?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-smbtorture: fill PrinterDriverData with more values for consistency test.
[Samba/nascimento.git] / source3 / smbd / reply.c
blob7d0fa7728a9a35808965cb23a13ea4cb1c779cd6
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 /****************************************************************************
31 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
32 path or anything including wildcards.
33 We're assuming here that '/' is not the second byte in any multibyte char
34 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
35 set.
36 ****************************************************************************/
37
38 /* Custom version for processing POSIX paths. */
39 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
40
41 static NTSTATUS check_path_syntax_internal(char *path,
42 bool posix_path,
43 bool *p_last_component_contains_wcard)
44 {
45 char *d = path;
46 const char *s = path;
47 NTSTATUS ret = NT_STATUS_OK;
48 bool start_of_name_component = True;
49 bool stream_started = false;
50
51 *p_last_component_contains_wcard = False;
52
53 while (*s) {
54 if (stream_started) {
55 switch (*s) {
56 case '/':
57 case '\\':
58 return NT_STATUS_OBJECT_NAME_INVALID;
59 case ':':
60 if (s[1] == '\0') {
61 return NT_STATUS_OBJECT_NAME_INVALID;
62 }
63 if (strchr_m(&s[1], ':')) {
64 return NT_STATUS_OBJECT_NAME_INVALID;
65 }
66 break;
67 }
68 }
69
70 if ((*s == ':') && !posix_path && !stream_started) {
71 if (*p_last_component_contains_wcard) {
72 return NT_STATUS_OBJECT_NAME_INVALID;
73 }
74 /* Stream names allow more characters than file names.
75 We're overloading posix_path here to allow a wider
76 range of characters. If stream_started is true this
77 is still a Windows path even if posix_path is true.
78 JRA.
79 */
80 stream_started = true;
81 start_of_name_component = false;
82 posix_path = true;
83
84 if (s[1] == '\0') {
85 return NT_STATUS_OBJECT_NAME_INVALID;
86 }
87 }
88
89 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
90 /*
91 * Safe to assume is not the second part of a mb char
92 * as this is handled below.
93 */
94 /* Eat multiple '/' or '\\' */
95 while (IS_PATH_SEP(*s,posix_path)) {
96 s++;
97 }
98 if ((d != path) && (*s != '\0')) {
99 /* We only care about non-leading or trailing '/' or '\\' */
100 *d++ = '/';
101 }
102
103 start_of_name_component = True;
104 /* New component. */
105 *p_last_component_contains_wcard = False;
106 continue;
107 }
108
109 if (start_of_name_component) {
110 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
111 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
112
113 /*
114 * No mb char starts with '.' so we're safe checking the directory separator here.
115 */
116
117 /* If we just added a '/' - delete it */
118 if ((d > path) && (*(d-1) == '/')) {
119 *(d-1) = '\0';
120 d--;
121 }
122
123 /* Are we at the start ? Can't go back further if so. */
124 if (d <= path) {
125 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
126 break;
127 }
128 /* Go back one level... */
129 /* We know this is safe as '/' cannot be part of a mb sequence. */
130 /* NOTE - if this assumption is invalid we are not in good shape... */
131 /* Decrement d first as d points to the *next* char to write into. */
132 for (d--; d > path; d--) {
133 if (*d == '/')
134 break;
135 }
136 s += 2; /* Else go past the .. */
137 /* We're still at the start of a name component, just the previous one. */
138 continue;
139
140 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
141 if (posix_path) {
142 /* Eat the '.' */
143 s++;
144 continue;
145 }
146 }
147
148 }
149
150 if (!(*s & 0x80)) {
151 if (!posix_path) {
152 if (*s <= 0x1f || *s == '|') {
153 return NT_STATUS_OBJECT_NAME_INVALID;
154 }
155 switch (*s) {
156 case '*':
157 case '?':
158 case '<':
159 case '>':
160 case '"':
161 *p_last_component_contains_wcard = True;
162 break;
163 default:
164 break;
165 }
166 }
167 *d++ = *s++;
168 } else {
169 size_t siz;
170 /* Get the size of the next MB character. */
171 next_codepoint(s,&siz);
172 switch(siz) {
173 case 5:
174 *d++ = *s++;
175 /*fall through*/
176 case 4:
177 *d++ = *s++;
178 /*fall through*/
179 case 3:
180 *d++ = *s++;
181 /*fall through*/
182 case 2:
183 *d++ = *s++;
184 /*fall through*/
185 case 1:
186 *d++ = *s++;
187 break;
188 default:
189 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
190 *d = '\0';
191 return NT_STATUS_INVALID_PARAMETER;
192 }
193 }
194 start_of_name_component = False;
195 }
196
197 *d = '\0';
198
199 return ret;
200 }
201
202 /****************************************************************************
203 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
204 No wildcards allowed.
205 ****************************************************************************/
206
207 NTSTATUS check_path_syntax(char *path)
208 {
209 bool ignore;
210 return check_path_syntax_internal(path, False, &ignore);
211 }
212
213 /****************************************************************************
214 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
215 Wildcards allowed - p_contains_wcard returns true if the last component contained
216 a wildcard.
217 ****************************************************************************/
218
219 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
220 {
221 return check_path_syntax_internal(path, False, p_contains_wcard);
222 }
223
224 /****************************************************************************
225 Check the path for a POSIX client.
226 We're assuming here that '/' is not the second byte in any multibyte char
227 set (a safe assumption).
228 ****************************************************************************/
229
230 NTSTATUS check_path_syntax_posix(char *path)
231 {
232 bool ignore;
233 return check_path_syntax_internal(path, True, &ignore);
234 }
235
236 /****************************************************************************
237 Pull a string and check the path allowing a wilcard - provide for error return.
238 ****************************************************************************/
239
240 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
241 const char *base_ptr,
242 uint16 smb_flags2,
243 char **pp_dest,
244 const char *src,
245 size_t src_len,
246 int flags,
247 NTSTATUS *err,
248 bool *contains_wcard)
249 {
250 size_t ret;
251
252 *pp_dest = NULL;
253
254 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
255 src_len, flags);
256
257 if (!*pp_dest) {
258 *err = NT_STATUS_INVALID_PARAMETER;
259 return ret;
260 }
261
262 *contains_wcard = False;
263
264 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
265 /*
266 * For a DFS path the function parse_dfs_path()
267 * will do the path processing, just make a copy.
268 */
269 *err = NT_STATUS_OK;
270 return ret;
271 }
272
273 if (lp_posix_pathnames()) {
274 *err = check_path_syntax_posix(*pp_dest);
275 } else {
276 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
277 }
278
279 return ret;
280 }
281
282 /****************************************************************************
283 Pull a string and check the path - provide for error return.
284 ****************************************************************************/
285
286 size_t srvstr_get_path(TALLOC_CTX *ctx,
287 const char *base_ptr,
288 uint16 smb_flags2,
289 char **pp_dest,
290 const char *src,
291 size_t src_len,
292 int flags,
293 NTSTATUS *err)
294 {
295 bool ignore;
296 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
297 src_len, flags, err, &ignore);
298 }
299
300 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
301 char **pp_dest, const char *src, int flags,
302 NTSTATUS *err, bool *contains_wcard)
303 {
304 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
305 pp_dest, src, smbreq_bufrem(req, src),
306 flags, err, contains_wcard);
307 }
308
309 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
310 char **pp_dest, const char *src, int flags,
311 NTSTATUS *err)
312 {
313 bool ignore;
314 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
315 flags, err, &ignore);
316 }
317
318 /****************************************************************************
319 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
320 ****************************************************************************/
321
322 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
323 files_struct *fsp)
324 {
325 if (!(fsp) || !(conn)) {
326 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
327 return False;
328 }
329 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
330 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
331 return False;
332 }
333 return True;
334 }
335
336 /****************************************************************************
337 Check if we have a correct fsp pointing to a file.
338 ****************************************************************************/
339
340 bool check_fsp(connection_struct *conn, struct smb_request *req,
341 files_struct *fsp)
342 {
343 if (!check_fsp_open(conn, req, fsp)) {
344 return False;
345 }
346 if ((fsp)->is_directory) {
347 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
348 return False;
349 }
350 if ((fsp)->fh->fd == -1) {
351 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
352 return False;
353 }
354 (fsp)->num_smb_operations++;
355 return True;
356 }
357
358 /****************************************************************************
359 Check if we have a correct fsp pointing to a quota fake file. Replacement for
360 the CHECK_NTQUOTA_HANDLE_OK macro.
361 ****************************************************************************/
362
363 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
364 files_struct *fsp)
365 {
366 if (!check_fsp_open(conn, req, fsp)) {
367 return false;
368 }
369
370 if (fsp->is_directory) {
371 return false;
372 }
373
374 if (fsp->fake_file_handle == NULL) {
375 return false;
376 }
377
378 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
379 return false;
380 }
381
382 if (fsp->fake_file_handle->private_data == NULL) {
383 return false;
384 }
385
386 return true;
387 }
388
389 /****************************************************************************
390 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
391 ****************************************************************************/
392
393 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
394 files_struct *fsp)
395 {
396 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
397 && (req->vuid == (fsp)->vuid)) {
398 return True;
399 }
400
401 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
402 return False;
403 }
404
405 static bool netbios_session_retarget(const char *name, int name_type)
406 {
407 char *trim_name;
408 char *trim_name_type;
409 const char *retarget_parm;
410 char *retarget;
411 char *p;
412 int retarget_type = 0x20;
413 int retarget_port = 139;
414 struct sockaddr_storage retarget_addr;
415 struct sockaddr_in *in_addr;
416 bool ret = false;
417 uint8_t outbuf[10];
418
419 if (get_socket_port(smbd_server_fd()) != 139) {
420 return false;
421 }
422
423 trim_name = talloc_strdup(talloc_tos(), name);
424 if (trim_name == NULL) {
425 goto fail;
426 }
427 trim_char(trim_name, ' ', ' ');
428
429 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
430 name_type);
431 if (trim_name_type == NULL) {
432 goto fail;
433 }
434
435 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
436 trim_name_type, NULL);
437 if (retarget_parm == NULL) {
438 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
439 trim_name, NULL);
440 }
441 if (retarget_parm == NULL) {
442 goto fail;
443 }
444
445 retarget = talloc_strdup(trim_name, retarget_parm);
446 if (retarget == NULL) {
447 goto fail;
448 }
449
450 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
451
452 p = strchr(retarget, ':');
453 if (p != NULL) {
454 *p++ = '\0';
455 retarget_port = atoi(p);
456 }
457
458 p = strchr_m(retarget, '#');
459 if (p != NULL) {
460 *p++ = '\0';
461 sscanf(p, "%x", &retarget_type);
462 }
463
464 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
465 if (!ret) {
466 DEBUG(10, ("could not resolve %s\n", retarget));
467 goto fail;
468 }
469
470 if (retarget_addr.ss_family != AF_INET) {
471 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
472 goto fail;
473 }
474
475 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
476
477 _smb_setlen(outbuf, 6);
478 SCVAL(outbuf, 0, 0x84);
479 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
480 *(uint16_t *)(outbuf+8) = htons(retarget_port);
481
482 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
483 NULL)) {
484 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
485 "failed.");
486 }
487
488 ret = true;
489 fail:
490 TALLOC_FREE(trim_name);
491 return ret;
492 }
493
494 /****************************************************************************
495 Reply to a (netbios-level) special message.
496 ****************************************************************************/
497
498 void reply_special(char *inbuf)
499 {
500 int msg_type = CVAL(inbuf,0);
501 int msg_flags = CVAL(inbuf,1);
502 fstring name1,name2;
503 char name_type1, name_type2;
504 struct smbd_server_connection *sconn = smbd_server_conn;
505
506 /*
507 * We only really use 4 bytes of the outbuf, but for the smb_setlen
508 * calculation & friends (srv_send_smb uses that) we need the full smb
509 * header.
510 */
511 char outbuf[smb_size];
512
513 *name1 = *name2 = 0;
514
515 memset(outbuf, '\0', sizeof(outbuf));
516
517 smb_setlen(outbuf,0);
518
519 switch (msg_type) {
520 case 0x81: /* session request */
521
522 if (sconn->nbt.got_session) {
523 exit_server_cleanly("multiple session request not permitted");
524 }
525
526 SCVAL(outbuf,0,0x82);
527 SCVAL(outbuf,3,0);
528 if (name_len(inbuf+4) > 50 ||
529 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
530 DEBUG(0,("Invalid name length in session request\n"));
531 return;
532 }
533 name_type1 = name_extract(inbuf,4,name1);
534 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
535 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
536 name1, name_type1, name2, name_type2));
537
538 if (netbios_session_retarget(name1, name_type1)) {
539 exit_server_cleanly("retargeted client");
540 }
541
542 set_local_machine_name(name1, True);
543 set_remote_machine_name(name2, True);
544
545 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
546 get_local_machine_name(), get_remote_machine_name(),
547 name_type2));
548
549 if (name_type2 == 'R') {
550 /* We are being asked for a pathworks session ---
551 no thanks! */
552 SCVAL(outbuf, 0,0x83);
553 break;
554 }
555
556 /* only add the client's machine name to the list
557 of possibly valid usernames if we are operating
558 in share mode security */
559 if (lp_security() == SEC_SHARE) {
560 add_session_user(sconn, get_remote_machine_name());
561 }
562
563 reload_services(True);
564 reopen_logs();
565
566 sconn->nbt.got_session = true;
567 break;
568
569 case 0x89: /* session keepalive request
570 (some old clients produce this?) */
571 SCVAL(outbuf,0,SMBkeepalive);
572 SCVAL(outbuf,3,0);
573 break;
574
575 case 0x82: /* positive session response */
576 case 0x83: /* negative session response */
577 case 0x84: /* retarget session response */
578 DEBUG(0,("Unexpected session response\n"));
579 break;
580
581 case SMBkeepalive: /* session keepalive */
582 default:
583 return;
584 }
585
586 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
587 msg_type, msg_flags));
588
589 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
590 return;
591 }
592
593 /****************************************************************************
594 Reply to a tcon.
595 conn POINTER CAN BE NULL HERE !
596 ****************************************************************************/
597
598 void reply_tcon(struct smb_request *req)
599 {
600 connection_struct *conn = req->conn;
601 const char *service;
602 char *service_buf = NULL;
603 char *password = NULL;
604 char *dev = NULL;
605 int pwlen=0;
606 NTSTATUS nt_status;
607 const char *p;
608 DATA_BLOB password_blob;
609 TALLOC_CTX *ctx = talloc_tos();
610 struct smbd_server_connection *sconn = smbd_server_conn;
611
612 START_PROFILE(SMBtcon);
613
614 if (req->buflen < 4) {
615 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
616 END_PROFILE(SMBtcon);
617 return;
618 }
619
620 p = (const char *)req->buf + 1;
621 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
622 p += 1;
623 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
624 p += pwlen+1;
625 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
626 p += 1;
627
628 if (service_buf == NULL || password == NULL || dev == NULL) {
629 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
630 END_PROFILE(SMBtcon);
631 return;
632 }
633 p = strrchr_m(service_buf,'\\');
634 if (p) {
635 service = p+1;
636 } else {
637 service = service_buf;
638 }
639
640 password_blob = data_blob(password, pwlen+1);
641
642 conn = make_connection(sconn,service,password_blob,dev,
643 req->vuid,&nt_status);
644 req->conn = conn;
645
646 data_blob_clear_free(&password_blob);
647
648 if (!conn) {
649 reply_nterror(req, nt_status);
650 END_PROFILE(SMBtcon);
651 return;
652 }
653
654 reply_outbuf(req, 2, 0);
655 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
656 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
657 SSVAL(req->outbuf,smb_tid,conn->cnum);
658
659 DEBUG(3,("tcon service=%s cnum=%d\n",
660 service, conn->cnum));
661
662 END_PROFILE(SMBtcon);
663 return;
664 }
665
666 /****************************************************************************
667 Reply to a tcon and X.
668 conn POINTER CAN BE NULL HERE !
669 ****************************************************************************/
670
671 void reply_tcon_and_X(struct smb_request *req)
672 {
673 connection_struct *conn = req->conn;
674 const char *service = NULL;
675 DATA_BLOB password;
676 TALLOC_CTX *ctx = talloc_tos();
677 /* what the cleint thinks the device is */
678 char *client_devicetype = NULL;
679 /* what the server tells the client the share represents */
680 const char *server_devicetype;
681 NTSTATUS nt_status;
682 int passlen;
683 char *path = NULL;
684 const char *p, *q;
685 uint16 tcon_flags;
686 struct smbd_server_connection *sconn = smbd_server_conn;
687
688 START_PROFILE(SMBtconX);
689
690 if (req->wct < 4) {
691 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
692 END_PROFILE(SMBtconX);
693 return;
694 }
695
696 passlen = SVAL(req->vwv+3, 0);
697 tcon_flags = SVAL(req->vwv+2, 0);
698
699 /* we might have to close an old one */
700 if ((tcon_flags & 0x1) && conn) {
701 close_cnum(conn,req->vuid);
702 req->conn = NULL;
703 conn = NULL;
704 }
705
706 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
707 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
708 END_PROFILE(SMBtconX);
709 return;
710 }
711
712 if (sconn->smb1.negprot.encrypted_passwords) {
713 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
714 if (lp_security() == SEC_SHARE) {
715 /*
716 * Security = share always has a pad byte
717 * after the password.
718 */
719 p = (const char *)req->buf + passlen + 1;
720 } else {
721 p = (const char *)req->buf + passlen;
722 }
723 } else {
724 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
725 /* Ensure correct termination */
726 password.data[passlen]=0;
727 p = (const char *)req->buf + passlen + 1;
728 }
729
730 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
731
732 if (path == NULL) {
733 data_blob_clear_free(&password);
734 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
735 END_PROFILE(SMBtconX);
736 return;
737 }
738
739 /*
740 * the service name can be either: \\server\share
741 * or share directly like on the DELL PowerVault 705
742 */
743 if (*path=='\\') {
744 q = strchr_m(path+2,'\\');
745 if (!q) {
746 data_blob_clear_free(&password);
747 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
748 END_PROFILE(SMBtconX);
749 return;
750 }
751 service = q+1;
752 } else {
753 service = path;
754 }
755
756 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
757 &client_devicetype, p,
758 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
759
760 if (client_devicetype == NULL) {
761 data_blob_clear_free(&password);
762 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
763 END_PROFILE(SMBtconX);
764 return;
765 }
766
767 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
768
769 conn = make_connection(sconn, service, password, client_devicetype,
770 req->vuid, &nt_status);
771 req->conn =conn;
772
773 data_blob_clear_free(&password);
774
775 if (!conn) {
776 reply_nterror(req, nt_status);
777 END_PROFILE(SMBtconX);
778 return;
779 }
780
781 if ( IS_IPC(conn) )
782 server_devicetype = "IPC";
783 else if ( IS_PRINT(conn) )
784 server_devicetype = "LPT1:";
785 else
786 server_devicetype = "A:";
787
788 if (get_Protocol() < PROTOCOL_NT1) {
789 reply_outbuf(req, 2, 0);
790 if (message_push_string(&req->outbuf, server_devicetype,
791 STR_TERMINATE|STR_ASCII) == -1) {
792 reply_nterror(req, NT_STATUS_NO_MEMORY);
793 END_PROFILE(SMBtconX);
794 return;
795 }
796 } else {
797 /* NT sets the fstype of IPC$ to the null string */
798 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
799
800 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
801 /* Return permissions. */
802 uint32 perm1 = 0;
803 uint32 perm2 = 0;
804
805 reply_outbuf(req, 7, 0);
806
807 if (IS_IPC(conn)) {
808 perm1 = FILE_ALL_ACCESS;
809 perm2 = FILE_ALL_ACCESS;
810 } else {
811 perm1 = CAN_WRITE(conn) ?
812 SHARE_ALL_ACCESS :
813 SHARE_READ_ONLY;
814 }
815
816 SIVAL(req->outbuf, smb_vwv3, perm1);
817 SIVAL(req->outbuf, smb_vwv5, perm2);
818 } else {
819 reply_outbuf(req, 3, 0);
820 }
821
822 if ((message_push_string(&req->outbuf, server_devicetype,
823 STR_TERMINATE|STR_ASCII) == -1)
824 || (message_push_string(&req->outbuf, fstype,
825 STR_TERMINATE) == -1)) {
826 reply_nterror(req, NT_STATUS_NO_MEMORY);
827 END_PROFILE(SMBtconX);
828 return;
829 }
830
831 /* what does setting this bit do? It is set by NT4 and
832 may affect the ability to autorun mounted cdroms */
833 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
834 (lp_csc_policy(SNUM(conn)) << 2));
835
836 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
837 DEBUG(2,("Serving %s as a Dfs root\n",
838 lp_servicename(SNUM(conn)) ));
839 SSVAL(req->outbuf, smb_vwv2,
840 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
841 }
842 }
843
844
845 DEBUG(3,("tconX service=%s \n",
846 service));
847
848 /* set the incoming and outgoing tid to the just created one */
849 SSVAL(req->inbuf,smb_tid,conn->cnum);
850 SSVAL(req->outbuf,smb_tid,conn->cnum);
851
852 END_PROFILE(SMBtconX);
853
854 req->tid = conn->cnum;
855 chain_reply(req);
856 return;
857 }
858
859 /****************************************************************************
860 Reply to an unknown type.
861 ****************************************************************************/
862
863 void reply_unknown_new(struct smb_request *req, uint8 type)
864 {
865 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
866 smb_fn_name(type), type, type));
867 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
868 return;
869 }
870
871 /****************************************************************************
872 Reply to an ioctl.
873 conn POINTER CAN BE NULL HERE !
874 ****************************************************************************/
875
876 void reply_ioctl(struct smb_request *req)
877 {
878 connection_struct *conn = req->conn;
879 uint16 device;
880 uint16 function;
881 uint32 ioctl_code;
882 int replysize;
883 char *p;
884
885 START_PROFILE(SMBioctl);
886
887 if (req->wct < 3) {
888 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
889 END_PROFILE(SMBioctl);
890 return;
891 }
892
893 device = SVAL(req->vwv+1, 0);
894 function = SVAL(req->vwv+2, 0);
895 ioctl_code = (device << 16) + function;
896
897 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
898
899 switch (ioctl_code) {
900 case IOCTL_QUERY_JOB_INFO:
901 replysize = 32;
902 break;
903 default:
904 reply_force_doserror(req, ERRSRV, ERRnosupport);
905 END_PROFILE(SMBioctl);
906 return;
907 }
908
909 reply_outbuf(req, 8, replysize+1);
910 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
911 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
912 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
913 p = smb_buf(req->outbuf);
914 memset(p, '\0', replysize+1); /* valgrind-safe. */
915 p += 1; /* Allow for alignment */
916
917 switch (ioctl_code) {
918 case IOCTL_QUERY_JOB_INFO:
919 {
920 files_struct *fsp = file_fsp(
921 req, SVAL(req->vwv+0, 0));
922 if (!fsp) {
923 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
928 srvstr_push((char *)req->outbuf, req->flags2, p+2,
929 global_myname(), 15,
930 STR_TERMINATE|STR_ASCII);
931 if (conn) {
932 srvstr_push((char *)req->outbuf, req->flags2,
933 p+18, lp_servicename(SNUM(conn)),
934 13, STR_TERMINATE|STR_ASCII);
935 } else {
936 memset(p+18, 0, 13);
937 }
938 break;
939 }
940 }
941
942 END_PROFILE(SMBioctl);
943 return;
944 }
945
946 /****************************************************************************
947 Strange checkpath NTSTATUS mapping.
948 ****************************************************************************/
949
950 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
951 {
952 /* Strange DOS error code semantics only for checkpath... */
953 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
954 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
955 /* We need to map to ERRbadpath */
956 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
957 }
958 }
959 return status;
960 }
961
962 /****************************************************************************
963 Reply to a checkpath.
964 ****************************************************************************/
965
966 void reply_checkpath(struct smb_request *req)
967 {
968 connection_struct *conn = req->conn;
969 struct smb_filename *smb_fname = NULL;
970 char *name = NULL;
971 NTSTATUS status;
972 TALLOC_CTX *ctx = talloc_tos();
973
974 START_PROFILE(SMBcheckpath);
975
976 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
977 STR_TERMINATE, &status);
978
979 if (!NT_STATUS_IS_OK(status)) {
980 status = map_checkpath_error(req->flags2, status);
981 reply_nterror(req, status);
982 END_PROFILE(SMBcheckpath);
983 return;
984 }
985
986 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
987
988 status = filename_convert(ctx,
989 conn,
990 req->flags2 & FLAGS2_DFS_PATHNAMES,
991 name,
992 0,
993 NULL,
994 &smb_fname);
995
996 if (!NT_STATUS_IS_OK(status)) {
997 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
998 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
999 ERRSRV, ERRbadpath);
1000 END_PROFILE(SMBcheckpath);
1001 return;
1002 }
1003 goto path_err;
1004 }
1005
1006 if (!VALID_STAT(smb_fname->st) &&
1007 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1008 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1009 smb_fname_str_dbg(smb_fname), strerror(errno)));
1010 status = map_nt_error_from_unix(errno);
1011 goto path_err;
1012 }
1013
1014 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1015 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1016 ERRDOS, ERRbadpath);
1017 goto out;
1018 }
1019
1020 reply_outbuf(req, 0, 0);
1021
1022 path_err:
1023 /* We special case this - as when a Windows machine
1024 is parsing a path is steps through the components
1025 one at a time - if a component fails it expects
1026 ERRbadpath, not ERRbadfile.
1027 */
1028 status = map_checkpath_error(req->flags2, status);
1029 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1030 /*
1031 * Windows returns different error codes if
1032 * the parent directory is valid but not the
1033 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1034 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1035 * if the path is invalid.
