?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Build error exception lost (without wafcache)
[Samba/ita.git] / source3 / smbd / reply.c
blobdf7dac7b095e41c6e8073609ede602c49ca74da8
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "printing.h"
29 #include "smbd/globals.h"
30 #include "fake_file.h"
31 #include "../librpc/gen_ndr/cli_spoolss.h"
32 #include "rpc_client/cli_spoolss.h"
33 #include "rpc_client/init_spoolss.h"
34
35 /****************************************************************************
36 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
37 path or anything including wildcards.
38 We're assuming here that '/' is not the second byte in any multibyte char
39 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
40 set.
41 ****************************************************************************/
42
43 /* Custom version for processing POSIX paths. */
44 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
45
46 static NTSTATUS check_path_syntax_internal(char *path,
47 bool posix_path,
48 bool *p_last_component_contains_wcard)
49 {
50 char *d = path;
51 const char *s = path;
52 NTSTATUS ret = NT_STATUS_OK;
53 bool start_of_name_component = True;
54 bool stream_started = false;
55
56 *p_last_component_contains_wcard = False;
57
58 while (*s) {
59 if (stream_started) {
60 switch (*s) {
61 case '/':
62 case '\\':
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 case ':':
65 if (s[1] == '\0') {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (strchr_m(&s[1], ':')) {
69 return NT_STATUS_OBJECT_NAME_INVALID;
70 }
71 break;
72 }
73 }
74
75 if ((*s == ':') && !posix_path && !stream_started) {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 break;
132 }
133 /* Go back one level... */
134 /* We know this is safe as '/' cannot be part of a mb sequence. */
135 /* NOTE - if this assumption is invalid we are not in good shape... */
136 /* Decrement d first as d points to the *next* char to write into. */
137 for (d--; d > path; d--) {
138 if (*d == '/')
139 break;
140 }
141 s += 2; /* Else go past the .. */
142 /* We're still at the start of a name component, just the previous one. */
143 continue;
144
145 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
146 if (posix_path) {
147 /* Eat the '.' */
148 s++;
149 continue;
150 }
151 }
152
153 }
154
155 if (!(*s & 0x80)) {
156 if (!posix_path) {
157 if (*s <= 0x1f || *s == '|') {
158 return NT_STATUS_OBJECT_NAME_INVALID;
159 }
160 switch (*s) {
161 case '*':
162 case '?':
163 case '<':
164 case '>':
165 case '"':
166 *p_last_component_contains_wcard = True;
167 break;
168 default:
169 break;
170 }
171 }
172 *d++ = *s++;
173 } else {
174 size_t siz;
175 /* Get the size of the next MB character. */
176 next_codepoint(s,&siz);
177 switch(siz) {
178 case 5:
179 *d++ = *s++;
180 /*fall through*/
181 case 4:
182 *d++ = *s++;
183 /*fall through*/
184 case 3:
185 *d++ = *s++;
186 /*fall through*/
187 case 2:
188 *d++ = *s++;
189 /*fall through*/
190 case 1:
191 *d++ = *s++;
192 break;
193 default:
194 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
195 *d = '\0';
196 return NT_STATUS_INVALID_PARAMETER;
197 }
198 }
199 start_of_name_component = False;
200 }
201
202 *d = '\0';
203
204 return ret;
205 }
206
207 /****************************************************************************
208 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
209 No wildcards allowed.
210 ****************************************************************************/
211
212 NTSTATUS check_path_syntax(char *path)
213 {
214 bool ignore;
215 return check_path_syntax_internal(path, False, &ignore);
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 Wildcards allowed - p_contains_wcard returns true if the last component contained
221 a wildcard.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
225 {
226 return check_path_syntax_internal(path, False, p_contains_wcard);
227 }
228
229 /****************************************************************************
230 Check the path for a POSIX client.
231 We're assuming here that '/' is not the second byte in any multibyte char
232 set (a safe assumption).
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_posix(char *path)
236 {
237 bool ignore;
238 return check_path_syntax_internal(path, True, &ignore);
239 }
240
241 /****************************************************************************
242 Pull a string and check the path allowing a wilcard - provide for error return.
243 ****************************************************************************/
244
245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
246 const char *base_ptr,
247 uint16 smb_flags2,
248 char **pp_dest,
249 const char *src,
250 size_t src_len,
251 int flags,
252 NTSTATUS *err,
253 bool *contains_wcard)
254 {
255 size_t ret;
256
257 *pp_dest = NULL;
258
259 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
260 src_len, flags);
261
262 if (!*pp_dest) {
263 *err = NT_STATUS_INVALID_PARAMETER;
264 return ret;
265 }
266
267 *contains_wcard = False;
268
269 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
270 /*
271 * For a DFS path the function parse_dfs_path()
272 * will do the path processing, just make a copy.
273 */
274 *err = NT_STATUS_OK;
275 return ret;
276 }
277
278 if (lp_posix_pathnames()) {
279 *err = check_path_syntax_posix(*pp_dest);
280 } else {
281 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
282 }
283
284 return ret;
285 }
286
287 /****************************************************************************
288 Pull a string and check the path - provide for error return.
289 ****************************************************************************/
290
291 size_t srvstr_get_path(TALLOC_CTX *ctx,
292 const char *base_ptr,
293 uint16 smb_flags2,
294 char **pp_dest,
295 const char *src,
296 size_t src_len,
297 int flags,
298 NTSTATUS *err)
299 {
300 bool ignore;
301 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
302 src_len, flags, err, &ignore);
303 }
304
305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
306 char **pp_dest, const char *src, int flags,
307 NTSTATUS *err, bool *contains_wcard)
308 {
309 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
310 pp_dest, src, smbreq_bufrem(req, src),
311 flags, err, contains_wcard);
312 }
313
314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err)
317 {
318 bool ignore;
319 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
320 flags, err, &ignore);
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if ((fsp == NULL) || (conn == NULL)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if (fsp->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if (fsp->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 fsp->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
395 const char *name, int name_type)
396 {
397 char *trim_name;
398 char *trim_name_type;
399 const char *retarget_parm;
400 char *retarget;
401 char *p;
402 int retarget_type = 0x20;
403 int retarget_port = 139;
404 struct sockaddr_storage retarget_addr;
405 struct sockaddr_in *in_addr;
406 bool ret = false;
407 uint8_t outbuf[10];
408
409 if (get_socket_port(sconn->sock) != 139) {
410 return false;
411 }
412
413 trim_name = talloc_strdup(talloc_tos(), name);
414 if (trim_name == NULL) {
415 goto fail;
416 }
417 trim_char(trim_name, ' ', ' ');
418
419 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
420 name_type);
421 if (trim_name_type == NULL) {
422 goto fail;
423 }
424
425 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
426 trim_name_type, NULL);
427 if (retarget_parm == NULL) {
428 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
429 trim_name, NULL);
430 }
431 if (retarget_parm == NULL) {
432 goto fail;
433 }
434
435 retarget = talloc_strdup(trim_name, retarget_parm);
436 if (retarget == NULL) {
437 goto fail;
438 }
439
440 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
441
442 p = strchr(retarget, ':');
443 if (p != NULL) {
444 *p++ = '\0';
445 retarget_port = atoi(p);
446 }
447
448 p = strchr_m(retarget, '#');
449 if (p != NULL) {
450 *p++ = '\0';
451 sscanf(p, "%x", &retarget_type);
452 }
453
454 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
455 if (!ret) {
456 DEBUG(10, ("could not resolve %s\n", retarget));
457 goto fail;
458 }
459
460 if (retarget_addr.ss_family != AF_INET) {
461 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
462 goto fail;
463 }
464
465 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
466
467 _smb_setlen(outbuf, 6);
468 SCVAL(outbuf, 0, 0x84);
469 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
470 *(uint16_t *)(outbuf+8) = htons(retarget_port);
471
472 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
473 NULL)) {
474 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
475 "failed.");
476 }
477
478 ret = true;
479 fail:
480 TALLOC_FREE(trim_name);
481 return ret;
482 }
483
484 /****************************************************************************
485 Reply to a (netbios-level) special message.
486 ****************************************************************************/
487
488 void reply_special(struct smbd_server_connection *sconn, char *inbuf)
489 {
490 int msg_type = CVAL(inbuf,0);
491 int msg_flags = CVAL(inbuf,1);
492 fstring name1,name2;
493 char name_type1, name_type2;
494
495 /*
496 * We only really use 4 bytes of the outbuf, but for the smb_setlen
497 * calculation & friends (srv_send_smb uses that) we need the full smb
498 * header.
499 */
500 char outbuf[smb_size];
501
502 *name1 = *name2 = 0;
503
504 memset(outbuf, '\0', sizeof(outbuf));
505
506 smb_setlen(outbuf,0);
507
508 switch (msg_type) {
509 case 0x81: /* session request */
510
511 if (sconn->nbt.got_session) {
512 exit_server_cleanly("multiple session request not permitted");
513 }
514
515 SCVAL(outbuf,0,0x82);
516 SCVAL(outbuf,3,0);
517 if (name_len(inbuf+4) > 50 ||
518 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
519 DEBUG(0,("Invalid name length in session request\n"));
520 return;
521 }
522 name_type1 = name_extract(inbuf,4,name1);
523 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
524 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
525 name1, name_type1, name2, name_type2));
526
527 if (netbios_session_retarget(sconn, name1, name_type1)) {
528 exit_server_cleanly("retargeted client");
529 }
530
531 /*
532 * Windows NT/2k uses "*SMBSERVER" and XP uses
533 * "*SMBSERV" arrggg!!!
534 */
535 if (strequal(name1, "*SMBSERVER ")
536 || strequal(name1, "*SMBSERV ")) {
537 fstrcpy(name1, sconn->client_id.addr);
538 }
539
540 set_local_machine_name(name1, True);
541 set_remote_machine_name(name2, True);
542
543 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
544 get_local_machine_name(), get_remote_machine_name(),
545 name_type2));
546
547 if (name_type2 == 'R') {
548 /* We are being asked for a pathworks session ---
549 no thanks! */
550 SCVAL(outbuf, 0,0x83);
551 break;
552 }
553
554 /* only add the client's machine name to the list
555 of possibly valid usernames if we are operating
556 in share mode security */
557 if (lp_security() == SEC_SHARE) {
558 add_session_user(sconn, get_remote_machine_name());
559 }
560
561 reload_services(sconn->msg_ctx, sconn->sock, True);
562 reopen_logs();
563
564 sconn->nbt.got_session = true;
565 break;
566
567 case 0x89: /* session keepalive request
568 (some old clients produce this?) */
569 SCVAL(outbuf,0,SMBkeepalive);
570 SCVAL(outbuf,3,0);
571 break;
572
573 case 0x82: /* positive session response */
574 case 0x83: /* negative session response */
575 case 0x84: /* retarget session response */
576 DEBUG(0,("Unexpected session response\n"));
577 break;
578
579 case SMBkeepalive: /* session keepalive */
580 default:
581 return;
582 }
583
584 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
585 msg_type, msg_flags));
586
587 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
588 return;
589 }
590
591 /****************************************************************************
592 Reply to a tcon.
593 conn POINTER CAN BE NULL HERE !
594 ****************************************************************************/
595
596 void reply_tcon(struct smb_request *req)
597 {
598 connection_struct *conn = req->conn;
599 const char *service;
600 char *service_buf = NULL;
601 char *password = NULL;
602 char *dev = NULL;
603 int pwlen=0;
604 NTSTATUS nt_status;
605 const char *p;
606 DATA_BLOB password_blob;
607 TALLOC_CTX *ctx = talloc_tos();
608 struct smbd_server_connection *sconn = req->sconn;
609
610 START_PROFILE(SMBtcon);
611
612 if (req->buflen < 4) {
613 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
614 END_PROFILE(SMBtcon);
615 return;
616 }
617
618 p = (const char *)req->buf + 1;
619 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
620 p += 1;
621 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
622 p += pwlen+1;
623 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
624 p += 1;
625
626 if (service_buf == NULL || password == NULL || dev == NULL) {
627 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
628 END_PROFILE(SMBtcon);
629 return;
630 }
631 p = strrchr_m(service_buf,'\\');
632 if (p) {
633 service = p+1;
634 } else {
635 service = service_buf;
636 }
637
638 password_blob = data_blob(password, pwlen+1);
639
640 conn = make_connection(sconn,service,password_blob,dev,
641 req->vuid,&nt_status);
642 req->conn = conn;
643
644 data_blob_clear_free(&password_blob);
645
646 if (!conn) {
647 reply_nterror(req, nt_status);
648 END_PROFILE(SMBtcon);
649 return;
650 }
651
652 reply_outbuf(req, 2, 0);
653 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
654 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
655 SSVAL(req->outbuf,smb_tid,conn->cnum);
656
657 DEBUG(3,("tcon service=%s cnum=%d\n",
658 service, conn->cnum));
659
660 END_PROFILE(SMBtcon);
661 return;
662 }
663
664 /****************************************************************************
665 Reply to a tcon and X.
666 conn POINTER CAN BE NULL HERE !
667 ****************************************************************************/
668
669 void reply_tcon_and_X(struct smb_request *req)
670 {
671 connection_struct *conn = req->conn;
672 const char *service = NULL;
673 DATA_BLOB password;
674 TALLOC_CTX *ctx = talloc_tos();
675 /* what the cleint thinks the device is */
676 char *client_devicetype = NULL;
677 /* what the server tells the client the share represents */
678 const char *server_devicetype;
679 NTSTATUS nt_status;
680 int passlen;
681 char *path = NULL;
682 const char *p, *q;
683 uint16 tcon_flags;
684 struct smbd_server_connection *sconn = req->sconn;
685
686 START_PROFILE(SMBtconX);
687
688 if (req->wct < 4) {
689 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
690 END_PROFILE(SMBtconX);
691 return;
692 }
693
694 passlen = SVAL(req->vwv+3, 0);
695 tcon_flags = SVAL(req->vwv+2, 0);
696
697 /* we might have to close an old one */
698 if ((tcon_flags & 0x1) && conn) {
699 close_cnum(conn,req->vuid);
700 req->conn = NULL;
701 conn = NULL;
702 }
703
704 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
705 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
706 END_PROFILE(SMBtconX);
707 return;
708 }
709
710 if (sconn->smb1.negprot.encrypted_passwords) {
711 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
712 if (lp_security() == SEC_SHARE) {
713 /*
714 * Security = share always has a pad byte
715 * after the password.
716 */
717 p = (const char *)req->buf + passlen + 1;
718 } else {
719 p = (const char *)req->buf + passlen;
720 }
721 } else {
722 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
723 /* Ensure correct termination */
724 password.data[passlen]=0;
725 p = (const char *)req->buf + passlen + 1;
726 }
727
728 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
729
730 if (path == NULL) {
731 data_blob_clear_free(&password);
732 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
733 END_PROFILE(SMBtconX);
734 return;
735 }
736
737 /*
738 * the service name can be either: \\server\share
739 * or share directly like on the DELL PowerVault 705
740 */
741 if (*path=='\\') {
742 q = strchr_m(path+2,'\\');
743 if (!q) {
744 data_blob_clear_free(&password);
745 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
746 END_PROFILE(SMBtconX);
747 return;
748 }
749 service = q+1;
750 } else {
751 service = path;
752 }
753
754 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
755 &client_devicetype, p,
756 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
757
758 if (client_devicetype == NULL) {
759 data_blob_clear_free(&password);
760 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
761 END_PROFILE(SMBtconX);
762 return;
763 }
764
765 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
766
767 conn = make_connection(sconn, service, password, client_devicetype,
768 req->vuid, &nt_status);
769 req->conn =conn;
770
771 data_blob_clear_free(&password);
772
773 if (!conn) {
774 reply_nterror(req, nt_status);
775 END_PROFILE(SMBtconX);
776 return;
777 }
778
779 if ( IS_IPC(conn) )
780 server_devicetype = "IPC";
781 else if ( IS_PRINT(conn) )
782 server_devicetype = "LPT1:";
783 else
784 server_devicetype = "A:";
785
786 if (get_Protocol() < PROTOCOL_NT1) {
787 reply_outbuf(req, 2, 0);
788 if (message_push_string(&req->outbuf, server_devicetype,
789 STR_TERMINATE|STR_ASCII) == -1) {
790 reply_nterror(req, NT_STATUS_NO_MEMORY);
791 END_PROFILE(SMBtconX);
792 return;
793 }
794 } else {
795 /* NT sets the fstype of IPC$ to the null string */
796 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
797
798 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
799 /* Return permissions. */
800 uint32 perm1 = 0;
801 uint32 perm2 = 0;
802
803 reply_outbuf(req, 7, 0);
804
805 if (IS_IPC(conn)) {
806 perm1 = FILE_ALL_ACCESS;
807 perm2 = FILE_ALL_ACCESS;
808 } else {
809 perm1 = CAN_WRITE(conn) ?
810 SHARE_ALL_ACCESS :
811 SHARE_READ_ONLY;
812 }
813
814 SIVAL(req->outbuf, smb_vwv3, perm1);
815 SIVAL(req->outbuf, smb_vwv5, perm2);
816 } else {
817 reply_outbuf(req, 3, 0);
818 }
819
820 if ((message_push_string(&req->outbuf, server_devicetype,
821 STR_TERMINATE|STR_ASCII) == -1)
822 || (message_push_string(&req->outbuf, fstype,
823 STR_TERMINATE) == -1)) {
824 reply_nterror(req, NT_STATUS_NO_MEMORY);
825 END_PROFILE(SMBtconX);
826 return;
827 }
828
829 /* what does setting this bit do? It is set by NT4 and
830 may affect the ability to autorun mounted cdroms */
831 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
832 (lp_csc_policy(SNUM(conn)) << 2));
833
834 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
835 DEBUG(2,("Serving %s as a Dfs root\n",
836 lp_servicename(SNUM(conn)) ));
837 SSVAL(req->outbuf, smb_vwv2,
838 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
839 }
840 }
841
842
843 DEBUG(3,("tconX service=%s \n",
844 service));
845
846 /* set the incoming and outgoing tid to the just created one */
847 SSVAL(req->inbuf,smb_tid,conn->cnum);
848 SSVAL(req->outbuf,smb_tid,conn->cnum);
849
850 END_PROFILE(SMBtconX);
851
852 req->tid = conn->cnum;
853 chain_reply(req);
854 return;
855 }
856
857 /****************************************************************************
858 Reply to an unknown type.
859 ****************************************************************************/
860
861 void reply_unknown_new(struct smb_request *req, uint8 type)
862 {
863 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
864 smb_fn_name(type), type, type));
865 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
866 return;
867 }
868
869 /****************************************************************************
870 Reply to an ioctl.
871 conn POINTER CAN BE NULL HERE !
872 ****************************************************************************/
873
874 void reply_ioctl(struct smb_request *req)
875 {
876 connection_struct *conn = req->conn;
877 uint16 device;
878 uint16 function;
879 uint32 ioctl_code;
880 int replysize;
881 char *p;
882
883 START_PROFILE(SMBioctl);
884
885 if (req->wct < 3) {
886 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
887 END_PROFILE(SMBioctl);
888 return;
889 }
890
891 device = SVAL(req->vwv+1, 0);
892 function = SVAL(req->vwv+2, 0);
893 ioctl_code = (device << 16) + function;
894
895 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
896
897 switch (ioctl_code) {
898 case IOCTL_QUERY_JOB_INFO:
899 replysize = 32;
900 break;
901 default:
902 reply_force_doserror(req, ERRSRV, ERRnosupport);
903 END_PROFILE(SMBioctl);
904 return;
905 }
906
907 reply_outbuf(req, 8, replysize+1);
908 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
909 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
910 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
911 p = smb_buf(req->outbuf);
912 memset(p, '\0', replysize+1); /* valgrind-safe. */
913 p += 1; /* Allow for alignment */
914
915 switch (ioctl_code) {
916 case IOCTL_QUERY_JOB_INFO:
917 {
918 files_struct *fsp = file_fsp(
919 req, SVAL(req->vwv+0, 0));
920 if (!fsp) {
921 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
922 END_PROFILE(SMBioctl);
923 return;
924 }
925 /* Job number */
926 if (fsp->print_file) {
927 SSVAL(p, 0, fsp->print_file->rap_jobid);
928 } else {
929 SSVAL(p, 0, 0);
930 }
931 srvstr_push((char *)req->outbuf, req->flags2, p+2,
932 global_myname(), 15,
933 STR_TERMINATE|STR_ASCII);
934 if (conn) {
935 srvstr_push((char *)req->outbuf, req->flags2,
936 p+18, lp_servicename(SNUM(conn)),
937 13, STR_TERMINATE|STR_ASCII);
938 } else {
939 memset(p+18, 0, 13);
940 }
941 break;
942 }
943 }
944
945 END_PROFILE(SMBioctl);
946 return;
947 }
948
949 /****************************************************************************
950 Strange checkpath NTSTATUS mapping.
951 ****************************************************************************/
952
953 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
954 {
955 /* Strange DOS error code semantics only for checkpath... */
956 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
957 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
958 /* We need to map to ERRbadpath */
959 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
960 }
961 }
962 return status;
963 }
964
965 /****************************************************************************
966 Reply to a checkpath.
967 ****************************************************************************/
968
969 void reply_checkpath(struct smb_request *req)
970 {
971 connection_struct *conn = req->conn;
972 struct smb_filename *smb_fname = NULL;
973 char *name = NULL;
974 NTSTATUS status;
975 TALLOC_CTX *ctx = talloc_tos();
976
977 START_PROFILE(SMBcheckpath);
978
979 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
980 STR_TERMINATE, &status);
981
982 if (!NT_STATUS_IS_OK(status)) {
983 status = map_checkpath_error(req->flags2, status);
984 reply_nterror(req, status);
985 END_PROFILE(SMBcheckpath);
986 return;
987 }
988
989 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
990
991 status = filename_convert(ctx,
992 conn,
993 req->flags2 & FLAGS2_DFS_PATHNAMES,
994 name,
995 0,
996 NULL,
997 &smb_fname);
998
999 if (!NT_STATUS_IS_OK(status)) {
1000 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1001 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1002 ERRSRV, ERRbadpath);
1003 END_PROFILE(SMBcheckpath);
1004 return;
1005 }
1006 goto path_err;
1007 }
1008
1009 if (!VALID_STAT(smb_fname->st) &&
1010 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1011 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1012 smb_fname_str_dbg(smb_fname), strerror(errno)));
1013 status = map_nt_error_from_unix(errno);
1014 goto path_err;
1015 }
1016
1017 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1018 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1019 ERRDOS, ERRbadpath);
1020 goto out;
1021 }
1022
1023 reply_outbuf(req, 0, 0);
1024
1025 path_err:
1026 /* We special case this - as when a Windows machine
1027 is parsing a path is steps through the components
1028 one at a time - if a component fails it expects
1029 ERRbadpath, not ERRbadfile.
1030 */
1031 status = map_checkpath_error(req->flags2, status);
1032 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1033 /*
1034 * Windows returns different error codes if
1035 * the parent directory is valid but not the
1036 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1037 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1038 * if the path is invalid.
1039 */
1040 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1041 ERRDOS, ERRbadpath);
1042 goto out;
1043 }
1044
1045 reply_nterror(req, status);
1046
1047 out:
1048 TALLOC_FREE(smb_fname);
1049 END_PROFILE(SMBcheckpath);
1050 return;
1051 }
1052
1053 /****************************************************************************
1054 Reply to a getatr.
1055 ****************************************************************************/
1056
1057 void reply_getatr(struct smb_request *req)
1058 {
1059 connection_struct *conn = req->conn;
1060 struct smb_filename *smb_fname = NULL;
1061 char *fname = NULL;
1062 int mode=0;
1063 SMB_OFF_T size=0;
1064 time_t mtime=0;
1065 const char *p;
1066 NTSTATUS status;
1067 TALLOC_CTX *ctx = talloc_tos();
1068 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1069
1070 START_PROFILE(SMBgetatr);
1071
1072 p = (const char *)req->buf + 1;
1073 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1074 if (!NT_STATUS_IS_OK(status)) {
1075 reply_nterror(req, status);
1076 goto out;
1077 }
1078
1079 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1080 under WfWg - weird! */
1081 if (*fname == '\0') {
1082 mode = aHIDDEN | aDIR;
1083 if (!CAN_WRITE(conn)) {
1084 mode |= aRONLY;
1085 }
1086 size = 0;
1087 mtime = 0;
1088 } else {
1089 status = filename_convert(ctx,
1090 conn,
1091 req->flags2 & FLAGS2_DFS_PATHNAMES,
1092 fname,
1093 0,
1094 NULL,
1095 &smb_fname);
1096 if (!NT_STATUS_IS_OK(status)) {
1097 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1098 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1099 ERRSRV, ERRbadpath);
1100 goto out;
1101 }
1102 reply_nterror(req, status);
1103 goto out;
1104 }
1105 if (!VALID_STAT(smb_fname->st) &&
1106 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1107 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1108 smb_fname_str_dbg(smb_fname),
1109 strerror(errno)));
1110 reply_nterror(req, map_nt_error_from_unix(errno));
1111 goto out;
1112 }
1113
1114 mode = dos_mode(conn, smb_fname);
1115 size = smb_fname->st.st_ex_size;
1116
1117 if (ask_sharemode) {
1118 struct timespec write_time_ts;
1119 struct file_id fileid;
1120
1121 ZERO_STRUCT(write_time_ts);
1122 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1123 get_file_infos(fileid, NULL, &write_time_ts);
1124 if (!null_timespec(write_time_ts)) {
1125 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1126 }
1127 }
1128
1129 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1130 if (mode & aDIR) {
1131 size = 0;
1132 }
1133 }
1134
1135 reply_outbuf(req, 10, 0);
1136
1137 SSVAL(req->outbuf,smb_vwv0,mode);
1138 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1139 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1140 } else {
1141 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1142 }
1143 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1144
1145 if (get_Protocol() >= PROTOCOL_NT1) {
1146 SSVAL(req->outbuf, smb_flg2,
1147 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1148 }
1149
1150 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1151 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1152
1153 out:
1154 TALLOC_FREE(smb_fname);
1155 TALLOC_FREE(fname);
1156 END_PROFILE(SMBgetatr);
1157 return;
1158 }
1159
1160 /****************************************************************************
1161 Reply to a setatr.
1162 ****************************************************************************/
1163
1164 void reply_setatr(struct smb_request *req)
1165 {
1166 struct smb_file_time ft;
1167 connection_struct *conn = req->conn;
1168 struct smb_filename *smb_fname = NULL;
1169 char *fname = NULL;
1170 int mode;
1171 time_t mtime;
1172 const char *p;
1173 NTSTATUS status;
1174 TALLOC_CTX *ctx = talloc_tos();
1175
1176 START_PROFILE(SMBsetatr);
1177
1178 ZERO_STRUCT(ft);
1179
1180 if (req->wct < 2) {
1181 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1182 goto out;
1183 }
1184
1185 p = (const char *)req->buf + 1;
1186 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1187 if (!NT_STATUS_IS_OK(status)) {
1188 reply_nterror(req, status);
1189 goto out;
1190 }
1191
1192 status = filename_convert(ctx,
1193 conn,
1194 req->flags2 & FLAGS2_DFS_PATHNAMES,
1195 fname,
1196 0,
1197 NULL,
1198 &smb_fname);
1199 if (!NT_STATUS_IS_OK(status)) {
1200 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1201 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1202 ERRSRV, ERRbadpath);
1203 goto out;
1204 }
1205 reply_nterror(req, status);
1206 goto out;
1207 }
1208
1209 if (smb_fname->base_name[0] == '.' &&
1210 smb_fname->base_name[1] == '\0') {
1211 /*
1212 * Not sure here is the right place to catch this
1213 * condition. Might be moved to somewhere else later -- vl
1214 */
1215 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1216 goto out;
1217 }
1218
1219 mode = SVAL(req->vwv+0, 0);
1220 mtime = srv_make_unix_date3(req->vwv+1);
1221
1222 ft.mtime = convert_time_t_to_timespec(mtime);
1223 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1224 if (!NT_STATUS_IS_OK(status)) {
1225 reply_nterror(req, status);
1226 goto out;
1227 }
1228
1229 if (mode != FILE_ATTRIBUTE_NORMAL) {
1230 if (VALID_STAT_OF_DIR(smb_fname->st))
1231 mode |= aDIR;
1232 else
1233 mode &= ~aDIR;
1234
1235 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1236 false) != 0) {
1237 reply_nterror(req, map_nt_error_from_unix(errno));
1238 goto out;
1239 }
1240 }
1241
1242 reply_outbuf(req, 0, 0);
1243
1244 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1245 mode));
1246 out:
1247 TALLOC_FREE(smb_fname);
1248 END_PROFILE(SMBsetatr);
1249 return;
1250 }
1251
1252 /****************************************************************************
1253 Reply to a dskattr.
1254 ****************************************************************************/
1255
1256 void reply_dskattr(struct smb_request *req)
1257 {
1258 connection_struct *conn = req->conn;
1259 uint64_t dfree,dsize,bsize;
1260 START_PROFILE(SMBdskattr);
1261
1262 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1263 reply_nterror(req, map_nt_error_from_unix(errno));
1264 END_PROFILE(SMBdskattr);
1265 return;
1266 }
1267
1268 reply_outbuf(req, 5, 0);
1269
1270 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1271 double total_space, free_space;
1272 /* we need to scale this to a number that DOS6 can handle. We
1273 use floating point so we can handle large drives on systems
1274 that don't have 64 bit integers
1275
1276 we end up displaying a maximum of 2G to DOS systems
1277 */
1278 total_space = dsize * (double)bsize;
1279 free_space = dfree * (double)bsize;
1280
1281 dsize = (uint64_t)((total_space+63*512) / (64*512));
1282 dfree = (uint64_t)((free_space+63*512) / (64*512));
1283
1284 if (dsize > 0xFFFF) dsize = 0xFFFF;
1285 if (dfree > 0xFFFF) dfree = 0xFFFF;
1286
1287 SSVAL(req->outbuf,smb_vwv0,dsize);
1288 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1289 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1290 SSVAL(req->outbuf,smb_vwv3,dfree);
1291 } else {
1292 SSVAL(req->outbuf,smb_vwv0,dsize);
1293 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1294 SSVAL(req->outbuf,smb_vwv2,512);
1295 SSVAL(req->outbuf,smb_vwv3,dfree);
1296 }
1297
1298 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1299
1300 END_PROFILE(SMBdskattr);
1301 return;
1302 }
1303
1304 /*
1305 * Utility function to split the filename from the directory.
