ****************************************************************************/
7855
7856 void reply_getattrE(struct smb_request *req)
7857 {
7858 connection_struct *conn = req->conn;
7859 int mode;
7860 files_struct *fsp;
7861 struct timespec create_ts;
7862
7863 START_PROFILE(SMBgetattrE);
7864
7865 if (req->wct < 1) {
7866 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7867 END_PROFILE(SMBgetattrE);
7868 return;
7869 }
7870
7871 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7872
7873 if(!fsp || (fsp->conn != conn)) {
7874 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7875 END_PROFILE(SMBgetattrE);
7876 return;
7877 }
7878
7879 /* Do an fstat on this file */
7880 if(fsp_stat(fsp)) {
7881 reply_nterror(req, map_nt_error_from_unix(errno));
7882 END_PROFILE(SMBgetattrE);
7883 return;
7884 }
7885
7886 mode = dos_mode(conn, fsp->fsp_name);
7887
7888 /*
7889 * Convert the times into dos times. Set create
7890 * date to be last modify date as UNIX doesn't save
7891 * this.
7892 */
7893
7894 reply_outbuf(req, 11, 0);
7895
7896 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7897 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7898 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7899 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7900 /* Should we check pending modtime here ? JRA */
7901 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7902 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7903
7904 if (mode & aDIR) {
7905 SIVAL(req->outbuf, smb_vwv6, 0);
7906 SIVAL(req->outbuf, smb_vwv8, 0);
7907 } else {
7908 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7909 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7910 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7911 }
7912 SSVAL(req->outbuf,smb_vwv10, mode);
7913
7914 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7915
7916 END_PROFILE(SMBgetattrE);
7917 return;
7918 }
reg import