1036 */
1037 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1038 ERRDOS, ERRbadpath);
1039 goto out;
1040 }
1041
1042 reply_nterror(req, status);
1043
1044 out:
1045 TALLOC_FREE(smb_fname);
1046 END_PROFILE(SMBcheckpath);
1047 return;
1048 }
1049
1050 /****************************************************************************
1051 Reply to a getatr.
1052 ****************************************************************************/
1053
1054 void reply_getatr(struct smb_request *req)
1055 {
1056 connection_struct *conn = req->conn;
1057 struct smb_filename *smb_fname = NULL;
1058 char *fname = NULL;
1059 int mode=0;
1060 SMB_OFF_T size=0;
1061 time_t mtime=0;
1062 const char *p;
1063 NTSTATUS status;
1064 TALLOC_CTX *ctx = talloc_tos();
1065 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1066
1067 START_PROFILE(SMBgetatr);
1068
1069 p = (const char *)req->buf + 1;
1070 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1071 if (!NT_STATUS_IS_OK(status)) {
1072 reply_nterror(req, status);
1073 goto out;
1074 }
1075
1076 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1077 under WfWg - weird! */
1078 if (*fname == '\0') {
1079 mode = aHIDDEN | aDIR;
1080 if (!CAN_WRITE(conn)) {
1081 mode |= aRONLY;
1082 }
1083 size = 0;
1084 mtime = 0;
1085 } else {
1086 status = filename_convert(ctx,
1087 conn,
1088 req->flags2 & FLAGS2_DFS_PATHNAMES,
1089 fname,
1090 0,
1091 NULL,
1092 &smb_fname);
1093 if (!NT_STATUS_IS_OK(status)) {
1094 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1095 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1096 ERRSRV, ERRbadpath);
1097 goto out;
1098 }
1099 reply_nterror(req, status);
1100 goto out;
1101 }
1102 if (!VALID_STAT(smb_fname->st) &&
1103 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1104 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1105 smb_fname_str_dbg(smb_fname),
1106 strerror(errno)));
1107 reply_nterror(req, map_nt_error_from_unix(errno));
1108 goto out;
1109 }
1110
1111 mode = dos_mode(conn, smb_fname);
1112 size = smb_fname->st.st_ex_size;
1113
1114 if (ask_sharemode) {
1115 struct timespec write_time_ts;
1116 struct file_id fileid;
1117
1118 ZERO_STRUCT(write_time_ts);
1119 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1120 get_file_infos(fileid, NULL, &write_time_ts);
1121 if (!null_timespec(write_time_ts)) {
1122 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1123 }
1124 }
1125
1126 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1127 if (mode & aDIR) {
1128 size = 0;
1129 }
1130 }
1131
1132 reply_outbuf(req, 10, 0);
1133
1134 SSVAL(req->outbuf,smb_vwv0,mode);
1135 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1136 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1137 } else {
1138 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1139 }
1140 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1141
1142 if (get_Protocol() >= PROTOCOL_NT1) {
1143 SSVAL(req->outbuf, smb_flg2,
1144 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1145 }
1146
1147 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1148 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1149
1150 out:
1151 TALLOC_FREE(smb_fname);
1152 TALLOC_FREE(fname);
1153 END_PROFILE(SMBgetatr);
1154 return;
1155 }
1156
1157 /****************************************************************************
1158 Reply to a setatr.
1159 ****************************************************************************/
1160
1161 void reply_setatr(struct smb_request *req)
1162 {
1163 struct smb_file_time ft;
1164 connection_struct *conn = req->conn;
1165 struct smb_filename *smb_fname = NULL;
1166 char *fname = NULL;
1167 int mode;
1168 time_t mtime;
1169 const char *p;
1170 NTSTATUS status;
1171 TALLOC_CTX *ctx = talloc_tos();
1172
1173 START_PROFILE(SMBsetatr);
1174
1175 ZERO_STRUCT(ft);
1176
1177 if (req->wct < 2) {
1178 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1179 goto out;
1180 }
1181
1182 p = (const char *)req->buf + 1;
1183 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1184 if (!NT_STATUS_IS_OK(status)) {
1185 reply_nterror(req, status);
1186 goto out;
1187 }
1188
1189 status = filename_convert(ctx,
1190 conn,
1191 req->flags2 & FLAGS2_DFS_PATHNAMES,
1192 fname,
1193 0,
1194 NULL,
1195 &smb_fname);
1196 if (!NT_STATUS_IS_OK(status)) {
1197 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1198 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1199 ERRSRV, ERRbadpath);
1200 goto out;
1201 }
1202 reply_nterror(req, status);
1203 goto out;
1204 }
1205
1206 if (smb_fname->base_name[0] == '.' &&
1207 smb_fname->base_name[1] == '\0') {
1208 /*
1209 * Not sure here is the right place to catch this
1210 * condition. Might be moved to somewhere else later -- vl
1211 */
1212 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1213 goto out;
1214 }
1215
1216 mode = SVAL(req->vwv+0, 0);
1217 mtime = srv_make_unix_date3(req->vwv+1);
1218
1219 ft.mtime = convert_time_t_to_timespec(mtime);
1220 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1221 if (!NT_STATUS_IS_OK(status)) {
1222 reply_nterror(req, status);
1223 goto out;
1224 }
1225
1226 if (mode != FILE_ATTRIBUTE_NORMAL) {
1227 if (VALID_STAT_OF_DIR(smb_fname->st))
1228 mode |= aDIR;
1229 else
1230 mode &= ~aDIR;
1231
1232 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1233 false) != 0) {
1234 reply_nterror(req, map_nt_error_from_unix(errno));
1235 goto out;
1236 }
1237 }
1238
1239 reply_outbuf(req, 0, 0);
1240
1241 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1242 mode));
1243 out:
1244 TALLOC_FREE(smb_fname);
1245 END_PROFILE(SMBsetatr);
1246 return;
1247 }
1248
1249 /****************************************************************************
1250 Reply to a dskattr.
1251 ****************************************************************************/
1252
1253 void reply_dskattr(struct smb_request *req)
1254 {
1255 connection_struct *conn = req->conn;
1256 uint64_t dfree,dsize,bsize;
1257 START_PROFILE(SMBdskattr);
1258
1259 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1260 reply_nterror(req, map_nt_error_from_unix(errno));
1261 END_PROFILE(SMBdskattr);
1262 return;
1263 }
1264
1265 reply_outbuf(req, 5, 0);
1266
1267 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1268 double total_space, free_space;
1269 /* we need to scale this to a number that DOS6 can handle. We
1270 use floating point so we can handle large drives on systems
1271 that don't have 64 bit integers
1272
1273 we end up displaying a maximum of 2G to DOS systems
1274 */
1275 total_space = dsize * (double)bsize;
1276 free_space = dfree * (double)bsize;
1277
1278 dsize = (uint64_t)((total_space+63*512) / (64*512));
1279 dfree = (uint64_t)((free_space+63*512) / (64*512));
1280
1281 if (dsize > 0xFFFF) dsize = 0xFFFF;
1282 if (dfree > 0xFFFF) dfree = 0xFFFF;
1283
1284 SSVAL(req->outbuf,smb_vwv0,dsize);
1285 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1286 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1287 SSVAL(req->outbuf,smb_vwv3,dfree);
1288 } else {
1289 SSVAL(req->outbuf,smb_vwv0,dsize);
1290 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1291 SSVAL(req->outbuf,smb_vwv2,512);
1292 SSVAL(req->outbuf,smb_vwv3,dfree);
1293 }
1294
1295 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1296
1297 END_PROFILE(SMBdskattr);
1298 return;
1299 }
1300
1301 /*
1302 * Utility function to split the filename from the directory.
1303 */
1304 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1305 char **fname_dir_out,
1306 char **fname_mask_out)
1307 {
1308 const char *p = NULL;
1309 char *fname_dir = NULL;
1310 char *fname_mask = NULL;
1311
1312 p = strrchr_m(fname_in, '/');
1313 if (!p) {
1314 fname_dir = talloc_strdup(ctx, ".");
1315 fname_mask = talloc_strdup(ctx, fname_in);
1316 } else {
1317 fname_dir = talloc_strndup(ctx, fname_in,
1318 PTR_DIFF(p, fname_in));
1319 fname_mask = talloc_strdup(ctx, p+1);
1320 }
1321
1322 if (!fname_dir || !fname_mask) {
1323 TALLOC_FREE(fname_dir);
1324 TALLOC_FREE(fname_mask);
1325 return NT_STATUS_NO_MEMORY;
1326 }
1327
1328 *fname_dir_out = fname_dir;
1329 *fname_mask_out = fname_mask;
1330 return NT_STATUS_OK;
1331 }
1332
1333 /****************************************************************************
1334 Reply to a search.
1335 Can be called from SMBsearch, SMBffirst or SMBfunique.
1336 ****************************************************************************/
1337
1338 void reply_search(struct smb_request *req)
1339 {
1340 connection_struct *conn = req->conn;
1341 char *path = NULL;
1342 const char *mask = NULL;
1343 char *directory = NULL;
1344 struct smb_filename *smb_fname = NULL;
1345 char *fname = NULL;
1346 SMB_OFF_T size;
1347 uint32 mode;
1348 struct timespec date;
1349 uint32 dirtype;
1350 unsigned int numentries = 0;
1351 unsigned int maxentries = 0;
1352 bool finished = False;
1353 const char *p;
1354 int status_len;
1355 char status[21];
1356 int dptr_num= -1;
1357 bool check_descend = False;
1358 bool expect_close = False;
1359 NTSTATUS nt_status;
1360 bool mask_contains_wcard = False;
1361 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1362 TALLOC_CTX *ctx = talloc_tos();
1363 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1364 struct dptr_struct *dirptr = NULL;
1365 struct smbd_server_connection *sconn = smbd_server_conn;
1366
1367 START_PROFILE(SMBsearch);
1368
1369 if (req->wct < 2) {
1370 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1371 goto out;
1372 }
1373
1374 if (lp_posix_pathnames()) {
1375 reply_unknown_new(req, req->cmd);
1376 goto out;
1377 }
1378
1379 /* If we were called as SMBffirst then we must expect close. */
1380 if(req->cmd == SMBffirst) {
1381 expect_close = True;
1382 }
1383
1384 reply_outbuf(req, 1, 3);
1385 maxentries = SVAL(req->vwv+0, 0);
1386 dirtype = SVAL(req->vwv+1, 0);
1387 p = (const char *)req->buf + 1;
1388 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1389 &nt_status, &mask_contains_wcard);
1390 if (!NT_STATUS_IS_OK(nt_status)) {
1391 reply_nterror(req, nt_status);
1392 goto out;
1393 }
1394
1395 p++;
1396 status_len = SVAL(p, 0);
1397 p += 2;
1398
1399 /* dirtype &= ~aDIR; */
1400
1401 if (status_len == 0) {
1402 nt_status = filename_convert(ctx, conn,
1403 req->flags2 & FLAGS2_DFS_PATHNAMES,
1404 path,
1405 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1406 &mask_contains_wcard,
1407 &smb_fname);
1408 if (!NT_STATUS_IS_OK(nt_status)) {
1409 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1410 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1411 ERRSRV, ERRbadpath);
1412 goto out;
1413 }
1414 reply_nterror(req, nt_status);
1415 goto out;
1416 }
1417
1418 directory = smb_fname->base_name;
1419
1420 p = strrchr_m(directory,'/');
1421 if ((p != NULL) && (*directory != '/')) {
1422 mask = p + 1;
1423 directory = talloc_strndup(ctx, directory,
1424 PTR_DIFF(p, directory));
1425 } else {
1426 mask = directory;
1427 directory = talloc_strdup(ctx,".");
1428 }
1429
1430 if (!directory) {
1431 reply_nterror(req, NT_STATUS_NO_MEMORY);
1432 goto out;
1433 }
1434
1435 memset((char *)status,'\0',21);
1436 SCVAL(status,0,(dirtype & 0x1F));
1437
1438 nt_status = dptr_create(conn,
1439 directory,
1440 True,
1441 expect_close,
1442 req->smbpid,
1443 mask,
1444 mask_contains_wcard,
1445 dirtype,
1446 &dirptr);
1447 if (!NT_STATUS_IS_OK(nt_status)) {
1448 reply_nterror(req, nt_status);
1449 goto out;
1450 }
1451 dptr_num = dptr_dnum(dirptr);
1452 } else {
1453 int status_dirtype;
1454 const char *dirpath;
1455
1456 memcpy(status,p,21);
1457 status_dirtype = CVAL(status,0) & 0x1F;
1458 if (status_dirtype != (dirtype & 0x1F)) {
1459 dirtype = status_dirtype;
1460 }
1461
1462 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1463 if (!dirptr) {
1464 goto SearchEmpty;
1465 }
1466 dirpath = dptr_path(sconn, dptr_num);
1467 directory = talloc_strdup(ctx, dirpath);
1468 if (!directory) {
1469 reply_nterror(req, NT_STATUS_NO_MEMORY);
1470 goto out;
1471 }
1472
1473 mask = dptr_wcard(sconn, dptr_num);
1474 if (!mask) {
1475 goto SearchEmpty;
1476 }
1477 /*
1478 * For a 'continue' search we have no string. So
1479 * check from the initial saved string.
1480 */
1481 mask_contains_wcard = ms_has_wild(mask);
1482 dirtype = dptr_attr(sconn, dptr_num);
1483 }
1484
1485 DEBUG(4,("dptr_num is %d\n",dptr_num));
1486
1487 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1488 dptr_init_search_op(dirptr);
1489
1490 if ((dirtype&0x1F) == aVOLID) {
1491 char buf[DIR_STRUCT_SIZE];
1492 memcpy(buf,status,21);
1493 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1494 0,aVOLID,0,!allow_long_path_components)) {
1495 reply_nterror(req, NT_STATUS_NO_MEMORY);
1496 goto out;
1497 }
1498 dptr_fill(sconn, buf+12,dptr_num);
1499 if (dptr_zero(buf+12) && (status_len==0)) {
1500 numentries = 1;
1501 } else {
1502 numentries = 0;
1503 }
1504 if (message_push_blob(&req->outbuf,
1505 data_blob_const(buf, sizeof(buf)))
1506 == -1) {
1507 reply_nterror(req, NT_STATUS_NO_MEMORY);
1508 goto out;
1509 }
1510 } else {
1511 unsigned int i;
1512 maxentries = MIN(
1513 maxentries,
1514 ((BUFFER_SIZE -
1515 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1516 /DIR_STRUCT_SIZE));
1517
1518 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1519 directory,lp_dontdescend(SNUM(conn))));
1520 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1521 check_descend = True;
1522 }
1523
1524 for (i=numentries;(i<maxentries) && !finished;i++) {
1525 finished = !get_dir_entry(ctx,
1526 dirptr,
1527 mask,
1528 dirtype,
1529 &fname,
1530 &size,
1531 &mode,
1532 &date,
1533 check_descend,
1534 ask_sharemode);
1535 if (!finished) {
1536 char buf[DIR_STRUCT_SIZE];
1537 memcpy(buf,status,21);
1538 if (!make_dir_struct(ctx,
1539 buf,
1540 mask,
1541 fname,
1542 size,
1543 mode,
1544 convert_timespec_to_time_t(date),
1545 !allow_long_path_components)) {
1546 reply_nterror(req, NT_STATUS_NO_MEMORY);
1547 goto out;
1548 }
1549 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1550 break;
1551 }
1552 if (message_push_blob(&req->outbuf,
1553 data_blob_const(buf, sizeof(buf)))
1554 == -1) {
1555 reply_nterror(req, NT_STATUS_NO_MEMORY);
1556 goto out;
1557 }
1558 numentries++;
1559 }
1560 }
1561 }
1562
1563 SearchEmpty:
1564
1565 /* If we were called as SMBffirst with smb_search_id == NULL
1566 and no entries were found then return error and close dirptr
1567 (X/Open spec) */
1568
1569 if (numentries == 0) {
1570 dptr_close(sconn, &dptr_num);
1571 } else if(expect_close && status_len == 0) {
1572 /* Close the dptr - we know it's gone */
1573 dptr_close(sconn, &dptr_num);
1574 }
1575
1576 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1577 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1578 dptr_close(sconn, &dptr_num);
1579 }
1580
1581 if ((numentries == 0) && !mask_contains_wcard) {
1582 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1583 goto out;
1584 }
1585
1586 SSVAL(req->outbuf,smb_vwv0,numentries);
1587 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1588 SCVAL(smb_buf(req->outbuf),0,5);
1589 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1590
1591 /* The replies here are never long name. */
1592 SSVAL(req->outbuf, smb_flg2,
1593 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1594 if (!allow_long_path_components) {
1595 SSVAL(req->outbuf, smb_flg2,
1596 SVAL(req->outbuf, smb_flg2)
1597 & (~FLAGS2_LONG_PATH_COMPONENTS));
1598 }
1599
1600 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1601 SSVAL(req->outbuf, smb_flg2,
1602 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1603
1604 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1605 smb_fn_name(req->cmd),
1606 mask,
1607 directory,
1608 dirtype,
1609 numentries,
1610 maxentries ));
1611 out:
1612 TALLOC_FREE(directory);
1613 TALLOC_FREE(smb_fname);
1614 END_PROFILE(SMBsearch);
1615 return;
1616 }
1617
1618 /****************************************************************************
1619 Reply to a fclose (stop directory search).
1620 ****************************************************************************/
1621
1622 void reply_fclose(struct smb_request *req)
1623 {
1624 int status_len;
1625 char status[21];
1626 int dptr_num= -2;
1627 const char *p;
1628 char *path = NULL;
1629 NTSTATUS err;
1630 bool path_contains_wcard = False;
1631 TALLOC_CTX *ctx = talloc_tos();
1632 struct smbd_server_connection *sconn = smbd_server_conn;
1633
1634 START_PROFILE(SMBfclose);
1635
1636 if (lp_posix_pathnames()) {
1637 reply_unknown_new(req, req->cmd);
1638 END_PROFILE(SMBfclose);
1639 return;
1640 }
1641
1642 p = (const char *)req->buf + 1;
1643 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1644 &err, &path_contains_wcard);
1645 if (!NT_STATUS_IS_OK(err)) {
1646 reply_nterror(req, err);
1647 END_PROFILE(SMBfclose);
1648 return;
1649 }
1650 p++;
1651 status_len = SVAL(p,0);
1652 p += 2;
1653
1654 if (status_len == 0) {
1655 reply_force_doserror(req, ERRSRV, ERRsrverror);
1656 END_PROFILE(SMBfclose);
1657 return;
1658 }
1659
1660 memcpy(status,p,21);
1661
1662 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1663 /* Close the dptr - we know it's gone */
1664 dptr_close(sconn, &dptr_num);
1665 }
1666
1667 reply_outbuf(req, 1, 0);
1668 SSVAL(req->outbuf,smb_vwv0,0);
1669
1670 DEBUG(3,("search close\n"));
1671
1672 END_PROFILE(SMBfclose);
1673 return;
1674 }
1675
1676 /****************************************************************************
1677 Reply to an open.
1678 ****************************************************************************/
1679
1680 void reply_open(struct smb_request *req)
1681 {
1682 connection_struct *conn = req->conn;
1683 struct smb_filename *smb_fname = NULL;
1684 char *fname = NULL;
1685 uint32 fattr=0;
1686 SMB_OFF_T size = 0;
1687 time_t mtime=0;
1688 int info;
1689 files_struct *fsp;
1690 int oplock_request;
1691 int deny_mode;
1692 uint32 dos_attr;
1693 uint32 access_mask;
1694 uint32 share_mode;
1695 uint32 create_disposition;
1696 uint32 create_options = 0;
1697 uint32_t private_flags = 0;
1698 NTSTATUS status;
1699 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1700 TALLOC_CTX *ctx = talloc_tos();
1701
1702 START_PROFILE(SMBopen);
1703
1704 if (req->wct < 2) {
1705 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1706 goto out;
1707 }
1708
1709 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1710 deny_mode = SVAL(req->vwv+0, 0);
1711 dos_attr = SVAL(req->vwv+1, 0);
1712
1713 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1714 STR_TERMINATE, &status);
1715 if (!NT_STATUS_IS_OK(status)) {
1716 reply_nterror(req, status);
1717 goto out;
1718 }
1719
1720 status = filename_convert(ctx,
1721 conn,
1722 req->flags2 & FLAGS2_DFS_PATHNAMES,
1723 fname,
1724 0,
1725 NULL,
1726 &smb_fname);
1727 if (!NT_STATUS_IS_OK(status)) {
1728 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1729 reply_botherror(req,
1730 NT_STATUS_PATH_NOT_COVERED,
1731 ERRSRV, ERRbadpath);
1732 goto out;
1733 }
1734 reply_nterror(req, status);
1735 goto out;
1736 }
1737
1738 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1739 OPENX_FILE_EXISTS_OPEN, &access_mask,
1740 &share_mode, &create_disposition,
1741 &create_options, &private_flags)) {
1742 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1743 goto out;
1744 }
1745
1746 status = SMB_VFS_CREATE_FILE(
1747 conn, /* conn */
1748 req, /* req */
1749 0, /* root_dir_fid */
1750 smb_fname, /* fname */
1751 access_mask, /* access_mask */
1752 share_mode, /* share_access */
1753 create_disposition, /* create_disposition*/
1754 create_options, /* create_options */
1755 dos_attr, /* file_attributes */
1756 oplock_request, /* oplock_request */
1757 0, /* allocation_size */
1758 private_flags,
1759 NULL, /* sd */
1760 NULL, /* ea_list */
1761 &fsp, /* result */
1762 &info); /* pinfo */
1763
1764 if (!NT_STATUS_IS_OK(status)) {
1765 if (open_was_deferred(req->mid)) {
1766 /* We have re-scheduled this call. */
1767 goto out;
1768 }
1769 reply_openerror(req, status);
1770 goto out;
1771 }
1772
1773 size = smb_fname->st.st_ex_size;
1774 fattr = dos_mode(conn, smb_fname);
1775
1776 /* Deal with other possible opens having a modified
1777 write time. JRA. */
1778 if (ask_sharemode) {
1779 struct timespec write_time_ts;
1780
1781 ZERO_STRUCT(write_time_ts);
1782 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1783 if (!null_timespec(write_time_ts)) {
1784 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1785 }
1786 }
1787
1788 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1789
1790 if (fattr & aDIR) {
1791 DEBUG(3,("attempt to open a directory %s\n",
1792 fsp_str_dbg(fsp)));
1793 close_file(req, fsp, ERROR_CLOSE);
1794 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1795 ERRDOS, ERRnoaccess);
1796 goto out;
1797 }
1798
1799 reply_outbuf(req, 7, 0);
1800 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1801 SSVAL(req->outbuf,smb_vwv1,fattr);
1802 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1803 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1804 } else {
1805 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1806 }
1807 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1808 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1809
1810 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1811 SCVAL(req->outbuf,smb_flg,
1812 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1813 }
1814
1815 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1816 SCVAL(req->outbuf,smb_flg,
1817 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1818 }
1819 out:
1820 TALLOC_FREE(smb_fname);
1821 END_PROFILE(SMBopen);
1822 return;
1823 }
1824
1825 /****************************************************************************