1306 */
1307 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1308 char **fname_dir_out,
1309 char **fname_mask_out)
1310 {
1311 const char *p = NULL;
1312 char *fname_dir = NULL;
1313 char *fname_mask = NULL;
1314
1315 p = strrchr_m(fname_in, '/');
1316 if (!p) {
1317 fname_dir = talloc_strdup(ctx, ".");
1318 fname_mask = talloc_strdup(ctx, fname_in);
1319 } else {
1320 fname_dir = talloc_strndup(ctx, fname_in,
1321 PTR_DIFF(p, fname_in));
1322 fname_mask = talloc_strdup(ctx, p+1);
1323 }
1324
1325 if (!fname_dir || !fname_mask) {
1326 TALLOC_FREE(fname_dir);
1327 TALLOC_FREE(fname_mask);
1328 return NT_STATUS_NO_MEMORY;
1329 }
1330
1331 *fname_dir_out = fname_dir;
1332 *fname_mask_out = fname_mask;
1333 return NT_STATUS_OK;
1334 }
1335
1336 /****************************************************************************
1337 Reply to a search.
1338 Can be called from SMBsearch, SMBffirst or SMBfunique.
1339 ****************************************************************************/
1340
1341 void reply_search(struct smb_request *req)
1342 {
1343 connection_struct *conn = req->conn;
1344 char *path = NULL;
1345 const char *mask = NULL;
1346 char *directory = NULL;
1347 struct smb_filename *smb_fname = NULL;
1348 char *fname = NULL;
1349 SMB_OFF_T size;
1350 uint32 mode;
1351 struct timespec date;
1352 uint32 dirtype;
1353 unsigned int numentries = 0;
1354 unsigned int maxentries = 0;
1355 bool finished = False;
1356 const char *p;
1357 int status_len;
1358 char status[21];
1359 int dptr_num= -1;
1360 bool check_descend = False;
1361 bool expect_close = False;
1362 NTSTATUS nt_status;
1363 bool mask_contains_wcard = False;
1364 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1365 TALLOC_CTX *ctx = talloc_tos();
1366 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1367 struct dptr_struct *dirptr = NULL;
1368 struct smbd_server_connection *sconn = req->sconn;
1369
1370 START_PROFILE(SMBsearch);
1371
1372 if (req->wct < 2) {
1373 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1374 goto out;
1375 }
1376
1377 if (lp_posix_pathnames()) {
1378 reply_unknown_new(req, req->cmd);
1379 goto out;
1380 }
1381
1382 /* If we were called as SMBffirst then we must expect close. */
1383 if(req->cmd == SMBffirst) {
1384 expect_close = True;
1385 }
1386
1387 reply_outbuf(req, 1, 3);
1388 maxentries = SVAL(req->vwv+0, 0);
1389 dirtype = SVAL(req->vwv+1, 0);
1390 p = (const char *)req->buf + 1;
1391 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1392 &nt_status, &mask_contains_wcard);
1393 if (!NT_STATUS_IS_OK(nt_status)) {
1394 reply_nterror(req, nt_status);
1395 goto out;
1396 }
1397
1398 p++;
1399 status_len = SVAL(p, 0);
1400 p += 2;
1401
1402 /* dirtype &= ~aDIR; */
1403
1404 if (status_len == 0) {
1405 nt_status = filename_convert(ctx, conn,
1406 req->flags2 & FLAGS2_DFS_PATHNAMES,
1407 path,
1408 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1409 &mask_contains_wcard,
1410 &smb_fname);
1411 if (!NT_STATUS_IS_OK(nt_status)) {
1412 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1413 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1414 ERRSRV, ERRbadpath);
1415 goto out;
1416 }
1417 reply_nterror(req, nt_status);
1418 goto out;
1419 }
1420
1421 directory = smb_fname->base_name;
1422
1423 p = strrchr_m(directory,'/');
1424 if ((p != NULL) && (*directory != '/')) {
1425 mask = p + 1;
1426 directory = talloc_strndup(ctx, directory,
1427 PTR_DIFF(p, directory));
1428 } else {
1429 mask = directory;
1430 directory = talloc_strdup(ctx,".");
1431 }
1432
1433 if (!directory) {
1434 reply_nterror(req, NT_STATUS_NO_MEMORY);
1435 goto out;
1436 }
1437
1438 memset((char *)status,'\0',21);
1439 SCVAL(status,0,(dirtype & 0x1F));
1440
1441 nt_status = dptr_create(conn,
1442 directory,
1443 True,
1444 expect_close,
1445 req->smbpid,
1446 mask,
1447 mask_contains_wcard,
1448 dirtype,
1449 &dirptr);
1450 if (!NT_STATUS_IS_OK(nt_status)) {
1451 reply_nterror(req, nt_status);
1452 goto out;
1453 }
1454 dptr_num = dptr_dnum(dirptr);
1455 } else {
1456 int status_dirtype;
1457 const char *dirpath;
1458
1459 memcpy(status,p,21);
1460 status_dirtype = CVAL(status,0) & 0x1F;
1461 if (status_dirtype != (dirtype & 0x1F)) {
1462 dirtype = status_dirtype;
1463 }
1464
1465 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1466 if (!dirptr) {
1467 goto SearchEmpty;
1468 }
1469 dirpath = dptr_path(sconn, dptr_num);
1470 directory = talloc_strdup(ctx, dirpath);
1471 if (!directory) {
1472 reply_nterror(req, NT_STATUS_NO_MEMORY);
1473 goto out;
1474 }
1475
1476 mask = dptr_wcard(sconn, dptr_num);
1477 if (!mask) {
1478 goto SearchEmpty;
1479 }
1480 /*
1481 * For a 'continue' search we have no string. So
1482 * check from the initial saved string.
1483 */
1484 mask_contains_wcard = ms_has_wild(mask);
1485 dirtype = dptr_attr(sconn, dptr_num);
1486 }
1487
1488 DEBUG(4,("dptr_num is %d\n",dptr_num));
1489
1490 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1491 dptr_init_search_op(dirptr);
1492
1493 if ((dirtype&0x1F) == aVOLID) {
1494 char buf[DIR_STRUCT_SIZE];
1495 memcpy(buf,status,21);
1496 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1497 0,aVOLID,0,!allow_long_path_components)) {
1498 reply_nterror(req, NT_STATUS_NO_MEMORY);
1499 goto out;
1500 }
1501 dptr_fill(sconn, buf+12,dptr_num);
1502 if (dptr_zero(buf+12) && (status_len==0)) {
1503 numentries = 1;
1504 } else {
1505 numentries = 0;
1506 }
1507 if (message_push_blob(&req->outbuf,
1508 data_blob_const(buf, sizeof(buf)))
1509 == -1) {
1510 reply_nterror(req, NT_STATUS_NO_MEMORY);
1511 goto out;
1512 }
1513 } else {
1514 unsigned int i;
1515 maxentries = MIN(
1516 maxentries,
1517 ((BUFFER_SIZE -
1518 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1519 /DIR_STRUCT_SIZE));
1520
1521 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1522 directory,lp_dontdescend(SNUM(conn))));
1523 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1524 check_descend = True;
1525 }
1526
1527 for (i=numentries;(i<maxentries) && !finished;i++) {
1528 finished = !get_dir_entry(ctx,
1529 dirptr,
1530 mask,
1531 dirtype,
1532 &fname,
1533 &size,
1534 &mode,
1535 &date,
1536 check_descend,
1537 ask_sharemode);
1538 if (!finished) {
1539 char buf[DIR_STRUCT_SIZE];
1540 memcpy(buf,status,21);
1541 if (!make_dir_struct(ctx,
1542 buf,
1543 mask,
1544 fname,
1545 size,
1546 mode,
1547 convert_timespec_to_time_t(date),
1548 !allow_long_path_components)) {
1549 reply_nterror(req, NT_STATUS_NO_MEMORY);
1550 goto out;
1551 }
1552 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1553 break;
1554 }
1555 if (message_push_blob(&req->outbuf,
1556 data_blob_const(buf, sizeof(buf)))
1557 == -1) {
1558 reply_nterror(req, NT_STATUS_NO_MEMORY);
1559 goto out;
1560 }
1561 numentries++;
1562 }
1563 }
1564 }
1565
1566 SearchEmpty:
1567
1568 /* If we were called as SMBffirst with smb_search_id == NULL
1569 and no entries were found then return error and close dirptr
1570 (X/Open spec) */
1571
1572 if (numentries == 0) {
1573 dptr_close(sconn, &dptr_num);
1574 } else if(expect_close && status_len == 0) {
1575 /* Close the dptr - we know it's gone */
1576 dptr_close(sconn, &dptr_num);
1577 }
1578
1579 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1580 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1581 dptr_close(sconn, &dptr_num);
1582 }
1583
1584 if ((numentries == 0) && !mask_contains_wcard) {
1585 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1586 goto out;
1587 }
1588
1589 SSVAL(req->outbuf,smb_vwv0,numentries);
1590 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1591 SCVAL(smb_buf(req->outbuf),0,5);
1592 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1593
1594 /* The replies here are never long name. */
1595 SSVAL(req->outbuf, smb_flg2,
1596 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1597 if (!allow_long_path_components) {
1598 SSVAL(req->outbuf, smb_flg2,
1599 SVAL(req->outbuf, smb_flg2)
1600 & (~FLAGS2_LONG_PATH_COMPONENTS));
1601 }
1602
1603 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1604 SSVAL(req->outbuf, smb_flg2,
1605 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1606
1607 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1608 smb_fn_name(req->cmd),
1609 mask,
1610 directory,
1611 dirtype,
1612 numentries,
1613 maxentries ));
1614 out:
1615 TALLOC_FREE(directory);
1616 TALLOC_FREE(smb_fname);
1617 END_PROFILE(SMBsearch);
1618 return;
1619 }
1620
1621 /****************************************************************************
1622 Reply to a fclose (stop directory search).
1623 ****************************************************************************/
1624
1625 void reply_fclose(struct smb_request *req)
1626 {
1627 int status_len;
1628 char status[21];
1629 int dptr_num= -2;
1630 const char *p;
1631 char *path = NULL;
1632 NTSTATUS err;
1633 bool path_contains_wcard = False;
1634 TALLOC_CTX *ctx = talloc_tos();
1635 struct smbd_server_connection *sconn = req->sconn;
1636
1637 START_PROFILE(SMBfclose);
1638
1639 if (lp_posix_pathnames()) {
1640 reply_unknown_new(req, req->cmd);
1641 END_PROFILE(SMBfclose);
1642 return;
1643 }
1644
1645 p = (const char *)req->buf + 1;
1646 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1647 &err, &path_contains_wcard);
1648 if (!NT_STATUS_IS_OK(err)) {
1649 reply_nterror(req, err);
1650 END_PROFILE(SMBfclose);
1651 return;
1652 }
1653 p++;
1654 status_len = SVAL(p,0);
1655 p += 2;
1656
1657 if (status_len == 0) {
1658 reply_force_doserror(req, ERRSRV, ERRsrverror);
1659 END_PROFILE(SMBfclose);
1660 return;
1661 }
1662
1663 memcpy(status,p,21);
1664
1665 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1666 /* Close the dptr - we know it's gone */
1667 dptr_close(sconn, &dptr_num);
1668 }
1669
1670 reply_outbuf(req, 1, 0);
1671 SSVAL(req->outbuf,smb_vwv0,0);
1672
1673 DEBUG(3,("search close\n"));
1674
1675 END_PROFILE(SMBfclose);
1676 return;
1677 }
1678
1679 /****************************************************************************
1680 Reply to an open.
1681 ****************************************************************************/
1682
1683 void reply_open(struct smb_request *req)
1684 {
1685 connection_struct *conn = req->conn;
1686 struct smb_filename *smb_fname = NULL;
1687 char *fname = NULL;
1688 uint32 fattr=0;
1689 SMB_OFF_T size = 0;
1690 time_t mtime=0;
1691 int info;
1692 files_struct *fsp;
1693 int oplock_request;
1694 int deny_mode;
1695 uint32 dos_attr;
1696 uint32 access_mask;
1697 uint32 share_mode;
1698 uint32 create_disposition;
1699 uint32 create_options = 0;
1700 uint32_t private_flags = 0;
1701 NTSTATUS status;
1702 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1703 TALLOC_CTX *ctx = talloc_tos();
1704
1705 START_PROFILE(SMBopen);
1706
1707 if (req->wct < 2) {
1708 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1709 goto out;
1710 }
1711
1712 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1713 deny_mode = SVAL(req->vwv+0, 0);
1714 dos_attr = SVAL(req->vwv+1, 0);
1715
1716 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1717 STR_TERMINATE, &status);
1718 if (!NT_STATUS_IS_OK(status)) {
1719 reply_nterror(req, status);
1720 goto out;
1721 }
1722
1723 status = filename_convert(ctx,
1724 conn,
1725 req->flags2 & FLAGS2_DFS_PATHNAMES,
1726 fname,
1727 0,
1728 NULL,
1729 &smb_fname);
1730 if (!NT_STATUS_IS_OK(status)) {
1731 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1732 reply_botherror(req,
1733 NT_STATUS_PATH_NOT_COVERED,
1734 ERRSRV, ERRbadpath);
1735 goto out;
1736 }
1737 reply_nterror(req, status);
1738 goto out;
1739 }
1740
1741 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1742 OPENX_FILE_EXISTS_OPEN, &access_mask,
1743 &share_mode, &create_disposition,
1744 &create_options, &private_flags)) {
1745 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1746 goto out;
1747 }
1748
1749 status = SMB_VFS_CREATE_FILE(
1750 conn, /* conn */
1751 req, /* req */
1752 0, /* root_dir_fid */
1753 smb_fname, /* fname */
1754 access_mask, /* access_mask */
1755 share_mode, /* share_access */
1756 create_disposition, /* create_disposition*/
1757 create_options, /* create_options */
1758 dos_attr, /* file_attributes */
1759 oplock_request, /* oplock_request */
1760 0, /* allocation_size */
1761 private_flags,
1762 NULL, /* sd */
1763 NULL, /* ea_list */
1764 &fsp, /* result */
1765 &info); /* pinfo */
1766
1767 if (!NT_STATUS_IS_OK(status)) {
1768 if (open_was_deferred(req->mid)) {
1769 /* We have re-scheduled this call. */
1770 goto out;
1771 }
1772 reply_openerror(req, status);
1773 goto out;
1774 }
1775
1776 size = smb_fname->st.st_ex_size;
1777 fattr = dos_mode(conn, smb_fname);
1778
1779 /* Deal with other possible opens having a modified
1780 write time. JRA. */
1781 if (ask_sharemode) {
1782 struct timespec write_time_ts;
1783
1784 ZERO_STRUCT(write_time_ts);
1785 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1786 if (!null_timespec(write_time_ts)) {
1787 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1788 }
1789 }
1790
1791 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1792
1793 if (fattr & aDIR) {
1794 DEBUG(3,("attempt to open a directory %s\n",
1795 fsp_str_dbg(fsp)));
1796 close_file(req, fsp, ERROR_CLOSE);
1797 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1798 ERRDOS, ERRnoaccess);
1799 goto out;
1800 }
1801
1802 reply_outbuf(req, 7, 0);
1803 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1804 SSVAL(req->outbuf,smb_vwv1,fattr);
1805 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1806 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1807 } else {
1808 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1809 }
1810 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1811 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1812
1813 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1814 SCVAL(req->outbuf,smb_flg,
1815 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1816 }
1817
1818 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1819 SCVAL(req->outbuf,smb_flg,
1820 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1821 }
1822 out:
1823 TALLOC_FREE(smb_fname);
1824 END_PROFILE(SMBopen);
1825 return;
1826 }
1827
1828 /****************************************************************************
1829 Reply to an open and X.
1830 ****************************************************************************/
1831
1832 void reply_open_and_X(struct smb_request *req)
1833 {
1834 connection_struct *conn = req->conn;
1835 struct smb_filename *smb_fname = NULL;
1836 char *fname = NULL;
1837 uint16 open_flags;
1838 int deny_mode;
1839 uint32 smb_attr;
1840 /* Breakout the oplock request bits so we can set the
1841 reply bits separately. */
1842 int ex_oplock_request;
1843 int core_oplock_request;
1844 int oplock_request;
1845 #if 0
1846 int smb_sattr = SVAL(req->vwv+4, 0);
1847 uint32 smb_time = make_unix_date3(req->vwv+6);
1848 #endif
1849 int smb_ofun;
1850 uint32 fattr=0;
1851 int mtime=0;
1852 int smb_action = 0;
1853 files_struct *fsp;
1854 NTSTATUS status;
1855 uint64_t allocation_size;
1856 ssize_t retval = -1;
1857 uint32 access_mask;
1858 uint32 share_mode;
1859 uint32 create_disposition;
1860 uint32 create_options = 0;
1861 uint32_t private_flags = 0;
1862 TALLOC_CTX *ctx = talloc_tos();
1863
1864 START_PROFILE(SMBopenX);
1865
1866 if (req->wct < 15) {
1867 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1868 goto out;
1869 }
1870
1871 open_flags = SVAL(req->vwv+2, 0);
1872 deny_mode = SVAL(req->vwv+3, 0);
1873 smb_attr = SVAL(req->vwv+5, 0);
1874 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1875 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1876 oplock_request = ex_oplock_request | core_oplock_request;
1877 smb_ofun = SVAL(req->vwv+8, 0);
1878 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1879
1880 /* If it's an IPC, pass off the pipe handler. */
1881 if (IS_IPC(conn)) {
1882 if (lp_nt_pipe_support()) {
1883 reply_open_pipe_and_X(conn, req);
1884 } else {
1885 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1886 }
1887 goto out;
1888 }
1889
1890 /* XXXX we need to handle passed times, sattr and flags */
1891 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1892 STR_TERMINATE, &status);
1893 if (!NT_STATUS_IS_OK(status)) {
1894 reply_nterror(req, status);
1895 goto out;
1896 }
1897
1898 status = filename_convert(ctx,
1899 conn,
1900 req->flags2 & FLAGS2_DFS_PATHNAMES,
1901 fname,
1902 0,
1903 NULL,
1904 &smb_fname);
1905 if (!NT_STATUS_IS_OK(status)) {
1906 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1907 reply_botherror(req,
1908 NT_STATUS_PATH_NOT_COVERED,
1909 ERRSRV, ERRbadpath);
1910 goto out;
1911 }
1912 reply_nterror(req, status);
1913 goto out;
1914 }
1915
1916 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1917 &access_mask, &share_mode,
1918 &create_disposition,
1919 &create_options,
1920 &private_flags)) {
1921 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1922 goto out;
1923 }
1924
1925 status = SMB_VFS_CREATE_FILE(
1926 conn, /* conn */
1927 req, /* req */
1928 0, /* root_dir_fid */
1929 smb_fname, /* fname */
1930 access_mask, /* access_mask */
1931 share_mode, /* share_access */
1932 create_disposition, /* create_disposition*/
1933 create_options, /* create_options */
1934 smb_attr, /* file_attributes */
1935 oplock_request, /* oplock_request */
1936 0, /* allocation_size */
1937 private_flags,
1938 NULL, /* sd */
1939 NULL, /* ea_list */
1940 &fsp, /* result */
1941 &smb_action); /* pinfo */
1942
1943 if (!NT_STATUS_IS_OK(status)) {
1944 if (open_was_deferred(req->mid)) {
1945 /* We have re-scheduled this call. */
1946 goto out;
1947 }
1948 reply_openerror(req, status);
1949 goto out;
1950 }
1951
1952 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1953 if the file is truncated or created. */
1954 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1955 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1956 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1957 close_file(req, fsp, ERROR_CLOSE);
1958 reply_nterror(req, NT_STATUS_DISK_FULL);
1959 goto out;
1960 }
1961 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1962 if (retval < 0) {
1963 close_file(req, fsp, ERROR_CLOSE);
1964 reply_nterror(req, NT_STATUS_DISK_FULL);
1965 goto out;
1966 }
1967 smb_fname->st.st_ex_size =
1968 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1969 }
1970
1971 fattr = dos_mode(conn, smb_fname);
1972 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1973 if (fattr & aDIR) {
1974 close_file(req, fsp, ERROR_CLOSE);
1975 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1976 goto out;
1977 }
1978
1979 /* If the caller set the extended oplock request bit
1980 and we granted one (by whatever means) - set the
1981 correct bit for extended oplock reply.
1982 */
1983
1984 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1985 smb_action |= EXTENDED_OPLOCK_GRANTED;
1986 }
1987
1988 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1989 smb_action |= EXTENDED_OPLOCK_GRANTED;
1990 }
1991
1992 /* If the caller set the core oplock request bit
1993 and we granted one (by whatever means) - set the
1994 correct bit for core oplock reply.
1995 */
1996
1997 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1998 reply_outbuf(req, 19, 0);
1999 } else {
2000 reply_outbuf(req, 15, 0);
2001 }
2002
2003 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2004 SCVAL(req->outbuf, smb_flg,
2005 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2006 }
2007
2008 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2009 SCVAL(req->outbuf, smb_flg,
2010 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2011 }
2012
2013 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2014 SSVAL(req->outbuf,smb_vwv3,fattr);
2015 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2016 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2017 } else {
2018 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2019 }
2020 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2021 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2022 SSVAL(req->outbuf,smb_vwv11,smb_action);
2023
2024 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2025 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2026 }
2027
2028 chain_reply(req);
2029 out:
2030 TALLOC_FREE(smb_fname);
2031 END_PROFILE(SMBopenX);
2032 return;
2033 }
2034
2035 /****************************************************************************
2036 Reply to a SMBulogoffX.
2037 ****************************************************************************/
2038
2039 void reply_ulogoffX(struct smb_request *req)
2040 {
2041 struct smbd_server_connection *sconn = req->sconn;
2042 user_struct *vuser;
2043
2044 START_PROFILE(SMBulogoffX);
2045
2046 vuser = get_valid_user_struct(sconn, req->vuid);
2047
2048 if(vuser == NULL) {
2049 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2050 req->vuid));
2051 }
2052
2053 /* in user level security we are supposed to close any files
2054 open by this user */
2055 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2056 file_close_user(req->vuid);
2057 }
2058
2059 invalidate_vuid(sconn, req->vuid);
2060
2061 reply_outbuf(req, 2, 0);
2062
2063 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2064
2065 END_PROFILE(SMBulogoffX);
2066 req->vuid = UID_FIELD_INVALID;
2067 chain_reply(req);
2068 }
2069
2070 /****************************************************************************
2071 Reply to a mknew or a create.
2072 ****************************************************************************/
2073
2074 void reply_mknew(struct smb_request *req)
2075 {
2076 connection_struct *conn = req->conn;
2077 struct smb_filename *smb_fname = NULL;
2078 char *fname = NULL;
2079 uint32 fattr = 0;
2080 struct smb_file_time ft;
2081 files_struct *fsp;
2082 int oplock_request = 0;
2083 NTSTATUS status;
2084 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2085 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2086 uint32 create_disposition;
2087 uint32 create_options = 0;
2088 TALLOC_CTX *ctx = talloc_tos();
2089
2090 START_PROFILE(SMBcreate);
2091 ZERO_STRUCT(ft);
2092
2093 if (req->wct < 3) {
2094 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2095 goto out;
2096 }
2097
2098 fattr = SVAL(req->vwv+0, 0);
2099 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2100
2101 /* mtime. */
2102 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2103
2104 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2105 STR_TERMINATE, &status);
2106 if (!NT_STATUS_IS_OK(status)) {
2107 reply_nterror(req, status);
2108 goto out;
2109 }
2110
2111 status = filename_convert(ctx,
2112 conn,
2113 req->flags2 & FLAGS2_DFS_PATHNAMES,
2114 fname,
2115 0,
2116 NULL,
2117 &smb_fname);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2120 reply_botherror(req,
2121 NT_STATUS_PATH_NOT_COVERED,
2122 ERRSRV, ERRbadpath);
2123 goto out;
2124 }
2125 reply_nterror(req, status);
2126 goto out;
2127 }
2128
2129 if (fattr & aVOLID) {
2130 DEBUG(0,("Attempt to create file (%s) with volid set - "
2131 "please report this\n",
2132 smb_fname_str_dbg(smb_fname)));
2133 }
2134
2135 if(req->cmd == SMBmknew) {
2136 /* We should fail if file exists. */
2137 create_disposition = FILE_CREATE;
2138 } else {
2139 /* Create if file doesn't exist, truncate if it does. */
2140 create_disposition = FILE_OVERWRITE_IF;
2141 }
2142
2143 status = SMB_VFS_CREATE_FILE(
2144 conn, /* conn */
2145 req, /* req */
2146 0, /* root_dir_fid */
2147 smb_fname, /* fname */
2148 access_mask, /* access_mask */
2149 share_mode, /* share_access */
2150 create_disposition, /* create_disposition*/
2151 create_options, /* create_options */
2152 fattr, /* file_attributes */
2153 oplock_request, /* oplock_request */
2154 0, /* allocation_size */
2155 0, /* private_flags */
2156 NULL, /* sd */
2157 NULL, /* ea_list */
2158 &fsp, /* result */
2159 NULL); /* pinfo */
2160
2161 if (!NT_STATUS_IS_OK(status)) {
2162 if (open_was_deferred(req->mid)) {
2163 /* We have re-scheduled this call. */
2164 goto out;
2165 }
2166 reply_openerror(req, status);
2167 goto out;
2168 }
2169
2170 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2171 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2172 if (!NT_STATUS_IS_OK(status)) {
2173 END_PROFILE(SMBcreate);
2174 goto out;
2175 }
2176
2177 reply_outbuf(req, 1, 0);
2178 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2179
2180 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2181 SCVAL(req->outbuf,smb_flg,
2182 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2183 }
2184
2185 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2186 SCVAL(req->outbuf,smb_flg,
2187 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2188 }
2189
2190 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2191 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2192 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2193 (unsigned int)fattr));
2194
2195 out:
2196 TALLOC_FREE(smb_fname);
2197 END_PROFILE(SMBcreate);
2198 return;
2199 }
2200
2201 /****************************************************************************