1826 Reply to an open and X.
1827 ****************************************************************************/
1828
1829 void reply_open_and_X(struct smb_request *req)
1830 {
1831 connection_struct *conn = req->conn;
1832 struct smb_filename *smb_fname = NULL;
1833 char *fname = NULL;
1834 uint16 open_flags;
1835 int deny_mode;
1836 uint32 smb_attr;
1837 /* Breakout the oplock request bits so we can set the
1838 reply bits separately. */
1839 int ex_oplock_request;
1840 int core_oplock_request;
1841 int oplock_request;
1842 #if 0
1843 int smb_sattr = SVAL(req->vwv+4, 0);
1844 uint32 smb_time = make_unix_date3(req->vwv+6);
1845 #endif
1846 int smb_ofun;
1847 uint32 fattr=0;
1848 int mtime=0;
1849 int smb_action = 0;
1850 files_struct *fsp;
1851 NTSTATUS status;
1852 uint64_t allocation_size;
1853 ssize_t retval = -1;
1854 uint32 access_mask;
1855 uint32 share_mode;
1856 uint32 create_disposition;
1857 uint32 create_options = 0;
1858 uint32_t private_flags = 0;
1859 TALLOC_CTX *ctx = talloc_tos();
1860
1861 START_PROFILE(SMBopenX);
1862
1863 if (req->wct < 15) {
1864 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1865 goto out;
1866 }
1867
1868 open_flags = SVAL(req->vwv+2, 0);
1869 deny_mode = SVAL(req->vwv+3, 0);
1870 smb_attr = SVAL(req->vwv+5, 0);
1871 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1872 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1873 oplock_request = ex_oplock_request | core_oplock_request;
1874 smb_ofun = SVAL(req->vwv+8, 0);
1875 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1876
1877 /* If it's an IPC, pass off the pipe handler. */
1878 if (IS_IPC(conn)) {
1879 if (lp_nt_pipe_support()) {
1880 reply_open_pipe_and_X(conn, req);
1881 } else {
1882 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1883 }
1884 goto out;
1885 }
1886
1887 /* XXXX we need to handle passed times, sattr and flags */
1888 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1889 STR_TERMINATE, &status);
1890 if (!NT_STATUS_IS_OK(status)) {
1891 reply_nterror(req, status);
1892 goto out;
1893 }
1894
1895 status = filename_convert(ctx,
1896 conn,
1897 req->flags2 & FLAGS2_DFS_PATHNAMES,
1898 fname,
1899 0,
1900 NULL,
1901 &smb_fname);
1902 if (!NT_STATUS_IS_OK(status)) {
1903 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1904 reply_botherror(req,
1905 NT_STATUS_PATH_NOT_COVERED,
1906 ERRSRV, ERRbadpath);
1907 goto out;
1908 }
1909 reply_nterror(req, status);
1910 goto out;
1911 }
1912
1913 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1914 &access_mask, &share_mode,
1915 &create_disposition,
1916 &create_options,
1917 &private_flags)) {
1918 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1919 goto out;
1920 }
1921
1922 status = SMB_VFS_CREATE_FILE(
1923 conn, /* conn */
1924 req, /* req */
1925 0, /* root_dir_fid */
1926 smb_fname, /* fname */
1927 access_mask, /* access_mask */
1928 share_mode, /* share_access */
1929 create_disposition, /* create_disposition*/
1930 create_options, /* create_options */
1931 smb_attr, /* file_attributes */
1932 oplock_request, /* oplock_request */
1933 0, /* allocation_size */
1934 private_flags,
1935 NULL, /* sd */
1936 NULL, /* ea_list */
1937 &fsp, /* result */
1938 &smb_action); /* pinfo */
1939
1940 if (!NT_STATUS_IS_OK(status)) {
1941 if (open_was_deferred(req->mid)) {
1942 /* We have re-scheduled this call. */
1943 goto out;
1944 }
1945 reply_openerror(req, status);
1946 goto out;
1947 }
1948
1949 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1950 if the file is truncated or created. */
1951 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1952 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1953 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1954 close_file(req, fsp, ERROR_CLOSE);
1955 reply_nterror(req, NT_STATUS_DISK_FULL);
1956 goto out;
1957 }
1958 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1959 if (retval < 0) {
1960 close_file(req, fsp, ERROR_CLOSE);
1961 reply_nterror(req, NT_STATUS_DISK_FULL);
1962 goto out;
1963 }
1964 smb_fname->st.st_ex_size =
1965 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1966 }
1967
1968 fattr = dos_mode(conn, smb_fname);
1969 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1970 if (fattr & aDIR) {
1971 close_file(req, fsp, ERROR_CLOSE);
1972 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1973 goto out;
1974 }
1975
1976 /* If the caller set the extended oplock request bit
1977 and we granted one (by whatever means) - set the
1978 correct bit for extended oplock reply.
1979 */
1980
1981 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1982 smb_action |= EXTENDED_OPLOCK_GRANTED;
1983 }
1984
1985 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1986 smb_action |= EXTENDED_OPLOCK_GRANTED;
1987 }
1988
1989 /* If the caller set the core oplock request bit
1990 and we granted one (by whatever means) - set the
1991 correct bit for core oplock reply.
1992 */
1993
1994 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1995 reply_outbuf(req, 19, 0);
1996 } else {
1997 reply_outbuf(req, 15, 0);
1998 }
1999
2000 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2001 SCVAL(req->outbuf, smb_flg,
2002 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2003 }
2004
2005 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2006 SCVAL(req->outbuf, smb_flg,
2007 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2008 }
2009
2010 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2011 SSVAL(req->outbuf,smb_vwv3,fattr);
2012 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2013 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2014 } else {
2015 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2016 }
2017 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2018 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2019 SSVAL(req->outbuf,smb_vwv11,smb_action);
2020
2021 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2022 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2023 }
2024
2025 chain_reply(req);
2026 out:
2027 TALLOC_FREE(smb_fname);
2028 END_PROFILE(SMBopenX);
2029 return;
2030 }
2031
2032 /****************************************************************************
2033 Reply to a SMBulogoffX.
2034 ****************************************************************************/
2035
2036 void reply_ulogoffX(struct smb_request *req)
2037 {
2038 struct smbd_server_connection *sconn = smbd_server_conn;
2039 user_struct *vuser;
2040
2041 START_PROFILE(SMBulogoffX);
2042
2043 vuser = get_valid_user_struct(sconn, req->vuid);
2044
2045 if(vuser == NULL) {
2046 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2047 req->vuid));
2048 }
2049
2050 /* in user level security we are supposed to close any files
2051 open by this user */
2052 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2053 file_close_user(req->vuid);
2054 }
2055
2056 invalidate_vuid(sconn, req->vuid);
2057
2058 reply_outbuf(req, 2, 0);
2059
2060 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2061
2062 END_PROFILE(SMBulogoffX);
2063 req->vuid = UID_FIELD_INVALID;
2064 chain_reply(req);
2065 }
2066
2067 /****************************************************************************
2068 Reply to a mknew or a create.
2069 ****************************************************************************/
2070
2071 void reply_mknew(struct smb_request *req)
2072 {
2073 connection_struct *conn = req->conn;
2074 struct smb_filename *smb_fname = NULL;
2075 char *fname = NULL;
2076 uint32 fattr = 0;
2077 struct smb_file_time ft;
2078 files_struct *fsp;
2079 int oplock_request = 0;
2080 NTSTATUS status;
2081 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2082 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2083 uint32 create_disposition;
2084 uint32 create_options = 0;
2085 TALLOC_CTX *ctx = talloc_tos();
2086
2087 START_PROFILE(SMBcreate);
2088 ZERO_STRUCT(ft);
2089
2090 if (req->wct < 3) {
2091 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2092 goto out;
2093 }
2094
2095 fattr = SVAL(req->vwv+0, 0);
2096 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2097
2098 /* mtime. */
2099 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2100
2101 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2102 STR_TERMINATE, &status);
2103 if (!NT_STATUS_IS_OK(status)) {
2104 reply_nterror(req, status);
2105 goto out;
2106 }
2107
2108 status = filename_convert(ctx,
2109 conn,
2110 req->flags2 & FLAGS2_DFS_PATHNAMES,
2111 fname,
2112 0,
2113 NULL,
2114 &smb_fname);
2115 if (!NT_STATUS_IS_OK(status)) {
2116 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2117 reply_botherror(req,
2118 NT_STATUS_PATH_NOT_COVERED,
2119 ERRSRV, ERRbadpath);
2120 goto out;
2121 }
2122 reply_nterror(req, status);
2123 goto out;
2124 }
2125
2126 if (fattr & aVOLID) {
2127 DEBUG(0,("Attempt to create file (%s) with volid set - "
2128 "please report this\n",
2129 smb_fname_str_dbg(smb_fname)));
2130 }
2131
2132 if(req->cmd == SMBmknew) {
2133 /* We should fail if file exists. */
2134 create_disposition = FILE_CREATE;
2135 } else {
2136 /* Create if file doesn't exist, truncate if it does. */
2137 create_disposition = FILE_OVERWRITE_IF;
2138 }
2139
2140 status = SMB_VFS_CREATE_FILE(
2141 conn, /* conn */
2142 req, /* req */
2143 0, /* root_dir_fid */
2144 smb_fname, /* fname */
2145 access_mask, /* access_mask */
2146 share_mode, /* share_access */
2147 create_disposition, /* create_disposition*/
2148 create_options, /* create_options */
2149 fattr, /* file_attributes */
2150 oplock_request, /* oplock_request */
2151 0, /* allocation_size */
2152 0, /* private_flags */
2153 NULL, /* sd */
2154 NULL, /* ea_list */
2155 &fsp, /* result */
2156 NULL); /* pinfo */
2157
2158 if (!NT_STATUS_IS_OK(status)) {
2159 if (open_was_deferred(req->mid)) {
2160 /* We have re-scheduled this call. */
2161 goto out;
2162 }
2163 reply_openerror(req, status);
2164 goto out;
2165 }
2166
2167 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2168 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2169 if (!NT_STATUS_IS_OK(status)) {
2170 END_PROFILE(SMBcreate);
2171 goto out;
2172 }
2173
2174 reply_outbuf(req, 1, 0);
2175 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2176
2177 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2178 SCVAL(req->outbuf,smb_flg,
2179 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2180 }
2181
2182 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2183 SCVAL(req->outbuf,smb_flg,
2184 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2185 }
2186
2187 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2188 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2189 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2190 (unsigned int)fattr));
2191
2192 out:
2193 TALLOC_FREE(smb_fname);
2194 END_PROFILE(SMBcreate);
2195 return;
2196 }
2197
2198 /****************************************************************************
2199 Reply to a create temporary file.
2200 ****************************************************************************/
2201
2202 void reply_ctemp(struct smb_request *req)
2203 {
2204 connection_struct *conn = req->conn;
2205 struct smb_filename *smb_fname = NULL;
2206 char *fname = NULL;
2207 uint32 fattr;
2208 files_struct *fsp;
2209 int oplock_request;
2210 int tmpfd;
2211 char *s;
2212 NTSTATUS status;
2213 TALLOC_CTX *ctx = talloc_tos();
2214
2215 START_PROFILE(SMBctemp);
2216
2217 if (req->wct < 3) {
2218 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2219 goto out;
2220 }
2221
2222 fattr = SVAL(req->vwv+0, 0);
2223 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2224
2225 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2226 STR_TERMINATE, &status);
2227 if (!NT_STATUS_IS_OK(status)) {
2228 reply_nterror(req, status);
2229 goto out;
2230 }
2231 if (*fname) {
2232 fname = talloc_asprintf(ctx,
2233 "%s/TMXXXXXX",
2234 fname);
2235 } else {
2236 fname = talloc_strdup(ctx, "TMXXXXXX");
2237 }
2238
2239 if (!fname) {
2240 reply_nterror(req, NT_STATUS_NO_MEMORY);
2241 goto out;
2242 }
2243
2244 status = filename_convert(ctx, conn,
2245 req->flags2 & FLAGS2_DFS_PATHNAMES,
2246 fname,
2247 0,
2248 NULL,
2249 &smb_fname);
2250 if (!NT_STATUS_IS_OK(status)) {
2251 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2252 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2253 ERRSRV, ERRbadpath);
2254 goto out;
2255 }
2256 reply_nterror(req, status);
2257 goto out;
2258 }
2259
2260 tmpfd = mkstemp(smb_fname->base_name);
2261 if (tmpfd == -1) {
2262 reply_nterror(req, map_nt_error_from_unix(errno));
2263 goto out;
2264 }
2265
2266 SMB_VFS_STAT(conn, smb_fname);
2267
2268 /* We should fail if file does not exist. */
2269 status = SMB_VFS_CREATE_FILE(
2270 conn, /* conn */
2271 req, /* req */
2272 0, /* root_dir_fid */
2273 smb_fname, /* fname */
2274 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2275 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2276 FILE_OPEN, /* create_disposition*/
2277 0, /* create_options */
2278 fattr, /* file_attributes */
2279 oplock_request, /* oplock_request */
2280 0, /* allocation_size */
2281 0, /* private_flags */
2282 NULL, /* sd */
2283 NULL, /* ea_list */
2284 &fsp, /* result */
2285 NULL); /* pinfo */
2286
2287 /* close fd from mkstemp() */
2288 close(tmpfd);
2289
2290 if (!NT_STATUS_IS_OK(status)) {
2291 if (open_was_deferred(req->mid)) {
2292 /* We have re-scheduled this call. */
2293 goto out;
2294 }
2295 reply_openerror(req, status);
2296 goto out;
2297 }
2298
2299 reply_outbuf(req, 1, 0);
2300 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2301
2302 /* the returned filename is relative to the directory */
2303 s = strrchr_m(fsp->fsp_name->base_name, '/');
2304 if (!s) {
2305 s = fsp->fsp_name->base_name;
2306 } else {
2307 s++;
2308 }
2309
2310 #if 0
2311 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2312 thing in the byte section. JRA */
2313 SSVALS(p, 0, -1); /* what is this? not in spec */
2314 #endif
2315 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2316 == -1) {
2317 reply_nterror(req, NT_STATUS_NO_MEMORY);
2318 goto out;
2319 }
2320
2321 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2322 SCVAL(req->outbuf, smb_flg,
2323 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2324 }
2325
2326 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2327 SCVAL(req->outbuf, smb_flg,
2328 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2329 }
2330
2331 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2332 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2333 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2334 out:
2335 TALLOC_FREE(smb_fname);
2336 END_PROFILE(SMBctemp);
2337 return;
2338 }
2339
2340 /*******************************************************************
2341 Check if a user is allowed to rename a file.
2342 ********************************************************************/
2343
2344 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2345 uint16 dirtype)
2346 {
2347 uint32 fmode;
2348
2349 if (!CAN_WRITE(conn)) {
2350 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2351 }
2352
2353 fmode = dos_mode(conn, fsp->fsp_name);
2354 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2355 return NT_STATUS_NO_SUCH_FILE;
2356 }
2357
2358 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2359 if (fsp->posix_open) {
2360 return NT_STATUS_OK;
2361 }
2362
2363 /* If no pathnames are open below this
2364 directory, allow the rename. */
2365
2366 if (file_find_subpath(fsp)) {
2367 return NT_STATUS_ACCESS_DENIED;
2368 }
2369 return NT_STATUS_OK;
2370 }
2371
2372 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2373 return NT_STATUS_OK;
2374 }
2375
2376 return NT_STATUS_ACCESS_DENIED;
2377 }
2378
2379 /*******************************************************************
2380 * unlink a file with all relevant access checks
2381 *******************************************************************/
2382
2383 static NTSTATUS do_unlink(connection_struct *conn,
2384 struct smb_request *req,
2385 struct smb_filename *smb_fname,
2386 uint32 dirtype)
2387 {
2388 uint32 fattr;
2389 files_struct *fsp;
2390 uint32 dirtype_orig = dirtype;
2391 NTSTATUS status;
2392 int ret;
2393 bool posix_paths = lp_posix_pathnames();
2394
2395 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2396 smb_fname_str_dbg(smb_fname),
2397 dirtype));
2398
2399 if (!CAN_WRITE(conn)) {
2400 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2401 }
2402
2403 if (posix_paths) {
2404 ret = SMB_VFS_LSTAT(conn, smb_fname);
2405 } else {
2406 ret = SMB_VFS_STAT(conn, smb_fname);
2407 }
2408 if (ret != 0) {
2409 return map_nt_error_from_unix(errno);
2410 }
2411
2412 fattr = dos_mode(conn, smb_fname);
2413
2414 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2415 dirtype = aDIR|aARCH|aRONLY;
2416 }
2417
2418 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2419 if (!dirtype) {
2420 return NT_STATUS_NO_SUCH_FILE;
2421 }
2422
2423 if (!dir_check_ftype(conn, fattr, dirtype)) {
2424 if (fattr & aDIR) {
2425 return NT_STATUS_FILE_IS_A_DIRECTORY;
2426 }
2427 return NT_STATUS_NO_SUCH_FILE;
2428 }
2429
2430 if (dirtype_orig & 0x8000) {
2431 /* These will never be set for POSIX. */
2432 return NT_STATUS_NO_SUCH_FILE;
2433 }
2434
2435 #if 0
2436 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2437 return NT_STATUS_FILE_IS_A_DIRECTORY;
2438 }
2439
2440 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2441 return NT_STATUS_NO_SUCH_FILE;
2442 }
2443
2444 if (dirtype & 0xFF00) {
2445 /* These will never be set for POSIX. */
2446 return NT_STATUS_NO_SUCH_FILE;
2447 }
2448
2449 dirtype &= 0xFF;
2450 if (!dirtype) {
2451 return NT_STATUS_NO_SUCH_FILE;
2452 }
2453
2454 /* Can't delete a directory. */
2455 if (fattr & aDIR) {
2456 return NT_STATUS_FILE_IS_A_DIRECTORY;
2457 }
2458 #endif
2459
2460 #if 0 /* JRATEST */
2461 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2462 return NT_STATUS_OBJECT_NAME_INVALID;
2463 #endif /* JRATEST */
2464
2465 /* On open checks the open itself will check the share mode, so
2466 don't do it here as we'll get it wrong. */
2467
2468 status = SMB_VFS_CREATE_FILE
2469 (conn, /* conn */
2470 req, /* req */
2471 0, /* root_dir_fid */
2472 smb_fname, /* fname */
2473 DELETE_ACCESS, /* access_mask */
2474 FILE_SHARE_NONE, /* share_access */
2475 FILE_OPEN, /* create_disposition*/
2476 FILE_NON_DIRECTORY_FILE, /* create_options */
2477 /* file_attributes */
2478 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2479 FILE_ATTRIBUTE_NORMAL,
2480 0, /* oplock_request */
2481 0, /* allocation_size */
2482 0, /* private_flags */
2483 NULL, /* sd */
2484 NULL, /* ea_list */
2485 &fsp, /* result */
2486 NULL); /* pinfo */
2487
2488 if (!NT_STATUS_IS_OK(status)) {
2489 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2490 nt_errstr(status)));
2491 return status;
2492 }
2493
2494 status = can_set_delete_on_close(fsp, fattr);
2495 if (!NT_STATUS_IS_OK(status)) {
2496 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2497 "(%s)\n",
2498 smb_fname_str_dbg(smb_fname),
2499 nt_errstr(status)));
2500 close_file(req, fsp, NORMAL_CLOSE);
2501 return status;
2502 }
2503
2504 /* The set is across all open files on this dev/inode pair. */
2505 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2506 close_file(req, fsp, NORMAL_CLOSE);
2507 return NT_STATUS_ACCESS_DENIED;
2508 }
2509
2510 return close_file(req, fsp, NORMAL_CLOSE);
2511 }
2512
2513 /****************************************************************************
2514 The guts of the unlink command, split out so it may be called by the NT SMB
2515 code.
2516 ****************************************************************************/
2517
2518 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2519 uint32 dirtype, struct smb_filename *smb_fname,
2520 bool has_wild)
2521 {
2522 char *fname_dir = NULL;
2523 char *fname_mask = NULL;
2524 int count=0;
2525 NTSTATUS status = NT_STATUS_OK;
2526 TALLOC_CTX *ctx = talloc_tos();
2527
2528 /* Split up the directory from the filename/mask. */
2529 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2530 &fname_dir, &fname_mask);
2531 if (!NT_STATUS_IS_OK(status)) {
2532 goto out;
2533 }
2534
2535 /*
2536 * We should only check the mangled cache
2537 * here if unix_convert failed. This means
2538 * that the path in 'mask' doesn't exist
2539 * on the file system and so we need to look
2540 * for a possible mangle. This patch from
2541 * Tine Smukavec <valentin.smukavec@hermes.si>.
2542 */
2543
2544 if (!VALID_STAT(smb_fname->st) &&
2545 mangle_is_mangled(fname_mask, conn->params)) {
2546 char *new_mask = NULL;
2547 mangle_lookup_name_from_8_3(ctx, fname_mask,
2548 &new_mask, conn->params);
2549 if (new_mask) {
2550 TALLOC_FREE(fname_mask);
2551 fname_mask = new_mask;
2552 }
2553 }
2554
2555 if (!has_wild) {
2556
2557 /*
2558 * Only one file needs to be unlinked. Append the mask back
2559 * onto the directory.
2560 */
2561 TALLOC_FREE(smb_fname->base_name);
2562 smb_fname->base_name = talloc_asprintf(smb_fname,
2563 "%s/%s",
2564 fname_dir,
2565 fname_mask);
2566 if (!smb_fname->base_name) {
2567 status = NT_STATUS_NO_MEMORY;
2568 goto out;
2569 }
2570 if (dirtype == 0) {
2571 dirtype = FILE_ATTRIBUTE_NORMAL;
2572 }
2573
2574 status = check_name(conn, smb_fname->base_name);
2575 if (!NT_STATUS_IS_OK(status)) {
2576 goto out;
2577 }
2578
2579 status = do_unlink(conn, req, smb_fname, dirtype);
2580 if (!NT_STATUS_IS_OK(status)) {
2581 goto out;
2582 }
2583
2584 count++;
2585 } else {
2586 struct smb_Dir *dir_hnd = NULL;
2587 long offset = 0;
2588 const char *dname = NULL;
2589 char *talloced = NULL;
2590
2591 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2592 status = NT_STATUS_OBJECT_NAME_INVALID;
2593 goto out;
2594 }
2595
2596 if (strequal(fname_mask,"????????.???")) {
2597 TALLOC_FREE(fname_mask);
2598 fname_mask = talloc_strdup(ctx, "*");
2599 if (!fname_mask) {
2600 status = NT_STATUS_NO_MEMORY;
2601 goto out;
2602 }
2603 }
2604
2605 status = check_name(conn, fname_dir);
2606 if (!NT_STATUS_IS_OK(status)) {
2607 goto out;
2608 }
2609
2610 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2611 dirtype);
2612 if (dir_hnd == NULL) {
2613 status = map_nt_error_from_unix(errno);
2614 goto out;
2615 }
2616
2617 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2618 the pattern matches against the long name, otherwise the short name
2619 We don't implement this yet XXXX
2620 */
2621
2622 status = NT_STATUS_NO_SUCH_FILE;
2623
2624 while ((dname = ReadDirName(dir_hnd, &offset,
2625 &smb_fname->st, &talloced))) {
2626 TALLOC_CTX *frame = talloc_stackframe();
2627
2628 if (!is_visible_file(conn, fname_dir, dname,
2629 &smb_fname->st, true)) {
2630 TALLOC_FREE(frame);
2631 TALLOC_FREE(talloced);
2632 continue;
2633 }
2634
2635 /* Quick check for "." and ".." */
2636 if (ISDOT(dname) || ISDOTDOT(dname)) {
2637 TALLOC_FREE(frame);
2638 TALLOC_FREE(talloced);
2639 continue;
2640 }
2641
2642 if(!mask_match(dname, fname_mask,
2643 conn->case_sensitive)) {
2644 TALLOC_FREE(frame);
2645 TALLOC_FREE(talloced);
2646 continue;
2647 }
2648
2649 TALLOC_FREE(smb_fname->base_name);
2650 smb_fname->base_name =
2651 talloc_asprintf(smb_fname, "%s/%s",
2652 fname_dir, dname);
2653
2654 if (!smb_fname->base_name) {
2655 TALLOC_FREE(dir_hnd);
2656 status = NT_STATUS_NO_MEMORY;
2657 TALLOC_FREE(frame);
2658 TALLOC_FREE(talloced);
2659 goto out;
2660 }
2661
2662 status = check_name(conn, smb_fname->base_name);
2663 if (!NT_STATUS_IS_OK(status)) {
2664 TALLOC_FREE(dir_hnd);
2665 TALLOC_FREE(frame);
2666 TALLOC_FREE(talloced);
2667 goto out;
2668 }
2669
2670 status = do_unlink(conn, req, smb_fname, dirtype);
2671 if (!NT_STATUS_IS_OK(status)) {
2672 TALLOC_FREE(frame);
2673 TALLOC_FREE(talloced);
2674 continue;
2675 }
2676
2677 count++;
2678 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2679 smb_fname->base_name));
2680
2681 TALLOC_FREE(frame);
2682 TALLOC_FREE(talloced);
2683 }
2684 TALLOC_FREE(dir_hnd);
2685 }
2686
2687 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2688 status = map_nt_error_from_unix(errno);
2689 }
2690
2691 out:
2692 TALLOC_FREE(fname_dir);
2693 TALLOC_FREE(fname_mask);
2694 return status;
2695 }
2696
2697 /****************************************************************************
2698 Reply to a unlink
2699 ****************************************************************************/
2700
2701 void reply_unlink(struct smb_request *req)
2702 {
2703 connection_struct *conn = req->conn;
2704 char *name = NULL;
2705 struct smb_filename *smb_fname = NULL;
2706 uint32 dirtype;
2707 NTSTATUS status;
2708 bool path_contains_wcard = False;
2709 TALLOC_CTX *ctx = talloc_tos();
2710
2711 START_PROFILE(SMBunlink);
2712
2713 if (req->wct < 1) {
2714 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2715 goto out;
2716 }
2717
2718 dirtype = SVAL(req->vwv+0, 0);
2719
2720 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2721 STR_TERMINATE, &status,
2722 &path_contains_wcard);
2723 if (!NT_STATUS_IS_OK(status)) {
2724 reply_nterror(req, status);
2725 goto out;
2726 }
2727
2728 status = filename_convert(ctx, conn,
2729 req->flags2 & FLAGS2_DFS_PATHNAMES,
2730 name,
2731 UCF_COND_ALLOW_WCARD_LCOMP,
2732 &path_contains_wcard,
2733 &smb_fname);
2734 if (!NT_STATUS_IS_OK(status)) {
2735 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2736 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2737 ERRSRV, ERRbadpath);
2738 goto out;
2739 }
2740 reply_nterror(req, status);
2741 goto out;
2742 }
2743
2744 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2745
2746 status = unlink_internals(conn, req, dirtype, smb_fname,
2747 path_contains_wcard);
2748 if (!NT_STATUS_IS_OK(status)) {
2749 if (open_was_deferred(req->mid)) {
2750 /* We have re-scheduled this call. */
2751 goto out;
2752 }
2753 reply_nterror(req, status);
2754 goto out;
2755 }
2756
2757 reply_outbuf(req, 0, 0);
2758 out:
2759 TALLOC_FREE(smb_fname);
2760 END_PROFILE(SMBunlink);
2761 return;
2762 }
2763
2764 /****************************************************************************
2765 Fail for readbraw.
2766 ****************************************************************************/
2767
2768 static void fail_readraw(void)
2769 {
2770 const char *errstr = talloc_asprintf(talloc_tos(),
2771 "FAIL ! reply_readbraw: socket write fail (%s)",
2772 strerror(errno));
2773 if (!errstr) {
2774 errstr = "";
2775 }
2776 exit_server_cleanly(errstr);
2777 }
2778
2779 /****************************************************************************
2780 Fake (read/write) sendfile. Returns -1 on read or write fail.
2781 ****************************************************************************/
2782
2783 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2784 size_t nread)
2785 {
2786 size_t bufsize;
2787 size_t tosend = nread;
2788 char *buf;
2789
2790 if (nread == 0) {
2791 return 0;
2792 }
2793
2794 bufsize = MIN(nread, 65536);
2795
2796 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2797 return -1;
2798 }
2799
2800 while (tosend > 0) {
2801 ssize_t ret;
2802 size_t cur_read;
2803
2804 if (tosend > bufsize) {
2805 cur_read = bufsize;
2806 } else {
2807 cur_read = tosend;
2808 }
2809 ret = read_file(fsp,buf,startpos,cur_read);
2810 if (ret == -1) {
2811 SAFE_FREE(buf);
2812 return -1;
2813 }
2814
2815 /* If we had a short read, fill with zeros. */
2816 if (ret < cur_read) {
2817 memset(buf + ret, '\0', cur_read - ret);
2818 }
2819
2820 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2821 SAFE_FREE(buf);
2822 return -1;
2823 }
2824 tosend -= cur_read;
2825 startpos += cur_read;
2826 }
2827
2828 SAFE_FREE(buf);
2829 return (ssize_t)nread;
2830 }
2831
2832 #if defined(WITH_SENDFILE)
2833 /****************************************************************************
2834 Deal with the case of sendfile reading less bytes from the file than
2835 requested. Fill with zeros (all we can do).
2836 ****************************************************************************/
2837
2838 static void sendfile_short_send(files_struct *fsp,
2839 ssize_t nread,
2840 size_t headersize,
2841 size_t smb_maxcnt)
2842 {
2843 #define SHORT_SEND_BUFSIZE 1024
2844 if (nread < headersize) {
2845 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2846 "header for file %s (%s). Terminating\n",
2847 fsp_str_dbg(fsp), strerror(errno)));
2848 exit_server_cleanly("sendfile_short_send failed");
2849 }
2850
2851 nread -= headersize;
2852
2853 if (nread < smb_maxcnt) {
2854 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2855 if (!buf) {
2856 exit_server_cleanly("sendfile_short_send: "
2857 "malloc failed");
2858 }
2859
2860 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2861 "with zeros !\n", fsp_str_dbg(fsp)));
2862
2863 while (nread < smb_maxcnt) {
2864 /*
2865 * We asked for the real file size and told sendfile
2866 * to not go beyond the end of the file. But it can
2867 * happen that in between our fstat call and the
2868 * sendfile call the file was truncated. This is very
2869 * bad because we have already announced the larger
2870 * number of bytes to the client.
2871 *
2872 * The best we can do now is to send 0-bytes, just as
2873 * a read from a hole in a sparse file would do.
2874 *
2875 * This should happen rarely enough that I don't care
2876 * about efficiency here :-)
2877 */
2878 size_t to_write;
2879
2880 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2881 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2882 exit_server_cleanly("sendfile_short_send: "
2883 "write_data failed");
2884 }
2885 nread += to_write;
2886 }
2887 SAFE_FREE(buf);
2888 }
2889 }
2890 #endif /* defined WITH_SENDFILE */
2891
2892 /****************************************************************************
2893 Return a readbraw error (4 bytes of zero).
2894 ****************************************************************************/
2895
2896 static void reply_readbraw_error(void)
2897 {
2898 char header[4];
2899 SIVAL(header,0,0);
2900 if (write_data(smbd_server_fd(),header,4) != 4) {
2901 fail_readraw();
2902 }
2903 }
2904
2905 /****************************************************************************
2906 Use sendfile in readbraw.
2907 ****************************************************************************/
2908
2909 static void send_file_readbraw(connection_struct *conn,
2910 struct smb_request *req,
2911 files_struct *fsp,
2912 SMB_OFF_T startpos,
2913 size_t nread,
2914 ssize_t mincount)
2915 {
2916 char *outbuf = NULL;
2917 ssize_t ret=0;
2918
2919 #if defined(WITH_SENDFILE)
2920 /*
2921 * We can only use sendfile on a non-chained packet
2922 * but we can use on a non-oplocked file. tridge proved this
2923 * on a train in Germany :-). JRA.
2924 * reply_readbraw has already checked the length.
2925 */
2926
2927 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2928 (fsp->wcp == NULL) &&
2929 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2930 ssize_t sendfile_read = -1;
2931 char header[4];
2932 DATA_BLOB header_blob;
2933
2934 _smb_setlen(header,nread);
2935 header_blob = data_blob_const(header, 4);
2936
2937 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2938 &header_blob, startpos, nread)) == -1) {
2939 /* Returning ENOSYS means no data at all was sent.
2940 * Do this as a normal read. */
2941 if (errno == ENOSYS) {
2942 goto normal_readbraw;
2943 }
2944
2945 /*
2946 * Special hack for broken Linux with no working sendfile. If we
2947 * return EINTR we sent the header but not the rest of the data.
2948 * Fake this up by doing read/write calls.
2949 */
2950 if (errno == EINTR) {
2951 /* Ensure we don't do this again. */
2952 set_use_sendfile(SNUM(conn), False);
2953 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2954
2955 if (fake_sendfile(fsp, startpos, nread) == -1) {
2956 DEBUG(0,("send_file_readbraw: "
2957 "fake_sendfile failed for "
2958 "file %s (%s).\n",
2959 fsp_str_dbg(fsp),
2960 strerror(errno)));
2961 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2962 }
2963 return;
2964 }
2965
2966 DEBUG(0,("send_file_readbraw: sendfile failed for "
2967 "file %s (%s). Terminating\n",
2968 fsp_str_dbg(fsp), strerror(errno)));
2969 exit_server_cleanly("send_file_readbraw sendfile failed");
2970 } else if (sendfile_read == 0) {
2971 /*
2972 * Some sendfile implementations return 0 to indicate
2973 * that there was a short read, but nothing was
2974 * actually written to the socket. In this case,
2975 * fallback to the normal read path so the header gets
2976 * the correct byte count.
2977 */
2978 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2979 "bytes falling back to the normal read: "
2980 "%s\n", fsp_str_dbg(fsp)));
2981 goto normal_readbraw;
2982 }
2983
2984 /* Deal with possible short send. */
2985 if (sendfile_read != 4+nread) {
2986 sendfile_short_send(fsp, sendfile_read, 4, nread);
2987 }
2988 return;
2989 }
2990
2991 normal_readbraw:
2992 #endif
2993
2994 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2995 if (!outbuf) {
2996 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2997 (unsigned)(nread+4)));
2998 reply_readbraw_error();
2999 return;
3000 }
3001
3002 if (nread > 0) {
3003 ret = read_file(fsp,outbuf+4,startpos,nread);
3004 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3005 if (ret < mincount)
3006 ret = 0;
3007 #else
3008 if (ret < nread)
3009 ret = 0;
3010 #endif
3011 }
3012
3013 _smb_setlen(outbuf,ret);
3014 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3015 fail_readraw();
3016
3017 TALLOC_FREE(outbuf);
3018 }
3019
3020 /****************************************************************************
3021 Reply to a readbraw (core+ protocol).
3022 ****************************************************************************/
3023
3024 void reply_readbraw(struct smb_request *req)
3025 {
3026 connection_struct *conn = req->conn;
3027 ssize_t maxcount,mincount;
3028 size_t nread = 0;
3029 SMB_OFF_T startpos;
3030 files_struct *fsp;
3031 struct lock_struct lock;
3032 SMB_OFF_T size = 0;
3033
3034 START_PROFILE(SMBreadbraw);
3035
3036 if (srv_is_signing_active(smbd_server_conn) ||
3037 is_encrypted_packet(req->inbuf)) {
3038 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3039 "raw reads/writes are disallowed.");
3040 }
3041
3042 if (req->wct < 8) {
3043 reply_readbraw_error();
3044 END_PROFILE(SMBreadbraw);
3045 return;
3046 }
3047
3048 /*
3049 * Special check if an oplock break has been issued
3050 * and the readraw request croses on the wire, we must
3051 * return a zero length response here.
3052 */
3053
3054 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3055
3056 /*
3057 * We have to do a check_fsp by hand here, as
3058 * we must always return 4 zero bytes on error,
3059 * not a NTSTATUS.
3060 */
3061
3062 if (!fsp || !conn || conn != fsp->conn ||
3063 req->vuid != fsp->vuid ||
3064 fsp->is_directory || fsp->fh->fd == -1) {
3065 /*
3066 * fsp could be NULL here so use the value from the packet. JRA.
3067 */
3068 DEBUG(3,("reply_readbraw: fnum %d not valid "
3069 "- cache prime?\n",
3070 (int)SVAL(req->vwv+0, 0)));
3071 reply_readbraw_error();
3072 END_PROFILE(SMBreadbraw);
3073 return;
3074 }
3075
3076 /* Do a "by hand" version of CHECK_READ. */
3077 if (!(fsp->can_read ||
3078 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3079 (fsp->access_mask & FILE_EXECUTE)))) {
3080 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3081 (int)SVAL(req->vwv+0, 0)));
3082 reply_readbraw_error();
3083 END_PROFILE(SMBreadbraw);
3084 return;
3085 }
3086
3087 flush_write_cache(fsp, READRAW_FLUSH);
3088
3089 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3090 if(req->wct == 10) {
3091 /*
3092 * This is a large offset (64 bit) read.
3093 */
3094 #ifdef LARGE_SMB_OFF_T
3095
3096 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3097
3098 #else /* !LARGE_SMB_OFF_T */
3099
3100 /*
3101 * Ensure we haven't been sent a >32 bit offset.
3102 */
3103
3104 if(IVAL(req->vwv+8, 0) != 0) {
3105 DEBUG(0,("reply_readbraw: large offset "
3106 "(%x << 32) used and we don't support "
3107 "64 bit offsets.\n",
3108 (unsigned int)IVAL(req->vwv+8, 0) ));
3109 reply_readbraw_error();
3110 END_PROFILE(SMBreadbraw);
3111 return;
3112 }
3113
3114 #endif /* LARGE_SMB_OFF_T */
3115
3116 if(startpos < 0) {
3117 DEBUG(0,("reply_readbraw: negative 64 bit "
3118 "readraw offset (%.0f) !\n",
3119 (double)startpos ));
3120 reply_readbraw_error();
3121 END_PROFILE(SMBreadbraw);
3122 return;
3123 }
3124 }
3125
3126 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3127 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3128
3129 /* ensure we don't overrun the packet size */
3130 maxcount = MIN(65535,maxcount);
3131
3132 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3133 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3134 &lock);
3135
3136 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3137 reply_readbraw_error();
3138 END_PROFILE(SMBreadbraw);
3139 return;
3140 }
3141
3142 if (fsp_stat(fsp) == 0) {
3143 size = fsp->fsp_name->st.st_ex_size;
3144 }
3145
3146 if (startpos >= size) {
3147 nread = 0;
3148 } else {
3149 nread = MIN(maxcount,(size - startpos));
3150 }
3151
3152 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3153 if (nread < mincount)
3154 nread = 0;
3155 #endif
3156
3157 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3158 "min=%lu nread=%lu\n",
3159 fsp->fnum, (double)startpos,
3160 (unsigned long)maxcount,
3161 (unsigned long)mincount,
3162 (unsigned long)nread ) );
3163
3164 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3165
3166 DEBUG(5,("reply_readbraw finished\n"));
3167
3168 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3169
3170 END_PROFILE(SMBreadbraw);
3171 return;
3172 }
3173
3174 #undef DBGC_CLASS
3175 #define DBGC_CLASS DBGC_LOCKING
3176
3177 /****************************************************************************
3178 Reply to a lockread (core+ protocol).
3179 ****************************************************************************/
3180
3181 void reply_lockread(struct smb_request *req)
3182 {
3183 connection_struct *conn = req->conn;
3184 ssize_t nread = -1;
3185 char *data;
3186 SMB_OFF_T startpos;
3187 size_t numtoread;
3188 NTSTATUS status;
3189 files_struct *fsp;
3190 struct byte_range_lock *br_lck = NULL;
3191 char *p = NULL;
3192 struct smbd_server_connection *sconn = smbd_server_conn;
3193
3194 START_PROFILE(SMBlockread);
3195
3196 if (req->wct < 5) {
3197 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3198 END_PROFILE(SMBlockread);
3199 return;
3200 }
3201
3202 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3203
3204 if (!check_fsp(conn, req, fsp)) {
3205 END_PROFILE(SMBlockread);
3206 return;
3207 }
3208
3209 if (!CHECK_READ(fsp,req)) {
3210 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3211 END_PROFILE(SMBlockread);
3212 return;
3213 }
3214
3215 numtoread = SVAL(req->vwv+1, 0);
3216 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3217
3218 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3219
3220 reply_outbuf(req, 5, numtoread + 3);
3221
3222 data = smb_buf(req->outbuf) + 3;
3223
3224 /*
3225 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3226 * protocol request that predates the read/write lock concept.
3227 * Thus instead of asking for a read lock here we need to ask
3228 * for a write lock. JRA.
3229 * Note that the requested lock size is unaffected by max_recv.
3230 */
3231
3232 br_lck = do_lock(smbd_messaging_context(),
3233 fsp,
3234 req->smbpid,
3235 (uint64_t)numtoread,
3236 (uint64_t)startpos,
3237 WRITE_LOCK,
3238 WINDOWS_LOCK,
3239 False, /* Non-blocking lock. */
3240 &status,
3241 NULL,
3242 NULL);
3243 TALLOC_FREE(br_lck);
3244
3245 if (NT_STATUS_V(status)) {
3246 reply_nterror(req, status);
3247 END_PROFILE(SMBlockread);
3248 return;
3249 }
3250
3251 /*
3252 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3253 */
3254
3255 if (numtoread > sconn->smb1.negprot.max_recv) {
3256 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3257 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3258 (unsigned int)numtoread,
3259 (unsigned int)sconn->smb1.negprot.max_recv));
3260 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3261 }
3262 nread = read_file(fsp,data,startpos,numtoread);
3263
3264 if (nread < 0) {
3265 reply_nterror(req, map_nt_error_from_unix(errno));
3266 END_PROFILE(SMBlockread);
3267 return;
3268 }
3269
3270 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3271
3272 SSVAL(req->outbuf,smb_vwv0,nread);
3273 SSVAL(req->outbuf,smb_vwv5,nread+3);
3274 p = smb_buf(req->outbuf);
3275 SCVAL(p,0,0); /* pad byte. */
3276 SSVAL(p,1,nread);
3277
3278 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3279 fsp->fnum, (int)numtoread, (int)nread));
3280
3281 END_PROFILE(SMBlockread);
3282 return;
3283 }
3284
3285 #undef DBGC_CLASS
3286 #define DBGC_CLASS DBGC_ALL
3287
3288 /****************************************************************************
3289 Reply to a read.
3290 ****************************************************************************/
3291
3292 void reply_read(struct smb_request *req)
3293 {
3294 connection_struct *conn = req->conn;
3295 size_t numtoread;
3296 ssize_t nread = 0;
3297 char *data;
3298 SMB_OFF_T startpos;
3299 int outsize = 0;
3300 files_struct *fsp;
3301 struct lock_struct lock;
3302 struct smbd_server_connection *sconn = smbd_server_conn;
3303
3304 START_PROFILE(SMBread);
3305
3306 if (req->wct < 3) {
3307 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3308 END_PROFILE(SMBread);
3309 return;
3310 }
3311
3312 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3313
3314 if (!check_fsp(conn, req, fsp)) {
3315 END_PROFILE(SMBread);
3316 return;
3317 }
3318
3319 if (!CHECK_READ(fsp,req)) {
3320 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3321 END_PROFILE(SMBread);
3322 return;
3323 }
3324
3325 numtoread = SVAL(req->vwv+1, 0);
3326 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3327
3328 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3329
3330 /*
3331 * The requested read size cannot be greater than max_recv. JRA.
3332 */
3333 if (numtoread > sconn->smb1.negprot.max_recv) {
3334 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3335 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3336 (unsigned int)numtoread,
3337 (unsigned int)sconn->smb1.negprot.max_recv));
3338 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3339 }
3340
3341 reply_outbuf(req, 5, numtoread+3);
3342
3343 data = smb_buf(req->outbuf) + 3;
3344
3345 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3346 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3347 &lock);
3348
3349 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3350 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3351 END_PROFILE(SMBread);
3352 return;
3353 }
3354
3355 if (numtoread > 0)
3356 nread = read_file(fsp,data,startpos,numtoread);
3357
3358 if (nread < 0) {
3359 reply_nterror(req, map_nt_error_from_unix(errno));
3360 goto strict_unlock;
3361 }
3362
3363 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3364
3365 SSVAL(req->outbuf,smb_vwv0,nread);
3366 SSVAL(req->outbuf,smb_vwv5,nread+3);
3367 SCVAL(smb_buf(req->outbuf),0,1);
3368 SSVAL(smb_buf(req->outbuf),1,nread);
3369
3370 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3371 fsp->fnum, (int)numtoread, (int)nread ) );
3372
3373 strict_unlock:
3374 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3375
3376 END_PROFILE(SMBread);
3377 return;
3378 }
3379
3380 /****************************************************************************
3381 Setup readX header.
3382 ****************************************************************************/
3383
3384 static int setup_readX_header(struct smb_request *req, char *outbuf,
3385 size_t smb_maxcnt)
3386 {
3387 int outsize;
3388 char *data;
3389
3390 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3391 data = smb_buf(outbuf);
3392
3393 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3394
3395 SCVAL(outbuf,smb_vwv0,0xFF);
3396 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3397 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3398 SSVAL(outbuf,smb_vwv6,
3399 req_wct_ofs(req)
3400 + 1 /* the wct field */
3401 + 12 * sizeof(uint16_t) /* vwv */
3402 + 2); /* the buflen field */
3403 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3404 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3405 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3406 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3407 return outsize;
3408 }
3409
3410 /****************************************************************************
3411 Reply to a read and X - possibly using sendfile.
3412 ****************************************************************************/
3413
3414 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3415 files_struct *fsp, SMB_OFF_T startpos,
3416 size_t smb_maxcnt)
3417 {
3418 ssize_t nread = -1;
3419 struct lock_struct lock;
3420 int saved_errno = 0;
3421
3422 if(fsp_stat(fsp) == -1) {
3423 reply_nterror(req, map_nt_error_from_unix(errno));
3424 return;
3425 }
3426
3427 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3428 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3429 &lock);
3430
3431 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3432 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3433 return;
3434 }
3435
3436 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3437 (startpos > fsp->fsp_name->st.st_ex_size)
3438 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3439 /*
3440 * We already know that we would do a short read, so don't
3441 * try the sendfile() path.
3442 */
3443 goto nosendfile_read;
3444 }
3445
3446 #if defined(WITH_SENDFILE)
3447 /*
3448 * We can only use sendfile on a non-chained packet
3449 * but we can use on a non-oplocked file. tridge proved this
3450 * on a train in Germany :-). JRA.
3451 */
3452
3453 if (!req_is_in_chain(req) &&
3454 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3455 (fsp->wcp == NULL) &&
3456 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3457 uint8 headerbuf[smb_size + 12 * 2];
3458 DATA_BLOB header;
3459
3460 /*
3461 * Set up the packet header before send. We
3462 * assume here the sendfile will work (get the
3463 * correct amount of data).
3464 */
3465
3466 header = data_blob_const(headerbuf, sizeof(headerbuf));
3467
3468 construct_reply_common_req(req, (char *)headerbuf);
3469 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3470
3471 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3472 /* Returning ENOSYS means no data at all was sent.
3473 Do this as a normal read. */
3474 if (errno == ENOSYS) {
3475 goto normal_read;
3476 }
3477
3478 /*
3479 * Special hack for broken Linux with no working sendfile. If we
3480 * return EINTR we sent the header but not the rest of the data.
3481 * Fake this up by doing read/write calls.
3482 */
3483
3484 if (errno == EINTR) {
3485 /* Ensure we don't do this again. */
3486 set_use_sendfile(SNUM(conn), False);
3487 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3488 nread = fake_sendfile(fsp, startpos,
3489 smb_maxcnt);
3490 if (nread == -1) {
3491 DEBUG(0,("send_file_readX: "
3492 "fake_sendfile failed for "
3493 "file %s (%s).\n",
3494 fsp_str_dbg(fsp),
3495 strerror(errno)));
3496 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3497 }
3498 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3499 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3500 /* No outbuf here means successful sendfile. */
3501 goto strict_unlock;
3502 }
3503
3504 DEBUG(0,("send_file_readX: sendfile failed for file "
3505 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3506 strerror(errno)));
3507 exit_server_cleanly("send_file_readX sendfile failed");
3508 } else if (nread == 0) {
3509 /*
3510 * Some sendfile implementations return 0 to indicate
3511 * that there was a short read, but nothing was
3512 * actually written to the socket. In this case,
3513 * fallback to the normal read path so the header gets
3514 * the correct byte count.