2202 Reply to a create temporary file.
2203 ****************************************************************************/
2204
2205 void reply_ctemp(struct smb_request *req)
2206 {
2207 connection_struct *conn = req->conn;
2208 struct smb_filename *smb_fname = NULL;
2209 char *fname = NULL;
2210 uint32 fattr;
2211 files_struct *fsp;
2212 int oplock_request;
2213 int tmpfd;
2214 char *s;
2215 NTSTATUS status;
2216 TALLOC_CTX *ctx = talloc_tos();
2217
2218 START_PROFILE(SMBctemp);
2219
2220 if (req->wct < 3) {
2221 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2222 goto out;
2223 }
2224
2225 fattr = SVAL(req->vwv+0, 0);
2226 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2227
2228 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2229 STR_TERMINATE, &status);
2230 if (!NT_STATUS_IS_OK(status)) {
2231 reply_nterror(req, status);
2232 goto out;
2233 }
2234 if (*fname) {
2235 fname = talloc_asprintf(ctx,
2236 "%s/TMXXXXXX",
2237 fname);
2238 } else {
2239 fname = talloc_strdup(ctx, "TMXXXXXX");
2240 }
2241
2242 if (!fname) {
2243 reply_nterror(req, NT_STATUS_NO_MEMORY);
2244 goto out;
2245 }
2246
2247 status = filename_convert(ctx, conn,
2248 req->flags2 & FLAGS2_DFS_PATHNAMES,
2249 fname,
2250 0,
2251 NULL,
2252 &smb_fname);
2253 if (!NT_STATUS_IS_OK(status)) {
2254 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2255 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2256 ERRSRV, ERRbadpath);
2257 goto out;
2258 }
2259 reply_nterror(req, status);
2260 goto out;
2261 }
2262
2263 tmpfd = mkstemp(smb_fname->base_name);
2264 if (tmpfd == -1) {
2265 reply_nterror(req, map_nt_error_from_unix(errno));
2266 goto out;
2267 }
2268
2269 SMB_VFS_STAT(conn, smb_fname);
2270
2271 /* We should fail if file does not exist. */
2272 status = SMB_VFS_CREATE_FILE(
2273 conn, /* conn */
2274 req, /* req */
2275 0, /* root_dir_fid */
2276 smb_fname, /* fname */
2277 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2278 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2279 FILE_OPEN, /* create_disposition*/
2280 0, /* create_options */
2281 fattr, /* file_attributes */
2282 oplock_request, /* oplock_request */
2283 0, /* allocation_size */
2284 0, /* private_flags */
2285 NULL, /* sd */
2286 NULL, /* ea_list */
2287 &fsp, /* result */
2288 NULL); /* pinfo */
2289
2290 /* close fd from mkstemp() */
2291 close(tmpfd);
2292
2293 if (!NT_STATUS_IS_OK(status)) {
2294 if (open_was_deferred(req->mid)) {
2295 /* We have re-scheduled this call. */
2296 goto out;
2297 }
2298 reply_openerror(req, status);
2299 goto out;
2300 }
2301
2302 reply_outbuf(req, 1, 0);
2303 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2304
2305 /* the returned filename is relative to the directory */
2306 s = strrchr_m(fsp->fsp_name->base_name, '/');
2307 if (!s) {
2308 s = fsp->fsp_name->base_name;
2309 } else {
2310 s++;
2311 }
2312
2313 #if 0
2314 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2315 thing in the byte section. JRA */
2316 SSVALS(p, 0, -1); /* what is this? not in spec */
2317 #endif
2318 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2319 == -1) {
2320 reply_nterror(req, NT_STATUS_NO_MEMORY);
2321 goto out;
2322 }
2323
2324 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2325 SCVAL(req->outbuf, smb_flg,
2326 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2327 }
2328
2329 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2330 SCVAL(req->outbuf, smb_flg,
2331 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2332 }
2333
2334 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2335 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2336 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2337 out:
2338 TALLOC_FREE(smb_fname);
2339 END_PROFILE(SMBctemp);
2340 return;
2341 }
2342
2343 /*******************************************************************
2344 Check if a user is allowed to rename a file.
2345 ********************************************************************/
2346
2347 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2348 uint16 dirtype)
2349 {
2350 uint32 fmode;
2351
2352 if (!CAN_WRITE(conn)) {
2353 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2354 }
2355
2356 fmode = dos_mode(conn, fsp->fsp_name);
2357 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2358 return NT_STATUS_NO_SUCH_FILE;
2359 }
2360
2361 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2362 if (fsp->posix_open) {
2363 return NT_STATUS_OK;
2364 }
2365
2366 /* If no pathnames are open below this
2367 directory, allow the rename. */
2368
2369 if (file_find_subpath(fsp)) {
2370 return NT_STATUS_ACCESS_DENIED;
2371 }
2372 return NT_STATUS_OK;
2373 }
2374
2375 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2376 return NT_STATUS_OK;
2377 }
2378
2379 return NT_STATUS_ACCESS_DENIED;
2380 }
2381
2382 /*******************************************************************
2383 * unlink a file with all relevant access checks
2384 *******************************************************************/
2385
2386 static NTSTATUS do_unlink(connection_struct *conn,
2387 struct smb_request *req,
2388 struct smb_filename *smb_fname,
2389 uint32 dirtype)
2390 {
2391 uint32 fattr;
2392 files_struct *fsp;
2393 uint32 dirtype_orig = dirtype;
2394 NTSTATUS status;
2395 int ret;
2396 bool posix_paths = lp_posix_pathnames();
2397
2398 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2399 smb_fname_str_dbg(smb_fname),
2400 dirtype));
2401
2402 if (!CAN_WRITE(conn)) {
2403 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2404 }
2405
2406 if (posix_paths) {
2407 ret = SMB_VFS_LSTAT(conn, smb_fname);
2408 } else {
2409 ret = SMB_VFS_STAT(conn, smb_fname);
2410 }
2411 if (ret != 0) {
2412 return map_nt_error_from_unix(errno);
2413 }
2414
2415 fattr = dos_mode(conn, smb_fname);
2416
2417 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2418 dirtype = aDIR|aARCH|aRONLY;
2419 }
2420
2421 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2422 if (!dirtype) {
2423 return NT_STATUS_NO_SUCH_FILE;
2424 }
2425
2426 if (!dir_check_ftype(conn, fattr, dirtype)) {
2427 if (fattr & aDIR) {
2428 return NT_STATUS_FILE_IS_A_DIRECTORY;
2429 }
2430 return NT_STATUS_NO_SUCH_FILE;
2431 }
2432
2433 if (dirtype_orig & 0x8000) {
2434 /* These will never be set for POSIX. */
2435 return NT_STATUS_NO_SUCH_FILE;
2436 }
2437
2438 #if 0
2439 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2440 return NT_STATUS_FILE_IS_A_DIRECTORY;
2441 }
2442
2443 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2444 return NT_STATUS_NO_SUCH_FILE;
2445 }
2446
2447 if (dirtype & 0xFF00) {
2448 /* These will never be set for POSIX. */
2449 return NT_STATUS_NO_SUCH_FILE;
2450 }
2451
2452 dirtype &= 0xFF;
2453 if (!dirtype) {
2454 return NT_STATUS_NO_SUCH_FILE;
2455 }
2456
2457 /* Can't delete a directory. */
2458 if (fattr & aDIR) {
2459 return NT_STATUS_FILE_IS_A_DIRECTORY;
2460 }
2461 #endif
2462
2463 #if 0 /* JRATEST */
2464 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2465 return NT_STATUS_OBJECT_NAME_INVALID;
2466 #endif /* JRATEST */
2467
2468 /* On open checks the open itself will check the share mode, so
2469 don't do it here as we'll get it wrong. */
2470
2471 status = SMB_VFS_CREATE_FILE
2472 (conn, /* conn */
2473 req, /* req */
2474 0, /* root_dir_fid */
2475 smb_fname, /* fname */
2476 DELETE_ACCESS, /* access_mask */
2477 FILE_SHARE_NONE, /* share_access */
2478 FILE_OPEN, /* create_disposition*/
2479 FILE_NON_DIRECTORY_FILE, /* create_options */
2480 /* file_attributes */
2481 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2482 FILE_ATTRIBUTE_NORMAL,
2483 0, /* oplock_request */
2484 0, /* allocation_size */
2485 0, /* private_flags */
2486 NULL, /* sd */
2487 NULL, /* ea_list */
2488 &fsp, /* result */
2489 NULL); /* pinfo */
2490
2491 if (!NT_STATUS_IS_OK(status)) {
2492 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2493 nt_errstr(status)));
2494 return status;
2495 }
2496
2497 status = can_set_delete_on_close(fsp, fattr);
2498 if (!NT_STATUS_IS_OK(status)) {
2499 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2500 "(%s)\n",
2501 smb_fname_str_dbg(smb_fname),
2502 nt_errstr(status)));
2503 close_file(req, fsp, NORMAL_CLOSE);
2504 return status;
2505 }
2506
2507 /* The set is across all open files on this dev/inode pair. */
2508 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2509 close_file(req, fsp, NORMAL_CLOSE);
2510 return NT_STATUS_ACCESS_DENIED;
2511 }
2512
2513 return close_file(req, fsp, NORMAL_CLOSE);
2514 }
2515
2516 /****************************************************************************
2517 The guts of the unlink command, split out so it may be called by the NT SMB
2518 code.
2519 ****************************************************************************/
2520
2521 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2522 uint32 dirtype, struct smb_filename *smb_fname,
2523 bool has_wild)
2524 {
2525 char *fname_dir = NULL;
2526 char *fname_mask = NULL;
2527 int count=0;
2528 NTSTATUS status = NT_STATUS_OK;
2529 TALLOC_CTX *ctx = talloc_tos();
2530
2531 /* Split up the directory from the filename/mask. */
2532 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2533 &fname_dir, &fname_mask);
2534 if (!NT_STATUS_IS_OK(status)) {
2535 goto out;
2536 }
2537
2538 /*
2539 * We should only check the mangled cache
2540 * here if unix_convert failed. This means
2541 * that the path in 'mask' doesn't exist
2542 * on the file system and so we need to look
2543 * for a possible mangle. This patch from
2544 * Tine Smukavec <valentin.smukavec@hermes.si>.
2545 */
2546
2547 if (!VALID_STAT(smb_fname->st) &&
2548 mangle_is_mangled(fname_mask, conn->params)) {
2549 char *new_mask = NULL;
2550 mangle_lookup_name_from_8_3(ctx, fname_mask,
2551 &new_mask, conn->params);
2552 if (new_mask) {
2553 TALLOC_FREE(fname_mask);
2554 fname_mask = new_mask;
2555 }
2556 }
2557
2558 if (!has_wild) {
2559
2560 /*
2561 * Only one file needs to be unlinked. Append the mask back
2562 * onto the directory.
2563 */
2564 TALLOC_FREE(smb_fname->base_name);
2565 smb_fname->base_name = talloc_asprintf(smb_fname,
2566 "%s/%s",
2567 fname_dir,
2568 fname_mask);
2569 if (!smb_fname->base_name) {
2570 status = NT_STATUS_NO_MEMORY;
2571 goto out;
2572 }
2573 if (dirtype == 0) {
2574 dirtype = FILE_ATTRIBUTE_NORMAL;
2575 }
2576
2577 status = check_name(conn, smb_fname->base_name);
2578 if (!NT_STATUS_IS_OK(status)) {
2579 goto out;
2580 }
2581
2582 status = do_unlink(conn, req, smb_fname, dirtype);
2583 if (!NT_STATUS_IS_OK(status)) {
2584 goto out;
2585 }
2586
2587 count++;
2588 } else {
2589 struct smb_Dir *dir_hnd = NULL;
2590 long offset = 0;
2591 const char *dname = NULL;
2592 char *talloced = NULL;
2593
2594 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2595 status = NT_STATUS_OBJECT_NAME_INVALID;
2596 goto out;
2597 }
2598
2599 if (strequal(fname_mask,"????????.???")) {
2600 TALLOC_FREE(fname_mask);
2601 fname_mask = talloc_strdup(ctx, "*");
2602 if (!fname_mask) {
2603 status = NT_STATUS_NO_MEMORY;
2604 goto out;
2605 }
2606 }
2607
2608 status = check_name(conn, fname_dir);
2609 if (!NT_STATUS_IS_OK(status)) {
2610 goto out;
2611 }
2612
2613 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2614 dirtype);
2615 if (dir_hnd == NULL) {
2616 status = map_nt_error_from_unix(errno);
2617 goto out;
2618 }
2619
2620 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2621 the pattern matches against the long name, otherwise the short name
2622 We don't implement this yet XXXX
2623 */
2624
2625 status = NT_STATUS_NO_SUCH_FILE;
2626
2627 while ((dname = ReadDirName(dir_hnd, &offset,
2628 &smb_fname->st, &talloced))) {
2629 TALLOC_CTX *frame = talloc_stackframe();
2630
2631 if (!is_visible_file(conn, fname_dir, dname,
2632 &smb_fname->st, true)) {
2633 TALLOC_FREE(frame);
2634 TALLOC_FREE(talloced);
2635 continue;
2636 }
2637
2638 /* Quick check for "." and ".." */
2639 if (ISDOT(dname) || ISDOTDOT(dname)) {
2640 TALLOC_FREE(frame);
2641 TALLOC_FREE(talloced);
2642 continue;
2643 }
2644
2645 if(!mask_match(dname, fname_mask,
2646 conn->case_sensitive)) {
2647 TALLOC_FREE(frame);
2648 TALLOC_FREE(talloced);
2649 continue;
2650 }
2651
2652 TALLOC_FREE(smb_fname->base_name);
2653 smb_fname->base_name =
2654 talloc_asprintf(smb_fname, "%s/%s",
2655 fname_dir, dname);
2656
2657 if (!smb_fname->base_name) {
2658 TALLOC_FREE(dir_hnd);
2659 status = NT_STATUS_NO_MEMORY;
2660 TALLOC_FREE(frame);
2661 TALLOC_FREE(talloced);
2662 goto out;
2663 }
2664
2665 status = check_name(conn, smb_fname->base_name);
2666 if (!NT_STATUS_IS_OK(status)) {
2667 TALLOC_FREE(dir_hnd);
2668 TALLOC_FREE(frame);
2669 TALLOC_FREE(talloced);
2670 goto out;
2671 }
2672
2673 status = do_unlink(conn, req, smb_fname, dirtype);
2674 if (!NT_STATUS_IS_OK(status)) {
2675 TALLOC_FREE(frame);
2676 TALLOC_FREE(talloced);
2677 continue;
2678 }
2679
2680 count++;
2681 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2682 smb_fname->base_name));
2683
2684 TALLOC_FREE(frame);
2685 TALLOC_FREE(talloced);
2686 }
2687 TALLOC_FREE(dir_hnd);
2688 }
2689
2690 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2691 status = map_nt_error_from_unix(errno);
2692 }
2693
2694 out:
2695 TALLOC_FREE(fname_dir);
2696 TALLOC_FREE(fname_mask);
2697 return status;
2698 }
2699
2700 /****************************************************************************
2701 Reply to a unlink
2702 ****************************************************************************/
2703
2704 void reply_unlink(struct smb_request *req)
2705 {
2706 connection_struct *conn = req->conn;
2707 char *name = NULL;
2708 struct smb_filename *smb_fname = NULL;
2709 uint32 dirtype;
2710 NTSTATUS status;
2711 bool path_contains_wcard = False;
2712 TALLOC_CTX *ctx = talloc_tos();
2713
2714 START_PROFILE(SMBunlink);
2715
2716 if (req->wct < 1) {
2717 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2718 goto out;
2719 }
2720
2721 dirtype = SVAL(req->vwv+0, 0);
2722
2723 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2724 STR_TERMINATE, &status,
2725 &path_contains_wcard);
2726 if (!NT_STATUS_IS_OK(status)) {
2727 reply_nterror(req, status);
2728 goto out;
2729 }
2730
2731 status = filename_convert(ctx, conn,
2732 req->flags2 & FLAGS2_DFS_PATHNAMES,
2733 name,
2734 UCF_COND_ALLOW_WCARD_LCOMP,
2735 &path_contains_wcard,
2736 &smb_fname);
2737 if (!NT_STATUS_IS_OK(status)) {
2738 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2739 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2740 ERRSRV, ERRbadpath);
2741 goto out;
2742 }
2743 reply_nterror(req, status);
2744 goto out;
2745 }
2746
2747 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2748
2749 status = unlink_internals(conn, req, dirtype, smb_fname,
2750 path_contains_wcard);
2751 if (!NT_STATUS_IS_OK(status)) {
2752 if (open_was_deferred(req->mid)) {
2753 /* We have re-scheduled this call. */
2754 goto out;
2755 }
2756 reply_nterror(req, status);
2757 goto out;
2758 }
2759
2760 reply_outbuf(req, 0, 0);
2761 out:
2762 TALLOC_FREE(smb_fname);
2763 END_PROFILE(SMBunlink);
2764 return;
2765 }
2766
2767 /****************************************************************************
2768 Fail for readbraw.
2769 ****************************************************************************/
2770
2771 static void fail_readraw(void)
2772 {
2773 const char *errstr = talloc_asprintf(talloc_tos(),
2774 "FAIL ! reply_readbraw: socket write fail (%s)",
2775 strerror(errno));
2776 if (!errstr) {
2777 errstr = "";
2778 }
2779 exit_server_cleanly(errstr);
2780 }
2781
2782 /****************************************************************************
2783 Fake (read/write) sendfile. Returns -1 on read or write fail.
2784 ****************************************************************************/
2785
2786 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2787 size_t nread)
2788 {
2789 size_t bufsize;
2790 size_t tosend = nread;
2791 char *buf;
2792
2793 if (nread == 0) {
2794 return 0;
2795 }
2796
2797 bufsize = MIN(nread, 65536);
2798
2799 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2800 return -1;
2801 }
2802
2803 while (tosend > 0) {
2804 ssize_t ret;
2805 size_t cur_read;
2806
2807 if (tosend > bufsize) {
2808 cur_read = bufsize;
2809 } else {
2810 cur_read = tosend;
2811 }
2812 ret = read_file(fsp,buf,startpos,cur_read);
2813 if (ret == -1) {
2814 SAFE_FREE(buf);
2815 return -1;
2816 }
2817
2818 /* If we had a short read, fill with zeros. */
2819 if (ret < cur_read) {
2820 memset(buf + ret, '\0', cur_read - ret);
2821 }
2822
2823 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2824 != cur_read) {
2825 char addr[INET6_ADDRSTRLEN];
2826 /*
2827 * Try and give an error message saying what
2828 * client failed.
2829 */
2830 DEBUG(0, ("write_data failed for client %s. "
2831 "Error %s\n",
2832 get_peer_addr(fsp->conn->sconn->sock, addr,
2833 sizeof(addr)),
2834 strerror(errno)));
2835 SAFE_FREE(buf);
2836 return -1;
2837 }
2838 tosend -= cur_read;
2839 startpos += cur_read;
2840 }
2841
2842 SAFE_FREE(buf);
2843 return (ssize_t)nread;
2844 }
2845
2846 #if defined(WITH_SENDFILE)
2847 /****************************************************************************
2848 Deal with the case of sendfile reading less bytes from the file than
2849 requested. Fill with zeros (all we can do).
2850 ****************************************************************************/
2851
2852 static void sendfile_short_send(files_struct *fsp,
2853 ssize_t nread,
2854 size_t headersize,
2855 size_t smb_maxcnt)
2856 {
2857 #define SHORT_SEND_BUFSIZE 1024
2858 if (nread < headersize) {
2859 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2860 "header for file %s (%s). Terminating\n",
2861 fsp_str_dbg(fsp), strerror(errno)));
2862 exit_server_cleanly("sendfile_short_send failed");
2863 }
2864
2865 nread -= headersize;
2866
2867 if (nread < smb_maxcnt) {
2868 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2869 if (!buf) {
2870 exit_server_cleanly("sendfile_short_send: "
2871 "malloc failed");
2872 }
2873
2874 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2875 "with zeros !\n", fsp_str_dbg(fsp)));
2876
2877 while (nread < smb_maxcnt) {
2878 /*
2879 * We asked for the real file size and told sendfile
2880 * to not go beyond the end of the file. But it can
2881 * happen that in between our fstat call and the
2882 * sendfile call the file was truncated. This is very
2883 * bad because we have already announced the larger
2884 * number of bytes to the client.
2885 *
2886 * The best we can do now is to send 0-bytes, just as
2887 * a read from a hole in a sparse file would do.
2888 *
2889 * This should happen rarely enough that I don't care
2890 * about efficiency here :-)
2891 */
2892 size_t to_write;
2893
2894 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2895 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2896 != to_write) {
2897 char addr[INET6_ADDRSTRLEN];
2898 /*
2899 * Try and give an error message saying what
2900 * client failed.
2901 */
2902 DEBUG(0, ("write_data failed for client %s. "
2903 "Error %s\n",
2904 get_peer_addr(
2905 fsp->conn->sconn->sock, addr,
2906 sizeof(addr)),
2907 strerror(errno)));
2908 exit_server_cleanly("sendfile_short_send: "
2909 "write_data failed");
2910 }
2911 nread += to_write;
2912 }
2913 SAFE_FREE(buf);
2914 }
2915 }
2916 #endif /* defined WITH_SENDFILE */
2917
2918 /****************************************************************************
2919 Return a readbraw error (4 bytes of zero).
2920 ****************************************************************************/
2921
2922 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2923 {
2924 char header[4];
2925
2926 SIVAL(header,0,0);
2927
2928 smbd_lock_socket(sconn);
2929 if (write_data(sconn->sock,header,4) != 4) {
2930 char addr[INET6_ADDRSTRLEN];
2931 /*
2932 * Try and give an error message saying what
2933 * client failed.
2934 */
2935 DEBUG(0, ("write_data failed for client %s. "
2936 "Error %s\n",
2937 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2938 strerror(errno)));
2939
2940 fail_readraw();
2941 }
2942 smbd_unlock_socket(sconn);
2943 }
2944
2945 /****************************************************************************
2946 Use sendfile in readbraw.
2947 ****************************************************************************/
2948
2949 static void send_file_readbraw(connection_struct *conn,
2950 struct smb_request *req,
2951 files_struct *fsp,
2952 SMB_OFF_T startpos,
2953 size_t nread,
2954 ssize_t mincount)
2955 {
2956 struct smbd_server_connection *sconn = req->sconn;
2957 char *outbuf = NULL;
2958 ssize_t ret=0;
2959
2960 #if defined(WITH_SENDFILE)
2961 /*
2962 * We can only use sendfile on a non-chained packet
2963 * but we can use on a non-oplocked file. tridge proved this
2964 * on a train in Germany :-). JRA.
2965 * reply_readbraw has already checked the length.
2966 */
2967
2968 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2969 (fsp->wcp == NULL) &&
2970 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
2971 ssize_t sendfile_read = -1;
2972 char header[4];
2973 DATA_BLOB header_blob;
2974
2975 _smb_setlen(header,nread);
2976 header_blob = data_blob_const(header, 4);
2977
2978 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
2979 &header_blob, startpos,
2980 nread);
2981 if (sendfile_read == -1) {
2982 /* Returning ENOSYS means no data at all was sent.
2983 * Do this as a normal read. */
2984 if (errno == ENOSYS) {
2985 goto normal_readbraw;
2986 }
2987
2988 /*
2989 * Special hack for broken Linux with no working sendfile. If we
2990 * return EINTR we sent the header but not the rest of the data.
2991 * Fake this up by doing read/write calls.
2992 */
2993 if (errno == EINTR) {
2994 /* Ensure we don't do this again. */
2995 set_use_sendfile(SNUM(conn), False);
2996 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2997
2998 if (fake_sendfile(fsp, startpos, nread) == -1) {
2999 DEBUG(0,("send_file_readbraw: "
3000 "fake_sendfile failed for "
3001 "file %s (%s).\n",
3002 fsp_str_dbg(fsp),
3003 strerror(errno)));
3004 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3005 }
3006 return;
3007 }
3008
3009 DEBUG(0,("send_file_readbraw: sendfile failed for "
3010 "file %s (%s). Terminating\n",
3011 fsp_str_dbg(fsp), strerror(errno)));
3012 exit_server_cleanly("send_file_readbraw sendfile failed");
3013 } else if (sendfile_read == 0) {
3014 /*
3015 * Some sendfile implementations return 0 to indicate
3016 * that there was a short read, but nothing was
3017 * actually written to the socket. In this case,
3018 * fallback to the normal read path so the header gets
3019 * the correct byte count.
3020 */
3021 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3022 "bytes falling back to the normal read: "
3023 "%s\n", fsp_str_dbg(fsp)));
3024 goto normal_readbraw;
3025 }
3026
3027 /* Deal with possible short send. */
3028 if (sendfile_read != 4+nread) {
3029 sendfile_short_send(fsp, sendfile_read, 4, nread);
3030 }
3031 return;
3032 }
3033
3034 normal_readbraw:
3035 #endif
3036
3037 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3038 if (!outbuf) {
3039 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3040 (unsigned)(nread+4)));
3041 reply_readbraw_error(sconn);
3042 return;
3043 }
3044
3045 if (nread > 0) {
3046 ret = read_file(fsp,outbuf+4,startpos,nread);
3047 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3048 if (ret < mincount)
3049 ret = 0;
3050 #else
3051 if (ret < nread)
3052 ret = 0;
3053 #endif
3054 }
3055
3056 _smb_setlen(outbuf,ret);
3057 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3058 char addr[INET6_ADDRSTRLEN];
3059 /*
3060 * Try and give an error message saying what
3061 * client failed.
3062 */
3063 DEBUG(0, ("write_data failed for client %s. "
3064 "Error %s\n",
3065 get_peer_addr(fsp->conn->sconn->sock, addr,
3066 sizeof(addr)),
3067 strerror(errno)));
3068
3069 fail_readraw();
3070 }
3071
3072 TALLOC_FREE(outbuf);
3073 }
3074
3075 /****************************************************************************
3076 Reply to a readbraw (core+ protocol).
3077 ****************************************************************************/
3078
3079 void reply_readbraw(struct smb_request *req)
3080 {
3081 connection_struct *conn = req->conn;
3082 struct smbd_server_connection *sconn = req->sconn;
3083 ssize_t maxcount,mincount;
3084 size_t nread = 0;
3085 SMB_OFF_T startpos;
3086 files_struct *fsp;
3087 struct lock_struct lock;
3088 SMB_OFF_T size = 0;
3089
3090 START_PROFILE(SMBreadbraw);
3091
3092 if (srv_is_signing_active(sconn) ||
3093 is_encrypted_packet(req->inbuf)) {
3094 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3095 "raw reads/writes are disallowed.");
3096 }
3097
3098 if (req->wct < 8) {
3099 reply_readbraw_error(sconn);
3100 END_PROFILE(SMBreadbraw);
3101 return;
3102 }
3103
3104 if (sconn->smb1.echo_handler.trusted_fde) {
3105 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3106 "'async smb echo handler = yes'\n"));
3107 reply_readbraw_error(sconn);
3108 END_PROFILE(SMBreadbraw);
3109 return;
3110 }
3111
3112 /*
3113 * Special check if an oplock break has been issued
3114 * and the readraw request croses on the wire, we must
3115 * return a zero length response here.