3515 */
3516 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3517 "falling back to the normal read: %s\n",
3518 fsp_str_dbg(fsp)));
3519 goto normal_read;
3520 }
3521
3522 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3523 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3524
3525 /* Deal with possible short send. */
3526 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3527 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3528 }
3529 /* No outbuf here means successful sendfile. */
3530 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3531 SMB_PERFCOUNT_END(&req->pcd);
3532 goto strict_unlock;
3533 }
3534
3535 normal_read:
3536
3537 #endif
3538
3539 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3540 uint8 headerbuf[smb_size + 2*12];
3541
3542 construct_reply_common_req(req, (char *)headerbuf);
3543 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3544
3545 /* Send out the header. */
3546 if (write_data(smbd_server_fd(), (char *)headerbuf,
3547 sizeof(headerbuf)) != sizeof(headerbuf)) {
3548 DEBUG(0,("send_file_readX: write_data failed for file "
3549 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3550 strerror(errno)));
3551 exit_server_cleanly("send_file_readX sendfile failed");
3552 }
3553 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3554 if (nread == -1) {
3555 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3556 "file %s (%s).\n", fsp_str_dbg(fsp),
3557 strerror(errno)));
3558 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3559 }
3560 goto strict_unlock;
3561 }
3562
3563 nosendfile_read:
3564
3565 reply_outbuf(req, 12, smb_maxcnt);
3566
3567 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3568 saved_errno = errno;
3569
3570 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3571
3572 if (nread < 0) {
3573 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3574 return;
3575 }
3576
3577 setup_readX_header(req, (char *)req->outbuf, nread);
3578
3579 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3580 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3581
3582 chain_reply(req);
3583 return;
3584
3585 strict_unlock:
3586 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3587 TALLOC_FREE(req->outbuf);
3588 return;
3589 }
3590
3591 /****************************************************************************
3592 Reply to a read and X.
3593 ****************************************************************************/
3594
3595 void reply_read_and_X(struct smb_request *req)
3596 {
3597 connection_struct *conn = req->conn;
3598 files_struct *fsp;
3599 SMB_OFF_T startpos;
3600 size_t smb_maxcnt;
3601 bool big_readX = False;
3602 #if 0
3603 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3604 #endif
3605
3606 START_PROFILE(SMBreadX);
3607
3608 if ((req->wct != 10) && (req->wct != 12)) {
3609 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3610 return;
3611 }
3612
3613 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3614 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3615 smb_maxcnt = SVAL(req->vwv+5, 0);
3616
3617 /* If it's an IPC, pass off the pipe handler. */
3618 if (IS_IPC(conn)) {
3619 reply_pipe_read_and_X(req);
3620 END_PROFILE(SMBreadX);
3621 return;
3622 }
3623
3624 if (!check_fsp(conn, req, fsp)) {
3625 END_PROFILE(SMBreadX);
3626 return;
3627 }
3628
3629 if (!CHECK_READ(fsp,req)) {
3630 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3631 END_PROFILE(SMBreadX);
3632 return;
3633 }
3634
3635 if (global_client_caps & CAP_LARGE_READX) {
3636 size_t upper_size = SVAL(req->vwv+7, 0);
3637 smb_maxcnt |= (upper_size<<16);
3638 if (upper_size > 1) {
3639 /* Can't do this on a chained packet. */
3640 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3641 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3642 END_PROFILE(SMBreadX);
3643 return;
3644 }
3645 /* We currently don't do this on signed or sealed data. */
3646 if (srv_is_signing_active(smbd_server_conn) ||
3647 is_encrypted_packet(req->inbuf)) {
3648 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3649 END_PROFILE(SMBreadX);
3650 return;
3651 }
3652 /* Is there room in the reply for this data ? */
3653 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3654 reply_nterror(req,
3655 NT_STATUS_INVALID_PARAMETER);
3656 END_PROFILE(SMBreadX);
3657 return;
3658 }
3659 big_readX = True;
3660 }
3661 }
3662
3663 if (req->wct == 12) {
3664 #ifdef LARGE_SMB_OFF_T
3665 /*
3666 * This is a large offset (64 bit) read.
3667 */
3668 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3669
3670 #else /* !LARGE_SMB_OFF_T */
3671
3672 /*
3673 * Ensure we haven't been sent a >32 bit offset.
3674 */
3675
3676 if(IVAL(req->vwv+10, 0) != 0) {
3677 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3678 "used and we don't support 64 bit offsets.\n",
3679 (unsigned int)IVAL(req->vwv+10, 0) ));
3680 END_PROFILE(SMBreadX);
3681 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3682 return;
3683 }
3684
3685 #endif /* LARGE_SMB_OFF_T */
3686
3687 }
3688
3689 if (!big_readX &&
3690 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3691 goto out;
3692 }
3693
3694 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3695
3696 out:
3697 END_PROFILE(SMBreadX);
3698 return;
3699 }
3700
3701 /****************************************************************************
3702 Error replies to writebraw must have smb_wct == 1. Fix this up.
3703 ****************************************************************************/
3704
3705 void error_to_writebrawerr(struct smb_request *req)
3706 {
3707 uint8 *old_outbuf = req->outbuf;
3708
3709 reply_outbuf(req, 1, 0);
3710
3711 memcpy(req->outbuf, old_outbuf, smb_size);
3712 TALLOC_FREE(old_outbuf);
3713 }
3714
3715 /****************************************************************************
3716 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3717 ****************************************************************************/
3718
3719 void reply_writebraw(struct smb_request *req)
3720 {
3721 connection_struct *conn = req->conn;
3722 char *buf = NULL;
3723 ssize_t nwritten=0;
3724 ssize_t total_written=0;
3725 size_t numtowrite=0;
3726 size_t tcount;
3727 SMB_OFF_T startpos;
3728 char *data=NULL;
3729 bool write_through;
3730 files_struct *fsp;
3731 struct lock_struct lock;
3732 NTSTATUS status;
3733
3734 START_PROFILE(SMBwritebraw);
3735
3736 /*
3737 * If we ever reply with an error, it must have the SMB command
3738 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3739 * we're finished.
3740 */
3741 SCVAL(req->inbuf,smb_com,SMBwritec);
3742
3743 if (srv_is_signing_active(smbd_server_conn)) {
3744 END_PROFILE(SMBwritebraw);
3745 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3746 "raw reads/writes are disallowed.");
3747 }
3748
3749 if (req->wct < 12) {
3750 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3751 error_to_writebrawerr(req);
3752 END_PROFILE(SMBwritebraw);
3753 return;
3754 }
3755
3756 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3757 if (!check_fsp(conn, req, fsp)) {
3758 error_to_writebrawerr(req);
3759 END_PROFILE(SMBwritebraw);
3760 return;
3761 }
3762
3763 if (!CHECK_WRITE(fsp)) {
3764 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3765 error_to_writebrawerr(req);
3766 END_PROFILE(SMBwritebraw);
3767 return;
3768 }
3769
3770 tcount = IVAL(req->vwv+1, 0);
3771 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3772 write_through = BITSETW(req->vwv+7,0);
3773
3774 /* We have to deal with slightly different formats depending
3775 on whether we are using the core+ or lanman1.0 protocol */
3776
3777 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3778 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3779 data = smb_buf(req->inbuf);
3780 } else {
3781 numtowrite = SVAL(req->vwv+10, 0);
3782 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3783 }
3784
3785 /* Ensure we don't write bytes past the end of this packet. */
3786 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3787 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3788 error_to_writebrawerr(req);
3789 END_PROFILE(SMBwritebraw);
3790 return;
3791 }
3792
3793 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3794 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3795 &lock);
3796
3797 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3798 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3799 error_to_writebrawerr(req);
3800 END_PROFILE(SMBwritebraw);
3801 return;
3802 }
3803
3804 if (numtowrite>0) {
3805 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3806 }
3807
3808 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3809 "wrote=%d sync=%d\n",
3810 fsp->fnum, (double)startpos, (int)numtowrite,
3811 (int)nwritten, (int)write_through));
3812
3813 if (nwritten < (ssize_t)numtowrite) {
3814 reply_nterror(req, NT_STATUS_DISK_FULL);
3815 error_to_writebrawerr(req);
3816 goto strict_unlock;
3817 }
3818
3819 total_written = nwritten;
3820
3821 /* Allocate a buffer of 64k + length. */
3822 buf = TALLOC_ARRAY(NULL, char, 65540);
3823 if (!buf) {
3824 reply_nterror(req, NT_STATUS_NO_MEMORY);
3825 error_to_writebrawerr(req);
3826 goto strict_unlock;
3827 }
3828
3829 /* Return a SMBwritebraw message to the redirector to tell
3830 * it to send more bytes */
3831
3832 memcpy(buf, req->inbuf, smb_size);
3833 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3834 SCVAL(buf,smb_com,SMBwritebraw);
3835 SSVALS(buf,smb_vwv0,0xFFFF);
3836 show_msg(buf);
3837 if (!srv_send_smb(smbd_server_fd(),
3838 buf,
3839 false, 0, /* no signing */
3840 IS_CONN_ENCRYPTED(conn),
3841 &req->pcd)) {
3842 exit_server_cleanly("reply_writebraw: srv_send_smb "
3843 "failed.");
3844 }
3845
3846 /* Now read the raw data into the buffer and write it */
3847 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3848 &numtowrite);
3849 if (!NT_STATUS_IS_OK(status)) {
3850 exit_server_cleanly("secondary writebraw failed");
3851 }
3852
3853 /* Set up outbuf to return the correct size */
3854 reply_outbuf(req, 1, 0);
3855
3856 if (numtowrite != 0) {
3857
3858 if (numtowrite > 0xFFFF) {
3859 DEBUG(0,("reply_writebraw: Oversize secondary write "
3860 "raw requested (%u). Terminating\n",
3861 (unsigned int)numtowrite ));
3862 exit_server_cleanly("secondary writebraw failed");
3863 }
3864
3865 if (tcount > nwritten+numtowrite) {
3866 DEBUG(3,("reply_writebraw: Client overestimated the "
3867 "write %d %d %d\n",
3868 (int)tcount,(int)nwritten,(int)numtowrite));
3869 }
3870
3871 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3872
3873 if (!NT_STATUS_IS_OK(status)) {
3874 DEBUG(0,("reply_writebraw: Oversize secondary write "
3875 "raw read failed (%s). Terminating\n",
3876 nt_errstr(status)));
3877 exit_server_cleanly("secondary writebraw failed");
3878 }
3879
3880 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3881 if (nwritten == -1) {
3882 TALLOC_FREE(buf);
3883 reply_nterror(req, map_nt_error_from_unix(errno));
3884 error_to_writebrawerr(req);
3885 goto strict_unlock;
3886 }
3887
3888 if (nwritten < (ssize_t)numtowrite) {
3889 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3890 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3891 }
3892
3893 if (nwritten > 0) {
3894 total_written += nwritten;
3895 }
3896 }
3897
3898 TALLOC_FREE(buf);
3899 SSVAL(req->outbuf,smb_vwv0,total_written);
3900
3901 status = sync_file(conn, fsp, write_through);
3902 if (!NT_STATUS_IS_OK(status)) {
3903 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3904 fsp_str_dbg(fsp), nt_errstr(status)));
3905 reply_nterror(req, status);
3906 error_to_writebrawerr(req);
3907 goto strict_unlock;
3908 }
3909
3910 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3911 "wrote=%d\n",
3912 fsp->fnum, (double)startpos, (int)numtowrite,
3913 (int)total_written));
3914
3915 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3916
3917 /* We won't return a status if write through is not selected - this
3918 * follows what WfWg does */
3919 END_PROFILE(SMBwritebraw);
3920
3921 if (!write_through && total_written==tcount) {
3922
3923 #if RABBIT_PELLET_FIX
3924 /*
3925 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3926 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3927 * JRA.
3928 */
3929 if (!send_keepalive(smbd_server_fd())) {
3930 exit_server_cleanly("reply_writebraw: send of "
3931 "keepalive failed");
3932 }
3933 #endif
3934 TALLOC_FREE(req->outbuf);
3935 }
3936 return;
3937
3938 strict_unlock:
3939 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3940
3941 END_PROFILE(SMBwritebraw);
3942 return;
3943 }
3944
3945 #undef DBGC_CLASS
3946 #define DBGC_CLASS DBGC_LOCKING
3947
3948 /****************************************************************************
3949 Reply to a writeunlock (core+).
3950 ****************************************************************************/
3951
3952 void reply_writeunlock(struct smb_request *req)
3953 {
3954 connection_struct *conn = req->conn;
3955 ssize_t nwritten = -1;
3956 size_t numtowrite;
3957 SMB_OFF_T startpos;
3958 const char *data;
3959 NTSTATUS status = NT_STATUS_OK;
3960 files_struct *fsp;
3961 struct lock_struct lock;
3962 int saved_errno = 0;
3963
3964 START_PROFILE(SMBwriteunlock);
3965
3966 if (req->wct < 5) {
3967 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3968 END_PROFILE(SMBwriteunlock);
3969 return;
3970 }
3971
3972 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3973
3974 if (!check_fsp(conn, req, fsp)) {
3975 END_PROFILE(SMBwriteunlock);
3976 return;
3977 }
3978
3979 if (!CHECK_WRITE(fsp)) {
3980 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3981 END_PROFILE(SMBwriteunlock);
3982 return;
3983 }
3984
3985 numtowrite = SVAL(req->vwv+1, 0);
3986 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3987 data = (const char *)req->buf + 3;
3988
3989 if (numtowrite) {
3990 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3991 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3992 &lock);
3993
3994 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3995 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3996 END_PROFILE(SMBwriteunlock);
3997 return;
3998 }
3999 }
4000
4001 /* The special X/Open SMB protocol handling of
4002 zero length writes is *NOT* done for
4003 this call */
4004 if(numtowrite == 0) {
4005 nwritten = 0;
4006 } else {
4007 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4008 saved_errno = errno;
4009 }
4010
4011 status = sync_file(conn, fsp, False /* write through */);
4012 if (!NT_STATUS_IS_OK(status)) {
4013 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4014 fsp_str_dbg(fsp), nt_errstr(status)));
4015 reply_nterror(req, status);
4016 goto strict_unlock;
4017 }
4018
4019 if(nwritten < 0) {
4020 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4021 goto strict_unlock;
4022 }
4023
4024 if((nwritten < numtowrite) && (numtowrite != 0)) {
4025 reply_nterror(req, NT_STATUS_DISK_FULL);
4026 goto strict_unlock;
4027 }
4028
4029 if (numtowrite) {
4030 status = do_unlock(smbd_messaging_context(),
4031 fsp,
4032 req->smbpid,
4033 (uint64_t)numtowrite,
4034 (uint64_t)startpos,
4035 WINDOWS_LOCK);
4036
4037 if (NT_STATUS_V(status)) {
4038 reply_nterror(req, status);
4039 goto strict_unlock;
4040 }
4041 }
4042
4043 reply_outbuf(req, 1, 0);
4044
4045 SSVAL(req->outbuf,smb_vwv0,nwritten);
4046
4047 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4048 fsp->fnum, (int)numtowrite, (int)nwritten));
4049
4050 strict_unlock:
4051 if (numtowrite) {
4052 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4053 }
4054
4055 END_PROFILE(SMBwriteunlock);
4056 return;
4057 }
4058
4059 #undef DBGC_CLASS
4060 #define DBGC_CLASS DBGC_ALL
4061
4062 /****************************************************************************
4063 Reply to a write.
4064 ****************************************************************************/
4065
4066 void reply_write(struct smb_request *req)
4067 {
4068 connection_struct *conn = req->conn;
4069 size_t numtowrite;
4070 ssize_t nwritten = -1;
4071 SMB_OFF_T startpos;
4072 const char *data;
4073 files_struct *fsp;
4074 struct lock_struct lock;
4075 NTSTATUS status;
4076 int saved_errno = 0;
4077
4078 START_PROFILE(SMBwrite);
4079
4080 if (req->wct < 5) {
4081 END_PROFILE(SMBwrite);
4082 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4083 return;
4084 }
4085
4086 /* If it's an IPC, pass off the pipe handler. */
4087 if (IS_IPC(conn)) {
4088 reply_pipe_write(req);
4089 END_PROFILE(SMBwrite);
4090 return;
4091 }
4092
4093 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4094
4095 if (!check_fsp(conn, req, fsp)) {
4096 END_PROFILE(SMBwrite);
4097 return;
4098 }
4099
4100 if (!CHECK_WRITE(fsp)) {
4101 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4102 END_PROFILE(SMBwrite);
4103 return;
4104 }
4105
4106 numtowrite = SVAL(req->vwv+1, 0);
4107 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4108 data = (const char *)req->buf + 3;
4109
4110 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4111 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4112 &lock);
4113
4114 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4115 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4116 END_PROFILE(SMBwrite);
4117 return;
4118 }
4119
4120 /*
4121 * X/Open SMB protocol says that if smb_vwv1 is
4122 * zero then the file size should be extended or
4123 * truncated to the size given in smb_vwv[2-3].
4124 */
4125
4126 if(numtowrite == 0) {
4127 /*
4128 * This is actually an allocate call, and set EOF. JRA.
4129 */
4130 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4131 if (nwritten < 0) {
4132 reply_nterror(req, NT_STATUS_DISK_FULL);
4133 goto strict_unlock;
4134 }
4135 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4136 if (nwritten < 0) {
4137 reply_nterror(req, NT_STATUS_DISK_FULL);
4138 goto strict_unlock;
4139 }
4140 trigger_write_time_update_immediate(fsp);
4141 } else {
4142 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4143 }
4144
4145 status = sync_file(conn, fsp, False);
4146 if (!NT_STATUS_IS_OK(status)) {
4147 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4148 fsp_str_dbg(fsp), nt_errstr(status)));
4149 reply_nterror(req, status);
4150 goto strict_unlock;
4151 }
4152
4153 if(nwritten < 0) {
4154 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4155 goto strict_unlock;
4156 }
4157
4158 if((nwritten == 0) && (numtowrite != 0)) {
4159 reply_nterror(req, NT_STATUS_DISK_FULL);
4160 goto strict_unlock;
4161 }
4162
4163 reply_outbuf(req, 1, 0);
4164
4165 SSVAL(req->outbuf,smb_vwv0,nwritten);
4166
4167 if (nwritten < (ssize_t)numtowrite) {
4168 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4169 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4170 }
4171
4172 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4173
4174 strict_unlock:
4175 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4176
4177 END_PROFILE(SMBwrite);
4178 return;
4179 }
4180
4181 /****************************************************************************
4182 Ensure a buffer is a valid writeX for recvfile purposes.
4183 ****************************************************************************/
4184
4185 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4186 (2*14) + /* word count (including bcc) */ \
4187 1 /* pad byte */)
4188
4189 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4190 {
4191 size_t numtowrite;
4192 connection_struct *conn = NULL;
4193 unsigned int doff = 0;
4194 size_t len = smb_len_large(inbuf);
4195 struct smbd_server_connection *sconn = smbd_server_conn;
4196
4197 if (is_encrypted_packet(inbuf)) {
4198 /* Can't do this on encrypted
4199 * connections. */
4200 return false;
4201 }
4202
4203 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4204 return false;
4205 }
4206
4207 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4208 CVAL(inbuf,smb_wct) != 14) {
4209 DEBUG(10,("is_valid_writeX_buffer: chained or "
4210 "invalid word length.\n"));
4211 return false;
4212 }
4213
4214 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4215 if (conn == NULL) {
4216 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4217 return false;
4218 }
4219 if (IS_IPC(conn)) {
4220 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4221 return false;
4222 }
4223 if (IS_PRINT(conn)) {
4224 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4225 return false;
4226 }
4227 doff = SVAL(inbuf,smb_vwv11);
4228
4229 numtowrite = SVAL(inbuf,smb_vwv10);
4230
4231 if (len > doff && len - doff > 0xFFFF) {
4232 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4233 }
4234
4235 if (numtowrite == 0) {
4236 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4237 return false;
4238 }
4239
4240 /* Ensure the sizes match up. */
4241 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4242 /* no pad byte...old smbclient :-( */
4243 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4244 (unsigned int)doff,
4245 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4246 return false;
4247 }
4248
4249 if (len - doff != numtowrite) {
4250 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4251 "len = %u, doff = %u, numtowrite = %u\n",
4252 (unsigned int)len,
4253 (unsigned int)doff,
4254 (unsigned int)numtowrite ));
4255 return false;
4256 }
4257
4258 DEBUG(10,("is_valid_writeX_buffer: true "
4259 "len = %u, doff = %u, numtowrite = %u\n",
4260 (unsigned int)len,
4261 (unsigned int)doff,
4262 (unsigned int)numtowrite ));
4263
4264 return true;
4265 }
4266
4267 /****************************************************************************
4268 Reply to a write and X.
4269 ****************************************************************************/
4270
4271 void reply_write_and_X(struct smb_request *req)
4272 {
4273 connection_struct *conn = req->conn;
4274 files_struct *fsp;
4275 struct lock_struct lock;
4276 SMB_OFF_T startpos;
4277 size_t numtowrite;
4278 bool write_through;
4279 ssize_t nwritten;
4280 unsigned int smb_doff;
4281 unsigned int smblen;
4282 char *data;
4283 NTSTATUS status;
4284
4285 START_PROFILE(SMBwriteX);
4286
4287 if ((req->wct != 12) && (req->wct != 14)) {
4288 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4289 END_PROFILE(SMBwriteX);
4290 return;
4291 }
4292
4293 numtowrite = SVAL(req->vwv+10, 0);
4294 smb_doff = SVAL(req->vwv+11, 0);
4295 smblen = smb_len(req->inbuf);
4296
4297 if (req->unread_bytes > 0xFFFF ||
4298 (smblen > smb_doff &&
4299 smblen - smb_doff > 0xFFFF)) {
4300 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4301 }
4302
4303 if (req->unread_bytes) {
4304 /* Can't do a recvfile write on IPC$ */
4305 if (IS_IPC(conn)) {
4306 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4307 END_PROFILE(SMBwriteX);
4308 return;
4309 }
4310 if (numtowrite != req->unread_bytes) {
4311 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4312 END_PROFILE(SMBwriteX);
4313 return;
4314 }
4315 } else {
4316 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4317 smb_doff + numtowrite > smblen) {
4318 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4319 END_PROFILE(SMBwriteX);
4320 return;
4321 }
4322 }
4323
4324 /* If it's an IPC, pass off the pipe handler. */
4325 if (IS_IPC(conn)) {
4326 if (req->unread_bytes) {
4327 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4328 END_PROFILE(SMBwriteX);
4329 return;
4330 }
4331 reply_pipe_write_and_X(req);
4332 END_PROFILE(SMBwriteX);
4333 return;
4334 }
4335
4336 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4337 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4338 write_through = BITSETW(req->vwv+7,0);
4339
4340 if (!check_fsp(conn, req, fsp)) {
4341 END_PROFILE(SMBwriteX);
4342 return;
4343 }
4344
4345 if (!CHECK_WRITE(fsp)) {
4346 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4347 END_PROFILE(SMBwriteX);
4348 return;
4349 }
4350
4351 data = smb_base(req->inbuf) + smb_doff;
4352
4353 if(req->wct == 14) {
4354 #ifdef LARGE_SMB_OFF_T
4355 /*
4356 * This is a large offset (64 bit) write.
4357 */
4358 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4359
4360 #else /* !LARGE_SMB_OFF_T */
4361
4362 /*
4363 * Ensure we haven't been sent a >32 bit offset.
4364 */
4365
4366 if(IVAL(req->vwv+12, 0) != 0) {
4367 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4368 "used and we don't support 64 bit offsets.\n",
4369 (unsigned int)IVAL(req->vwv+12, 0) ));
4370 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4371 END_PROFILE(SMBwriteX);
4372 return;
4373 }
4374
4375 #endif /* LARGE_SMB_OFF_T */
4376 }
4377
4378 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4379 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4380 &lock);
4381
4382 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4383 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4384 END_PROFILE(SMBwriteX);
4385 return;
4386 }
4387
4388 /* X/Open SMB protocol says that, unlike SMBwrite
4389 if the length is zero then NO truncation is
4390 done, just a write of zero. To truncate a file,
4391 use SMBwrite. */
4392
4393 if(numtowrite == 0) {
4394 nwritten = 0;
4395 } else {
4396
4397 if ((req->unread_bytes == 0) &&
4398 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4399 numtowrite)) {
4400 goto strict_unlock;
4401 }
4402
4403 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4404 }
4405
4406 if(nwritten < 0) {
4407 reply_nterror(req, map_nt_error_from_unix(errno));
4408 goto strict_unlock;
4409 }
4410
4411 if((nwritten == 0) && (numtowrite != 0)) {
4412 reply_nterror(req, NT_STATUS_DISK_FULL);
4413 goto strict_unlock;
4414 }
4415
4416 reply_outbuf(req, 6, 0);
4417 SSVAL(req->outbuf,smb_vwv2,nwritten);
4418 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4419
4420 if (nwritten < (ssize_t)numtowrite) {
4421 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4422 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4423 }
4424
4425 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4426 fsp->fnum, (int)numtowrite, (int)nwritten));
4427
4428 status = sync_file(conn, fsp, write_through);
4429 if (!NT_STATUS_IS_OK(status)) {
4430 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4431 fsp_str_dbg(fsp), nt_errstr(status)));
4432 reply_nterror(req, status);
4433 goto strict_unlock;
4434 }
4435
4436 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4437
4438 END_PROFILE(SMBwriteX);
4439 chain_reply(req);
4440 return;
4441
4442 strict_unlock:
4443 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4444
4445 END_PROFILE(SMBwriteX);
4446 return;
4447 }
4448
4449 /****************************************************************************
4450 Reply to a lseek.
4451 ****************************************************************************/
4452
4453 void reply_lseek(struct smb_request *req)
4454 {
4455 connection_struct *conn = req->conn;
4456 SMB_OFF_T startpos;
4457 SMB_OFF_T res= -1;
4458 int mode,umode;
4459 files_struct *fsp;
4460
4461 START_PROFILE(SMBlseek);
4462
4463 if (req->wct < 4) {
4464 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4465 END_PROFILE(SMBlseek);
4466 return;
4467 }
4468
4469 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4470
4471 if (!check_fsp(conn, req, fsp)) {
4472 return;
4473 }
4474
4475 flush_write_cache(fsp, SEEK_FLUSH);
4476
4477 mode = SVAL(req->vwv+1, 0) & 3;
4478 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4479 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4480
4481 switch (mode) {
4482 case 0:
4483 umode = SEEK_SET;
4484 res = startpos;
4485 break;
4486 case 1:
4487 umode = SEEK_CUR;
4488 res = fsp->fh->pos + startpos;
4489 break;
4490 case 2:
4491 umode = SEEK_END;
4492 break;
4493 default:
4494 umode = SEEK_SET;
4495 res = startpos;
4496 break;
4497 }
4498
4499 if (umode == SEEK_END) {
4500 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4501 if(errno == EINVAL) {
4502 SMB_OFF_T current_pos = startpos;
4503
4504 if(fsp_stat(fsp) == -1) {
4505 reply_nterror(req,
4506 map_nt_error_from_unix(errno));
4507 END_PROFILE(SMBlseek);
4508 return;
4509 }
4510
4511 current_pos += fsp->fsp_name->st.st_ex_size;
4512 if(current_pos < 0)
4513 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4514 }
4515 }
4516
4517 if(res == -1) {
4518 reply_nterror(req, map_nt_error_from_unix(errno));
4519 END_PROFILE(SMBlseek);
4520 return;
4521 }
4522 }
4523
4524 fsp->fh->pos = res;
4525
4526 reply_outbuf(req, 2, 0);
4527 SIVAL(req->outbuf,smb_vwv0,res);
4528
4529 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4530 fsp->fnum, (double)startpos, (double)res, mode));
4531
4532 END_PROFILE(SMBlseek);
4533 return;
4534 }
4535
4536 /****************************************************************************
4537 Reply to a flush.
4538 ****************************************************************************/
4539
4540 void reply_flush(struct smb_request *req)
4541 {
4542 connection_struct *conn = req->conn;
4543 uint16 fnum;
4544 files_struct *fsp;
4545
4546 START_PROFILE(SMBflush);
4547
4548 if (req->wct < 1) {
4549 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4550 return;
4551 }
4552
4553 fnum = SVAL(req->vwv+0, 0);
4554 fsp = file_fsp(req, fnum);
4555
4556 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4557 return;
4558 }
4559
4560 if (!fsp) {
4561 file_sync_all(conn);
4562 } else {
4563 NTSTATUS status = sync_file(conn, fsp, True);
4564 if (!NT_STATUS_IS_OK(status)) {
4565 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4566 fsp_str_dbg(fsp), nt_errstr(status)));
4567 reply_nterror(req, status);
4568 END_PROFILE(SMBflush);
4569 return;
4570 }
4571 }
4572
4573 reply_outbuf(req, 0, 0);
4574
4575 DEBUG(3,("flush\n"));
4576 END_PROFILE(SMBflush);
4577 return;
4578 }
4579
4580 /****************************************************************************
4581 Reply to a exit.
4582 conn POINTER CAN BE NULL HERE !
4583 ****************************************************************************/
4584
4585 void reply_exit(struct smb_request *req)
4586 {
4587 START_PROFILE(SMBexit);
4588
4589 file_close_pid(req->smbpid, req->vuid);
4590
4591 reply_outbuf(req, 0, 0);
4592
4593 DEBUG(3,("exit\n"));
4594
4595 END_PROFILE(SMBexit);
4596 return;
4597 }
4598
4599 /****************************************************************************
4600 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4601 ****************************************************************************/
4602
4603 void reply_close(struct smb_request *req)
4604 {
4605 connection_struct *conn = req->conn;
4606 NTSTATUS status = NT_STATUS_OK;
4607 files_struct *fsp = NULL;
4608 START_PROFILE(SMBclose);
4609
4610 if (req->wct < 3) {
4611 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4612 END_PROFILE(SMBclose);
4613 return;
4614 }
4615
4616 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4617
4618 /*
4619 * We can only use check_fsp if we know it's not a directory.
4620 */
4621
4622 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4623 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4624 END_PROFILE(SMBclose);
4625 return;
4626 }
4627
4628 if(fsp->is_directory) {
4629 /*
4630 * Special case - close NT SMB directory handle.
4631 */
4632 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4633 status = close_file(req, fsp, NORMAL_CLOSE);
4634 } else {
4635 time_t t;
4636 /*
4637 * Close ordinary file.
4638 */
4639
4640 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4641 fsp->fh->fd, fsp->fnum,
4642 conn->num_files_open));
4643
4644 /*
4645 * Take care of any time sent in the close.
4646 */
4647
4648 t = srv_make_unix_date3(req->vwv+1);
4649 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4650
4651 /*
4652 * close_file() returns the unix errno if an error
4653 * was detected on close - normally this is due to
4654 * a disk full error. If not then it was probably an I/O error.
4655 */
4656
4657 status = close_file(req, fsp, NORMAL_CLOSE);
4658 }
4659
4660 if (!NT_STATUS_IS_OK(status)) {
4661 reply_nterror(req, status);
4662 END_PROFILE(SMBclose);
4663 return;
4664 }
4665
4666 reply_outbuf(req, 0, 0);
4667 END_PROFILE(SMBclose);
4668 return;
4669 }
4670
4671 /****************************************************************************
4672 Reply to a writeclose (Core+ protocol).
4673 ****************************************************************************/
4674
4675 void reply_writeclose(struct smb_request *req)
4676 {
4677 connection_struct *conn = req->conn;
4678 size_t numtowrite;
4679 ssize_t nwritten = -1;
4680 NTSTATUS close_status = NT_STATUS_OK;
4681 SMB_OFF_T startpos;
4682 const char *data;
4683 struct timespec mtime;
4684 files_struct *fsp;
4685 struct lock_struct lock;
4686
4687 START_PROFILE(SMBwriteclose);
4688
4689 if (req->wct < 6) {
4690 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4691 END_PROFILE(SMBwriteclose);
4692 return;
4693 }
4694
4695 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4696
4697 if (!check_fsp(conn, req, fsp)) {
4698 END_PROFILE(SMBwriteclose);
4699 return;
4700 }
4701 if (!CHECK_WRITE(fsp)) {
4702 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4703 END_PROFILE(SMBwriteclose);
4704 return;
4705 }
4706
4707 numtowrite = SVAL(req->vwv+1, 0);
4708 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4709 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4710 data = (const char *)req->buf + 1;
4711
4712 if (numtowrite) {
4713 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4714 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4715 &lock);
4716
4717 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4718 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4719 END_PROFILE(SMBwriteclose);
4720 return;
4721 }
4722 }
4723
4724 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4725
4726 set_close_write_time(fsp, mtime);
4727
4728 /*
4729 * More insanity. W2K only closes the file if writelen > 0.
4730 * JRA.
4731 */
4732
4733 if (numtowrite) {
4734 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4735 "file %s\n", fsp_str_dbg(fsp)));
4736 close_status = close_file(req, fsp, NORMAL_CLOSE);
4737 }
4738
4739 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4740 fsp->fnum, (int)numtowrite, (int)nwritten,
4741 conn->num_files_open));
4742
4743 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4744 reply_nterror(req, NT_STATUS_DISK_FULL);
4745 goto strict_unlock;
4746 }
4747
4748 if(!NT_STATUS_IS_OK(close_status)) {
4749 reply_nterror(req, close_status);
4750 goto strict_unlock;
4751 }
4752
4753 reply_outbuf(req, 1, 0);
4754
4755 SSVAL(req->outbuf,smb_vwv0,nwritten);
4756
4757 strict_unlock:
4758 if (numtowrite) {
4759 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4760 }
4761
4762 END_PROFILE(SMBwriteclose);
4763 return;
4764 }
4765
4766 #undef DBGC_CLASS
4767 #define DBGC_CLASS DBGC_LOCKING
4768
4769 /****************************************************************************
4770 Reply to a lock.
4771 ****************************************************************************/
4772
4773 void reply_lock(struct smb_request *req)
4774 {
4775 connection_struct *conn = req->conn;
4776 uint64_t count,offset;
4777 NTSTATUS status;
4778 files_struct *fsp;
4779 struct byte_range_lock *br_lck = NULL;
4780
4781 START_PROFILE(SMBlock);
4782
4783 if (req->wct < 5) {
4784 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4785 END_PROFILE(SMBlock);
4786 return;
4787 }
4788
4789 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4790
4791 if (!check_fsp(conn, req, fsp)) {
4792 END_PROFILE(SMBlock);
4793 return;
4794 }
4795
4796 count = (uint64_t)IVAL(req->vwv+1, 0);
4797 offset = (uint64_t)IVAL(req->vwv+3, 0);
4798
4799 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4800 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4801
4802 br_lck = do_lock(smbd_messaging_context(),
4803 fsp,
4804 req->smbpid,
4805 count,
4806 offset,
4807 WRITE_LOCK,
4808 WINDOWS_LOCK,
4809 False, /* Non-blocking lock. */
4810 &status,
4811 NULL,
4812 NULL);
4813
4814 TALLOC_FREE(br_lck);
4815
4816 if (NT_STATUS_V(status)) {
4817 reply_nterror(req, status);
4818 END_PROFILE(SMBlock);
4819 return;
4820 }
4821
4822 reply_outbuf(req, 0, 0);
4823
4824 END_PROFILE(SMBlock);
4825 return;
4826 }
4827
4828 /****************************************************************************
4829 Reply to a unlock.
4830 ****************************************************************************/
4831
4832 void reply_unlock(struct smb_request *req)
4833 {
4834 connection_struct *conn = req->conn;
4835 uint64_t count,offset;
4836 NTSTATUS status;
4837 files_struct *fsp;
4838
4839 START_PROFILE(SMBunlock);
4840
4841 if (req->wct < 5) {
4842 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4843 END_PROFILE(SMBunlock);
4844 return;
4845 }
4846
4847 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4848
4849 if (!check_fsp(conn, req, fsp)) {
4850 END_PROFILE(SMBunlock);
4851 return;
4852 }
4853
4854 count = (uint64_t)IVAL(req->vwv+1, 0);
4855 offset = (uint64_t)IVAL(req->vwv+3, 0);
4856
4857 status = do_unlock(smbd_messaging_context(),
4858 fsp,
4859 req->smbpid,
4860 count,
4861 offset,
4862 WINDOWS_LOCK);
4863
4864 if (NT_STATUS_V(status)) {
4865 reply_nterror(req, status);
4866 END_PROFILE(SMBunlock);
4867 return;
4868 }
4869
4870 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4871 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4872
4873 reply_outbuf(req, 0, 0);
4874
4875 END_PROFILE(SMBunlock);
4876 return;
4877 }
4878
4879 #undef DBGC_CLASS
4880 #define DBGC_CLASS DBGC_ALL
4881
4882 /****************************************************************************
4883 Reply to a tdis.
4884 conn POINTER CAN BE NULL HERE !
4885 ****************************************************************************/
4886
4887 void reply_tdis(struct smb_request *req)
4888 {
4889 connection_struct *conn = req->conn;
4890 START_PROFILE(SMBtdis);
4891
4892 if (!conn) {
4893 DEBUG(4,("Invalid connection in tdis\n"));
4894 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
4895 END_PROFILE(SMBtdis);
4896 return;
4897 }
4898
4899 conn->used = False;
4900
4901 close_cnum(conn,req->vuid);
4902 req->conn = NULL;
4903
4904 reply_outbuf(req, 0, 0);
4905 END_PROFILE(SMBtdis);
4906 return;
4907 }
4908
4909 /****************************************************************************
4910 Reply to a echo.
4911 conn POINTER CAN BE NULL HERE !
4912 ****************************************************************************/
4913
4914 void reply_echo(struct smb_request *req)
4915 {
4916 connection_struct *conn = req->conn;
4917 struct smb_perfcount_data local_pcd;
4918 struct smb_perfcount_data *cur_pcd;
4919 int smb_reverb;
4920 int seq_num;
4921
4922 START_PROFILE(SMBecho);
4923
4924 smb_init_perfcount_data(&local_pcd);
4925
4926 if (req->wct < 1) {
4927 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4928 END_PROFILE(SMBecho);
4929 return;
4930 }
4931
4932 smb_reverb = SVAL(req->vwv+0, 0);
4933
4934 reply_outbuf(req, 1, req->buflen);
4935
4936 /* copy any incoming data back out */
4937 if (req->buflen > 0) {
4938 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4939 }
4940
4941 if (smb_reverb > 100) {
4942 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4943 smb_reverb = 100;
4944 }
4945
4946 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4947
4948 /* this makes sure we catch the request pcd */
4949 if (seq_num == smb_reverb) {
4950 cur_pcd = &req->pcd;
4951 } else {
4952 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4953 cur_pcd = &local_pcd;
4954 }
4955
4956 SSVAL(req->outbuf,smb_vwv0,seq_num);
4957
4958 show_msg((char *)req->outbuf);
4959 if (!srv_send_smb(smbd_server_fd(),
4960 (char *)req->outbuf,
4961 true, req->seqnum+1,
4962 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4963 cur_pcd))
4964 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4965 }
4966
4967 DEBUG(3,("echo %d times\n", smb_reverb));
4968
4969 TALLOC_FREE(req->outbuf);
4970
4971 END_PROFILE(SMBecho);
4972 return;
4973 }
4974
4975 /****************************************************************************
4976 Reply to a printopen.
4977 ****************************************************************************/
4978
4979 void reply_printopen(struct smb_request *req)
4980 {
4981 connection_struct *conn = req->conn;
4982 files_struct *fsp;
4983 NTSTATUS status;
4984
4985 START_PROFILE(SMBsplopen);
4986
4987 if (req->wct < 2) {
4988 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4989 END_PROFILE(SMBsplopen);
4990 return;
4991 }
4992
4993 if (!CAN_PRINT(conn)) {
4994 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4995 END_PROFILE(SMBsplopen);
4996 return;
4997 }
4998
4999 status = file_new(req, conn, &fsp);
5000 if(!NT_STATUS_IS_OK(status)) {
5001 reply_nterror(req, status);
5002 END_PROFILE(SMBsplopen);
5003 return;
5004 }
5005
5006 /* Open for exclusive use, write only. */
5007 status = print_fsp_open(req, conn, NULL, req->vuid, fsp);
5008
5009 if (!NT_STATUS_IS_OK(status)) {
5010 file_free(req, fsp);
5011 reply_nterror(req, status);
5012 END_PROFILE(SMBsplopen);
5013 return;
5014 }
5015
5016 reply_outbuf(req, 1, 0);
5017 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5018
5019 DEBUG(3,("openprint fd=%d fnum=%d\n",
5020 fsp->fh->fd, fsp->fnum));
5021
5022 END_PROFILE(SMBsplopen);
5023 return;
5024 }
5025
5026 /****************************************************************************
5027 Reply to a printclose.
5028 ****************************************************************************/
5029
5030 void reply_printclose(struct smb_request *req)
5031 {
5032 connection_struct *conn = req->conn;
5033 files_struct *fsp;
5034 NTSTATUS status;
5035
5036 START_PROFILE(SMBsplclose);
5037
5038 if (req->wct < 1) {
5039 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5040 END_PROFILE(SMBsplclose);
5041 return;
5042 }
5043
5044 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5045
5046 if (!check_fsp(conn, req, fsp)) {
5047 END_PROFILE(SMBsplclose);
5048 return;
5049 }
5050
5051 if (!CAN_PRINT(conn)) {
5052 reply_force_doserror(req, ERRSRV, ERRerror);
5053 END_PROFILE(SMBsplclose);
5054 return;
5055 }
5056
5057 DEBUG(3,("printclose fd=%d fnum=%d\n",
5058 fsp->fh->fd,fsp->fnum));
5059
5060 status = close_file(req, fsp, NORMAL_CLOSE);
5061
5062 if(!NT_STATUS_IS_OK(status)) {
5063 reply_nterror(req, status);
5064 END_PROFILE(SMBsplclose);
5065 return;
5066 }
5067
5068 reply_outbuf(req, 0, 0);
5069
5070 END_PROFILE(SMBsplclose);
5071 return;
5072 }
5073
5074 /****************************************************************************
5075 Reply to a printqueue.
5076 ****************************************************************************/
5077
5078 void reply_printqueue(struct smb_request *req)
5079 {
5080 connection_struct *conn = req->conn;
5081 int max_count;
5082 int start_index;
5083
5084 START_PROFILE(SMBsplretq);
5085
5086 if (req->wct < 2) {
5087 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5088 END_PROFILE(SMBsplretq);
5089 return;
5090 }
5091
5092 max_count = SVAL(req->vwv+0, 0);
5093 start_index = SVAL(req->vwv+1, 0);
5094
5095 /* we used to allow the client to get the cnum wrong, but that
5096 is really quite gross and only worked when there was only
5097 one printer - I think we should now only accept it if they
5098 get it right (tridge) */
5099 if (!CAN_PRINT(conn)) {
5100 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5101 END_PROFILE(SMBsplretq);
5102 return;
5103 }
5104
5105 reply_outbuf(req, 2, 3);
5106 SSVAL(req->outbuf,smb_vwv0,0);
5107 SSVAL(req->outbuf,smb_vwv1,0);
5108 SCVAL(smb_buf(req->outbuf),0,1);
5109 SSVAL(smb_buf(req->outbuf),1,0);
5110
5111 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5112 start_index, max_count));
5113
5114 {
5115 print_queue_struct *queue = NULL;
5116 print_status_struct status;
5117 int count = print_queue_status(SNUM(conn), &queue, &status);
5118 int num_to_get = ABS(max_count);
5119 int first = (max_count>0?start_index:start_index+max_count+1);
5120 int i;
5121
5122 if (first >= count)
5123 num_to_get = 0;
5124 else
5125 num_to_get = MIN(num_to_get,count-first);
5126
5127
5128 for (i=first;i<first+num_to_get;i++) {
5129 char blob[28];
5130 char *p = blob;
5131
5132 srv_put_dos_date2(p,0,queue[i].time);
5133 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5134 SSVAL(p,5, queue[i].job);
5135 SIVAL(p,7,queue[i].size);
5136 SCVAL(p,11,0);
5137 srvstr_push(blob, req->flags2, p+12,
5138 queue[i].fs_user, 16, STR_ASCII);
5139
5140 if (message_push_blob(
5141 &req->outbuf,
5142 data_blob_const(
5143 blob, sizeof(blob))) == -1) {
5144 reply_nterror(req, NT_STATUS_NO_MEMORY);
5145 END_PROFILE(SMBsplretq);
5146 return;
5147 }
5148 }
5149
5150 if (count > 0) {
5151 SSVAL(req->outbuf,smb_vwv0,count);
5152 SSVAL(req->outbuf,smb_vwv1,
5153 (max_count>0?first+count:first-1));
5154 SCVAL(smb_buf(req->outbuf),0,1);
5155 SSVAL(smb_buf(req->outbuf),1,28*count);
5156 }
5157
5158 SAFE_FREE(queue);
5159
5160 DEBUG(3,("%d entries returned in queue\n",count));
5161 }
5162
5163 END_PROFILE(SMBsplretq);
5164 return;
5165 }
5166
5167 /****************************************************************************
5168 Reply to a printwrite.
5169 ****************************************************************************/
5170
5171 void reply_printwrite(struct smb_request *req)
5172 {
5173 connection_struct *conn = req->conn;
5174 int numtowrite;
5175 const char *data;
5176 files_struct *fsp;
5177
5178 START_PROFILE(SMBsplwr);
5179
5180 if (req->wct < 1) {
5181 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5182 END_PROFILE(SMBsplwr);
5183 return;
5184 }
5185
5186 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5187
5188 if (!check_fsp(conn, req, fsp)) {
5189 END_PROFILE(SMBsplwr);
5190 return;
5191 }
5192
5193 if (!CAN_PRINT(conn)) {
5194 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5195 END_PROFILE(SMBsplwr);
5196 return;
5197 }
5198
5199 if (!CHECK_WRITE(fsp)) {
5200 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5201 END_PROFILE(SMBsplwr);
5202 return;
5203 }
5204
5205 numtowrite = SVAL(req->buf, 1);
5206
5207 if (req->buflen < numtowrite + 3) {
5208 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5209 END_PROFILE(SMBsplwr);
5210 return;
5211 }
5212
5213 data = (const char *)req->buf + 3;
5214
5215 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5216 reply_nterror(req, map_nt_error_from_unix(errno));
5217 END_PROFILE(SMBsplwr);
5218 return;
5219 }
5220
5221 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5222
5223 END_PROFILE(SMBsplwr);
5224 return;
5225 }
5226
5227 /****************************************************************************
5228 Reply to a mkdir.
5229 ****************************************************************************/
5230
5231 void reply_mkdir(struct smb_request *req)
5232 {
5233 connection_struct *conn = req->conn;
5234 struct smb_filename *smb_dname = NULL;
5235 char *directory = NULL;
5236 NTSTATUS status;
5237 TALLOC_CTX *ctx = talloc_tos();
5238
5239 START_PROFILE(SMBmkdir);
5240
5241 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5242 STR_TERMINATE, &status);
5243 if (!NT_STATUS_IS_OK(status)) {
5244 reply_nterror(req, status);
5245 goto out;
5246 }
5247
5248 status = filename_convert(ctx, conn,
5249 req->flags2 & FLAGS2_DFS_PATHNAMES,
5250 directory,
5251 0,
5252 NULL,
5253 &smb_dname);
5254 if (!NT_STATUS_IS_OK(status)) {
5255 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5256 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5257 ERRSRV, ERRbadpath);
5258 goto out;
5259 }
5260 reply_nterror(req, status);
5261 goto out;
5262 }
5263
5264 status = create_directory(conn, req, smb_dname);
5265
5266 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5267
5268 if (!NT_STATUS_IS_OK(status)) {
5269
5270 if (!use_nt_status()
5271 && NT_STATUS_EQUAL(status,
5272 NT_STATUS_OBJECT_NAME_COLLISION)) {
5273 /*
5274 * Yes, in the DOS error code case we get a
5275 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5276 * samba4 torture test.
5277 */
5278 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5279 }
5280
5281 reply_nterror(req, status);
5282 goto out;
5283 }
5284
5285 reply_outbuf(req, 0, 0);
5286
5287 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5288 out:
5289 TALLOC_FREE(smb_dname);
5290 END_PROFILE(SMBmkdir);
5291 return;
5292 }
5293
5294 /****************************************************************************
5295 Reply to a rmdir.
5296 ****************************************************************************/
5297
5298 void reply_rmdir(struct smb_request *req)
5299 {
5300 connection_struct *conn = req->conn;
5301 struct smb_filename *smb_dname = NULL;
5302 char *directory = NULL;
5303 NTSTATUS status;
5304 TALLOC_CTX *ctx = talloc_tos();
5305 files_struct *fsp = NULL;
5306 int info = 0;
5307 struct smbd_server_connection *sconn = smbd_server_conn;
5308
5309 START_PROFILE(SMBrmdir);
5310
5311 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5312 STR_TERMINATE, &status);
5313 if (!NT_STATUS_IS_OK(status)) {
5314 reply_nterror(req, status);
5315 goto out;
5316 }
5317
5318 status = filename_convert(ctx, conn,
5319 req->flags2 & FLAGS2_DFS_PATHNAMES,
5320 directory,
5321 0,
5322 NULL,
5323 &smb_dname);
5324 if (!NT_STATUS_IS_OK(status)) {
5325 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5326 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5327 ERRSRV, ERRbadpath);
5328 goto out;
5329 }
5330 reply_nterror(req, status);
5331 goto out;
5332 }
5333
5334 if (is_ntfs_stream_smb_fname(smb_dname)) {
5335 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5336 goto out;
5337 }
5338
5339 status = SMB_VFS_CREATE_FILE(
5340 conn, /* conn */
5341 req, /* req */
5342 0, /* root_dir_fid */
5343 smb_dname, /* fname */
5344 DELETE_ACCESS, /* access_mask */
5345 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5346 FILE_SHARE_DELETE),
5347 FILE_OPEN, /* create_disposition*/
5348 FILE_DIRECTORY_FILE, /* create_options */
5349 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5350 0, /* oplock_request */
5351 0, /* allocation_size */
5352 0, /* private_flags */
5353 NULL, /* sd */
5354 NULL, /* ea_list */
5355 &fsp, /* result */
5356 &info); /* pinfo */
5357
5358 if (!NT_STATUS_IS_OK(status)) {
5359 if (open_was_deferred(req->mid)) {
5360 /* We have re-scheduled this call. */
5361 goto out;
5362 }
5363 reply_nterror(req, status);
5364 goto out;
5365 }
5366
5367 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5368 if (!NT_STATUS_IS_OK(status)) {
5369 close_file(req, fsp, ERROR_CLOSE);
5370 reply_nterror(req, status);
5371 goto out;
5372 }
5373
5374 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5375 close_file(req, fsp, ERROR_CLOSE);
5376 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5377 goto out;
5378 }
5379
5380 status = close_file(req, fsp, NORMAL_CLOSE);
5381 if (!NT_STATUS_IS_OK(status)) {
5382 reply_nterror(req, status);
5383 } else {
5384 reply_outbuf(req, 0, 0);
5385 }
5386
5387 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5388
5389 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5390 out:
5391 TALLOC_FREE(smb_dname);
5392 END_PROFILE(SMBrmdir);
5393 return;
5394 }
5395
5396 /*******************************************************************
5397 Resolve wildcards in a filename rename.
5398 ********************************************************************/
5399
5400 static bool resolve_wildcards(TALLOC_CTX *ctx,
5401 const char *name1,
5402 const char *name2,
5403 char **pp_newname)
5404 {
5405 char *name2_copy = NULL;
5406 char *root1 = NULL;
5407 char *root2 = NULL;
5408 char *ext1 = NULL;
5409 char *ext2 = NULL;
5410 char *p,*p2, *pname1, *pname2;
5411
5412 name2_copy = talloc_strdup(ctx, name2);
5413 if (!name2_copy) {
5414 return False;
5415 }
5416
5417 pname1 = strrchr_m(name1,'/');
5418 pname2 = strrchr_m(name2_copy,'/');
5419
5420 if (!pname1 || !pname2) {
5421 return False;
5422 }
5423
5424 /* Truncate the copy of name2 at the last '/' */
5425 *pname2 = '\0';
5426
5427 /* Now go past the '/' */
5428 pname1++;
5429 pname2++;
5430
5431 root1 = talloc_strdup(ctx, pname1);
5432 root2 = talloc_strdup(ctx, pname2);
5433
5434 if (!root1 || !root2) {
5435 return False;
5436 }
5437
5438 p = strrchr_m(root1,'.');
5439 if (p) {
5440 *p = 0;
5441 ext1 = talloc_strdup(ctx, p+1);
5442 } else {
5443 ext1 = talloc_strdup(ctx, "");
5444 }
5445 p = strrchr_m(root2,'.');
5446 if (p) {
5447 *p = 0;
5448 ext2 = talloc_strdup(ctx, p+1);
5449 } else {
5450 ext2 = talloc_strdup(ctx, "");
5451 }
5452
5453 if (!ext1 || !ext2) {
5454 return False;
5455 }
5456
5457 p = root1;
5458 p2 = root2;
5459 while (*p2) {
5460 if (*p2 == '?') {
5461 /* Hmmm. Should this be mb-aware ? */
5462 *p2 = *p;
5463 p2++;
5464 } else if (*p2 == '*') {
5465 *p2 = '\0';
5466 root2 = talloc_asprintf(ctx, "%s%s",
5467 root2,
5468 p);
5469 if (!root2) {
5470 return False;
5471 }
5472 break;
5473 } else {
5474 p2++;
5475 }
5476 if (*p) {
5477 p++;
5478 }
5479 }
5480
5481 p = ext1;
5482 p2 = ext2;
5483 while (*p2) {
5484 if (*p2 == '?') {
5485 /* Hmmm. Should this be mb-aware ? */
5486 *p2 = *p;
5487 p2++;
5488 } else if (*p2 == '*') {
5489 *p2 = '\0';
5490 ext2 = talloc_asprintf(ctx, "%s%s",
5491 ext2,
5492 p);
5493 if (!ext2) {
5494 return False;
5495 }
5496 break;
5497 } else {
5498 p2++;
5499 }
5500 if (*p) {
5501 p++;
5502 }
5503 }
5504
5505 if (*ext2) {
5506 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5507 name2_copy,
5508 root2,
5509 ext2);
5510 } else {
5511 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5512 name2_copy,
5513 root2);
5514 }
5515
5516 if (!*pp_newname) {
5517 return False;
5518 }
5519
5520 return True;
5521 }
5522
5523 /****************************************************************************
5524 Ensure open files have their names updated. Updated to notify other smbd's
5525 asynchronously.