3116 */
3117
3118 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3119
3120 /*
3121 * We have to do a check_fsp by hand here, as
3122 * we must always return 4 zero bytes on error,
3123 * not a NTSTATUS.
3124 */
3125
3126 if (!fsp || !conn || conn != fsp->conn ||
3127 req->vuid != fsp->vuid ||
3128 fsp->is_directory || fsp->fh->fd == -1) {
3129 /*
3130 * fsp could be NULL here so use the value from the packet. JRA.
3131 */
3132 DEBUG(3,("reply_readbraw: fnum %d not valid "
3133 "- cache prime?\n",
3134 (int)SVAL(req->vwv+0, 0)));
3135 reply_readbraw_error(sconn);
3136 END_PROFILE(SMBreadbraw);
3137 return;
3138 }
3139
3140 /* Do a "by hand" version of CHECK_READ. */
3141 if (!(fsp->can_read ||
3142 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3143 (fsp->access_mask & FILE_EXECUTE)))) {
3144 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3145 (int)SVAL(req->vwv+0, 0)));
3146 reply_readbraw_error(sconn);
3147 END_PROFILE(SMBreadbraw);
3148 return;
3149 }
3150
3151 flush_write_cache(fsp, READRAW_FLUSH);
3152
3153 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3154 if(req->wct == 10) {
3155 /*
3156 * This is a large offset (64 bit) read.
3157 */
3158 #ifdef LARGE_SMB_OFF_T
3159
3160 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3161
3162 #else /* !LARGE_SMB_OFF_T */
3163
3164 /*
3165 * Ensure we haven't been sent a >32 bit offset.
3166 */
3167
3168 if(IVAL(req->vwv+8, 0) != 0) {
3169 DEBUG(0,("reply_readbraw: large offset "
3170 "(%x << 32) used and we don't support "
3171 "64 bit offsets.\n",
3172 (unsigned int)IVAL(req->vwv+8, 0) ));
3173 reply_readbraw_error();
3174 END_PROFILE(SMBreadbraw);
3175 return;
3176 }
3177
3178 #endif /* LARGE_SMB_OFF_T */
3179
3180 if(startpos < 0) {
3181 DEBUG(0,("reply_readbraw: negative 64 bit "
3182 "readraw offset (%.0f) !\n",
3183 (double)startpos ));
3184 reply_readbraw_error(sconn);
3185 END_PROFILE(SMBreadbraw);
3186 return;
3187 }
3188 }
3189
3190 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3191 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3192
3193 /* ensure we don't overrun the packet size */
3194 maxcount = MIN(65535,maxcount);
3195
3196 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3197 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3198 &lock);
3199
3200 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3201 reply_readbraw_error(sconn);
3202 END_PROFILE(SMBreadbraw);
3203 return;
3204 }
3205
3206 if (fsp_stat(fsp) == 0) {
3207 size = fsp->fsp_name->st.st_ex_size;
3208 }
3209
3210 if (startpos >= size) {
3211 nread = 0;
3212 } else {
3213 nread = MIN(maxcount,(size - startpos));
3214 }
3215
3216 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3217 if (nread < mincount)
3218 nread = 0;
3219 #endif
3220
3221 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3222 "min=%lu nread=%lu\n",
3223 fsp->fnum, (double)startpos,
3224 (unsigned long)maxcount,
3225 (unsigned long)mincount,
3226 (unsigned long)nread ) );
3227
3228 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3229
3230 DEBUG(5,("reply_readbraw finished\n"));
3231
3232 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3233
3234 END_PROFILE(SMBreadbraw);
3235 return;
3236 }
3237
3238 #undef DBGC_CLASS
3239 #define DBGC_CLASS DBGC_LOCKING
3240
3241 /****************************************************************************
3242 Reply to a lockread (core+ protocol).
3243 ****************************************************************************/
3244
3245 void reply_lockread(struct smb_request *req)
3246 {
3247 connection_struct *conn = req->conn;
3248 ssize_t nread = -1;
3249 char *data;
3250 SMB_OFF_T startpos;
3251 size_t numtoread;
3252 NTSTATUS status;
3253 files_struct *fsp;
3254 struct byte_range_lock *br_lck = NULL;
3255 char *p = NULL;
3256 struct smbd_server_connection *sconn = req->sconn;
3257
3258 START_PROFILE(SMBlockread);
3259
3260 if (req->wct < 5) {
3261 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3262 END_PROFILE(SMBlockread);
3263 return;
3264 }
3265
3266 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3267
3268 if (!check_fsp(conn, req, fsp)) {
3269 END_PROFILE(SMBlockread);
3270 return;
3271 }
3272
3273 if (!CHECK_READ(fsp,req)) {
3274 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3275 END_PROFILE(SMBlockread);
3276 return;
3277 }
3278
3279 numtoread = SVAL(req->vwv+1, 0);
3280 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3281
3282 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3283
3284 reply_outbuf(req, 5, numtoread + 3);
3285
3286 data = smb_buf(req->outbuf) + 3;
3287
3288 /*
3289 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3290 * protocol request that predates the read/write lock concept.
3291 * Thus instead of asking for a read lock here we need to ask
3292 * for a write lock. JRA.
3293 * Note that the requested lock size is unaffected by max_recv.
3294 */
3295
3296 br_lck = do_lock(req->sconn->msg_ctx,
3297 fsp,
3298 (uint64_t)req->smbpid,
3299 (uint64_t)numtoread,
3300 (uint64_t)startpos,
3301 WRITE_LOCK,
3302 WINDOWS_LOCK,
3303 False, /* Non-blocking lock. */
3304 &status,
3305 NULL,
3306 NULL);
3307 TALLOC_FREE(br_lck);
3308
3309 if (NT_STATUS_V(status)) {
3310 reply_nterror(req, status);
3311 END_PROFILE(SMBlockread);
3312 return;
3313 }
3314
3315 /*
3316 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3317 */
3318
3319 if (numtoread > sconn->smb1.negprot.max_recv) {
3320 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3321 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3322 (unsigned int)numtoread,
3323 (unsigned int)sconn->smb1.negprot.max_recv));
3324 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3325 }
3326 nread = read_file(fsp,data,startpos,numtoread);
3327
3328 if (nread < 0) {
3329 reply_nterror(req, map_nt_error_from_unix(errno));
3330 END_PROFILE(SMBlockread);
3331 return;
3332 }
3333
3334 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3335
3336 SSVAL(req->outbuf,smb_vwv0,nread);
3337 SSVAL(req->outbuf,smb_vwv5,nread+3);
3338 p = smb_buf(req->outbuf);
3339 SCVAL(p,0,0); /* pad byte. */
3340 SSVAL(p,1,nread);
3341
3342 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3343 fsp->fnum, (int)numtoread, (int)nread));
3344
3345 END_PROFILE(SMBlockread);
3346 return;
3347 }
3348
3349 #undef DBGC_CLASS
3350 #define DBGC_CLASS DBGC_ALL
3351
3352 /****************************************************************************
3353 Reply to a read.
3354 ****************************************************************************/
3355
3356 void reply_read(struct smb_request *req)
3357 {
3358 connection_struct *conn = req->conn;
3359 size_t numtoread;
3360 ssize_t nread = 0;
3361 char *data;
3362 SMB_OFF_T startpos;
3363 int outsize = 0;
3364 files_struct *fsp;
3365 struct lock_struct lock;
3366 struct smbd_server_connection *sconn = req->sconn;
3367
3368 START_PROFILE(SMBread);
3369
3370 if (req->wct < 3) {
3371 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3372 END_PROFILE(SMBread);
3373 return;
3374 }
3375
3376 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3377
3378 if (!check_fsp(conn, req, fsp)) {
3379 END_PROFILE(SMBread);
3380 return;
3381 }
3382
3383 if (!CHECK_READ(fsp,req)) {
3384 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3385 END_PROFILE(SMBread);
3386 return;
3387 }
3388
3389 numtoread = SVAL(req->vwv+1, 0);
3390 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3391
3392 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3393
3394 /*
3395 * The requested read size cannot be greater than max_recv. JRA.
3396 */
3397 if (numtoread > sconn->smb1.negprot.max_recv) {
3398 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3399 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3400 (unsigned int)numtoread,
3401 (unsigned int)sconn->smb1.negprot.max_recv));
3402 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3403 }
3404
3405 reply_outbuf(req, 5, numtoread+3);
3406
3407 data = smb_buf(req->outbuf) + 3;
3408
3409 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3410 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3411 &lock);
3412
3413 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3414 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3415 END_PROFILE(SMBread);
3416 return;
3417 }
3418
3419 if (numtoread > 0)
3420 nread = read_file(fsp,data,startpos,numtoread);
3421
3422 if (nread < 0) {
3423 reply_nterror(req, map_nt_error_from_unix(errno));
3424 goto strict_unlock;
3425 }
3426
3427 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3428
3429 SSVAL(req->outbuf,smb_vwv0,nread);
3430 SSVAL(req->outbuf,smb_vwv5,nread+3);
3431 SCVAL(smb_buf(req->outbuf),0,1);
3432 SSVAL(smb_buf(req->outbuf),1,nread);
3433
3434 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3435 fsp->fnum, (int)numtoread, (int)nread ) );
3436
3437 strict_unlock:
3438 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3439
3440 END_PROFILE(SMBread);
3441 return;
3442 }
3443
3444 /****************************************************************************
3445 Setup readX header.
3446 ****************************************************************************/
3447
3448 static int setup_readX_header(struct smb_request *req, char *outbuf,
3449 size_t smb_maxcnt)
3450 {
3451 int outsize;
3452 char *data;
3453
3454 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3455 data = smb_buf(outbuf);
3456
3457 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3458
3459 SCVAL(outbuf,smb_vwv0,0xFF);
3460 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3461 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3462 SSVAL(outbuf,smb_vwv6,
3463 req_wct_ofs(req)
3464 + 1 /* the wct field */
3465 + 12 * sizeof(uint16_t) /* vwv */
3466 + 2); /* the buflen field */
3467 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3468 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3469 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3470 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3471 return outsize;
3472 }
3473
3474 /****************************************************************************
3475 Reply to a read and X - possibly using sendfile.
3476 ****************************************************************************/
3477
3478 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3479 files_struct *fsp, SMB_OFF_T startpos,
3480 size_t smb_maxcnt)
3481 {
3482 ssize_t nread = -1;
3483 struct lock_struct lock;
3484 int saved_errno = 0;
3485
3486 if(fsp_stat(fsp) == -1) {
3487 reply_nterror(req, map_nt_error_from_unix(errno));
3488 return;
3489 }
3490
3491 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3492 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3493 &lock);
3494
3495 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3496 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3497 return;
3498 }
3499
3500 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3501 (startpos > fsp->fsp_name->st.st_ex_size)
3502 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3503 /*
3504 * We already know that we would do a short read, so don't
3505 * try the sendfile() path.
3506 */
3507 goto nosendfile_read;
3508 }
3509
3510 #if defined(WITH_SENDFILE)
3511 /*
3512 * We can only use sendfile on a non-chained packet
3513 * but we can use on a non-oplocked file. tridge proved this
3514 * on a train in Germany :-). JRA.
3515 */
3516
3517 if (!req_is_in_chain(req) &&
3518 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3519 (fsp->wcp == NULL) &&
3520 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3521 uint8 headerbuf[smb_size + 12 * 2];
3522 DATA_BLOB header;
3523
3524 /*
3525 * Set up the packet header before send. We
3526 * assume here the sendfile will work (get the
3527 * correct amount of data).
3528 */
3529
3530 header = data_blob_const(headerbuf, sizeof(headerbuf));
3531
3532 construct_reply_common_req(req, (char *)headerbuf);
3533 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3534
3535 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3536 startpos, smb_maxcnt);
3537 if (nread == -1) {
3538 /* Returning ENOSYS means no data at all was sent.
3539 Do this as a normal read. */
3540 if (errno == ENOSYS) {
3541 goto normal_read;
3542 }
3543
3544 /*
3545 * Special hack for broken Linux with no working sendfile. If we
3546 * return EINTR we sent the header but not the rest of the data.
3547 * Fake this up by doing read/write calls.
3548 */
3549
3550 if (errno == EINTR) {
3551 /* Ensure we don't do this again. */
3552 set_use_sendfile(SNUM(conn), False);
3553 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3554 nread = fake_sendfile(fsp, startpos,
3555 smb_maxcnt);
3556 if (nread == -1) {
3557 DEBUG(0,("send_file_readX: "
3558 "fake_sendfile failed for "
3559 "file %s (%s).\n",
3560 fsp_str_dbg(fsp),
3561 strerror(errno)));
3562 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3563 }
3564 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3565 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3566 /* No outbuf here means successful sendfile. */
3567 goto strict_unlock;
3568 }
3569
3570 DEBUG(0,("send_file_readX: sendfile failed for file "
3571 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3572 strerror(errno)));
3573 exit_server_cleanly("send_file_readX sendfile failed");
3574 } else if (nread == 0) {
3575 /*
3576 * Some sendfile implementations return 0 to indicate
3577 * that there was a short read, but nothing was
3578 * actually written to the socket. In this case,
3579 * fallback to the normal read path so the header gets
3580 * the correct byte count.
3581 */
3582 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3583 "falling back to the normal read: %s\n",
3584 fsp_str_dbg(fsp)));
3585 goto normal_read;
3586 }
3587
3588 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3589 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3590
3591 /* Deal with possible short send. */
3592 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3593 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3594 }
3595 /* No outbuf here means successful sendfile. */
3596 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3597 SMB_PERFCOUNT_END(&req->pcd);
3598 goto strict_unlock;
3599 }
3600
3601 normal_read:
3602
3603 #endif
3604
3605 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3606 uint8 headerbuf[smb_size + 2*12];
3607
3608 construct_reply_common_req(req, (char *)headerbuf);
3609 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3610
3611 /* Send out the header. */
3612 if (write_data(req->sconn->sock, (char *)headerbuf,
3613 sizeof(headerbuf)) != sizeof(headerbuf)) {
3614
3615 char addr[INET6_ADDRSTRLEN];
3616 /*
3617 * Try and give an error message saying what
3618 * client failed.
3619 */
3620 DEBUG(0, ("write_data failed for client %s. "
3621 "Error %s\n",
3622 get_peer_addr(req->sconn->sock, addr,
3623 sizeof(addr)),
3624 strerror(errno)));
3625
3626 DEBUG(0,("send_file_readX: write_data failed for file "
3627 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3628 strerror(errno)));
3629 exit_server_cleanly("send_file_readX sendfile failed");
3630 }
3631 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3632 if (nread == -1) {
3633 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3634 "file %s (%s).\n", fsp_str_dbg(fsp),
3635 strerror(errno)));
3636 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3637 }
3638 goto strict_unlock;
3639 }
3640
3641 nosendfile_read:
3642
3643 reply_outbuf(req, 12, smb_maxcnt);
3644
3645 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3646 saved_errno = errno;
3647
3648 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3649
3650 if (nread < 0) {
3651 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3652 return;
3653 }
3654
3655 setup_readX_header(req, (char *)req->outbuf, nread);
3656
3657 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3658 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3659
3660 chain_reply(req);
3661 return;
3662
3663 strict_unlock:
3664 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3665 TALLOC_FREE(req->outbuf);
3666 return;
3667 }
3668
3669 /****************************************************************************
3670 Reply to a read and X.
3671 ****************************************************************************/
3672
3673 void reply_read_and_X(struct smb_request *req)
3674 {
3675 connection_struct *conn = req->conn;
3676 files_struct *fsp;
3677 SMB_OFF_T startpos;
3678 size_t smb_maxcnt;
3679 bool big_readX = False;
3680 #if 0
3681 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3682 #endif
3683
3684 START_PROFILE(SMBreadX);
3685
3686 if ((req->wct != 10) && (req->wct != 12)) {
3687 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3688 return;
3689 }
3690
3691 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3692 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3693 smb_maxcnt = SVAL(req->vwv+5, 0);
3694
3695 /* If it's an IPC, pass off the pipe handler. */
3696 if (IS_IPC(conn)) {
3697 reply_pipe_read_and_X(req);
3698 END_PROFILE(SMBreadX);
3699 return;
3700 }
3701
3702 if (!check_fsp(conn, req, fsp)) {
3703 END_PROFILE(SMBreadX);
3704 return;
3705 }
3706
3707 if (!CHECK_READ(fsp,req)) {
3708 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3709 END_PROFILE(SMBreadX);
3710 return;
3711 }
3712
3713 if (global_client_caps & CAP_LARGE_READX) {
3714 size_t upper_size = SVAL(req->vwv+7, 0);
3715 smb_maxcnt |= (upper_size<<16);
3716 if (upper_size > 1) {
3717 /* Can't do this on a chained packet. */
3718 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3719 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3720 END_PROFILE(SMBreadX);
3721 return;
3722 }
3723 /* We currently don't do this on signed or sealed data. */
3724 if (srv_is_signing_active(req->sconn) ||
3725 is_encrypted_packet(req->inbuf)) {
3726 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3727 END_PROFILE(SMBreadX);
3728 return;
3729 }
3730 /* Is there room in the reply for this data ? */
3731 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3732 reply_nterror(req,
3733 NT_STATUS_INVALID_PARAMETER);
3734 END_PROFILE(SMBreadX);
3735 return;
3736 }
3737 big_readX = True;
3738 }
3739 }
3740
3741 if (req->wct == 12) {
3742 #ifdef LARGE_SMB_OFF_T
3743 /*
3744 * This is a large offset (64 bit) read.
3745 */
3746 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3747
3748 #else /* !LARGE_SMB_OFF_T */
3749
3750 /*
3751 * Ensure we haven't been sent a >32 bit offset.
3752 */
3753
3754 if(IVAL(req->vwv+10, 0) != 0) {
3755 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3756 "used and we don't support 64 bit offsets.\n",
3757 (unsigned int)IVAL(req->vwv+10, 0) ));
3758 END_PROFILE(SMBreadX);
3759 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3760 return;
3761 }
3762
3763 #endif /* LARGE_SMB_OFF_T */
3764
3765 }
3766
3767 if (!big_readX) {
3768 NTSTATUS status = schedule_aio_read_and_X(conn,
3769 req,
3770 fsp,
3771 startpos,
3772 smb_maxcnt);
3773 if (NT_STATUS_IS_OK(status)) {
3774 /* Read scheduled - we're done. */
3775 goto out;
3776 }
3777 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3778 /* Real error - report to client. */
3779 END_PROFILE(SMBreadX);
3780 reply_nterror(req, status);
3781 return;
3782 }
3783 /* NT_STATUS_RETRY - fall back to sync read. */
3784 }
3785
3786 smbd_lock_socket(req->sconn);
3787 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3788 smbd_unlock_socket(req->sconn);
3789
3790 out:
3791 END_PROFILE(SMBreadX);
3792 return;
3793 }
3794
3795 /****************************************************************************
3796 Error replies to writebraw must have smb_wct == 1. Fix this up.
3797 ****************************************************************************/
3798
3799 void error_to_writebrawerr(struct smb_request *req)
3800 {
3801 uint8 *old_outbuf = req->outbuf;
3802
3803 reply_outbuf(req, 1, 0);
3804
3805 memcpy(req->outbuf, old_outbuf, smb_size);
3806 TALLOC_FREE(old_outbuf);
3807 }
3808
3809 /****************************************************************************
3810 Read 4 bytes of a smb packet and return the smb length of the packet.
3811 Store the result in the buffer. This version of the function will
3812 never return a session keepalive (length of zero).
3813 Timeout is in milliseconds.
3814 ****************************************************************************/
3815
3816 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3817 size_t *len)
3818 {
3819 uint8_t msgtype = SMBkeepalive;
3820
3821 while (msgtype == SMBkeepalive) {
3822 NTSTATUS status;
3823
3824 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3825 len);
3826 if (!NT_STATUS_IS_OK(status)) {
3827 char addr[INET6_ADDRSTRLEN];
3828 /* Try and give an error message
3829 * saying what client failed. */
3830 DEBUG(0, ("read_fd_with_timeout failed for "
3831 "client %s read error = %s.\n",
3832 get_peer_addr(fd,addr,sizeof(addr)),
3833 nt_errstr(status)));
3834 return status;
3835 }
3836
3837 msgtype = CVAL(inbuf, 0);
3838 }
3839
3840 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3841 (unsigned long)len));
3842
3843 return NT_STATUS_OK;
3844 }
3845
3846 /****************************************************************************
3847 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3848 ****************************************************************************/
3849
3850 void reply_writebraw(struct smb_request *req)
3851 {
3852 connection_struct *conn = req->conn;
3853 char *buf = NULL;
3854 ssize_t nwritten=0;
3855 ssize_t total_written=0;
3856 size_t numtowrite=0;
3857 size_t tcount;
3858 SMB_OFF_T startpos;
3859 char *data=NULL;
3860 bool write_through;
3861 files_struct *fsp;
3862 struct lock_struct lock;
3863 NTSTATUS status;
3864
3865 START_PROFILE(SMBwritebraw);
3866
3867 /*
3868 * If we ever reply with an error, it must have the SMB command
3869 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3870 * we're finished.
3871 */
3872 SCVAL(req->inbuf,smb_com,SMBwritec);
3873
3874 if (srv_is_signing_active(req->sconn)) {
3875 END_PROFILE(SMBwritebraw);
3876 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3877 "raw reads/writes are disallowed.");
3878 }
3879
3880 if (req->wct < 12) {
3881 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3882 error_to_writebrawerr(req);
3883 END_PROFILE(SMBwritebraw);
3884 return;
3885 }
3886
3887 if (req->sconn->smb1.echo_handler.trusted_fde) {
3888 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3889 "'async smb echo handler = yes'\n"));
3890 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3891 error_to_writebrawerr(req);
3892 END_PROFILE(SMBwritebraw);
3893 return;
3894 }
3895
3896 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3897 if (!check_fsp(conn, req, fsp)) {
3898 error_to_writebrawerr(req);
3899 END_PROFILE(SMBwritebraw);
3900 return;
3901 }
3902
3903 if (!CHECK_WRITE(fsp)) {
3904 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3905 error_to_writebrawerr(req);
3906 END_PROFILE(SMBwritebraw);
3907 return;
3908 }
3909
3910 tcount = IVAL(req->vwv+1, 0);
3911 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3912 write_through = BITSETW(req->vwv+7,0);
3913
3914 /* We have to deal with slightly different formats depending
3915 on whether we are using the core+ or lanman1.0 protocol */
3916
3917 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3918 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3919 data = smb_buf(req->inbuf);
3920 } else {
3921 numtowrite = SVAL(req->vwv+10, 0);
3922 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3923 }
3924
3925 /* Ensure we don't write bytes past the end of this packet. */
3926 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3927 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3928 error_to_writebrawerr(req);
3929 END_PROFILE(SMBwritebraw);
3930 return;
3931 }
3932
3933 if (!fsp->print_file) {
3934 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3935 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3936 &lock);
3937
3938 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3939 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3940 error_to_writebrawerr(req);
3941 END_PROFILE(SMBwritebraw);
3942 return;
3943 }
3944 }
3945
3946 if (numtowrite>0) {
3947 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3948 }
3949
3950 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3951 "wrote=%d sync=%d\n",
3952 fsp->fnum, (double)startpos, (int)numtowrite,
3953 (int)nwritten, (int)write_through));
3954
3955 if (nwritten < (ssize_t)numtowrite) {
3956 reply_nterror(req, NT_STATUS_DISK_FULL);
3957 error_to_writebrawerr(req);
3958 goto strict_unlock;
3959 }
3960
3961 total_written = nwritten;
3962
3963 /* Allocate a buffer of 64k + length. */
3964 buf = TALLOC_ARRAY(NULL, char, 65540);
3965 if (!buf) {
3966 reply_nterror(req, NT_STATUS_NO_MEMORY);
3967 error_to_writebrawerr(req);
3968 goto strict_unlock;
3969 }
3970
3971 /* Return a SMBwritebraw message to the redirector to tell
3972 * it to send more bytes */
3973
3974 memcpy(buf, req->inbuf, smb_size);
3975 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3976 SCVAL(buf,smb_com,SMBwritebraw);
3977 SSVALS(buf,smb_vwv0,0xFFFF);
3978 show_msg(buf);
3979 if (!srv_send_smb(req->sconn,
3980 buf,
3981 false, 0, /* no signing */
3982 IS_CONN_ENCRYPTED(conn),
3983 &req->pcd)) {
3984 exit_server_cleanly("reply_writebraw: srv_send_smb "
3985 "failed.");
3986 }
3987
3988 /* Now read the raw data into the buffer and write it */
3989 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
3990 &numtowrite);
3991 if (!NT_STATUS_IS_OK(status)) {
3992 exit_server_cleanly("secondary writebraw failed");
3993 }
3994
3995 /* Set up outbuf to return the correct size */
3996 reply_outbuf(req, 1, 0);
3997
3998 if (numtowrite != 0) {
3999
4000 if (numtowrite > 0xFFFF) {
4001 DEBUG(0,("reply_writebraw: Oversize secondary write "
4002 "raw requested (%u). Terminating\n",
4003 (unsigned int)numtowrite ));
4004 exit_server_cleanly("secondary writebraw failed");
4005 }
4006
4007 if (tcount > nwritten+numtowrite) {
4008 DEBUG(3,("reply_writebraw: Client overestimated the "
4009 "write %d %d %d\n",
4010 (int)tcount,(int)nwritten,(int)numtowrite));
4011 }
4012
4013 status = read_data(req->sconn->sock, buf+4, numtowrite);
4014
4015 if (!NT_STATUS_IS_OK(status)) {
4016 char addr[INET6_ADDRSTRLEN];
4017 /* Try and give an error message
4018 * saying what client failed. */
4019 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4020 "raw read failed (%s) for client %s. "
4021 "Terminating\n", nt_errstr(status),
4022 get_peer_addr(req->sconn->sock, addr,
4023 sizeof(addr))));
4024 exit_server_cleanly("secondary writebraw failed");
4025 }
4026
4027 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4028 if (nwritten == -1) {
4029 TALLOC_FREE(buf);
4030 reply_nterror(req, map_nt_error_from_unix(errno));
4031 error_to_writebrawerr(req);
4032 goto strict_unlock;
4033 }
4034
4035 if (nwritten < (ssize_t)numtowrite) {
4036 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4037 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4038 }
4039
4040 if (nwritten > 0) {
4041 total_written += nwritten;
4042 }
4043 }
4044
4045 TALLOC_FREE(buf);
4046 SSVAL(req->outbuf,smb_vwv0,total_written);
4047
4048 status = sync_file(conn, fsp, write_through);
4049 if (!NT_STATUS_IS_OK(status)) {
4050 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4051 fsp_str_dbg(fsp), nt_errstr(status)));
4052 reply_nterror(req, status);
4053 error_to_writebrawerr(req);
4054 goto strict_unlock;
4055 }
4056
4057 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4058 "wrote=%d\n",
4059 fsp->fnum, (double)startpos, (int)numtowrite,
4060 (int)total_written));
4061
4062 if (!fsp->print_file) {
4063 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4064 }
4065
4066 /* We won't return a status if write through is not selected - this
4067 * follows what WfWg does */
4068 END_PROFILE(SMBwritebraw);
4069
4070 if (!write_through && total_written==tcount) {
4071
4072 #if RABBIT_PELLET_FIX
4073 /*
4074 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4075 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4076 * JRA.
4077 */
4078 if (!send_keepalive(req->sconn->sock)) {
4079 exit_server_cleanly("reply_writebraw: send of "
4080 "keepalive failed");
4081 }
4082 #endif
4083 TALLOC_FREE(req->outbuf);
4084 }
4085 return;
4086
4087 strict_unlock:
4088 if (!fsp->print_file) {
4089 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4090 }
4091
4092 END_PROFILE(SMBwritebraw);
4093 return;
4094 }
4095
4096 #undef DBGC_CLASS
4097 #define DBGC_CLASS DBGC_LOCKING
4098
4099 /****************************************************************************
4100 Reply to a writeunlock (core+).
4101 ****************************************************************************/
4102
4103 void reply_writeunlock(struct smb_request *req)
4104 {
4105 connection_struct *conn = req->conn;
4106 ssize_t nwritten = -1;
4107 size_t numtowrite;
4108 SMB_OFF_T startpos;
4109 const char *data;
4110 NTSTATUS status = NT_STATUS_OK;
4111 files_struct *fsp;
4112 struct lock_struct lock;
4113 int saved_errno = 0;
4114
4115 START_PROFILE(SMBwriteunlock);
4116
4117 if (req->wct < 5) {
4118 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4119 END_PROFILE(SMBwriteunlock);
4120 return;
4121 }
4122
4123 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4124
4125 if (!check_fsp(conn, req, fsp)) {
4126 END_PROFILE(SMBwriteunlock);
4127 return;
4128 }
4129
4130 if (!CHECK_WRITE(fsp)) {
4131 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4132 END_PROFILE(SMBwriteunlock);
4133 return;
4134 }
4135
4136 numtowrite = SVAL(req->vwv+1, 0);
4137 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4138 data = (const char *)req->buf + 3;
4139
4140 if (!fsp->print_file && numtowrite > 0) {
4141 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4142 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4143 &lock);
4144
4145 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4146 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4147 END_PROFILE(SMBwriteunlock);
4148 return;
4149 }
4150 }
4151
4152 /* The special X/Open SMB protocol handling of
4153 zero length writes is *NOT* done for
4154 this call */
4155 if(numtowrite == 0) {
4156 nwritten = 0;
4157 } else {
4158 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4159 saved_errno = errno;
4160 }
4161
4162 status = sync_file(conn, fsp, False /* write through */);
4163 if (!NT_STATUS_IS_OK(status)) {
4164 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4165 fsp_str_dbg(fsp), nt_errstr(status)));
4166 reply_nterror(req, status);
4167 goto strict_unlock;
4168 }
4169
4170 if(nwritten < 0) {
4171 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4172 goto strict_unlock;
4173 }
4174
4175 if((nwritten < numtowrite) && (numtowrite != 0)) {
4176 reply_nterror(req, NT_STATUS_DISK_FULL);
4177 goto strict_unlock;
4178 }
4179
4180 if (numtowrite && !fsp->print_file) {
4181 status = do_unlock(req->sconn->msg_ctx,
4182 fsp,
4183 (uint64_t)req->smbpid,
4184 (uint64_t)numtowrite,
4185 (uint64_t)startpos,
4186 WINDOWS_LOCK);
4187
4188 if (NT_STATUS_V(status)) {
4189 reply_nterror(req, status);
4190 goto strict_unlock;
4191 }
4192 }
4193
4194 reply_outbuf(req, 1, 0);
4195
4196 SSVAL(req->outbuf,smb_vwv0,nwritten);
4197
4198 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4199 fsp->fnum, (int)numtowrite, (int)nwritten));
4200
4201 strict_unlock:
4202 if (numtowrite && !fsp->print_file) {
4203 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4204 }
4205
4206 END_PROFILE(SMBwriteunlock);
4207 return;
4208 }
4209
4210 #undef DBGC_CLASS
4211 #define DBGC_CLASS DBGC_ALL
4212
4213 /****************************************************************************
4214 Reply to a write.
4215 ****************************************************************************/
4216
4217 void reply_write(struct smb_request *req)
4218 {
4219 connection_struct *conn = req->conn;
4220 size_t numtowrite;
4221 ssize_t nwritten = -1;
4222 SMB_OFF_T startpos;
4223 const char *data;
4224 files_struct *fsp;
4225 struct lock_struct lock;
4226 NTSTATUS status;
4227 int saved_errno = 0;
4228
4229 START_PROFILE(SMBwrite);
4230
4231 if (req->wct < 5) {
4232 END_PROFILE(SMBwrite);
4233 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4234 return;
4235 }
4236
4237 /* If it's an IPC, pass off the pipe handler. */
4238 if (IS_IPC(conn)) {
4239 reply_pipe_write(req);
4240 END_PROFILE(SMBwrite);
4241 return;
4242 }
4243
4244 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4245
4246 if (!check_fsp(conn, req, fsp)) {
4247 END_PROFILE(SMBwrite);
4248 return;
4249 }
4250
4251 if (!CHECK_WRITE(fsp)) {
4252 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4253 END_PROFILE(SMBwrite);
4254 return;
4255 }
4256
4257 numtowrite = SVAL(req->vwv+1, 0);
4258 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4259 data = (const char *)req->buf + 3;
4260
4261 if (!fsp->print_file) {
4262 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4263 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4264 &lock);
4265
4266 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4267 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4268 END_PROFILE(SMBwrite);
4269 return;
4270 }
4271 }
4272
4273 /*
4274 * X/Open SMB protocol says that if smb_vwv1 is
4275 * zero then the file size should be extended or
4276 * truncated to the size given in smb_vwv[2-3].
4277 */
4278
4279 if(numtowrite == 0) {
4280 /*
4281 * This is actually an allocate call, and set EOF. JRA.
4282 */
4283 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4284 if (nwritten < 0) {
4285 reply_nterror(req, NT_STATUS_DISK_FULL);
4286 goto strict_unlock;
4287 }
4288 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4289 if (nwritten < 0) {
4290 reply_nterror(req, NT_STATUS_DISK_FULL);
4291 goto strict_unlock;
4292 }
4293 trigger_write_time_update_immediate(fsp);
4294 } else {
4295 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4296 }
4297
4298 status = sync_file(conn, fsp, False);
4299 if (!NT_STATUS_IS_OK(status)) {
4300 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4301 fsp_str_dbg(fsp), nt_errstr(status)));
4302 reply_nterror(req, status);
4303 goto strict_unlock;
4304 }
4305
4306 if(nwritten < 0) {
4307 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4308 goto strict_unlock;
4309 }
4310
4311 if((nwritten == 0) && (numtowrite != 0)) {
4312 reply_nterror(req, NT_STATUS_DISK_FULL);
4313 goto strict_unlock;
4314 }
4315
4316 reply_outbuf(req, 1, 0);
4317
4318 SSVAL(req->outbuf,smb_vwv0,nwritten);
4319
4320 if (nwritten < (ssize_t)numtowrite) {
4321 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4322 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4323 }
4324
4325 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4326
4327 strict_unlock:
4328 if (!fsp->print_file) {
4329 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4330 }
4331
4332 END_PROFILE(SMBwrite);
4333 return;
4334 }
4335
4336 /****************************************************************************
4337 Ensure a buffer is a valid writeX for recvfile purposes.
4338 ****************************************************************************/
4339
4340 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4341 (2*14) + /* word count (including bcc) */ \
4342 1 /* pad byte */)
4343
4344 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4345 const uint8_t *inbuf)
4346 {
4347 size_t numtowrite;
4348 connection_struct *conn = NULL;
4349 unsigned int doff = 0;
4350 size_t len = smb_len_large(inbuf);
4351
4352 if (is_encrypted_packet(inbuf)) {
4353 /* Can't do this on encrypted
4354 * connections. */
4355 return false;
4356 }
4357
4358 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4359 return false;
4360 }
4361
4362 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4363 CVAL(inbuf,smb_wct) != 14) {
4364 DEBUG(10,("is_valid_writeX_buffer: chained or "
4365 "invalid word length.\n"));
4366 return false;
4367 }
4368
4369 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4370 if (conn == NULL) {
4371 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4372 return false;
4373 }
4374 if (IS_IPC(conn)) {
4375 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4376 return false;
4377 }
4378 if (IS_PRINT(conn)) {
4379 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4380 return false;
4381 }
4382 doff = SVAL(inbuf,smb_vwv11);
4383
4384 numtowrite = SVAL(inbuf,smb_vwv10);
4385
4386 if (len > doff && len - doff > 0xFFFF) {
4387 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4388 }
4389
4390 if (numtowrite == 0) {
4391 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4392 return false;
4393 }
4394
4395 /* Ensure the sizes match up. */
4396 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4397 /* no pad byte...old smbclient :-( */
4398 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4399 (unsigned int)doff,
4400 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4401 return false;
4402 }
4403
4404 if (len - doff != numtowrite) {
4405 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4406 "len = %u, doff = %u, numtowrite = %u\n",
4407 (unsigned int)len,
4408 (unsigned int)doff,
4409 (unsigned int)numtowrite ));
4410 return false;
4411 }
4412
4413 DEBUG(10,("is_valid_writeX_buffer: true "
4414 "len = %u, doff = %u, numtowrite = %u\n",
4415 (unsigned int)len,
4416 (unsigned int)doff,
4417 (unsigned int)numtowrite ));
4418
4419 return true;
4420 }
4421
4422 /****************************************************************************
4423 Reply to a write and X.
4424 ****************************************************************************/
4425
4426 void reply_write_and_X(struct smb_request *req)
4427 {
4428 connection_struct *conn = req->conn;
4429 files_struct *fsp;
4430 struct lock_struct lock;
4431 SMB_OFF_T startpos;
4432 size_t numtowrite;
4433 bool write_through;
4434 ssize_t nwritten;
4435 unsigned int smb_doff;
4436 unsigned int smblen;
4437 char *data;
4438 NTSTATUS status;
4439 int saved_errno = 0;
4440
4441 START_PROFILE(SMBwriteX);
4442
4443 if ((req->wct != 12) && (req->wct != 14)) {
4444 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4445 END_PROFILE(SMBwriteX);
4446 return;
4447 }
4448
4449 numtowrite = SVAL(req->vwv+10, 0);
4450 smb_doff = SVAL(req->vwv+11, 0);
4451 smblen = smb_len(req->inbuf);
4452
4453 if (req->unread_bytes > 0xFFFF ||
4454 (smblen > smb_doff &&
4455 smblen - smb_doff > 0xFFFF)) {
4456 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4457 }
4458
4459 if (req->unread_bytes) {
4460 /* Can't do a recvfile write on IPC$ */
4461 if (IS_IPC(conn)) {
4462 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4463 END_PROFILE(SMBwriteX);
4464 return;
4465 }
4466 if (numtowrite != req->unread_bytes) {
4467 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4468 END_PROFILE(SMBwriteX);
4469 return;
4470 }
4471 } else {
4472 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4473 smb_doff + numtowrite > smblen) {
4474 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4475 END_PROFILE(SMBwriteX);
4476 return;
4477 }
4478 }
4479
4480 /* If it's an IPC, pass off the pipe handler. */
4481 if (IS_IPC(conn)) {
4482 if (req->unread_bytes) {
4483 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4484 END_PROFILE(SMBwriteX);
4485 return;
4486 }
4487 reply_pipe_write_and_X(req);
4488 END_PROFILE(SMBwriteX);
4489 return;
4490 }
4491
4492 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4493 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4494 write_through = BITSETW(req->vwv+7,0);
4495
4496 if (!check_fsp(conn, req, fsp)) {
4497 END_PROFILE(SMBwriteX);
4498 return;
4499 }
4500
4501 if (!CHECK_WRITE(fsp)) {
4502 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4503 END_PROFILE(SMBwriteX);
4504 return;
4505 }
4506
4507 data = smb_base(req->inbuf) + smb_doff;
4508
4509 if(req->wct == 14) {
4510 #ifdef LARGE_SMB_OFF_T
4511 /*
4512 * This is a large offset (64 bit) write.
4513 */
4514 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4515
4516 #else /* !LARGE_SMB_OFF_T */
4517
4518 /*
4519 * Ensure we haven't been sent a >32 bit offset.
4520 */
4521
4522 if(IVAL(req->vwv+12, 0) != 0) {
4523 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4524 "used and we don't support 64 bit offsets.\n",
4525 (unsigned int)IVAL(req->vwv+12, 0) ));
4526 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4527 END_PROFILE(SMBwriteX);
4528 return;
4529 }
4530
4531 #endif /* LARGE_SMB_OFF_T */
4532 }
4533
4534 /* X/Open SMB protocol says that, unlike SMBwrite
4535 if the length is zero then NO truncation is
4536 done, just a write of zero. To truncate a file,
4537 use SMBwrite. */
4538
4539 if(numtowrite == 0) {
4540 nwritten = 0;
4541 } else {
4542 if (req->unread_bytes == 0) {
4543 status = schedule_aio_write_and_X(conn,
4544 req,
4545 fsp,
4546 data,
4547 startpos,
4548 numtowrite);
4549
4550 if (NT_STATUS_IS_OK(status)) {
4551 /* write scheduled - we're done. */
4552 goto out;
4553 }
4554 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4555 /* Real error - report to client. */
4556 reply_nterror(req, status);
4557 goto out;
4558 }
4559 /* NT_STATUS_RETRY - fall through to sync write. */
4560 }
4561
4562 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4563 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4564 &lock);
4565
4566 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4567 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4568 goto out;
4569 }
4570
4571 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4572 saved_errno = errno;
4573
4574 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4575 }
4576
4577 if(nwritten < 0) {
4578 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4579 goto out;
4580 }
4581
4582 if((nwritten == 0) && (numtowrite != 0)) {
4583 reply_nterror(req, NT_STATUS_DISK_FULL);
4584 goto out;
4585 }
4586
4587 reply_outbuf(req, 6, 0);
4588 SSVAL(req->outbuf,smb_vwv2,nwritten);
4589 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4590
4591 if (nwritten < (ssize_t)numtowrite) {
4592 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4593 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4594 }
4595
4596 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4597 fsp->fnum, (int)numtowrite, (int)nwritten));
4598
4599 status = sync_file(conn, fsp, write_through);
4600 if (!NT_STATUS_IS_OK(status)) {
4601 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4602 fsp_str_dbg(fsp), nt_errstr(status)));
4603 reply_nterror(req, status);
4604 goto out;
4605 }
4606
4607 END_PROFILE(SMBwriteX);
4608 chain_reply(req);
4609 return;
4610
4611 out:
4612 END_PROFILE(SMBwriteX);
4613 return;
4614 }
4615
4616 /****************************************************************************
4617 Reply to a lseek.
4618 ****************************************************************************/
4619
4620 void reply_lseek(struct smb_request *req)
4621 {
4622 connection_struct *conn = req->conn;
4623 SMB_OFF_T startpos;
4624 SMB_OFF_T res= -1;
4625 int mode,umode;
4626 files_struct *fsp;
4627
4628 START_PROFILE(SMBlseek);
4629
4630 if (req->wct < 4) {
4631 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4632 END_PROFILE(SMBlseek);
4633 return;
4634 }
4635
4636 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4637
4638 if (!check_fsp(conn, req, fsp)) {
4639 return;
4640 }
4641
4642 flush_write_cache(fsp, SEEK_FLUSH);
4643
4644 mode = SVAL(req->vwv+1, 0) & 3;
4645 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4646 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4647
4648 switch (mode) {
4649 case 0:
4650 umode = SEEK_SET;
4651 res = startpos;
4652 break;
4653 case 1:
4654 umode = SEEK_CUR;
4655 res = fsp->fh->pos + startpos;
4656 break;
4657 case 2:
4658 umode = SEEK_END;
4659 break;
4660 default:
4661 umode = SEEK_SET;
4662 res = startpos;
4663 break;
4664 }
4665
4666 if (umode == SEEK_END) {
4667 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4668 if(errno == EINVAL) {
4669 SMB_OFF_T current_pos = startpos;
4670
4671 if(fsp_stat(fsp) == -1) {
4672 reply_nterror(req,
4673 map_nt_error_from_unix(errno));
4674 END_PROFILE(SMBlseek);
4675 return;
4676 }
4677
4678 current_pos += fsp->fsp_name->st.st_ex_size;
4679 if(current_pos < 0)
4680 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4681 }
4682 }
4683
4684 if(res == -1) {
4685 reply_nterror(req, map_nt_error_from_unix(errno));
4686 END_PROFILE(SMBlseek);
4687 return;
4688 }
4689 }
4690
4691 fsp->fh->pos = res;
4692
4693 reply_outbuf(req, 2, 0);
4694 SIVAL(req->outbuf,smb_vwv0,res);
4695
4696 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4697 fsp->fnum, (double)startpos, (double)res, mode));
4698
4699 END_PROFILE(SMBlseek);
4700 return;
4701 }
4702
4703 /****************************************************************************
4704 Reply to a flush.
4705 ****************************************************************************/
4706
4707 void reply_flush(struct smb_request *req)
4708 {
4709 connection_struct *conn = req->conn;
4710 uint16 fnum;
4711 files_struct *fsp;
4712
4713 START_PROFILE(SMBflush);
4714
4715 if (req->wct < 1) {
4716 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4717 return;
4718 }
4719
4720 fnum = SVAL(req->vwv+0, 0);
4721 fsp = file_fsp(req, fnum);
4722
4723 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4724 return;
4725 }
4726
4727 if (!fsp) {
4728 file_sync_all(conn);
4729 } else {
4730 NTSTATUS status = sync_file(conn, fsp, True);
4731 if (!NT_STATUS_IS_OK(status)) {
4732 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4733 fsp_str_dbg(fsp), nt_errstr(status)));
4734 reply_nterror(req, status);
4735 END_PROFILE(SMBflush);
4736 return;
4737 }
4738 }
4739
4740 reply_outbuf(req, 0, 0);
4741
4742 DEBUG(3,("flush\n"));
4743 END_PROFILE(SMBflush);
4744 return;
4745 }
4746
4747 /****************************************************************************
4748 Reply to a exit.
4749 conn POINTER CAN BE NULL HERE !
4750 ****************************************************************************/
4751
4752 void reply_exit(struct smb_request *req)
4753 {
4754 START_PROFILE(SMBexit);
4755
4756 file_close_pid(req->smbpid, req->vuid);
4757
4758 reply_outbuf(req, 0, 0);
4759
4760 DEBUG(3,("exit\n"));
4761
4762 END_PROFILE(SMBexit);
4763 return;
4764 }
4765
4766 /****************************************************************************
4767 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4768 ****************************************************************************/
4769
4770 void reply_close(struct smb_request *req)
4771 {
4772 connection_struct *conn = req->conn;
4773 NTSTATUS status = NT_STATUS_OK;
4774 files_struct *fsp = NULL;
4775 START_PROFILE(SMBclose);
4776
4777 if (req->wct < 3) {
4778 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4779 END_PROFILE(SMBclose);
4780 return;
4781 }
4782
4783 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4784
4785 /*
4786 * We can only use check_fsp if we know it's not a directory.
4787 */
4788
4789 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4790 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4791 END_PROFILE(SMBclose);
4792 return;
4793 }
4794
4795 if(fsp->is_directory) {
4796 /*
4797 * Special case - close NT SMB directory handle.
4798 */
4799 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4800 status = close_file(req, fsp, NORMAL_CLOSE);
4801 } else {
4802 time_t t;
4803 /*
4804 * Close ordinary file.
4805 */
4806
4807 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4808 fsp->fh->fd, fsp->fnum,
4809 conn->num_files_open));
4810
4811 /*
4812 * Take care of any time sent in the close.
4813 */
4814
4815 t = srv_make_unix_date3(req->vwv+1);
4816 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4817
4818 /*
4819 * close_file() returns the unix errno if an error
4820 * was detected on close - normally this is due to
4821 * a disk full error. If not then it was probably an I/O error.
4822 */
4823
4824 status = close_file(req, fsp, NORMAL_CLOSE);
4825 }
4826
4827 if (!NT_STATUS_IS_OK(status)) {
4828 reply_nterror(req, status);
4829 END_PROFILE(SMBclose);
4830 return;
4831 }
4832
4833 reply_outbuf(req, 0, 0);
4834 END_PROFILE(SMBclose);
4835 return;
4836 }
4837
4838 /****************************************************************************
4839 Reply to a writeclose (Core+ protocol).
4840 ****************************************************************************/
4841
4842 void reply_writeclose(struct smb_request *req)
4843 {
4844 connection_struct *conn = req->conn;
4845 size_t numtowrite;
4846 ssize_t nwritten = -1;
4847 NTSTATUS close_status = NT_STATUS_OK;
4848 SMB_OFF_T startpos;
4849 const char *data;
4850 struct timespec mtime;
4851 files_struct *fsp;
4852 struct lock_struct lock;
4853
4854 START_PROFILE(SMBwriteclose);
4855
4856 if (req->wct < 6) {
4857 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4858 END_PROFILE(SMBwriteclose);
4859 return;
4860 }
4861
4862 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4863
4864 if (!check_fsp(conn, req, fsp)) {
4865 END_PROFILE(SMBwriteclose);
4866 return;
4867 }
4868 if (!CHECK_WRITE(fsp)) {
4869 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4870 END_PROFILE(SMBwriteclose);
4871 return;
4872 }
4873
4874 numtowrite = SVAL(req->vwv+1, 0);
4875 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4876 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4877 data = (const char *)req->buf + 1;
4878
4879 if (!fsp->print_file) {
4880 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4881 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4882 &lock);
4883
4884 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4885 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4886 END_PROFILE(SMBwriteclose);
4887 return;
4888 }
4889 }
4890
4891 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4892
4893 set_close_write_time(fsp, mtime);
4894
4895 /*
4896 * More insanity. W2K only closes the file if writelen > 0.
4897 * JRA.
4898 */
4899
4900 if (numtowrite) {
4901 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4902 "file %s\n", fsp_str_dbg(fsp)));
4903 close_status = close_file(req, fsp, NORMAL_CLOSE);
4904 }
4905
4906 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4907 fsp->fnum, (int)numtowrite, (int)nwritten,
4908 conn->num_files_open));
4909
4910 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4911 reply_nterror(req, NT_STATUS_DISK_FULL);
4912 goto strict_unlock;
4913 }
4914
4915 if(!NT_STATUS_IS_OK(close_status)) {
4916 reply_nterror(req, close_status);
4917 goto strict_unlock;
4918 }
4919
4920 reply_outbuf(req, 1, 0);
4921
4922 SSVAL(req->outbuf,smb_vwv0,nwritten);
4923
4924 strict_unlock:
4925 if (numtowrite && !fsp->print_file) {
4926 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4927 }
4928
4929 END_PROFILE(SMBwriteclose);
4930 return;
4931 }
4932
4933 #undef DBGC_CLASS
4934 #define DBGC_CLASS DBGC_LOCKING
4935
4936 /****************************************************************************
4937 Reply to a lock.
4938 ****************************************************************************/
4939
4940 void reply_lock(struct smb_request *req)
4941 {
4942 connection_struct *conn = req->conn;
4943 uint64_t count,offset;
4944 NTSTATUS status;
4945 files_struct *fsp;
4946 struct byte_range_lock *br_lck = NULL;
4947
4948 START_PROFILE(SMBlock);
4949
4950 if (req->wct < 5) {
4951 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4952 END_PROFILE(SMBlock);
4953 return;
4954 }
4955
4956 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4957
4958 if (!check_fsp(conn, req, fsp)) {
4959 END_PROFILE(SMBlock);
4960 return;
4961 }
4962
4963 count = (uint64_t)IVAL(req->vwv+1, 0);
4964 offset = (uint64_t)IVAL(req->vwv+3, 0);
4965
4966 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4967 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4968
4969 br_lck = do_lock(req->sconn->msg_ctx,
4970 fsp,
4971 (uint64_t)req->smbpid,
4972 count,
4973 offset,
4974 WRITE_LOCK,
4975 WINDOWS_LOCK,
4976 False, /* Non-blocking lock. */
4977 &status,
4978 NULL,
4979 NULL);
4980
4981 TALLOC_FREE(br_lck);
4982
4983 if (NT_STATUS_V(status)) {
4984 reply_nterror(req, status);
4985 END_PROFILE(SMBlock);
4986 return;
4987 }
4988
4989 reply_outbuf(req, 0, 0);
4990
4991 END_PROFILE(SMBlock);
4992 return;
4993 }
4994
4995 /****************************************************************************
4996 Reply to a unlock.
4997 ****************************************************************************/
4998
4999 void reply_unlock(struct smb_request *req)
5000 {
5001 connection_struct *conn = req->conn;
5002 uint64_t count,offset;
5003 NTSTATUS status;
5004 files_struct *fsp;
5005
5006 START_PROFILE(SMBunlock);
5007
5008 if (req->wct < 5) {
5009 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5010 END_PROFILE(SMBunlock);
5011 return;
5012 }
5013
5014 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5015
5016 if (!check_fsp(conn, req, fsp)) {
5017 END_PROFILE(SMBunlock);
5018 return;
5019 }
5020
5021 count = (uint64_t)IVAL(req->vwv+1, 0);
5022 offset = (uint64_t)IVAL(req->vwv+3, 0);
5023
5024 status = do_unlock(req->sconn->msg_ctx,
5025 fsp,
5026 (uint64_t)req->smbpid,
5027 count,
5028 offset,
5029 WINDOWS_LOCK);
5030
5031 if (NT_STATUS_V(status)) {
5032 reply_nterror(req, status);
5033 END_PROFILE(SMBunlock);
5034 return;
5035 }
5036
5037 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5038 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5039
5040 reply_outbuf(req, 0, 0);
5041
5042 END_PROFILE(SMBunlock);
5043 return;
5044 }
5045
5046 #undef DBGC_CLASS
5047 #define DBGC_CLASS DBGC_ALL
5048
5049 /****************************************************************************
5050 Reply to a tdis.
5051 conn POINTER CAN BE NULL HERE !
5052 ****************************************************************************/
5053
5054 void reply_tdis(struct smb_request *req)
5055 {
5056 connection_struct *conn = req->conn;
5057 START_PROFILE(SMBtdis);
5058
5059 if (!conn) {
5060 DEBUG(4,("Invalid connection in tdis\n"));
5061 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5062 END_PROFILE(SMBtdis);
5063 return;
5064 }
5065
5066 conn->used = False;
5067
5068 close_cnum(conn,req->vuid);
5069 req->conn = NULL;
5070
5071 reply_outbuf(req, 0, 0);
5072 END_PROFILE(SMBtdis);
5073 return;
5074 }
5075
5076 /****************************************************************************
5077 Reply to a echo.
5078 conn POINTER CAN BE NULL HERE !