5526 ****************************************************************************/
5527
5528 static void rename_open_files(connection_struct *conn,
5529 struct share_mode_lock *lck,
5530 const struct smb_filename *smb_fname_dst)
5531 {
5532 files_struct *fsp;
5533 bool did_rename = False;
5534 NTSTATUS status;
5535
5536 for(fsp = file_find_di_first(lck->id); fsp;
5537 fsp = file_find_di_next(fsp)) {
5538 /* fsp_name is a relative path under the fsp. To change this for other
5539 sharepaths we need to manipulate relative paths. */
5540 /* TODO - create the absolute path and manipulate the newname
5541 relative to the sharepath. */
5542 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5543 continue;
5544 }
5545 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5546 "(file_id %s) from %s -> %s\n", fsp->fnum,
5547 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5548 smb_fname_str_dbg(smb_fname_dst)));
5549
5550 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5551 if (NT_STATUS_IS_OK(status)) {
5552 did_rename = True;
5553 }
5554 }
5555
5556 if (!did_rename) {
5557 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5558 "for %s\n", file_id_string_tos(&lck->id),
5559 smb_fname_str_dbg(smb_fname_dst)));
5560 }
5561
5562 /* Send messages to all smbd's (not ourself) that the name has changed. */
5563 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5564 smb_fname_dst);
5565
5566 }
5567
5568 /****************************************************************************
5569 We need to check if the source path is a parent directory of the destination
5570 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5571 refuse the rename with a sharing violation. Under UNIX the above call can
5572 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5573 probably need to check that the client is a Windows one before disallowing
5574 this as a UNIX client (one with UNIX extensions) can know the source is a
5575 symlink and make this decision intelligently. Found by an excellent bug
5576 report from <AndyLiebman@aol.com>.
5577 ****************************************************************************/
5578
5579 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5580 const struct smb_filename *smb_fname_dst)
5581 {
5582 const char *psrc = smb_fname_src->base_name;
5583 const char *pdst = smb_fname_dst->base_name;
5584 size_t slen;
5585
5586 if (psrc[0] == '.' && psrc[1] == '/') {
5587 psrc += 2;
5588 }
5589 if (pdst[0] == '.' && pdst[1] == '/') {
5590 pdst += 2;
5591 }
5592 if ((slen = strlen(psrc)) > strlen(pdst)) {
5593 return False;
5594 }
5595 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5596 }
5597
5598 /*
5599 * Do the notify calls from a rename
5600 */
5601
5602 static void notify_rename(connection_struct *conn, bool is_dir,
5603 const struct smb_filename *smb_fname_src,
5604 const struct smb_filename *smb_fname_dst)
5605 {
5606 char *parent_dir_src = NULL;
5607 char *parent_dir_dst = NULL;
5608 uint32 mask;
5609
5610 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5611 : FILE_NOTIFY_CHANGE_FILE_NAME;
5612
5613 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5614 &parent_dir_src, NULL) ||
5615 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5616 &parent_dir_dst, NULL)) {
5617 goto out;
5618 }
5619
5620 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5621 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5622 smb_fname_src->base_name);
5623 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5624 smb_fname_dst->base_name);
5625 }
5626 else {
5627 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5628 smb_fname_src->base_name);
5629 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5630 smb_fname_dst->base_name);
5631 }
5632
5633 /* this is a strange one. w2k3 gives an additional event for
5634 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5635 files, but not directories */
5636 if (!is_dir) {
5637 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5638 FILE_NOTIFY_CHANGE_ATTRIBUTES
5639 |FILE_NOTIFY_CHANGE_CREATION,
5640 smb_fname_dst->base_name);
5641 }
5642 out:
5643 TALLOC_FREE(parent_dir_src);
5644 TALLOC_FREE(parent_dir_dst);
5645 }
5646
5647 /****************************************************************************
5648 Rename an open file - given an fsp.
5649 ****************************************************************************/
5650
5651 NTSTATUS rename_internals_fsp(connection_struct *conn,
5652 files_struct *fsp,
5653 const struct smb_filename *smb_fname_dst_in,
5654 uint32 attrs,
5655 bool replace_if_exists)
5656 {
5657 TALLOC_CTX *ctx = talloc_tos();
5658 struct smb_filename *smb_fname_dst = NULL;
5659 NTSTATUS status = NT_STATUS_OK;
5660 struct share_mode_lock *lck = NULL;
5661 bool dst_exists, old_is_stream, new_is_stream;
5662
5663 status = check_name(conn, smb_fname_dst_in->base_name);
5664 if (!NT_STATUS_IS_OK(status)) {
5665 return status;
5666 }
5667
5668 /* Make a copy of the dst smb_fname structs */
5669
5670 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5671 if (!NT_STATUS_IS_OK(status)) {
5672 goto out;
5673 }
5674
5675 /* Ensure the dst smb_fname contains a '/' */
5676 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5677 char * tmp;
5678 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5679 smb_fname_dst->base_name);
5680 if (!tmp) {
5681 status = NT_STATUS_NO_MEMORY;
5682 goto out;
5683 }
5684 TALLOC_FREE(smb_fname_dst->base_name);
5685 smb_fname_dst->base_name = tmp;
5686 }
5687
5688 /*
5689 * Check for special case with case preserving and not
5690 * case sensitive. If the old last component differs from the original
5691 * last component only by case, then we should allow
5692 * the rename (user is trying to change the case of the
5693 * filename).
5694 */
5695 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5696 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5697 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5698 char *last_slash;
5699 char *fname_dst_lcomp_base_mod = NULL;
5700 struct smb_filename *smb_fname_orig_lcomp = NULL;
5701
5702 /*
5703 * Get the last component of the destination name. Note that
5704 * we guarantee that destination name contains a '/' character
5705 * above.
5706 */
5707 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5708 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5709 if (!fname_dst_lcomp_base_mod) {
5710 status = NT_STATUS_NO_MEMORY;
5711 goto out;
5712 }
5713
5714 /*
5715 * Create an smb_filename struct using the original last
5716 * component of the destination.
5717 */
5718 status = create_synthetic_smb_fname_split(ctx,
5719 smb_fname_dst->original_lcomp, NULL,
5720 &smb_fname_orig_lcomp);
5721 if (!NT_STATUS_IS_OK(status)) {
5722 TALLOC_FREE(fname_dst_lcomp_base_mod);
5723 goto out;
5724 }
5725
5726 /* If the base names only differ by case, use original. */
5727 if(!strcsequal(fname_dst_lcomp_base_mod,
5728 smb_fname_orig_lcomp->base_name)) {
5729 char *tmp;
5730 /*
5731 * Replace the modified last component with the
5732 * original.
5733 */
5734 *last_slash = '\0'; /* Truncate at the '/' */
5735 tmp = talloc_asprintf(smb_fname_dst,
5736 "%s/%s",
5737 smb_fname_dst->base_name,
5738 smb_fname_orig_lcomp->base_name);
5739 if (tmp == NULL) {
5740 status = NT_STATUS_NO_MEMORY;
5741 TALLOC_FREE(fname_dst_lcomp_base_mod);
5742 TALLOC_FREE(smb_fname_orig_lcomp);
5743 goto out;
5744 }
5745 TALLOC_FREE(smb_fname_dst->base_name);
5746 smb_fname_dst->base_name = tmp;
5747 }
5748
5749 /* If the stream_names only differ by case, use original. */
5750 if(!strcsequal(smb_fname_dst->stream_name,
5751 smb_fname_orig_lcomp->stream_name)) {
5752 char *tmp = NULL;
5753 /* Use the original stream. */
5754 tmp = talloc_strdup(smb_fname_dst,
5755 smb_fname_orig_lcomp->stream_name);
5756 if (tmp == NULL) {
5757 status = NT_STATUS_NO_MEMORY;
5758 TALLOC_FREE(fname_dst_lcomp_base_mod);
5759 TALLOC_FREE(smb_fname_orig_lcomp);
5760 goto out;
5761 }
5762 TALLOC_FREE(smb_fname_dst->stream_name);
5763 smb_fname_dst->stream_name = tmp;
5764 }
5765 TALLOC_FREE(fname_dst_lcomp_base_mod);
5766 TALLOC_FREE(smb_fname_orig_lcomp);
5767 }
5768
5769 /*
5770 * If the src and dest names are identical - including case,
5771 * don't do the rename, just return success.
5772 */
5773
5774 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5775 strcsequal(fsp->fsp_name->stream_name,
5776 smb_fname_dst->stream_name)) {
5777 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5778 "- returning success\n",
5779 smb_fname_str_dbg(smb_fname_dst)));
5780 status = NT_STATUS_OK;
5781 goto out;
5782 }
5783
5784 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
5785 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5786
5787 /* Return the correct error code if both names aren't streams. */
5788 if (!old_is_stream && new_is_stream) {
5789 status = NT_STATUS_OBJECT_NAME_INVALID;
5790 goto out;
5791 }
5792
5793 if (old_is_stream && !new_is_stream) {
5794 status = NT_STATUS_INVALID_PARAMETER;
5795 goto out;
5796 }
5797
5798 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5799
5800 if(!replace_if_exists && dst_exists) {
5801 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5802 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5803 smb_fname_str_dbg(smb_fname_dst)));
5804 status = NT_STATUS_OBJECT_NAME_COLLISION;
5805 goto out;
5806 }
5807
5808 if (dst_exists) {
5809 struct file_id fileid = vfs_file_id_from_sbuf(conn,
5810 &smb_fname_dst->st);
5811 files_struct *dst_fsp = file_find_di_first(fileid);
5812 /* The file can be open when renaming a stream */
5813 if (dst_fsp && !new_is_stream) {
5814 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5815 status = NT_STATUS_ACCESS_DENIED;
5816 goto out;
5817 }
5818 }
5819
5820 /* Ensure we have a valid stat struct for the source. */
5821 status = vfs_stat_fsp(fsp);
5822 if (!NT_STATUS_IS_OK(status)) {
5823 goto out;
5824 }
5825
5826 status = can_rename(conn, fsp, attrs);
5827
5828 if (!NT_STATUS_IS_OK(status)) {
5829 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5830 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5831 smb_fname_str_dbg(smb_fname_dst)));
5832 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5833 status = NT_STATUS_ACCESS_DENIED;
5834 goto out;
5835 }
5836
5837 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
5838 status = NT_STATUS_ACCESS_DENIED;
5839 }
5840
5841 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5842 NULL);
5843
5844 /*
5845 * We have the file open ourselves, so not being able to get the
5846 * corresponding share mode lock is a fatal error.
5847 */
5848
5849 SMB_ASSERT(lck != NULL);
5850
5851 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
5852 uint32 create_options = fsp->fh->private_options;
5853
5854 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
5855 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5856 smb_fname_str_dbg(smb_fname_dst)));
5857
5858 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
5859 smb_fname_dst);
5860
5861 rename_open_files(conn, lck, smb_fname_dst);
5862
5863 /*
5864 * A rename acts as a new file create w.r.t. allowing an initial delete
5865 * on close, probably because in Windows there is a new handle to the
5866 * new file. If initial delete on close was requested but not
5867 * originally set, we need to set it here. This is probably not 100% correct,
5868 * but will work for the CIFSFS client which in non-posix mode
5869 * depends on these semantics. JRA.
5870 */
5871
5872 if (create_options & FILE_DELETE_ON_CLOSE) {
5873 status = can_set_delete_on_close(fsp, 0);
5874
5875 if (NT_STATUS_IS_OK(status)) {
5876 /* Note that here we set the *inital* delete on close flag,
5877 * not the regular one. The magic gets handled in close. */
5878 fsp->initial_delete_on_close = True;
5879 }
5880 }
5881 TALLOC_FREE(lck);
5882 status = NT_STATUS_OK;
5883 goto out;
5884 }
5885
5886 TALLOC_FREE(lck);
5887
5888 if (errno == ENOTDIR || errno == EISDIR) {
5889 status = NT_STATUS_OBJECT_NAME_COLLISION;
5890 } else {
5891 status = map_nt_error_from_unix(errno);
5892 }
5893
5894 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5895 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5896 smb_fname_str_dbg(smb_fname_dst)));
5897
5898 out:
5899 TALLOC_FREE(smb_fname_dst);
5900
5901 return status;
5902 }
5903
5904 /****************************************************************************
5905 The guts of the rename command, split out so it may be called by the NT SMB
5906 code.
5907 ****************************************************************************/
5908
5909 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5910 connection_struct *conn,
5911 struct smb_request *req,
5912 struct smb_filename *smb_fname_src,
5913 struct smb_filename *smb_fname_dst,
5914 uint32 attrs,
5915 bool replace_if_exists,
5916 bool src_has_wild,
5917 bool dest_has_wild,
5918 uint32_t access_mask)
5919 {
5920 char *fname_src_dir = NULL;
5921 char *fname_src_mask = NULL;
5922 int count=0;
5923 NTSTATUS status = NT_STATUS_OK;
5924 struct smb_Dir *dir_hnd = NULL;
5925 const char *dname = NULL;
5926 char *talloced = NULL;
5927 long offset = 0;
5928 int create_options = 0;
5929 bool posix_pathnames = lp_posix_pathnames();
5930
5931 /*
5932 * Split the old name into directory and last component
5933 * strings. Note that unix_convert may have stripped off a
5934 * leading ./ from both name and newname if the rename is
5935 * at the root of the share. We need to make sure either both
5936 * name and newname contain a / character or neither of them do
5937 * as this is checked in resolve_wildcards().
5938 */
5939
5940 /* Split up the directory from the filename/mask. */
5941 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
5942 &fname_src_dir, &fname_src_mask);
5943 if (!NT_STATUS_IS_OK(status)) {
5944 status = NT_STATUS_NO_MEMORY;
5945 goto out;
5946 }
5947
5948 /*
5949 * We should only check the mangled cache
5950 * here if unix_convert failed. This means
5951 * that the path in 'mask' doesn't exist
5952 * on the file system and so we need to look
5953 * for a possible mangle. This patch from
5954 * Tine Smukavec <valentin.smukavec@hermes.si>.
5955 */
5956
5957 if (!VALID_STAT(smb_fname_src->st) &&
5958 mangle_is_mangled(fname_src_mask, conn->params)) {
5959 char *new_mask = NULL;
5960 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
5961 conn->params);
5962 if (new_mask) {
5963 TALLOC_FREE(fname_src_mask);
5964 fname_src_mask = new_mask;
5965 }
5966 }
5967
5968 if (!src_has_wild) {
5969 files_struct *fsp;
5970
5971 /*
5972 * Only one file needs to be renamed. Append the mask back
5973 * onto the directory.
5974 */
5975 TALLOC_FREE(smb_fname_src->base_name);
5976 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
5977 "%s/%s",
5978 fname_src_dir,
5979 fname_src_mask);
5980 if (!smb_fname_src->base_name) {
5981 status = NT_STATUS_NO_MEMORY;
5982 goto out;
5983 }
5984
5985 /* Ensure dst fname contains a '/' also */
5986 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
5987 char *tmp;
5988 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5989 smb_fname_dst->base_name);
5990 if (!tmp) {
5991 status = NT_STATUS_NO_MEMORY;
5992 goto out;
5993 }
5994 TALLOC_FREE(smb_fname_dst->base_name);
5995 smb_fname_dst->base_name = tmp;
5996 }
5997
5998 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5999 "case_preserve = %d, short case preserve = %d, "
6000 "directory = %s, newname = %s, "
6001 "last_component_dest = %s\n",
6002 conn->case_sensitive, conn->case_preserve,
6003 conn->short_case_preserve,
6004 smb_fname_str_dbg(smb_fname_src),
6005 smb_fname_str_dbg(smb_fname_dst),
6006 smb_fname_dst->original_lcomp));
6007
6008 /* The dest name still may have wildcards. */
6009 if (dest_has_wild) {
6010 char *fname_dst_mod = NULL;
6011 if (!resolve_wildcards(smb_fname_dst,
6012 smb_fname_src->base_name,
6013 smb_fname_dst->base_name,
6014 &fname_dst_mod)) {
6015 DEBUG(6, ("rename_internals: resolve_wildcards "
6016 "%s %s failed\n",
6017 smb_fname_src->base_name,
6018 smb_fname_dst->base_name));
6019 status = NT_STATUS_NO_MEMORY;
6020 goto out;
6021 }
6022 TALLOC_FREE(smb_fname_dst->base_name);
6023 smb_fname_dst->base_name = fname_dst_mod;
6024 }
6025
6026 ZERO_STRUCT(smb_fname_src->st);
6027 if (posix_pathnames) {
6028 SMB_VFS_LSTAT(conn, smb_fname_src);
6029 } else {
6030 SMB_VFS_STAT(conn, smb_fname_src);
6031 }
6032
6033 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6034 create_options |= FILE_DIRECTORY_FILE;
6035 }
6036
6037 status = SMB_VFS_CREATE_FILE(
6038 conn, /* conn */
6039 req, /* req */
6040 0, /* root_dir_fid */
6041 smb_fname_src, /* fname */
6042 access_mask, /* access_mask */
6043 (FILE_SHARE_READ | /* share_access */
6044 FILE_SHARE_WRITE),
6045 FILE_OPEN, /* create_disposition*/
6046 create_options, /* create_options */
6047 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6048 0, /* oplock_request */
6049 0, /* allocation_size */
6050 0, /* private_flags */
6051 NULL, /* sd */
6052 NULL, /* ea_list */
6053 &fsp, /* result */
6054 NULL); /* pinfo */
6055
6056 if (!NT_STATUS_IS_OK(status)) {
6057 DEBUG(3, ("Could not open rename source %s: %s\n",
6058 smb_fname_str_dbg(smb_fname_src),
6059 nt_errstr(status)));
6060 goto out;
6061 }
6062
6063 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6064 attrs, replace_if_exists);
6065
6066 close_file(req, fsp, NORMAL_CLOSE);
6067
6068 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6069 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6070 smb_fname_str_dbg(smb_fname_dst)));
6071
6072 goto out;
6073 }
6074
6075 /*
6076 * Wildcards - process each file that matches.
6077 */
6078 if (strequal(fname_src_mask, "????????.???")) {
6079 TALLOC_FREE(fname_src_mask);
6080 fname_src_mask = talloc_strdup(ctx, "*");
6081 if (!fname_src_mask) {
6082 status = NT_STATUS_NO_MEMORY;
6083 goto out;
6084 }
6085 }
6086
6087 status = check_name(conn, fname_src_dir);
6088 if (!NT_STATUS_IS_OK(status)) {
6089 goto out;
6090 }
6091
6092 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6093 attrs);
6094 if (dir_hnd == NULL) {
6095 status = map_nt_error_from_unix(errno);
6096 goto out;
6097 }
6098
6099 status = NT_STATUS_NO_SUCH_FILE;
6100 /*
6101 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6102 * - gentest fix. JRA
6103 */
6104
6105 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6106 &talloced))) {
6107 files_struct *fsp = NULL;
6108 char *destname = NULL;
6109 bool sysdir_entry = False;
6110
6111 /* Quick check for "." and ".." */
6112 if (ISDOT(dname) || ISDOTDOT(dname)) {
6113 if (attrs & aDIR) {
6114 sysdir_entry = True;
6115 } else {
6116 TALLOC_FREE(talloced);
6117 continue;
6118 }
6119 }
6120
6121 if (!is_visible_file(conn, fname_src_dir, dname,
6122 &smb_fname_src->st, false)) {
6123 TALLOC_FREE(talloced);
6124 continue;
6125 }
6126
6127 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6128 TALLOC_FREE(talloced);
6129 continue;
6130 }
6131
6132 if (sysdir_entry) {
6133 status = NT_STATUS_OBJECT_NAME_INVALID;
6134 break;
6135 }
6136
6137 TALLOC_FREE(smb_fname_src->base_name);
6138 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6139 "%s/%s",
6140 fname_src_dir,
6141 dname);
6142 if (!smb_fname_src->base_name) {
6143 status = NT_STATUS_NO_MEMORY;
6144 goto out;
6145 }
6146
6147 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6148 smb_fname_dst->base_name,
6149 &destname)) {
6150 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6151 smb_fname_src->base_name, destname));
6152 TALLOC_FREE(talloced);
6153 continue;
6154 }
6155 if (!destname) {
6156 status = NT_STATUS_NO_MEMORY;
6157 goto out;
6158 }
6159
6160 TALLOC_FREE(smb_fname_dst->base_name);
6161 smb_fname_dst->base_name = destname;
6162
6163 ZERO_STRUCT(smb_fname_src->st);
6164 if (posix_pathnames) {
6165 SMB_VFS_LSTAT(conn, smb_fname_src);
6166 } else {
6167 SMB_VFS_STAT(conn, smb_fname_src);
6168 }
6169
6170 create_options = 0;
6171
6172 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6173 create_options |= FILE_DIRECTORY_FILE;
6174 }
6175
6176 status = SMB_VFS_CREATE_FILE(
6177 conn, /* conn */
6178 req, /* req */
6179 0, /* root_dir_fid */
6180 smb_fname_src, /* fname */
6181 access_mask, /* access_mask */
6182 (FILE_SHARE_READ | /* share_access */
6183 FILE_SHARE_WRITE),
6184 FILE_OPEN, /* create_disposition*/
6185 create_options, /* create_options */
6186 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6187 0, /* oplock_request */
6188 0, /* allocation_size */
6189 0, /* private_flags */
6190 NULL, /* sd */
6191 NULL, /* ea_list */
6192 &fsp, /* result */
6193 NULL); /* pinfo */
6194
6195 if (!NT_STATUS_IS_OK(status)) {
6196 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6197 "returned %s rename %s -> %s\n",
6198 nt_errstr(status),
6199 smb_fname_str_dbg(smb_fname_src),
6200 smb_fname_str_dbg(smb_fname_dst)));
6201 break;
6202 }
6203
6204 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6205 dname);
6206 if (!smb_fname_dst->original_lcomp) {
6207 status = NT_STATUS_NO_MEMORY;
6208 goto out;
6209 }
6210
6211 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6212 attrs, replace_if_exists);
6213
6214 close_file(req, fsp, NORMAL_CLOSE);
6215
6216 if (!NT_STATUS_IS_OK(status)) {
6217 DEBUG(3, ("rename_internals_fsp returned %s for "
6218 "rename %s -> %s\n", nt_errstr(status),
6219 smb_fname_str_dbg(smb_fname_src),
6220 smb_fname_str_dbg(smb_fname_dst)));
6221 break;
6222 }
6223
6224 count++;
6225
6226 DEBUG(3,("rename_internals: doing rename on %s -> "
6227 "%s\n", smb_fname_str_dbg(smb_fname_src),
6228 smb_fname_str_dbg(smb_fname_src)));
6229 TALLOC_FREE(talloced);
6230 }
6231 TALLOC_FREE(dir_hnd);
6232
6233 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6234 status = map_nt_error_from_unix(errno);
6235 }
6236
6237 out:
6238 TALLOC_FREE(talloced);
6239 TALLOC_FREE(fname_src_dir);
6240 TALLOC_FREE(fname_src_mask);
6241 return status;
6242 }
6243
6244 /****************************************************************************