5079 ****************************************************************************/
5080
5081 void reply_echo(struct smb_request *req)
5082 {
5083 connection_struct *conn = req->conn;
5084 struct smb_perfcount_data local_pcd;
5085 struct smb_perfcount_data *cur_pcd;
5086 int smb_reverb;
5087 int seq_num;
5088
5089 START_PROFILE(SMBecho);
5090
5091 smb_init_perfcount_data(&local_pcd);
5092
5093 if (req->wct < 1) {
5094 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5095 END_PROFILE(SMBecho);
5096 return;
5097 }
5098
5099 smb_reverb = SVAL(req->vwv+0, 0);
5100
5101 reply_outbuf(req, 1, req->buflen);
5102
5103 /* copy any incoming data back out */
5104 if (req->buflen > 0) {
5105 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5106 }
5107
5108 if (smb_reverb > 100) {
5109 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5110 smb_reverb = 100;
5111 }
5112
5113 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5114
5115 /* this makes sure we catch the request pcd */
5116 if (seq_num == smb_reverb) {
5117 cur_pcd = &req->pcd;
5118 } else {
5119 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5120 cur_pcd = &local_pcd;
5121 }
5122
5123 SSVAL(req->outbuf,smb_vwv0,seq_num);
5124
5125 show_msg((char *)req->outbuf);
5126 if (!srv_send_smb(req->sconn,
5127 (char *)req->outbuf,
5128 true, req->seqnum+1,
5129 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5130 cur_pcd))
5131 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5132 }
5133
5134 DEBUG(3,("echo %d times\n", smb_reverb));
5135
5136 TALLOC_FREE(req->outbuf);
5137
5138 END_PROFILE(SMBecho);
5139 return;
5140 }
5141
5142 /****************************************************************************
5143 Reply to a printopen.
5144 ****************************************************************************/
5145
5146 void reply_printopen(struct smb_request *req)
5147 {
5148 connection_struct *conn = req->conn;
5149 files_struct *fsp;
5150 NTSTATUS status;
5151
5152 START_PROFILE(SMBsplopen);
5153
5154 if (req->wct < 2) {
5155 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5156 END_PROFILE(SMBsplopen);
5157 return;
5158 }
5159
5160 if (!CAN_PRINT(conn)) {
5161 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5162 END_PROFILE(SMBsplopen);
5163 return;
5164 }
5165
5166 status = file_new(req, conn, &fsp);
5167 if(!NT_STATUS_IS_OK(status)) {
5168 reply_nterror(req, status);
5169 END_PROFILE(SMBsplopen);
5170 return;
5171 }
5172
5173 /* Open for exclusive use, write only. */
5174 status = print_spool_open(fsp, NULL, req->vuid);
5175
5176 if (!NT_STATUS_IS_OK(status)) {
5177 file_free(req, fsp);
5178 reply_nterror(req, status);
5179 END_PROFILE(SMBsplopen);
5180 return;
5181 }
5182
5183 reply_outbuf(req, 1, 0);
5184 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5185
5186 DEBUG(3,("openprint fd=%d fnum=%d\n",
5187 fsp->fh->fd, fsp->fnum));
5188
5189 END_PROFILE(SMBsplopen);
5190 return;
5191 }
5192
5193 /****************************************************************************
5194 Reply to a printclose.
5195 ****************************************************************************/
5196
5197 void reply_printclose(struct smb_request *req)
5198 {
5199 connection_struct *conn = req->conn;
5200 files_struct *fsp;
5201 NTSTATUS status;
5202
5203 START_PROFILE(SMBsplclose);
5204
5205 if (req->wct < 1) {
5206 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5207 END_PROFILE(SMBsplclose);
5208 return;
5209 }
5210
5211 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5212
5213 if (!check_fsp(conn, req, fsp)) {
5214 END_PROFILE(SMBsplclose);
5215 return;
5216 }
5217
5218 if (!CAN_PRINT(conn)) {
5219 reply_force_doserror(req, ERRSRV, ERRerror);
5220 END_PROFILE(SMBsplclose);
5221 return;
5222 }
5223
5224 DEBUG(3,("printclose fd=%d fnum=%d\n",
5225 fsp->fh->fd,fsp->fnum));
5226
5227 status = close_file(req, fsp, NORMAL_CLOSE);
5228
5229 if(!NT_STATUS_IS_OK(status)) {
5230 reply_nterror(req, status);
5231 END_PROFILE(SMBsplclose);
5232 return;
5233 }
5234
5235 reply_outbuf(req, 0, 0);
5236
5237 END_PROFILE(SMBsplclose);
5238 return;
5239 }
5240
5241 /****************************************************************************
5242 Reply to a printqueue.
5243 ****************************************************************************/
5244
5245 void reply_printqueue(struct smb_request *req)
5246 {
5247 connection_struct *conn = req->conn;
5248 int max_count;
5249 int start_index;
5250
5251 START_PROFILE(SMBsplretq);
5252
5253 if (req->wct < 2) {
5254 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5255 END_PROFILE(SMBsplretq);
5256 return;
5257 }
5258
5259 max_count = SVAL(req->vwv+0, 0);
5260 start_index = SVAL(req->vwv+1, 0);
5261
5262 /* we used to allow the client to get the cnum wrong, but that
5263 is really quite gross and only worked when there was only
5264 one printer - I think we should now only accept it if they
5265 get it right (tridge) */
5266 if (!CAN_PRINT(conn)) {
5267 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5268 END_PROFILE(SMBsplretq);
5269 return;
5270 }
5271
5272 reply_outbuf(req, 2, 3);
5273 SSVAL(req->outbuf,smb_vwv0,0);
5274 SSVAL(req->outbuf,smb_vwv1,0);
5275 SCVAL(smb_buf(req->outbuf),0,1);
5276 SSVAL(smb_buf(req->outbuf),1,0);
5277
5278 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5279 start_index, max_count));
5280
5281 {
5282 TALLOC_CTX *mem_ctx = talloc_tos();
5283 NTSTATUS status;
5284 WERROR werr;
5285 const char *sharename = lp_servicename(SNUM(conn));
5286 struct rpc_pipe_client *cli = NULL;
5287 struct policy_handle handle;
5288 struct spoolss_DevmodeContainer devmode_ctr;
5289 union spoolss_JobInfo *info;
5290 uint32_t count;
5291 uint32_t num_to_get;
5292 uint32_t first;
5293 uint32_t i;
5294
5295 ZERO_STRUCT(handle);
5296
5297 status = rpc_connect_spoolss_pipe(conn, &cli);
5298 if (!NT_STATUS_IS_OK(status)) {
5299 DEBUG(0, ("reply_printqueue: "
5300 "could not connect to spoolss: %s\n",
5301 nt_errstr(status)));
5302 reply_nterror(req, status);
5303 goto out;
5304 }
5305
5306 ZERO_STRUCT(devmode_ctr);
5307
5308 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
5309 sharename,
5310 NULL, devmode_ctr,
5311 SEC_FLAG_MAXIMUM_ALLOWED,
5312 &handle,
5313 &werr);
5314 if (!NT_STATUS_IS_OK(status)) {
5315 reply_nterror(req, status);
5316 goto out;
5317 }
5318 if (!W_ERROR_IS_OK(werr)) {
5319 reply_nterror(req, werror_to_ntstatus(werr));
5320 goto out;
5321 }
5322
5323 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5324 &handle,
5325 0, /* firstjob */
5326 0xff, /* numjobs */
5327 2, /* level */
5328 0, /* offered */
5329 &count,
5330 &info);
5331 if (!W_ERROR_IS_OK(werr)) {
5332 reply_nterror(req, werror_to_ntstatus(werr));
5333 goto out;
5334 }
5335
5336 if (max_count > 0) {
5337 first = start_index;
5338 } else {
5339 first = start_index + max_count + 1;
5340 }
5341
5342 if (first >= count) {
5343 num_to_get = first;
5344 } else {
5345 num_to_get = first + MIN(ABS(max_count), count - first);
5346 }
5347
5348 for (i = first; i < num_to_get; i++) {
5349 char blob[28];
5350 char *p = blob;
5351 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5352 int qstatus;
5353 uint16_t qrapjobid = pjobid_to_rap(sharename,
5354 info[i].info2.job_id);
5355
5356 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5357 qstatus = 2;
5358 } else {
5359 qstatus = 3;
5360 }
5361
5362 srv_put_dos_date2(p, 0, qtime);
5363 SCVAL(p, 4, qstatus);
5364 SSVAL(p, 5, qrapjobid);
5365 SIVAL(p, 7, info[i].info2.size);
5366 SCVAL(p, 11, 0);
5367 srvstr_push(blob, req->flags2, p+12,
5368 info[i].info2.notify_name, 16, STR_ASCII);
5369
5370 if (message_push_blob(
5371 &req->outbuf,
5372 data_blob_const(
5373 blob, sizeof(blob))) == -1) {
5374 reply_nterror(req, NT_STATUS_NO_MEMORY);
5375 goto out;
5376 }
5377 }
5378
5379 if (count > 0) {
5380 SSVAL(req->outbuf,smb_vwv0,count);
5381 SSVAL(req->outbuf,smb_vwv1,
5382 (max_count>0?first+count:first-1));
5383 SCVAL(smb_buf(req->outbuf),0,1);
5384 SSVAL(smb_buf(req->outbuf),1,28*count);
5385 }
5386
5387
5388 DEBUG(3, ("%u entries returned in queue\n",
5389 (unsigned)count));
5390
5391 out:
5392 if (cli && is_valid_policy_hnd(&handle)) {
5393 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
5394 }
5395
5396 }
5397
5398 END_PROFILE(SMBsplretq);
5399 return;
5400 }
5401
5402 /****************************************************************************
5403 Reply to a printwrite.
5404 ****************************************************************************/
5405
5406 void reply_printwrite(struct smb_request *req)
5407 {
5408 connection_struct *conn = req->conn;
5409 int numtowrite;
5410 const char *data;
5411 files_struct *fsp;
5412
5413 START_PROFILE(SMBsplwr);
5414
5415 if (req->wct < 1) {
5416 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5417 END_PROFILE(SMBsplwr);
5418 return;
5419 }
5420
5421 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5422
5423 if (!check_fsp(conn, req, fsp)) {
5424 END_PROFILE(SMBsplwr);
5425 return;
5426 }
5427
5428 if (!fsp->print_file) {
5429 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5430 END_PROFILE(SMBsplwr);
5431 return;
5432 }
5433
5434 if (!CHECK_WRITE(fsp)) {
5435 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5436 END_PROFILE(SMBsplwr);
5437 return;
5438 }
5439
5440 numtowrite = SVAL(req->buf, 1);
5441
5442 if (req->buflen < numtowrite + 3) {
5443 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5444 END_PROFILE(SMBsplwr);
5445 return;
5446 }
5447
5448 data = (const char *)req->buf + 3;
5449
5450 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5451 reply_nterror(req, map_nt_error_from_unix(errno));
5452 END_PROFILE(SMBsplwr);
5453 return;
5454 }
5455
5456 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5457
5458 END_PROFILE(SMBsplwr);
5459 return;
5460 }
5461
5462 /****************************************************************************
5463 Reply to a mkdir.
5464 ****************************************************************************/
5465
5466 void reply_mkdir(struct smb_request *req)
5467 {
5468 connection_struct *conn = req->conn;
5469 struct smb_filename *smb_dname = NULL;
5470 char *directory = NULL;
5471 NTSTATUS status;
5472 TALLOC_CTX *ctx = talloc_tos();
5473
5474 START_PROFILE(SMBmkdir);
5475
5476 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5477 STR_TERMINATE, &status);
5478 if (!NT_STATUS_IS_OK(status)) {
5479 reply_nterror(req, status);
5480 goto out;
5481 }
5482
5483 status = filename_convert(ctx, conn,
5484 req->flags2 & FLAGS2_DFS_PATHNAMES,
5485 directory,
5486 0,
5487 NULL,
5488 &smb_dname);
5489 if (!NT_STATUS_IS_OK(status)) {
5490 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5491 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5492 ERRSRV, ERRbadpath);
5493 goto out;
5494 }
5495 reply_nterror(req, status);
5496 goto out;
5497 }
5498
5499 status = create_directory(conn, req, smb_dname);
5500
5501 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5502
5503 if (!NT_STATUS_IS_OK(status)) {
5504
5505 if (!use_nt_status()
5506 && NT_STATUS_EQUAL(status,
5507 NT_STATUS_OBJECT_NAME_COLLISION)) {
5508 /*
5509 * Yes, in the DOS error code case we get a
5510 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5511 * samba4 torture test.
5512 */
5513 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5514 }
5515
5516 reply_nterror(req, status);
5517 goto out;
5518 }
5519
5520 reply_outbuf(req, 0, 0);
5521
5522 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5523 out:
5524 TALLOC_FREE(smb_dname);
5525 END_PROFILE(SMBmkdir);
5526 return;
5527 }
5528
5529 /****************************************************************************
5530 Reply to a rmdir.
5531 ****************************************************************************/
5532
5533 void reply_rmdir(struct smb_request *req)
5534 {
5535 connection_struct *conn = req->conn;
5536 struct smb_filename *smb_dname = NULL;
5537 char *directory = NULL;
5538 NTSTATUS status;
5539 TALLOC_CTX *ctx = talloc_tos();
5540 files_struct *fsp = NULL;
5541 int info = 0;
5542 struct smbd_server_connection *sconn = req->sconn;
5543
5544 START_PROFILE(SMBrmdir);
5545
5546 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5547 STR_TERMINATE, &status);
5548 if (!NT_STATUS_IS_OK(status)) {
5549 reply_nterror(req, status);
5550 goto out;
5551 }
5552
5553 status = filename_convert(ctx, conn,
5554 req->flags2 & FLAGS2_DFS_PATHNAMES,
5555 directory,
5556 0,
5557 NULL,
5558 &smb_dname);
5559 if (!NT_STATUS_IS_OK(status)) {
5560 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5561 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5562 ERRSRV, ERRbadpath);
5563 goto out;
5564 }
5565 reply_nterror(req, status);
5566 goto out;
5567 }
5568
5569 if (is_ntfs_stream_smb_fname(smb_dname)) {
5570 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5571 goto out;
5572 }
5573
5574 status = SMB_VFS_CREATE_FILE(
5575 conn, /* conn */
5576 req, /* req */
5577 0, /* root_dir_fid */
5578 smb_dname, /* fname */
5579 DELETE_ACCESS, /* access_mask */
5580 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5581 FILE_SHARE_DELETE),
5582 FILE_OPEN, /* create_disposition*/
5583 FILE_DIRECTORY_FILE, /* create_options */
5584 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5585 0, /* oplock_request */
5586 0, /* allocation_size */
5587 0, /* private_flags */
5588 NULL, /* sd */
5589 NULL, /* ea_list */
5590 &fsp, /* result */
5591 &info); /* pinfo */
5592
5593 if (!NT_STATUS_IS_OK(status)) {
5594 if (open_was_deferred(req->mid)) {
5595 /* We have re-scheduled this call. */
5596 goto out;
5597 }
5598 reply_nterror(req, status);
5599 goto out;
5600 }
5601
5602 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5603 if (!NT_STATUS_IS_OK(status)) {
5604 close_file(req, fsp, ERROR_CLOSE);
5605 reply_nterror(req, status);
5606 goto out;
5607 }
5608
5609 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5610 close_file(req, fsp, ERROR_CLOSE);
5611 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5612 goto out;
5613 }
5614
5615 status = close_file(req, fsp, NORMAL_CLOSE);
5616 if (!NT_STATUS_IS_OK(status)) {
5617 reply_nterror(req, status);
5618 } else {
5619 reply_outbuf(req, 0, 0);
5620 }
5621
5622 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5623
5624 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5625 out:
5626 TALLOC_FREE(smb_dname);
5627 END_PROFILE(SMBrmdir);
5628 return;
5629 }
5630
5631 /*******************************************************************
5632 Resolve wildcards in a filename rename.
5633 ********************************************************************/
5634
5635 static bool resolve_wildcards(TALLOC_CTX *ctx,
5636 const char *name1,
5637 const char *name2,
5638 char **pp_newname)
5639 {
5640 char *name2_copy = NULL;
5641 char *root1 = NULL;
5642 char *root2 = NULL;
5643 char *ext1 = NULL;
5644 char *ext2 = NULL;
5645 char *p,*p2, *pname1, *pname2;
5646
5647 name2_copy = talloc_strdup(ctx, name2);
5648 if (!name2_copy) {
5649 return False;
5650 }
5651
5652 pname1 = strrchr_m(name1,'/');
5653 pname2 = strrchr_m(name2_copy,'/');
5654
5655 if (!pname1 || !pname2) {
5656 return False;
5657 }
5658
5659 /* Truncate the copy of name2 at the last '/' */
5660 *pname2 = '\0';
5661
5662 /* Now go past the '/' */
5663 pname1++;
5664 pname2++;
5665
5666 root1 = talloc_strdup(ctx, pname1);
5667 root2 = talloc_strdup(ctx, pname2);
5668
5669 if (!root1 || !root2) {
5670 return False;
5671 }
5672
5673 p = strrchr_m(root1,'.');
5674 if (p) {
5675 *p = 0;
5676 ext1 = talloc_strdup(ctx, p+1);
5677 } else {
5678 ext1 = talloc_strdup(ctx, "");
5679 }
5680 p = strrchr_m(root2,'.');
5681 if (p) {
5682 *p = 0;
5683 ext2 = talloc_strdup(ctx, p+1);
5684 } else {
5685 ext2 = talloc_strdup(ctx, "");
5686 }
5687
5688 if (!ext1 || !ext2) {
5689 return False;
5690 }
5691
5692 p = root1;
5693 p2 = root2;
5694 while (*p2) {
5695 if (*p2 == '?') {
5696 /* Hmmm. Should this be mb-aware ? */
5697 *p2 = *p;
5698 p2++;
5699 } else if (*p2 == '*') {
5700 *p2 = '\0';
5701 root2 = talloc_asprintf(ctx, "%s%s",
5702 root2,
5703 p);
5704 if (!root2) {
5705 return False;
5706 }
5707 break;
5708 } else {
5709 p2++;
5710 }
5711 if (*p) {
5712 p++;
5713 }
5714 }
5715
5716 p = ext1;
5717 p2 = ext2;
5718 while (*p2) {
5719 if (*p2 == '?') {
5720 /* Hmmm. Should this be mb-aware ? */
5721 *p2 = *p;
5722 p2++;
5723 } else if (*p2 == '*') {
5724 *p2 = '\0';
5725 ext2 = talloc_asprintf(ctx, "%s%s",
5726 ext2,
5727 p);
5728 if (!ext2) {
5729 return False;
5730 }
5731 break;
5732 } else {
5733 p2++;
5734 }
5735 if (*p) {
5736 p++;
5737 }
5738 }
5739
5740 if (*ext2) {
5741 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5742 name2_copy,
5743 root2,
5744 ext2);
5745 } else {
5746 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5747 name2_copy,
5748 root2);
5749 }
5750
5751 if (!*pp_newname) {
5752 return False;
5753 }
5754
5755 return True;
5756 }
5757
5758 /****************************************************************************
5759 Ensure open files have their names updated. Updated to notify other smbd's
5760 asynchronously.
5761 ****************************************************************************/
5762
5763 static void rename_open_files(connection_struct *conn,
5764 struct share_mode_lock *lck,
5765 const struct smb_filename *smb_fname_dst)
5766 {
5767 files_struct *fsp;
5768 bool did_rename = False;
5769 NTSTATUS status;
5770
5771 for(fsp = file_find_di_first(lck->id); fsp;
5772 fsp = file_find_di_next(fsp)) {
5773 /* fsp_name is a relative path under the fsp. To change this for other
5774 sharepaths we need to manipulate relative paths. */
5775 /* TODO - create the absolute path and manipulate the newname
5776 relative to the sharepath. */
5777 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5778 continue;
5779 }
5780 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5781 "(file_id %s) from %s -> %s\n", fsp->fnum,
5782 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5783 smb_fname_str_dbg(smb_fname_dst)));
5784
5785 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5786 if (NT_STATUS_IS_OK(status)) {
5787 did_rename = True;
5788 }
5789 }
5790
5791 if (!did_rename) {
5792 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5793 "for %s\n", file_id_string_tos(&lck->id),
5794 smb_fname_str_dbg(smb_fname_dst)));
5795 }
5796
5797 /* Send messages to all smbd's (not ourself) that the name has changed. */
5798 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5799 smb_fname_dst);
5800
5801 }
5802
5803 /****************************************************************************
5804 We need to check if the source path is a parent directory of the destination
5805 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5806 refuse the rename with a sharing violation. Under UNIX the above call can
5807 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5808 probably need to check that the client is a Windows one before disallowing
5809 this as a UNIX client (one with UNIX extensions) can know the source is a
5810 symlink and make this decision intelligently. Found by an excellent bug
5811 report from <AndyLiebman@aol.com>.
5812 ****************************************************************************/
5813
5814 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5815 const struct smb_filename *smb_fname_dst)
5816 {
5817 const char *psrc = smb_fname_src->base_name;
5818 const char *pdst = smb_fname_dst->base_name;
5819 size_t slen;
5820
5821 if (psrc[0] == '.' && psrc[1] == '/') {
5822 psrc += 2;
5823 }
5824 if (pdst[0] == '.' && pdst[1] == '/') {
5825 pdst += 2;
5826 }
5827 if ((slen = strlen(psrc)) > strlen(pdst)) {
5828 return False;
5829 }
5830 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5831 }
5832
5833 /*
5834 * Do the notify calls from a rename
5835 */
5836
5837 static void notify_rename(connection_struct *conn, bool is_dir,
5838 const struct smb_filename *smb_fname_src,
5839 const struct smb_filename *smb_fname_dst)
5840 {
5841 char *parent_dir_src = NULL;
5842 char *parent_dir_dst = NULL;
5843 uint32 mask;
5844
5845 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5846 : FILE_NOTIFY_CHANGE_FILE_NAME;
5847
5848 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5849 &parent_dir_src, NULL) ||
5850 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5851 &parent_dir_dst, NULL)) {
5852 goto out;
5853 }
5854
5855 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5856 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5857 smb_fname_src->base_name);
5858 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5859 smb_fname_dst->base_name);
5860 }
5861 else {
5862 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5863 smb_fname_src->base_name);
5864 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5865 smb_fname_dst->base_name);
5866 }
5867
5868 /* this is a strange one. w2k3 gives an additional event for
5869 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5870 files, but not directories */
5871 if (!is_dir) {
5872 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5873 FILE_NOTIFY_CHANGE_ATTRIBUTES
5874 |FILE_NOTIFY_CHANGE_CREATION,
5875 smb_fname_dst->base_name);
5876 }
5877 out:
5878 TALLOC_FREE(parent_dir_src);
5879 TALLOC_FREE(parent_dir_dst);
5880 }
5881
5882 /****************************************************************************
5883 Rename an open file - given an fsp.
5884 ****************************************************************************/
5885
5886 NTSTATUS rename_internals_fsp(connection_struct *conn,
5887 files_struct *fsp,
5888 const struct smb_filename *smb_fname_dst_in,
5889 uint32 attrs,
5890 bool replace_if_exists)
5891 {
5892 TALLOC_CTX *ctx = talloc_tos();
5893 struct smb_filename *smb_fname_dst = NULL;
5894 NTSTATUS status = NT_STATUS_OK;
5895 struct share_mode_lock *lck = NULL;
5896 bool dst_exists, old_is_stream, new_is_stream;
5897
5898 status = check_name(conn, smb_fname_dst_in->base_name);
5899 if (!NT_STATUS_IS_OK(status)) {
5900 return status;
5901 }
5902
5903 /* Make a copy of the dst smb_fname structs */
5904
5905 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5906 if (!NT_STATUS_IS_OK(status)) {
5907 goto out;
5908 }
5909
5910 /* Ensure the dst smb_fname contains a '/' */
5911 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5912 char * tmp;
5913 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5914 smb_fname_dst->base_name);
5915 if (!tmp) {
5916 status = NT_STATUS_NO_MEMORY;
5917 goto out;
5918 }
5919 TALLOC_FREE(smb_fname_dst->base_name);
5920 smb_fname_dst->base_name = tmp;
5921 }
5922
5923 /*
5924 * Check for special case with case preserving and not
5925 * case sensitive. If the old last component differs from the original
5926 * last component only by case, then we should allow
5927 * the rename (user is trying to change the case of the
5928 * filename).
5929 */
5930 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5931 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5932 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5933 char *last_slash;
5934 char *fname_dst_lcomp_base_mod = NULL;
5935 struct smb_filename *smb_fname_orig_lcomp = NULL;
5936
5937 /*
5938 * Get the last component of the destination name. Note that
5939 * we guarantee that destination name contains a '/' character
5940 * above.
5941 */
5942 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5943 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5944 if (!fname_dst_lcomp_base_mod) {
5945 status = NT_STATUS_NO_MEMORY;
5946 goto out;
5947 }
5948
5949 /*
5950 * Create an smb_filename struct using the original last
5951 * component of the destination.
5952 */
5953 status = create_synthetic_smb_fname_split(ctx,
5954 smb_fname_dst->original_lcomp, NULL,
5955 &smb_fname_orig_lcomp);
5956 if (!NT_STATUS_IS_OK(status)) {
5957 TALLOC_FREE(fname_dst_lcomp_base_mod);
5958 goto out;
5959 }
5960
5961 /* If the base names only differ by case, use original. */
5962 if(!strcsequal(fname_dst_lcomp_base_mod,
5963 smb_fname_orig_lcomp->base_name)) {
5964 char *tmp;
5965 /*
5966 * Replace the modified last component with the
5967 * original.
5968 */
5969 *last_slash = '\0'; /* Truncate at the '/' */
5970 tmp = talloc_asprintf(smb_fname_dst,
5971 "%s/%s",
5972 smb_fname_dst->base_name,
5973 smb_fname_orig_lcomp->base_name);
5974 if (tmp == NULL) {
5975 status = NT_STATUS_NO_MEMORY;
5976 TALLOC_FREE(fname_dst_lcomp_base_mod);
5977 TALLOC_FREE(smb_fname_orig_lcomp);
5978 goto out;
5979 }
5980 TALLOC_FREE(smb_fname_dst->base_name);
5981 smb_fname_dst->base_name = tmp;
5982 }
5983
5984 /* If the stream_names only differ by case, use original. */
5985 if(!strcsequal(smb_fname_dst->stream_name,
5986 smb_fname_orig_lcomp->stream_name)) {
5987 char *tmp = NULL;
5988 /* Use the original stream. */
5989 tmp = talloc_strdup(smb_fname_dst,
5990 smb_fname_orig_lcomp->stream_name);
5991 if (tmp == NULL) {
5992 status = NT_STATUS_NO_MEMORY;
5993 TALLOC_FREE(fname_dst_lcomp_base_mod);
5994 TALLOC_FREE(smb_fname_orig_lcomp);
5995 goto out;
5996 }
5997 TALLOC_FREE(smb_fname_dst->stream_name);
5998 smb_fname_dst->stream_name = tmp;
5999 }
6000 TALLOC_FREE(fname_dst_lcomp_base_mod);
6001 TALLOC_FREE(smb_fname_orig_lcomp);
6002 }
6003
6004 /*
6005 * If the src and dest names are identical - including case,
6006 * don't do the rename, just return success.
6007 */
6008
6009 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6010 strcsequal(fsp->fsp_name->stream_name,
6011 smb_fname_dst->stream_name)) {
6012 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6013 "- returning success\n",
6014 smb_fname_str_dbg(smb_fname_dst)));
6015 status = NT_STATUS_OK;
6016 goto out;
6017 }
6018
6019 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6020 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6021
6022 /* Return the correct error code if both names aren't streams. */
6023 if (!old_is_stream && new_is_stream) {
6024 status = NT_STATUS_OBJECT_NAME_INVALID;
6025 goto out;
6026 }
6027
6028 if (old_is_stream && !new_is_stream) {
6029 status = NT_STATUS_INVALID_PARAMETER;
6030 goto out;
6031 }
6032
6033 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6034
6035 if(!replace_if_exists && dst_exists) {
6036 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6037 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6038 smb_fname_str_dbg(smb_fname_dst)));
6039 status = NT_STATUS_OBJECT_NAME_COLLISION;
6040 goto out;
6041 }
6042
6043 if (dst_exists) {
6044 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6045 &smb_fname_dst->st);
6046 files_struct *dst_fsp = file_find_di_first(fileid);
6047 /* The file can be open when renaming a stream */
6048 if (dst_fsp && !new_is_stream) {
6049 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6050 status = NT_STATUS_ACCESS_DENIED;
6051 goto out;
6052 }
6053 }
6054
6055 /* Ensure we have a valid stat struct for the source. */
6056 status = vfs_stat_fsp(fsp);
6057 if (!NT_STATUS_IS_OK(status)) {
6058 goto out;
6059 }
6060
6061 status = can_rename(conn, fsp, attrs);
6062
6063 if (!NT_STATUS_IS_OK(status)) {
6064 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6065 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6066 smb_fname_str_dbg(smb_fname_dst)));
6067 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6068 status = NT_STATUS_ACCESS_DENIED;
6069 goto out;
6070 }
6071
6072 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6073 status = NT_STATUS_ACCESS_DENIED;
6074 }
6075
6076 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6077 NULL);
6078
6079 /*
6080 * We have the file open ourselves, so not being able to get the
6081 * corresponding share mode lock is a fatal error.
6082 */
6083
6084 SMB_ASSERT(lck != NULL);
6085
6086 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6087 uint32 create_options = fsp->fh->private_options;
6088
6089 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6090 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6091 smb_fname_str_dbg(smb_fname_dst)));
6092
6093 if (lp_map_archive(SNUM(conn)) ||
6094 lp_store_dos_attributes(SNUM(conn))) {
6095 /* We must set the archive bit on the newly
6096 renamed file. */
6097 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6098 uint32_t old_dosmode = dos_mode(conn,
6099 smb_fname_dst);
6100 file_set_dosmode(conn,
6101 smb_fname_dst,
6102 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6103 NULL,
6104 true);
6105 }
6106 }
6107
6108 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6109 smb_fname_dst);
6110
6111 rename_open_files(conn, lck, smb_fname_dst);
6112
6113 /*
6114 * A rename acts as a new file create w.r.t. allowing an initial delete
6115 * on close, probably because in Windows there is a new handle to the
6116 * new file. If initial delete on close was requested but not
6117 * originally set, we need to set it here. This is probably not 100% correct,
6118 * but will work for the CIFSFS client which in non-posix mode
6119 * depends on these semantics. JRA.
6120 */
6121
6122 if (create_options & FILE_DELETE_ON_CLOSE) {
6123 status = can_set_delete_on_close(fsp, 0);
6124
6125 if (NT_STATUS_IS_OK(status)) {
6126 /* Note that here we set the *inital* delete on close flag,
6127 * not the regular one. The magic gets handled in close. */
6128 fsp->initial_delete_on_close = True;
6129 }
6130 }
6131 TALLOC_FREE(lck);
6132 status = NT_STATUS_OK;
6133 goto out;
6134 }
6135
6136 TALLOC_FREE(lck);
6137
6138 if (errno == ENOTDIR || errno == EISDIR) {
6139 status = NT_STATUS_OBJECT_NAME_COLLISION;
6140 } else {
6141 status = map_nt_error_from_unix(errno);
6142 }
6143
6144 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6145 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6146 smb_fname_str_dbg(smb_fname_dst)));
6147
6148 out:
6149 TALLOC_FREE(smb_fname_dst);
6150
6151 return status;
6152 }
6153
6154 /****************************************************************************
6155 The guts of the rename command, split out so it may be called by the NT SMB
6156 code.
6157 ****************************************************************************/
6158
6159 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6160 connection_struct *conn,
6161 struct smb_request *req,
6162 struct smb_filename *smb_fname_src,
6163 struct smb_filename *smb_fname_dst,
6164 uint32 attrs,
6165 bool replace_if_exists,
6166 bool src_has_wild,
6167 bool dest_has_wild,
6168 uint32_t access_mask)
6169 {
6170 char *fname_src_dir = NULL;
6171 char *fname_src_mask = NULL;
6172 int count=0;
6173 NTSTATUS status = NT_STATUS_OK;
6174 struct smb_Dir *dir_hnd = NULL;
6175 const char *dname = NULL;
6176 char *talloced = NULL;
6177 long offset = 0;
6178 int create_options = 0;
6179 bool posix_pathnames = lp_posix_pathnames();
6180
6181 /*
6182 * Split the old name into directory and last component
6183 * strings. Note that unix_convert may have stripped off a
6184 * leading ./ from both name and newname if the rename is
6185 * at the root of the share. We need to make sure either both
6186 * name and newname contain a / character or neither of them do
6187 * as this is checked in resolve_wildcards().
6188 */
6189
6190 /* Split up the directory from the filename/mask. */
6191 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6192 &fname_src_dir, &fname_src_mask);
6193 if (!NT_STATUS_IS_OK(status)) {
6194 status = NT_STATUS_NO_MEMORY;
6195 goto out;
6196 }
6197
6198 /*
6199 * We should only check the mangled cache
6200 * here if unix_convert failed. This means
6201 * that the path in 'mask' doesn't exist
6202 * on the file system and so we need to look
6203 * for a possible mangle. This patch from
6204 * Tine Smukavec <valentin.smukavec@hermes.si>.
6205 */
6206
6207 if (!VALID_STAT(smb_fname_src->st) &&
6208 mangle_is_mangled(fname_src_mask, conn->params)) {
6209 char *new_mask = NULL;
6210 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6211 conn->params);
6212 if (new_mask) {
6213 TALLOC_FREE(fname_src_mask);
6214 fname_src_mask = new_mask;
6215 }
6216 }
6217
6218 if (!src_has_wild) {
6219 files_struct *fsp;
6220
6221 /*
6222 * Only one file needs to be renamed. Append the mask back
6223 * onto the directory.
6224 */
6225 TALLOC_FREE(smb_fname_src->base_name);
6226 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6227 "%s/%s",
6228 fname_src_dir,
6229 fname_src_mask);
6230 if (!smb_fname_src->base_name) {
6231 status = NT_STATUS_NO_MEMORY;
6232 goto out;
6233 }
6234
6235 /* Ensure dst fname contains a '/' also */
6236 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6237 char *tmp;
6238 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6239 smb_fname_dst->base_name);
6240 if (!tmp) {
6241 status = NT_STATUS_NO_MEMORY;
6242 goto out;
6243 }
6244 TALLOC_FREE(smb_fname_dst->base_name);
6245 smb_fname_dst->base_name = tmp;
6246 }
6247
6248 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6249 "case_preserve = %d, short case preserve = %d, "
6250 "directory = %s, newname = %s, "
6251 "last_component_dest = %s\n",
6252 conn->case_sensitive, conn->case_preserve,
6253 conn->short_case_preserve,
6254 smb_fname_str_dbg(smb_fname_src),
6255 smb_fname_str_dbg(smb_fname_dst),
6256 smb_fname_dst->original_lcomp));
6257
6258 /* The dest name still may have wildcards. */
6259 if (dest_has_wild) {
6260 char *fname_dst_mod = NULL;
6261 if (!resolve_wildcards(smb_fname_dst,
6262 smb_fname_src->base_name,
6263 smb_fname_dst->base_name,
6264 &fname_dst_mod)) {
6265 DEBUG(6, ("rename_internals: resolve_wildcards "
6266 "%s %s failed\n",
6267 smb_fname_src->base_name,
6268 smb_fname_dst->base_name));
6269 status = NT_STATUS_NO_MEMORY;
6270 goto out;
6271 }
6272 TALLOC_FREE(smb_fname_dst->base_name);
6273 smb_fname_dst->base_name = fname_dst_mod;
6274 }
6275
6276 ZERO_STRUCT(smb_fname_src->st);
6277 if (posix_pathnames) {
6278 SMB_VFS_LSTAT(conn, smb_fname_src);
6279 } else {
6280 SMB_VFS_STAT(conn, smb_fname_src);
6281 }
6282
6283 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6284 create_options |= FILE_DIRECTORY_FILE;
6285 }
6286
6287 status = SMB_VFS_CREATE_FILE(
6288 conn, /* conn */
6289 req, /* req */
6290 0, /* root_dir_fid */
6291 smb_fname_src, /* fname */
6292 access_mask, /* access_mask */
6293 (FILE_SHARE_READ | /* share_access */
6294 FILE_SHARE_WRITE),
6295 FILE_OPEN, /* create_disposition*/
6296 create_options, /* create_options */
6297 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6298 0, /* oplock_request */
6299 0, /* allocation_size */
6300 0, /* private_flags */
6301 NULL, /* sd */
6302 NULL, /* ea_list */
6303 &fsp, /* result */
6304 NULL); /* pinfo */
6305
6306 if (!NT_STATUS_IS_OK(status)) {
6307 DEBUG(3, ("Could not open rename source %s: %s\n",
6308 smb_fname_str_dbg(smb_fname_src),
6309 nt_errstr(status)));
6310 goto out;
6311 }
6312
6313 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6314 attrs, replace_if_exists);
6315
6316 close_file(req, fsp, NORMAL_CLOSE);
6317
6318 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6319 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6320 smb_fname_str_dbg(smb_fname_dst)));
6321
6322 goto out;
6323 }
6324
6325 /*
6326 * Wildcards - process each file that matches.
6327 */
6328 if (strequal(fname_src_mask, "????????.???")) {
6329 TALLOC_FREE(fname_src_mask);
6330 fname_src_mask = talloc_strdup(ctx, "*");
6331 if (!fname_src_mask) {
6332 status = NT_STATUS_NO_MEMORY;
6333 goto out;
6334 }
6335 }
6336
6337 status = check_name(conn, fname_src_dir);
6338 if (!NT_STATUS_IS_OK(status)) {
6339 goto out;
6340 }
6341
6342 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6343 attrs);
6344 if (dir_hnd == NULL) {
6345 status = map_nt_error_from_unix(errno);
6346 goto out;
6347 }
6348
6349 status = NT_STATUS_NO_SUCH_FILE;
6350 /*
6351 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6352 * - gentest fix. JRA
6353 */
6354
6355 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6356 &talloced))) {
6357 files_struct *fsp = NULL;
6358 char *destname = NULL;
6359 bool sysdir_entry = False;
6360
6361 /* Quick check for "." and ".." */
6362 if (ISDOT(dname) || ISDOTDOT(dname)) {
6363 if (attrs & aDIR) {
6364 sysdir_entry = True;
6365 } else {
6366 TALLOC_FREE(talloced);
6367 continue;
6368 }
6369 }
6370
6371 if (!is_visible_file(conn, fname_src_dir, dname,
6372 &smb_fname_src->st, false)) {
6373 TALLOC_FREE(talloced);
6374 continue;
6375 }
6376
6377 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6378 TALLOC_FREE(talloced);
6379 continue;
6380 }
6381
6382 if (sysdir_entry) {
6383 status = NT_STATUS_OBJECT_NAME_INVALID;
6384 break;
6385 }
6386
6387 TALLOC_FREE(smb_fname_src->base_name);
6388 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6389 "%s/%s",
6390 fname_src_dir,
6391 dname);
6392 if (!smb_fname_src->base_name) {
6393 status = NT_STATUS_NO_MEMORY;
6394 goto out;
6395 }
6396
6397 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6398 smb_fname_dst->base_name,
6399 &destname)) {
6400 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6401 smb_fname_src->base_name, destname));
6402 TALLOC_FREE(talloced);
6403 continue;
6404 }
6405 if (!destname) {
6406 status = NT_STATUS_NO_MEMORY;
6407 goto out;
6408 }
6409
6410 TALLOC_FREE(smb_fname_dst->base_name);
6411 smb_fname_dst->base_name = destname;
6412
6413 ZERO_STRUCT(smb_fname_src->st);
6414 if (posix_pathnames) {
6415 SMB_VFS_LSTAT(conn, smb_fname_src);
6416 } else {
6417 SMB_VFS_STAT(conn, smb_fname_src);
6418 }
6419
6420 create_options = 0;
6421
6422 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6423 create_options |= FILE_DIRECTORY_FILE;
6424 }
6425
6426 status = SMB_VFS_CREATE_FILE(
6427 conn, /* conn */
6428 req, /* req */
6429 0, /* root_dir_fid */
6430 smb_fname_src, /* fname */
6431 access_mask, /* access_mask */
6432 (FILE_SHARE_READ | /* share_access */
6433 FILE_SHARE_WRITE),
6434 FILE_OPEN, /* create_disposition*/
6435 create_options, /* create_options */
6436 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6437 0, /* oplock_request */
6438 0, /* allocation_size */
6439 0, /* private_flags */
6440 NULL, /* sd */
6441 NULL, /* ea_list */
6442 &fsp, /* result */
6443 NULL); /* pinfo */
6444
6445 if (!NT_STATUS_IS_OK(status)) {
6446 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6447 "returned %s rename %s -> %s\n",
6448 nt_errstr(status),
6449 smb_fname_str_dbg(smb_fname_src),
6450 smb_fname_str_dbg(smb_fname_dst)));
6451 break;
6452 }
6453
6454 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6455 dname);
6456 if (!smb_fname_dst->original_lcomp) {
6457 status = NT_STATUS_NO_MEMORY;
6458 goto out;
6459 }
6460
6461 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6462 attrs, replace_if_exists);
6463
6464 close_file(req, fsp, NORMAL_CLOSE);
6465
6466 if (!NT_STATUS_IS_OK(status)) {
6467 DEBUG(3, ("rename_internals_fsp returned %s for "
6468 "rename %s -> %s\n", nt_errstr(status),
6469 smb_fname_str_dbg(smb_fname_src),
6470 smb_fname_str_dbg(smb_fname_dst)));
6471 break;
6472 }
6473
6474 count++;
6475
6476 DEBUG(3,("rename_internals: doing rename on %s -> "
6477 "%s\n", smb_fname_str_dbg(smb_fname_src),
6478 smb_fname_str_dbg(smb_fname_src)));
6479 TALLOC_FREE(talloced);
6480 }
6481 TALLOC_FREE(dir_hnd);
6482
6483 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6484 status = map_nt_error_from_unix(errno);
6485 }
6486
6487 out:
6488 TALLOC_FREE(talloced);
6489 TALLOC_FREE(fname_src_dir);
6490 TALLOC_FREE(fname_src_mask);
6491 return status;
6492 }
6493
6494 /****************************************************************************
6495 Reply to a mv.
6496 ****************************************************************************/
6497
6498 void reply_mv(struct smb_request *req)
6499 {
6500 connection_struct *conn = req->conn;
6501 char *name = NULL;
6502 char *newname = NULL;
6503 const char *p;
6504 uint32 attrs;
6505 NTSTATUS status;
6506 bool src_has_wcard = False;
6507 bool dest_has_wcard = False;
6508 TALLOC_CTX *ctx = talloc_tos();
6509 struct smb_filename *smb_fname_src = NULL;
6510 struct smb_filename *smb_fname_dst = NULL;
6511
6512 START_PROFILE(SMBmv);
6513
6514 if (req->wct < 1) {
6515 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6516 goto out;
6517 }
6518
6519 attrs = SVAL(req->vwv+0, 0);
6520
6521 p = (const char *)req->buf + 1;
6522 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6523 &status, &src_has_wcard);
6524 if (!NT_STATUS_IS_OK(status)) {
6525 reply_nterror(req, status);
6526 goto out;
6527 }
6528 p++;
6529 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6530 &status, &dest_has_wcard);
6531 if (!NT_STATUS_IS_OK(status)) {
6532 reply_nterror(req, status);
6533 goto out;
6534 }
6535
6536 status = filename_convert(ctx,
6537 conn,
6538 req->flags2 & FLAGS2_DFS_PATHNAMES,
6539 name,
6540 UCF_COND_ALLOW_WCARD_LCOMP,
6541 &src_has_wcard,
6542 &smb_fname_src);
6543
6544 if (!NT_STATUS_IS_OK(status)) {
6545 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6546 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6547 ERRSRV, ERRbadpath);
6548 goto out;
6549 }
6550 reply_nterror(req, status);
6551 goto out;
6552 }
6553
6554 status = filename_convert(ctx,
6555 conn,
6556 req->flags2 & FLAGS2_DFS_PATHNAMES,
6557 newname,
6558 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6559 &dest_has_wcard,
6560 &smb_fname_dst);
6561
6562 if (!NT_STATUS_IS_OK(status)) {
6563 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6564 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6565 ERRSRV, ERRbadpath);
6566 goto out;
6567 }
6568 reply_nterror(req, status);
6569 goto out;
6570 }
6571
6572 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6573 smb_fname_str_dbg(smb_fname_dst)));
6574
6575 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6576 attrs, False, src_has_wcard, dest_has_wcard,
6577 DELETE_ACCESS);
6578 if (!NT_STATUS_IS_OK(status)) {
6579 if (open_was_deferred(req->mid)) {
6580 /* We have re-scheduled this call. */
6581 goto out;
6582 }
6583 reply_nterror(req, status);
6584 goto out;
6585 }
6586
6587 reply_outbuf(req, 0, 0);
6588 out:
6589 TALLOC_FREE(smb_fname_src);
6590 TALLOC_FREE(smb_fname_dst);
6591 END_PROFILE(SMBmv);
6592 return;
6593 }
6594
6595 /*******************************************************************
6596 Copy a file as part of a reply_copy.
6597 ******************************************************************/
6598
6599 /*
6600 * TODO: check error codes on all callers
6601 */
6602
6603 NTSTATUS copy_file(TALLOC_CTX *ctx,
6604 connection_struct *conn,
6605 struct smb_filename *smb_fname_src,
6606 struct smb_filename *smb_fname_dst,
6607 int ofun,
6608 int count,
6609 bool target_is_directory)
6610 {
6611 struct smb_filename *smb_fname_dst_tmp = NULL;
6612 SMB_OFF_T ret=-1;
6613 files_struct *fsp1,*fsp2;
6614 uint32 dosattrs;
6615 uint32 new_create_disposition;
6616 NTSTATUS status;
6617
6618
6619 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6620 if (!NT_STATUS_IS_OK(status)) {
6621 return status;
6622 }
6623
6624 /*
6625 * If the target is a directory, extract the last component from the
6626 * src filename and append it to the dst filename
6627 */
6628 if (target_is_directory) {
6629 const char *p;
6630
6631 /* dest/target can't be a stream if it's a directory. */
6632 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6633
6634 p = strrchr_m(smb_fname_src->base_name,'/');
6635 if (p) {
6636 p++;
6637 } else {
6638 p = smb_fname_src->base_name;
6639 }
6640 smb_fname_dst_tmp->base_name =
6641 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6642 p);
6643 if (!smb_fname_dst_tmp->base_name) {
6644 status = NT_STATUS_NO_MEMORY;
6645 goto out;
6646 }
6647 }
6648
6649 status = vfs_file_exist(conn, smb_fname_src);
6650 if (!NT_STATUS_IS_OK(status)) {
6651 goto out;
6652 }
6653
6654 if (!target_is_directory && count) {
6655 new_create_disposition = FILE_OPEN;
6656 } else {
6657 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6658 NULL, NULL,
6659 &new_create_disposition,
6660 NULL,
6661 NULL)) {
6662 status = NT_STATUS_INVALID_PARAMETER;
6663 goto out;
6664 }
6665 }
6666
6667 /* Open the src file for reading. */
6668 status = SMB_VFS_CREATE_FILE(
6669 conn, /* conn */
6670 NULL, /* req */
6671 0, /* root_dir_fid */
6672 smb_fname_src, /* fname */
6673 FILE_GENERIC_READ, /* access_mask */
6674 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6675 FILE_OPEN, /* create_disposition*/
6676 0, /* create_options */
6677 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6678 INTERNAL_OPEN_ONLY, /* oplock_request */
6679 0, /* allocation_size */
6680 0, /* private_flags */
6681 NULL, /* sd */
6682 NULL, /* ea_list */
6683 &fsp1, /* result */
6684 NULL); /* psbuf */
6685
6686 if (!NT_STATUS_IS_OK(status)) {
6687 goto out;
6688 }
6689
6690 dosattrs = dos_mode(conn, smb_fname_src);
6691
6692 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6693 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6694 }
6695
6696 /* Open the dst file for writing. */
6697 status = SMB_VFS_CREATE_FILE(
6698 conn, /* conn */
6699 NULL, /* req */
6700 0, /* root_dir_fid */
6701 smb_fname_dst, /* fname */
6702 FILE_GENERIC_WRITE, /* access_mask */
6703 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6704 new_create_disposition, /* create_disposition*/
6705 0, /* create_options */
6706 dosattrs, /* file_attributes */
6707 INTERNAL_OPEN_ONLY, /* oplock_request */
6708 0, /* allocation_size */
6709 0, /* private_flags */
6710 NULL, /* sd */
6711 NULL, /* ea_list */
6712 &fsp2, /* result */
6713 NULL); /* psbuf */
6714
6715 if (!NT_STATUS_IS_OK(status)) {
6716 close_file(NULL, fsp1, ERROR_CLOSE);
6717 goto out;
6718 }
6719
6720 if ((ofun&3) == 1) {
6721 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6722 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6723 /*
6724 * Stop the copy from occurring.
6725 */
6726 ret = -1;
6727 smb_fname_src->st.st_ex_size = 0;
6728 }
6729 }
6730
6731 /* Do the actual copy. */
6732 if (smb_fname_src->st.st_ex_size) {
6733 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6734 }
6735
6736 close_file(NULL, fsp1, NORMAL_CLOSE);
6737
6738 /* Ensure the modtime is set correctly on the destination file. */
6739 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6740
6741 /*
6742 * As we are opening fsp1 read-only we only expect
6743 * an error on close on fsp2 if we are out of space.
6744 * Thus we don't look at the error return from the
6745 * close of fsp1.
6746 */
6747 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6748
6749 if (!NT_STATUS_IS_OK(status)) {
6750 goto out;
6751 }
6752
6753 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6754 status = NT_STATUS_DISK_FULL;
6755 goto out;
6756 }
6757
6758 status = NT_STATUS_OK;
6759
6760 out:
6761 TALLOC_FREE(smb_fname_dst_tmp);
6762 return status;
6763 }
6764
6765 /****************************************************************************
6766 Reply to a file copy.
6767 ****************************************************************************/
6768
6769 void reply_copy(struct smb_request *req)
6770 {
6771 connection_struct *conn = req->conn;
6772 struct smb_filename *smb_fname_src = NULL;
6773 struct smb_filename *smb_fname_dst = NULL;
6774 char *fname_src = NULL;
6775 char *fname_dst = NULL;
6776 char *fname_src_mask = NULL;
6777 char *fname_src_dir = NULL;
6778 const char *p;
6779 int count=0;
6780 int error = ERRnoaccess;
6781 int tid2;
6782 int ofun;
6783 int flags;
6784 bool target_is_directory=False;
6785 bool source_has_wild = False;
6786 bool dest_has_wild = False;
6787 NTSTATUS status;
6788 TALLOC_CTX *ctx = talloc_tos();
6789
6790 START_PROFILE(SMBcopy);
6791
6792 if (req->wct < 3) {
6793 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6794 goto out;
6795 }
6796
6797 tid2 = SVAL(req->vwv+0, 0);
6798 ofun = SVAL(req->vwv+1, 0);
6799 flags = SVAL(req->vwv+2, 0);
6800
6801 p = (const char *)req->buf;
6802 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6803 &status, &source_has_wild);
6804 if (!NT_STATUS_IS_OK(status)) {
6805 reply_nterror(req, status);
6806 goto out;
6807 }
6808 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6809 &status, &dest_has_wild);
6810 if (!NT_STATUS_IS_OK(status)) {
6811 reply_nterror(req, status);
6812 goto out;
6813 }
6814
6815 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6816
6817 if (tid2 != conn->cnum) {
6818 /* can't currently handle inter share copies XXXX */
6819 DEBUG(3,("Rejecting inter-share copy\n"));
6820 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6821 goto out;
6822 }
6823
6824 status = filename_convert(ctx, conn,
6825 req->flags2 & FLAGS2_DFS_PATHNAMES,
6826 fname_src,
6827 UCF_COND_ALLOW_WCARD_LCOMP,
6828 &source_has_wild,
6829 &smb_fname_src);
6830 if (!NT_STATUS_IS_OK(status)) {
6831 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6832 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6833 ERRSRV, ERRbadpath);
6834 goto out;
6835 }
6836 reply_nterror(req, status);
6837 goto out;
6838 }
6839
6840 status = filename_convert(ctx, conn,
6841 req->flags2 & FLAGS2_DFS_PATHNAMES,
6842 fname_dst,
6843 UCF_COND_ALLOW_WCARD_LCOMP,
6844 &dest_has_wild,
6845 &smb_fname_dst);
6846 if (!NT_STATUS_IS_OK(status)) {
6847 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6848 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6849 ERRSRV, ERRbadpath);
6850 goto out;
6851 }
6852 reply_nterror(req, status);
6853 goto out;
6854 }
6855
6856 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6857
6858 if ((flags&1) && target_is_directory) {
6859 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6860 goto out;
6861 }
6862
6863 if ((flags&2) && !target_is_directory) {
6864 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6865 goto out;
6866 }
6867
6868 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6869 /* wants a tree copy! XXXX */
6870 DEBUG(3,("Rejecting tree copy\n"));
6871 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6872 goto out;
6873 }
6874
6875 /* Split up the directory from the filename/mask. */
6876 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6877 &fname_src_dir, &fname_src_mask);
6878 if (!NT_STATUS_IS_OK(status)) {
6879 reply_nterror(req, NT_STATUS_NO_MEMORY);
6880 goto out;
6881 }
6882
6883 /*
6884 * We should only check the mangled cache
6885 * here if unix_convert failed. This means
6886 * that the path in 'mask' doesn't exist
6887 * on the file system and so we need to look
6888 * for a possible mangle. This patch from
6889 * Tine Smukavec <valentin.smukavec@hermes.si>.
6890 */
6891 if (!VALID_STAT(smb_fname_src->st) &&
6892 mangle_is_mangled(fname_src_mask, conn->params)) {
6893 char *new_mask = NULL;
6894 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6895 &new_mask, conn->params);
6896
6897 /* Use demangled name if one was successfully found. */
6898 if (new_mask) {
6899 TALLOC_FREE(fname_src_mask);
6900 fname_src_mask = new_mask;
6901 }
6902 }
6903
6904 if (!source_has_wild) {
6905
6906 /*
6907 * Only one file needs to be copied. Append the mask back onto
6908 * the directory.
6909 */
6910 TALLOC_FREE(smb_fname_src->base_name);
6911 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6912 "%s/%s",
6913 fname_src_dir,
6914 fname_src_mask);
6915 if (!smb_fname_src->base_name) {
6916 reply_nterror(req, NT_STATUS_NO_MEMORY);
6917 goto out;
6918 }
6919
6920 if (dest_has_wild) {
6921 char *fname_dst_mod = NULL;
6922 if (!resolve_wildcards(smb_fname_dst,
6923 smb_fname_src->base_name,
6924 smb_fname_dst->base_name,
6925 &fname_dst_mod)) {
6926 reply_nterror(req, NT_STATUS_NO_MEMORY);
6927 goto out;
6928 }
6929 TALLOC_FREE(smb_fname_dst->base_name);
6930 smb_fname_dst->base_name = fname_dst_mod;
6931 }
6932
6933 status = check_name(conn, smb_fname_src->base_name);
6934 if (!NT_STATUS_IS_OK(status)) {
6935 reply_nterror(req, status);
6936 goto out;
6937 }
6938
6939 status = check_name(conn, smb_fname_dst->base_name);
6940 if (!NT_STATUS_IS_OK(status)) {
6941 reply_nterror(req, status);
6942 goto out;
6943 }
6944
6945 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6946 ofun, count, target_is_directory);
6947
6948 if(!NT_STATUS_IS_OK(status)) {
6949 reply_nterror(req, status);
6950 goto out;
6951 } else {
6952 count++;
6953 }
6954 } else {
6955 struct smb_Dir *dir_hnd = NULL;
6956 const char *dname = NULL;
6957 char *talloced = NULL;
6958 long offset = 0;
6959
6960 /*
6961 * There is a wildcard that requires us to actually read the
6962 * src dir and copy each file matching the mask to the dst.
6963 * Right now streams won't be copied, but this could
6964 * presumably be added with a nested loop for reach dir entry.
6965 */
6966 SMB_ASSERT(!smb_fname_src->stream_name);
6967 SMB_ASSERT(!smb_fname_dst->stream_name);
6968
6969 smb_fname_src->stream_name = NULL;
6970 smb_fname_dst->stream_name = NULL;
6971
6972 if (strequal(fname_src_mask,"????????.???")) {
6973 TALLOC_FREE(fname_src_mask);
6974 fname_src_mask = talloc_strdup(ctx, "*");
6975 if (!fname_src_mask) {
6976 reply_nterror(req, NT_STATUS_NO_MEMORY);
6977 goto out;
6978 }
6979 }
6980
6981 status = check_name(conn, fname_src_dir);
6982 if (!NT_STATUS_IS_OK(status)) {
6983 reply_nterror(req, status);
6984 goto out;
6985 }
6986
6987 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6988 if (dir_hnd == NULL) {
6989 status = map_nt_error_from_unix(errno);
6990 reply_nterror(req, status);
6991 goto out;
6992 }
6993
6994 error = ERRbadfile;
6995
6996 /* Iterate over the src dir copying each entry to the dst. */
6997 while ((dname = ReadDirName(dir_hnd, &offset,
6998 &smb_fname_src->st, &talloced))) {
6999 char *destname = NULL;
7000
7001 if (ISDOT(dname) || ISDOTDOT(dname)) {
7002 TALLOC_FREE(talloced);
7003 continue;
7004 }
7005
7006 if (!is_visible_file(conn, fname_src_dir, dname,
7007 &smb_fname_src->st, false)) {
7008 TALLOC_FREE(talloced);
7009 continue;
7010 }
7011
7012 if(!mask_match(dname, fname_src_mask,
7013 conn->case_sensitive)) {
7014 TALLOC_FREE(talloced);
7015 continue;
7016 }
7017
7018 error = ERRnoaccess;
7019
7020 /* Get the src smb_fname struct setup. */
7021 TALLOC_FREE(smb_fname_src->base_name);
7022 smb_fname_src->base_name =
7023 talloc_asprintf(smb_fname_src, "%s/%s",
7024 fname_src_dir, dname);
7025
7026 if (!smb_fname_src->base_name) {
7027 TALLOC_FREE(dir_hnd);
7028 TALLOC_FREE(talloced);
7029 reply_nterror(req, NT_STATUS_NO_MEMORY);
7030 goto out;
7031 }
7032
7033 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7034 smb_fname_dst->base_name,
7035 &destname)) {
7036 TALLOC_FREE(talloced);
7037 continue;
7038 }
7039 if (!destname) {
7040 TALLOC_FREE(dir_hnd);
7041 TALLOC_FREE(talloced);
7042 reply_nterror(req, NT_STATUS_NO_MEMORY);
7043 goto out;
7044 }
7045
7046 TALLOC_FREE(smb_fname_dst->base_name);
7047 smb_fname_dst->base_name = destname;
7048
7049 status = check_name(conn, smb_fname_src->base_name);
7050 if (!NT_STATUS_IS_OK(status)) {
7051 TALLOC_FREE(dir_hnd);
7052 TALLOC_FREE(talloced);
7053 reply_nterror(req, status);
7054 goto out;
7055 }
7056
7057 status = check_name(conn, smb_fname_dst->base_name);
7058 if (!NT_STATUS_IS_OK(status)) {
7059 TALLOC_FREE(dir_hnd);
7060 TALLOC_FREE(talloced);
7061 reply_nterror(req, status);
7062 goto out;
7063 }
7064
7065 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7066 smb_fname_src->base_name,
7067 smb_fname_dst->base_name));
7068
7069 status = copy_file(ctx, conn, smb_fname_src,
7070 smb_fname_dst, ofun, count,
7071 target_is_directory);
7072 if (NT_STATUS_IS_OK(status)) {
7073 count++;
7074 }
7075
7076 TALLOC_FREE(talloced);
7077 }
7078 TALLOC_FREE(dir_hnd);
7079 }
7080
7081 if (count == 0) {
7082 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7083 goto out;
7084 }
7085
7086 reply_outbuf(req, 1, 0);
7087 SSVAL(req->outbuf,smb_vwv0,count);
7088 out:
7089 TALLOC_FREE(smb_fname_src);
7090 TALLOC_FREE(smb_fname_dst);
7091 TALLOC_FREE(fname_src);
7092 TALLOC_FREE(fname_dst);
7093 TALLOC_FREE(fname_src_mask);
7094 TALLOC_FREE(fname_src_dir);
7095
7096 END_PROFILE(SMBcopy);
7097 return;
7098 }
7099
7100 #undef DBGC_CLASS
7101 #define DBGC_CLASS DBGC_LOCKING
7102
7103 /****************************************************************************
7104 Get a lock pid, dealing with large count requests.
7105 ****************************************************************************/
7106
7107 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7108 bool large_file_format)
7109 {
7110 if(!large_file_format)
7111 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7112 else
7113 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7114 }
7115
7116 /****************************************************************************
7117 Get a lock count, dealing with large count requests.
7118 ****************************************************************************/
7119
7120 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7121 bool large_file_format)
7122 {
7123 uint64_t count = 0;
7124
7125 if(!large_file_format) {
7126 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7127 } else {
7128
7129 #if defined(HAVE_LONGLONG)
7130 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7131 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7132 #else /* HAVE_LONGLONG */
7133
7134 /*
7135 * NT4.x seems to be broken in that it sends large file (64 bit)
7136 * lockingX calls even if the CAP_LARGE_FILES was *not*
7137 * negotiated. For boxes without large unsigned ints truncate the
7138 * lock count by dropping the top 32 bits.
7139 */
7140
7141 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7142 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7143 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7144 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7145 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7146 }
7147
7148 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7149 #endif /* HAVE_LONGLONG */
7150 }
7151
7152 return count;
7153 }
7154
7155 #if !defined(HAVE_LONGLONG)
7156 /****************************************************************************
7157 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7158 ****************************************************************************/
7159
7160 static uint32 map_lock_offset(uint32 high, uint32 low)
7161 {
7162 unsigned int i;
7163 uint32 mask = 0;
7164 uint32 highcopy = high;
7165
7166 /*
7167 * Try and find out how many significant bits there are in high.
7168 */
7169
7170 for(i = 0; highcopy; i++)
7171 highcopy >>= 1;
7172
7173 /*
7174 * We use 31 bits not 32 here as POSIX
7175 * lock offsets may not be negative.
7176 */
7177
7178 mask = (~0) << (31 - i);
7179
7180 if(low & mask)
7181 return 0; /* Fail. */
7182
7183 high <<= (31 - i);
7184
7185 return (high|low);
7186 }
7187 #endif /* !defined(HAVE_LONGLONG) */
7188
7189 /****************************************************************************
7190 Get a lock offset, dealing with large offset requests.
7191 ****************************************************************************/
7192
7193 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7194 bool large_file_format, bool *err)
7195 {
7196 uint64_t offset = 0;
7197
7198 *err = False;
7199
7200 if(!large_file_format) {
7201 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7202 } else {
7203
7204 #if defined(HAVE_LONGLONG)
7205 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7206 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7207 #else /* HAVE_LONGLONG */
7208
7209 /*
7210 * NT4.x seems to be broken in that it sends large file (64 bit)
7211 * lockingX calls even if the CAP_LARGE_FILES was *not*
7212 * negotiated. For boxes without large unsigned ints mangle the
7213 * lock offset by mapping the top 32 bits onto the lower 32.
7214 */
7215
7216 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7217 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7218 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7219 uint32 new_low = 0;
7220
7221 if((new_low = map_lock_offset(high, low)) == 0) {
7222 *err = True;
7223 return (uint64_t)-1;
7224 }
7225
7226 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7227 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7228 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7229 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7230 }
7231
7232 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7233 #endif /* HAVE_LONGLONG */
7234 }
7235
7236 return offset;
7237 }
7238
7239 NTSTATUS smbd_do_locking(struct smb_request *req,
7240 files_struct *fsp,
7241 uint8_t type,
7242 int32_t timeout,
7243 uint16_t num_ulocks,
7244 struct smbd_lock_element *ulocks,
7245 uint16_t num_locks,
7246 struct smbd_lock_element *locks,
7247 bool *async)
7248 {
7249 connection_struct *conn = req->conn;
7250 int i;
7251 NTSTATUS status = NT_STATUS_OK;
7252
7253 *async = false;
7254
7255 /* Data now points at the beginning of the list
7256 of smb_unlkrng structs */
7257 for(i = 0; i < (int)num_ulocks; i++) {
7258 struct smbd_lock_element *e = &ulocks[i];
7259
7260 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7261 "pid %u, file %s\n",
7262 (double)e->offset,
7263 (double)e->count,
7264 (unsigned int)e->smblctx,
7265 fsp_str_dbg(fsp)));
7266
7267 if (e->brltype != UNLOCK_LOCK) {
7268 /* this can only happen with SMB2 */
7269 return NT_STATUS_INVALID_PARAMETER;
7270 }
7271
7272 status = do_unlock(req->sconn->msg_ctx,
7273 fsp,
7274 e->smblctx,
7275 e->count,
7276 e->offset,
7277 WINDOWS_LOCK);
7278
7279 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7280 nt_errstr(status)));
7281
7282 if (!NT_STATUS_IS_OK(status)) {
7283 return status;
7284 }
7285 }
7286
7287 /* Setup the timeout in seconds. */
7288
7289 if (!lp_blocking_locks(SNUM(conn))) {
7290 timeout = 0;
7291 }
7292
7293 /* Data now points at the beginning of the list
7294 of smb_lkrng structs */
7295
7296 for(i = 0; i < (int)num_locks; i++) {
7297 struct smbd_lock_element *e = &locks[i];
7298
7299 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7300 "%llu, file %s timeout = %d\n",
7301 (double)e->offset,
7302 (double)e->count,
7303 (unsigned long long)e->smblctx,
7304 fsp_str_dbg(fsp),
7305 (int)timeout));
7306
7307 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7308 struct blocking_lock_record *blr = NULL;
7309
7310 if (num_locks > 1) {
7311 /*
7312 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7313 * if the lock vector contains one entry. When given mutliple cancel
7314 * requests in a single PDU we expect the server to return an
7315 * error. Windows servers seem to accept the request but only
7316 * cancel the first lock.
7317 * JRA - Do what Windows does (tm) :-).
7318 */
7319
7320 #if 0
7321 /* MS-CIFS (2.2.4.32.1) behavior. */
7322 return NT_STATUS_DOS(ERRDOS,
7323 ERRcancelviolation);
7324 #else
7325 /* Windows behavior. */
7326 if (i != 0) {
7327 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7328 "cancel request\n"));
7329 continue;
7330 }
7331 #endif
7332 }
7333
7334 if (lp_blocking_locks(SNUM(conn))) {
7335
7336 /* Schedule a message to ourselves to
7337 remove the blocking lock record and
7338 return the right error. */
7339
7340 blr = blocking_lock_cancel_smb1(fsp,
7341 e->smblctx,
7342 e->offset,
7343 e->count,
7344 WINDOWS_LOCK,
7345 type,
7346 NT_STATUS_FILE_LOCK_CONFLICT);
7347 if (blr == NULL) {
7348 return NT_STATUS_DOS(
7349 ERRDOS,
7350 ERRcancelviolation);
7351 }
7352 }
7353 /* Remove a matching pending lock. */
7354 status = do_lock_cancel(fsp,
7355 e->smblctx,
7356 e->count,
7357 e->offset,
7358 WINDOWS_LOCK,
7359 blr);
7360 } else {
7361 bool blocking_lock = timeout ? true : false;
7362 bool defer_lock = false;
7363 struct byte_range_lock *br_lck;
7364 uint64_t block_smblctx;
7365
7366 br_lck = do_lock(req->sconn->msg_ctx,
7367 fsp,
7368 e->smblctx,
7369 e->count,
7370 e->offset,
7371 e->brltype,
7372 WINDOWS_LOCK,
7373 blocking_lock,
7374 &status,
7375 &block_smblctx,
7376 NULL);
7377
7378 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7379 /* Windows internal resolution for blocking locks seems
7380 to be about 200ms... Don't wait for less than that. JRA. */
7381 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7382 timeout = lp_lock_spin_time();
7383 }
7384 defer_lock = true;
7385 }
7386
7387 /* If a lock sent with timeout of zero would fail, and
7388 * this lock has been requested multiple times,
7389 * according to brl_lock_failed() we convert this
7390 * request to a blocking lock with a timeout of between
7391 * 150 - 300 milliseconds.
7392 *
7393 * If lp_lock_spin_time() has been set to 0, we skip
7394 * this blocking retry and fail immediately.
7395 *
7396 * Replacement for do_lock_spin(). JRA. */
7397
7398 if (!req->sconn->using_smb2 &&
7399 br_lck && lp_blocking_locks(SNUM(conn)) &&
7400 lp_lock_spin_time() && !blocking_lock &&
7401 NT_STATUS_EQUAL((status),
7402 NT_STATUS_FILE_LOCK_CONFLICT))
7403 {
7404 defer_lock = true;
7405 timeout = lp_lock_spin_time();
7406 }
7407
7408 if (br_lck && defer_lock) {
7409 /*
7410 * A blocking lock was requested. Package up
7411 * this smb into a queued request and push it
7412 * onto the blocking lock queue.
7413 */
7414 if(push_blocking_lock_request(br_lck,
7415 req,
7416 fsp,
7417 timeout,
7418 i,
7419 e->smblctx,
7420 e->brltype,
7421 WINDOWS_LOCK,
7422 e->offset,
7423 e->count,
7424 block_smblctx)) {
7425 TALLOC_FREE(br_lck);
7426 *async = true;
7427 return NT_STATUS_OK;
7428 }
7429 }
7430
7431 TALLOC_FREE(br_lck);
7432 }
7433
7434 if (!NT_STATUS_IS_OK(status)) {
7435 break;
7436 }
7437 }
7438
7439 /* If any of the above locks failed, then we must unlock
7440 all of the previous locks (X/Open spec). */
7441
7442 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7443
7444 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7445 i = -1; /* we want to skip the for loop */
7446 }
7447
7448 /*
7449 * Ensure we don't do a remove on the lock that just failed,
7450 * as under POSIX rules, if we have a lock already there, we
7451 * will delete it (and we shouldn't) .....
7452 */
7453 for(i--; i >= 0; i--) {
7454 struct smbd_lock_element *e = &locks[i];
7455
7456 do_unlock(req->sconn->msg_ctx,
7457 fsp,
7458 e->smblctx,
7459 e->count,
7460 e->offset,
7461 WINDOWS_LOCK);
7462 }
7463 return status;
7464 }
7465
7466 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7467 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7468
7469 return NT_STATUS_OK;
7470 }
7471
7472 /****************************************************************************
7473 Reply to a lockingX request.
7474 ****************************************************************************/
7475
7476 void reply_lockingX(struct smb_request *req)
7477 {
7478 connection_struct *conn = req->conn;
7479 files_struct *fsp;
7480 unsigned char locktype;
7481 unsigned char oplocklevel;
7482 uint16 num_ulocks;
7483 uint16 num_locks;
7484 int32 lock_timeout;
7485 int i;
7486 const uint8_t *data;
7487 bool large_file_format;
7488 bool err;
7489 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7490 struct smbd_lock_element *ulocks;
7491 struct smbd_lock_element *locks;
7492 bool async = false;
7493
7494 START_PROFILE(SMBlockingX);
7495
7496 if (req->wct < 8) {
7497 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7498 END_PROFILE(SMBlockingX);
7499 return;
7500 }
7501
7502 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7503 locktype = CVAL(req->vwv+3, 0);
7504 oplocklevel = CVAL(req->vwv+3, 1);
7505 num_ulocks = SVAL(req->vwv+6, 0);
7506 num_locks = SVAL(req->vwv+7, 0);
7507 lock_timeout = IVAL(req->vwv+4, 0);
7508 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7509
7510 if (!check_fsp(conn, req, fsp)) {
7511 END_PROFILE(SMBlockingX);
7512 return;
7513 }
7514
7515 data = req->buf;
7516
7517 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7518 /* we don't support these - and CANCEL_LOCK makes w2k
7519 and XP reboot so I don't really want to be
7520 compatible! (tridge) */
7521 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7522 END_PROFILE(SMBlockingX);
7523 return;
7524 }
7525
7526 /* Check if this is an oplock break on a file
7527 we have granted an oplock on.
7528 */
7529 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7530 /* Client can insist on breaking to none. */
7531 bool break_to_none = (oplocklevel == 0);
7532 bool result;
7533
7534 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7535 "for fnum = %d\n", (unsigned int)oplocklevel,
7536 fsp->fnum ));
7537
7538 /*
7539 * Make sure we have granted an exclusive or batch oplock on
7540 * this file.
7541 */
7542
7543 if (fsp->oplock_type == 0) {
7544
7545 /* The Samba4 nbench simulator doesn't understand
7546 the difference between break to level2 and break
7547 to none from level2 - it sends oplock break
7548 replies in both cases. Don't keep logging an error
7549 message here - just ignore it. JRA. */
7550
7551 DEBUG(5,("reply_lockingX: Error : oplock break from "
7552 "client for fnum = %d (oplock=%d) and no "
7553 "oplock granted on this file (%s).\n",
7554 fsp->fnum, fsp->oplock_type,
7555 fsp_str_dbg(fsp)));
7556
7557 /* if this is a pure oplock break request then don't
7558 * send a reply */
7559 if (num_locks == 0 && num_ulocks == 0) {
7560 END_PROFILE(SMBlockingX);
7561 return;
7562 } else {
7563 END_PROFILE(SMBlockingX);
7564 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7565 return;
7566 }
7567 }
7568
7569 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7570 (break_to_none)) {
7571 result = remove_oplock(fsp);
7572 } else {
7573 result = downgrade_oplock(fsp);
7574 }
7575
7576 if (!result) {
7577 DEBUG(0, ("reply_lockingX: error in removing "
7578 "oplock on file %s\n", fsp_str_dbg(fsp)));
7579 /* Hmmm. Is this panic justified? */
7580 smb_panic("internal tdb error");
7581 }
7582
7583 reply_to_oplock_break_requests(fsp);
7584
7585 /* if this is a pure oplock break request then don't send a
7586 * reply */
7587 if (num_locks == 0 && num_ulocks == 0) {
7588 /* Sanity check - ensure a pure oplock break is not a
7589 chained request. */
7590 if(CVAL(req->vwv+0, 0) != 0xff)
7591 DEBUG(0,("reply_lockingX: Error : pure oplock "
7592 "break is a chained %d request !\n",
7593 (unsigned int)CVAL(req->vwv+0, 0)));
7594 END_PROFILE(SMBlockingX);
7595 return;
7596 }
7597 }
7598
7599 if (req->buflen <
7600 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7601 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7602 END_PROFILE(SMBlockingX);
7603 return;
7604 }
7605
7606 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7607 if (ulocks == NULL) {
7608 reply_nterror(req, NT_STATUS_NO_MEMORY);
7609 END_PROFILE(SMBlockingX);
7610 return;
7611 }
7612
7613 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7614 if (locks == NULL) {
7615 reply_nterror(req, NT_STATUS_NO_MEMORY);
7616 END_PROFILE(SMBlockingX);
7617 return;
7618 }
7619
7620 /* Data now points at the beginning of the list
7621 of smb_unlkrng structs */
7622 for(i = 0; i < (int)num_ulocks; i++) {
7623 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7624 ulocks[i].count = get_lock_count(data, i, large_file_format);
7625 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7626 ulocks[i].brltype = UNLOCK_LOCK;
7627
7628 /*
7629 * There is no error code marked "stupid client bug".... :-).
7630 */
7631 if(err) {
7632 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7633 END_PROFILE(SMBlockingX);
7634 return;
7635 }
7636 }
7637
7638 /* Now do any requested locks */
7639 data += ((large_file_format ? 20 : 10)*num_ulocks);
7640
7641 /* Data now points at the beginning of the list
7642 of smb_lkrng structs */
7643
7644 for(i = 0; i < (int)num_locks; i++) {
7645 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7646 locks[i].count = get_lock_count(data, i, large_file_format);
7647 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7648
7649 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7650 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7651 locks[i].brltype = PENDING_READ_LOCK;
7652 } else {
7653 locks[i].brltype = READ_LOCK;
7654 }
7655 } else {
7656 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7657 locks[i].brltype = PENDING_WRITE_LOCK;
7658 } else {
7659 locks[i].brltype = WRITE_LOCK;
7660 }
7661 }
7662
7663 /*
7664 * There is no error code marked "stupid client bug".... :-).
7665 */
7666 if(err) {
7667 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7668 END_PROFILE(SMBlockingX);
7669 return;
7670 }
7671 }
7672
7673 status = smbd_do_locking(req, fsp,
7674 locktype, lock_timeout,
7675 num_ulocks, ulocks,
7676 num_locks, locks,
7677 &async);
7678 if (!NT_STATUS_IS_OK(status)) {
7679 END_PROFILE(SMBlockingX);
7680 reply_nterror(req, status);
7681 return;
7682 }
7683 if (async) {
7684 END_PROFILE(SMBlockingX);
7685 return;
7686 }
7687
7688 reply_outbuf(req, 2, 0);
7689
7690 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7691 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7692
7693 END_PROFILE(SMBlockingX);
7694 chain_reply(req);
7695 }
7696
7697 #undef DBGC_CLASS
7698 #define DBGC_CLASS DBGC_ALL
7699
7700 /****************************************************************************
7701 Reply to a SMBreadbmpx (read block multiplex) request.
7702 Always reply with an error, if someone has a platform really needs this,
7703 please contact vl@samba.org
7704 ****************************************************************************/
7705
7706 void reply_readbmpx(struct smb_request *req)
7707 {
7708 START_PROFILE(SMBreadBmpx);
7709 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7710 END_PROFILE(SMBreadBmpx);
7711 return;
7712 }
7713
7714 /****************************************************************************
7715 Reply to a SMBreadbs (read block multiplex secondary) request.
7716 Always reply with an error, if someone has a platform really needs this,
7717 please contact vl@samba.org
7718 ****************************************************************************/
7719
7720 void reply_readbs(struct smb_request *req)
7721 {
7722 START_PROFILE(SMBreadBs);
7723 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7724 END_PROFILE(SMBreadBs);
7725 return;
7726 }
7727
7728 /****************************************************************************
7729 Reply to a SMBsetattrE.
7730 ****************************************************************************/
7731
7732 void reply_setattrE(struct smb_request *req)
7733 {
7734 connection_struct *conn = req->conn;
7735 struct smb_file_time ft;
7736 files_struct *fsp;
7737 NTSTATUS status;
7738
7739 START_PROFILE(SMBsetattrE);
7740 ZERO_STRUCT(ft);
7741
7742 if (req->wct < 7) {
7743 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7744 goto out;
7745 }
7746
7747 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7748
7749 if(!fsp || (fsp->conn != conn)) {
7750 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7751 goto out;
7752 }
7753
7754 /*
7755 * Convert the DOS times into unix times.
7756 */
7757
7758 ft.atime = convert_time_t_to_timespec(
7759 srv_make_unix_date2(req->vwv+3));
7760 ft.mtime = convert_time_t_to_timespec(
7761 srv_make_unix_date2(req->vwv+5));
7762 ft.create_time = convert_time_t_to_timespec(
7763 srv_make_unix_date2(req->vwv+1));
7764
7765 reply_outbuf(req, 0, 0);
7766
7767 /*
7768 * Patch from Ray Frush <frush@engr.colostate.edu>
7769 * Sometimes times are sent as zero - ignore them.
7770 */
7771
7772 /* Ensure we have a valid stat struct for the source. */
7773 status = vfs_stat_fsp(fsp);
7774 if (!NT_STATUS_IS_OK(status)) {
7775 reply_nterror(req, status);
7776 goto out;
7777 }
7778
7779 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7780 if (!NT_STATUS_IS_OK(status)) {
7781 reply_nterror(req, status);
7782 goto out;
7783 }
7784
7785 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7786 " createtime=%u\n",
7787 fsp->fnum,
7788 (unsigned int)ft.atime.tv_sec,
7789 (unsigned int)ft.mtime.tv_sec,
7790 (unsigned int)ft.create_time.tv_sec
7791 ));
7792 out:
7793 END_PROFILE(SMBsetattrE);
7794 return;
7795 }
7796
7797
7798 /* Back from the dead for OS/2..... JRA. */
7799
7800 /****************************************************************************
7801 Reply to a SMBwritebmpx (write block multiplex primary) request.
7802 Always reply with an error, if someone has a platform really needs this,
7803 please contact vl@samba.org
7804 ****************************************************************************/
7805
7806 void reply_writebmpx(struct smb_request *req)
7807 {
7808 START_PROFILE(SMBwriteBmpx);
7809 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7810 END_PROFILE(SMBwriteBmpx);
7811 return;
7812 }
7813
7814 /****************************************************************************
7815 Reply to a SMBwritebs (write block multiplex secondary) request.
7816 Always reply with an error, if someone has a platform really needs this,
7817 please contact vl@samba.org
7818 ****************************************************************************/
7819
7820 void reply_writebs(struct smb_request *req)
7821 {
7822 START_PROFILE(SMBwriteBs);
7823 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7824 END_PROFILE(SMBwriteBs);
7825 return;
7826 }
7827
7828 /****************************************************************************
7829 Reply to a SMBgetattrE.
7830 ****************************************************************************/
7831
7832 void reply_getattrE(struct smb_request *req)
7833 {
7834 connection_struct *conn = req->conn;
7835 int mode;
7836 files_struct *fsp;
7837 struct timespec create_ts;
7838
7839 START_PROFILE(SMBgetattrE);
7840
7841 if (req->wct < 1) {
7842 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7843 END_PROFILE(SMBgetattrE);
7844 return;
7845 }
7846
7847 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7848
7849 if(!fsp || (fsp->conn != conn)) {
7850 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7851 END_PROFILE(SMBgetattrE);
7852 return;
7853 }
7854
7855 /* Do an fstat on this file */
7856 if(fsp_stat(fsp)) {
7857 reply_nterror(req, map_nt_error_from_unix(errno));
7858 END_PROFILE(SMBgetattrE);
7859 return;
7860 }
7861
7862 mode = dos_mode(conn, fsp->fsp_name);
7863
7864 /*
7865 * Convert the times into dos times. Set create
7866 * date to be last modify date as UNIX doesn't save
7867 * this.
7868 */
7869
7870 reply_outbuf(req, 11, 0);
7871
7872 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7873 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7874 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7875 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7876 /* Should we check pending modtime here ? JRA */
7877 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7878 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7879
7880 if (mode & aDIR) {
7881 SIVAL(req->outbuf, smb_vwv6, 0);
7882 SIVAL(req->outbuf, smb_vwv8, 0);
7883 } else {
7884 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7885 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7886 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7887 }
7888 SSVAL(req->outbuf,smb_vwv10, mode);
7889
7890 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7891
7892 END_PROFILE(SMBgetattrE);
7893 return;
7894 }