6245 Reply to a mv.
6246 ****************************************************************************/
6247
6248 void reply_mv(struct smb_request *req)
6249 {
6250 connection_struct *conn = req->conn;
6251 char *name = NULL;
6252 char *newname = NULL;
6253 const char *p;
6254 uint32 attrs;
6255 NTSTATUS status;
6256 bool src_has_wcard = False;
6257 bool dest_has_wcard = False;
6258 TALLOC_CTX *ctx = talloc_tos();
6259 struct smb_filename *smb_fname_src = NULL;
6260 struct smb_filename *smb_fname_dst = NULL;
6261
6262 START_PROFILE(SMBmv);
6263
6264 if (req->wct < 1) {
6265 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6266 goto out;
6267 }
6268
6269 attrs = SVAL(req->vwv+0, 0);
6270
6271 p = (const char *)req->buf + 1;
6272 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6273 &status, &src_has_wcard);
6274 if (!NT_STATUS_IS_OK(status)) {
6275 reply_nterror(req, status);
6276 goto out;
6277 }
6278 p++;
6279 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6280 &status, &dest_has_wcard);
6281 if (!NT_STATUS_IS_OK(status)) {
6282 reply_nterror(req, status);
6283 goto out;
6284 }
6285
6286 status = filename_convert(ctx,
6287 conn,
6288 req->flags2 & FLAGS2_DFS_PATHNAMES,
6289 name,
6290 UCF_COND_ALLOW_WCARD_LCOMP,
6291 &src_has_wcard,
6292 &smb_fname_src);
6293
6294 if (!NT_STATUS_IS_OK(status)) {
6295 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6296 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6297 ERRSRV, ERRbadpath);
6298 goto out;
6299 }
6300 reply_nterror(req, status);
6301 goto out;
6302 }
6303
6304 status = filename_convert(ctx,
6305 conn,
6306 req->flags2 & FLAGS2_DFS_PATHNAMES,
6307 newname,
6308 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6309 &dest_has_wcard,
6310 &smb_fname_dst);
6311
6312 if (!NT_STATUS_IS_OK(status)) {
6313 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6314 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6315 ERRSRV, ERRbadpath);
6316 goto out;
6317 }
6318 reply_nterror(req, status);
6319 goto out;
6320 }
6321
6322 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6323 smb_fname_str_dbg(smb_fname_dst)));
6324
6325 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6326 attrs, False, src_has_wcard, dest_has_wcard,
6327 DELETE_ACCESS);
6328 if (!NT_STATUS_IS_OK(status)) {
6329 if (open_was_deferred(req->mid)) {
6330 /* We have re-scheduled this call. */
6331 goto out;
6332 }
6333 reply_nterror(req, status);
6334 goto out;
6335 }
6336
6337 reply_outbuf(req, 0, 0);
6338 out:
6339 TALLOC_FREE(smb_fname_src);
6340 TALLOC_FREE(smb_fname_dst);
6341 END_PROFILE(SMBmv);
6342 return;
6343 }
6344
6345 /*******************************************************************
6346 Copy a file as part of a reply_copy.
6347 ******************************************************************/
6348
6349 /*
6350 * TODO: check error codes on all callers
6351 */
6352
6353 NTSTATUS copy_file(TALLOC_CTX *ctx,
6354 connection_struct *conn,
6355 struct smb_filename *smb_fname_src,
6356 struct smb_filename *smb_fname_dst,
6357 int ofun,
6358 int count,
6359 bool target_is_directory)
6360 {
6361 struct smb_filename *smb_fname_dst_tmp = NULL;
6362 SMB_OFF_T ret=-1;
6363 files_struct *fsp1,*fsp2;
6364 uint32 dosattrs;
6365 uint32 new_create_disposition;
6366 NTSTATUS status;
6367
6368
6369 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6370 if (!NT_STATUS_IS_OK(status)) {
6371 return status;
6372 }
6373
6374 /*
6375 * If the target is a directory, extract the last component from the
6376 * src filename and append it to the dst filename
6377 */
6378 if (target_is_directory) {
6379 const char *p;
6380
6381 /* dest/target can't be a stream if it's a directory. */
6382 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6383
6384 p = strrchr_m(smb_fname_src->base_name,'/');
6385 if (p) {
6386 p++;
6387 } else {
6388 p = smb_fname_src->base_name;
6389 }
6390 smb_fname_dst_tmp->base_name =
6391 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6392 p);
6393 if (!smb_fname_dst_tmp->base_name) {
6394 status = NT_STATUS_NO_MEMORY;
6395 goto out;
6396 }
6397 }
6398
6399 status = vfs_file_exist(conn, smb_fname_src);
6400 if (!NT_STATUS_IS_OK(status)) {
6401 goto out;
6402 }
6403
6404 if (!target_is_directory && count) {
6405 new_create_disposition = FILE_OPEN;
6406 } else {
6407 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6408 NULL, NULL,
6409 &new_create_disposition,
6410 NULL,
6411 NULL)) {
6412 status = NT_STATUS_INVALID_PARAMETER;
6413 goto out;
6414 }
6415 }
6416
6417 /* Open the src file for reading. */
6418 status = SMB_VFS_CREATE_FILE(
6419 conn, /* conn */
6420 NULL, /* req */
6421 0, /* root_dir_fid */
6422 smb_fname_src, /* fname */
6423 FILE_GENERIC_READ, /* access_mask */
6424 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6425 FILE_OPEN, /* create_disposition*/
6426 0, /* create_options */
6427 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6428 INTERNAL_OPEN_ONLY, /* oplock_request */
6429 0, /* allocation_size */
6430 0, /* private_flags */
6431 NULL, /* sd */
6432 NULL, /* ea_list */
6433 &fsp1, /* result */
6434 NULL); /* psbuf */
6435
6436 if (!NT_STATUS_IS_OK(status)) {
6437 goto out;
6438 }
6439
6440 dosattrs = dos_mode(conn, smb_fname_src);
6441
6442 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6443 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6444 }
6445
6446 /* Open the dst file for writing. */
6447 status = SMB_VFS_CREATE_FILE(
6448 conn, /* conn */
6449 NULL, /* req */
6450 0, /* root_dir_fid */
6451 smb_fname_dst, /* fname */
6452 FILE_GENERIC_WRITE, /* access_mask */
6453 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6454 new_create_disposition, /* create_disposition*/
6455 0, /* create_options */
6456 dosattrs, /* file_attributes */
6457 INTERNAL_OPEN_ONLY, /* oplock_request */
6458 0, /* allocation_size */
6459 0, /* private_flags */
6460 NULL, /* sd */
6461 NULL, /* ea_list */
6462 &fsp2, /* result */
6463 NULL); /* psbuf */
6464
6465 if (!NT_STATUS_IS_OK(status)) {
6466 close_file(NULL, fsp1, ERROR_CLOSE);
6467 goto out;
6468 }
6469
6470 if ((ofun&3) == 1) {
6471 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6472 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6473 /*
6474 * Stop the copy from occurring.
6475 */
6476 ret = -1;
6477 smb_fname_src->st.st_ex_size = 0;
6478 }
6479 }
6480
6481 /* Do the actual copy. */
6482 if (smb_fname_src->st.st_ex_size) {
6483 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6484 }
6485
6486 close_file(NULL, fsp1, NORMAL_CLOSE);
6487
6488 /* Ensure the modtime is set correctly on the destination file. */
6489 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6490
6491 /*
6492 * As we are opening fsp1 read-only we only expect
6493 * an error on close on fsp2 if we are out of space.
6494 * Thus we don't look at the error return from the
6495 * close of fsp1.
6496 */
6497 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6498
6499 if (!NT_STATUS_IS_OK(status)) {
6500 goto out;
6501 }
6502
6503 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6504 status = NT_STATUS_DISK_FULL;
6505 goto out;
6506 }
6507
6508 status = NT_STATUS_OK;
6509
6510 out:
6511 TALLOC_FREE(smb_fname_dst_tmp);
6512 return status;
6513 }
6514
6515 /****************************************************************************
6516 Reply to a file copy.
6517 ****************************************************************************/
6518
6519 void reply_copy(struct smb_request *req)
6520 {
6521 connection_struct *conn = req->conn;
6522 struct smb_filename *smb_fname_src = NULL;
6523 struct smb_filename *smb_fname_dst = NULL;
6524 char *fname_src = NULL;
6525 char *fname_dst = NULL;
6526 char *fname_src_mask = NULL;
6527 char *fname_src_dir = NULL;
6528 const char *p;
6529 int count=0;
6530 int error = ERRnoaccess;
6531 int tid2;
6532 int ofun;
6533 int flags;
6534 bool target_is_directory=False;
6535 bool source_has_wild = False;
6536 bool dest_has_wild = False;
6537 NTSTATUS status;
6538 TALLOC_CTX *ctx = talloc_tos();
6539
6540 START_PROFILE(SMBcopy);
6541
6542 if (req->wct < 3) {
6543 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6544 goto out;
6545 }
6546
6547 tid2 = SVAL(req->vwv+0, 0);
6548 ofun = SVAL(req->vwv+1, 0);
6549 flags = SVAL(req->vwv+2, 0);
6550
6551 p = (const char *)req->buf;
6552 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6553 &status, &source_has_wild);
6554 if (!NT_STATUS_IS_OK(status)) {
6555 reply_nterror(req, status);
6556 goto out;
6557 }
6558 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6559 &status, &dest_has_wild);
6560 if (!NT_STATUS_IS_OK(status)) {
6561 reply_nterror(req, status);
6562 goto out;
6563 }
6564
6565 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6566
6567 if (tid2 != conn->cnum) {
6568 /* can't currently handle inter share copies XXXX */
6569 DEBUG(3,("Rejecting inter-share copy\n"));
6570 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6571 goto out;
6572 }
6573
6574 status = filename_convert(ctx, conn,
6575 req->flags2 & FLAGS2_DFS_PATHNAMES,
6576 fname_src,
6577 UCF_COND_ALLOW_WCARD_LCOMP,
6578 &source_has_wild,
6579 &smb_fname_src);
6580 if (!NT_STATUS_IS_OK(status)) {
6581 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6582 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6583 ERRSRV, ERRbadpath);
6584 goto out;
6585 }
6586 reply_nterror(req, status);
6587 goto out;
6588 }
6589
6590 status = filename_convert(ctx, conn,
6591 req->flags2 & FLAGS2_DFS_PATHNAMES,
6592 fname_dst,
6593 UCF_COND_ALLOW_WCARD_LCOMP,
6594 &dest_has_wild,
6595 &smb_fname_dst);
6596 if (!NT_STATUS_IS_OK(status)) {
6597 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6598 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6599 ERRSRV, ERRbadpath);
6600 goto out;
6601 }
6602 reply_nterror(req, status);
6603 goto out;
6604 }
6605
6606 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6607
6608 if ((flags&1) && target_is_directory) {
6609 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6610 goto out;
6611 }
6612
6613 if ((flags&2) && !target_is_directory) {
6614 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6615 goto out;
6616 }
6617
6618 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6619 /* wants a tree copy! XXXX */
6620 DEBUG(3,("Rejecting tree copy\n"));
6621 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6622 goto out;
6623 }
6624
6625 /* Split up the directory from the filename/mask. */
6626 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6627 &fname_src_dir, &fname_src_mask);
6628 if (!NT_STATUS_IS_OK(status)) {
6629 reply_nterror(req, NT_STATUS_NO_MEMORY);
6630 goto out;
6631 }
6632
6633 /*
6634 * We should only check the mangled cache
6635 * here if unix_convert failed. This means
6636 * that the path in 'mask' doesn't exist
6637 * on the file system and so we need to look
6638 * for a possible mangle. This patch from
6639 * Tine Smukavec <valentin.smukavec@hermes.si>.
6640 */
6641 if (!VALID_STAT(smb_fname_src->st) &&
6642 mangle_is_mangled(fname_src_mask, conn->params)) {
6643 char *new_mask = NULL;
6644 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6645 &new_mask, conn->params);
6646
6647 /* Use demangled name if one was successfully found. */
6648 if (new_mask) {
6649 TALLOC_FREE(fname_src_mask);
6650 fname_src_mask = new_mask;
6651 }
6652 }
6653
6654 if (!source_has_wild) {
6655
6656 /*
6657 * Only one file needs to be copied. Append the mask back onto
6658 * the directory.
6659 */
6660 TALLOC_FREE(smb_fname_src->base_name);
6661 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6662 "%s/%s",
6663 fname_src_dir,
6664 fname_src_mask);
6665 if (!smb_fname_src->base_name) {
6666 reply_nterror(req, NT_STATUS_NO_MEMORY);
6667 goto out;
6668 }
6669
6670 if (dest_has_wild) {
6671 char *fname_dst_mod = NULL;
6672 if (!resolve_wildcards(smb_fname_dst,
6673 smb_fname_src->base_name,
6674 smb_fname_dst->base_name,
6675 &fname_dst_mod)) {
6676 reply_nterror(req, NT_STATUS_NO_MEMORY);
6677 goto out;
6678 }
6679 TALLOC_FREE(smb_fname_dst->base_name);
6680 smb_fname_dst->base_name = fname_dst_mod;
6681 }
6682
6683 status = check_name(conn, smb_fname_src->base_name);
6684 if (!NT_STATUS_IS_OK(status)) {
6685 reply_nterror(req, status);
6686 goto out;
6687 }
6688
6689 status = check_name(conn, smb_fname_dst->base_name);
6690 if (!NT_STATUS_IS_OK(status)) {
6691 reply_nterror(req, status);
6692 goto out;
6693 }
6694
6695 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6696 ofun, count, target_is_directory);
6697
6698 if(!NT_STATUS_IS_OK(status)) {
6699 reply_nterror(req, status);
6700 goto out;
6701 } else {
6702 count++;
6703 }
6704 } else {
6705 struct smb_Dir *dir_hnd = NULL;
6706 const char *dname = NULL;
6707 char *talloced = NULL;
6708 long offset = 0;
6709
6710 /*
6711 * There is a wildcard that requires us to actually read the
6712 * src dir and copy each file matching the mask to the dst.
6713 * Right now streams won't be copied, but this could
6714 * presumably be added with a nested loop for reach dir entry.
6715 */
6716 SMB_ASSERT(!smb_fname_src->stream_name);
6717 SMB_ASSERT(!smb_fname_dst->stream_name);
6718
6719 smb_fname_src->stream_name = NULL;
6720 smb_fname_dst->stream_name = NULL;
6721
6722 if (strequal(fname_src_mask,"????????.???")) {
6723 TALLOC_FREE(fname_src_mask);
6724 fname_src_mask = talloc_strdup(ctx, "*");
6725 if (!fname_src_mask) {
6726 reply_nterror(req, NT_STATUS_NO_MEMORY);
6727 goto out;
6728 }
6729 }
6730
6731 status = check_name(conn, fname_src_dir);
6732 if (!NT_STATUS_IS_OK(status)) {
6733 reply_nterror(req, status);
6734 goto out;
6735 }
6736
6737 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6738 if (dir_hnd == NULL) {
6739 status = map_nt_error_from_unix(errno);
6740 reply_nterror(req, status);
6741 goto out;
6742 }
6743
6744 error = ERRbadfile;
6745
6746 /* Iterate over the src dir copying each entry to the dst. */
6747 while ((dname = ReadDirName(dir_hnd, &offset,
6748 &smb_fname_src->st, &talloced))) {
6749 char *destname = NULL;
6750
6751 if (ISDOT(dname) || ISDOTDOT(dname)) {
6752 TALLOC_FREE(talloced);
6753 continue;
6754 }
6755
6756 if (!is_visible_file(conn, fname_src_dir, dname,
6757 &smb_fname_src->st, false)) {
6758 TALLOC_FREE(talloced);
6759 continue;
6760 }
6761
6762 if(!mask_match(dname, fname_src_mask,
6763 conn->case_sensitive)) {
6764 TALLOC_FREE(talloced);
6765 continue;
6766 }
6767
6768 error = ERRnoaccess;
6769
6770 /* Get the src smb_fname struct setup. */
6771 TALLOC_FREE(smb_fname_src->base_name);
6772 smb_fname_src->base_name =
6773 talloc_asprintf(smb_fname_src, "%s/%s",
6774 fname_src_dir, dname);
6775
6776 if (!smb_fname_src->base_name) {
6777 TALLOC_FREE(dir_hnd);
6778 TALLOC_FREE(talloced);
6779 reply_nterror(req, NT_STATUS_NO_MEMORY);
6780 goto out;
6781 }
6782
6783 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6784 smb_fname_dst->base_name,
6785 &destname)) {
6786 TALLOC_FREE(talloced);
6787 continue;
6788 }
6789 if (!destname) {
6790 TALLOC_FREE(dir_hnd);
6791 TALLOC_FREE(talloced);
6792 reply_nterror(req, NT_STATUS_NO_MEMORY);
6793 goto out;
6794 }
6795
6796 TALLOC_FREE(smb_fname_dst->base_name);
6797 smb_fname_dst->base_name = destname;
6798
6799 status = check_name(conn, smb_fname_src->base_name);
6800 if (!NT_STATUS_IS_OK(status)) {
6801 TALLOC_FREE(dir_hnd);
6802 TALLOC_FREE(talloced);
6803 reply_nterror(req, status);
6804 goto out;
6805 }
6806
6807 status = check_name(conn, smb_fname_dst->base_name);
6808 if (!NT_STATUS_IS_OK(status)) {
6809 TALLOC_FREE(dir_hnd);
6810 TALLOC_FREE(talloced);
6811 reply_nterror(req, status);
6812 goto out;
6813 }
6814
6815 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
6816 smb_fname_src->base_name,
6817 smb_fname_dst->base_name));
6818
6819 status = copy_file(ctx, conn, smb_fname_src,
6820 smb_fname_dst, ofun, count,
6821 target_is_directory);
6822 if (NT_STATUS_IS_OK(status)) {
6823 count++;
6824 }
6825
6826 TALLOC_FREE(talloced);
6827 }
6828 TALLOC_FREE(dir_hnd);
6829 }
6830
6831 if (count == 0) {
6832 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
6833 goto out;
6834 }
6835
6836 reply_outbuf(req, 1, 0);
6837 SSVAL(req->outbuf,smb_vwv0,count);
6838 out:
6839 TALLOC_FREE(smb_fname_src);
6840 TALLOC_FREE(smb_fname_dst);
6841 TALLOC_FREE(fname_src);
6842 TALLOC_FREE(fname_dst);
6843 TALLOC_FREE(fname_src_mask);
6844 TALLOC_FREE(fname_src_dir);
6845
6846 END_PROFILE(SMBcopy);
6847 return;
6848 }
6849
6850 #undef DBGC_CLASS
6851 #define DBGC_CLASS DBGC_LOCKING
6852
6853 /****************************************************************************
6854 Get a lock pid, dealing with large count requests.
6855 ****************************************************************************/
6856
6857 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6858 bool large_file_format)
6859 {
6860 if(!large_file_format)
6861 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6862 else
6863 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6864 }
6865
6866 /****************************************************************************
6867 Get a lock count, dealing with large count requests.
6868 ****************************************************************************/
6869
6870 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6871 bool large_file_format)
6872 {
6873 uint64_t count = 0;
6874
6875 if(!large_file_format) {
6876 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6877 } else {
6878
6879 #if defined(HAVE_LONGLONG)
6880 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6881 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6882 #else /* HAVE_LONGLONG */
6883
6884 /*
6885 * NT4.x seems to be broken in that it sends large file (64 bit)
6886 * lockingX calls even if the CAP_LARGE_FILES was *not*
6887 * negotiated. For boxes without large unsigned ints truncate the
6888 * lock count by dropping the top 32 bits.
6889 */
6890
6891 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6892 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6893 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6894 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6895 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6896 }
6897
6898 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6899 #endif /* HAVE_LONGLONG */
6900 }
6901
6902 return count;
6903 }
6904
6905 #if !defined(HAVE_LONGLONG)
6906 /****************************************************************************
6907 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6908 ****************************************************************************/
6909
6910 static uint32 map_lock_offset(uint32 high, uint32 low)
6911 {
6912 unsigned int i;
6913 uint32 mask = 0;
6914 uint32 highcopy = high;
6915
6916 /*
6917 * Try and find out how many significant bits there are in high.
6918 */
6919
6920 for(i = 0; highcopy; i++)
6921 highcopy >>= 1;
6922
6923 /*
6924 * We use 31 bits not 32 here as POSIX
6925 * lock offsets may not be negative.
6926 */
6927
6928 mask = (~0) << (31 - i);
6929
6930 if(low & mask)
6931 return 0; /* Fail. */
6932
6933 high <<= (31 - i);
6934
6935 return (high|low);
6936 }
6937 #endif /* !defined(HAVE_LONGLONG) */
6938
6939 /****************************************************************************
6940 Get a lock offset, dealing with large offset requests.
6941 ****************************************************************************/
6942
6943 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6944 bool large_file_format, bool *err)
6945 {
6946 uint64_t offset = 0;
6947
6948 *err = False;
6949
6950 if(!large_file_format) {
6951 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6952 } else {
6953
6954 #if defined(HAVE_LONGLONG)
6955 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6956 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6957 #else /* HAVE_LONGLONG */
6958
6959 /*
6960 * NT4.x seems to be broken in that it sends large file (64 bit)
6961 * lockingX calls even if the CAP_LARGE_FILES was *not*
6962 * negotiated. For boxes without large unsigned ints mangle the
6963 * lock offset by mapping the top 32 bits onto the lower 32.
6964 */
6965
6966 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6967 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6968 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6969 uint32 new_low = 0;
6970
6971 if((new_low = map_lock_offset(high, low)) == 0) {
6972 *err = True;
6973 return (uint64_t)-1;
6974 }
6975
6976 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6977 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6978 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6979 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6980 }
6981
6982 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6983 #endif /* HAVE_LONGLONG */
6984 }
6985
6986 return offset;
6987 }
6988
6989 NTSTATUS smbd_do_locking(struct smb_request *req,
6990 files_struct *fsp,
6991 uint8_t type,
6992 int32_t timeout,
6993 uint16_t num_ulocks,
6994 struct smbd_lock_element *ulocks,
6995 uint16_t num_locks,
6996 struct smbd_lock_element *locks,
6997 bool *async)
6998 {
6999 connection_struct *conn = req->conn;
7000 int i;
7001 NTSTATUS status = NT_STATUS_OK;
7002
7003 *async = false;
7004
7005 /* Data now points at the beginning of the list
7006 of smb_unlkrng structs */
7007 for(i = 0; i < (int)num_ulocks; i++) {
7008 struct smbd_lock_element *e = &ulocks[i];
7009
7010 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7011 "pid %u, file %s\n",
7012 (double)e->offset,
7013 (double)e->count,
7014 (unsigned int)e->smbpid,
7015 fsp_str_dbg(fsp)));
7016
7017 if (e->brltype != UNLOCK_LOCK) {
7018 /* this can only happen with SMB2 */
7019 return NT_STATUS_INVALID_PARAMETER;
7020 }
7021
7022 status = do_unlock(smbd_messaging_context(),
7023 fsp,
7024 e->smbpid,
7025 e->count,
7026 e->offset,
7027 WINDOWS_LOCK);
7028
7029 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7030 nt_errstr(status)));
7031
7032 if (!NT_STATUS_IS_OK(status)) {
7033 return status;
7034 }
7035 }
7036
7037 /* Setup the timeout in seconds. */
7038
7039 if (!lp_blocking_locks(SNUM(conn))) {
7040 timeout = 0;
7041 }
7042
7043 /* Data now points at the beginning of the list
7044 of smb_lkrng structs */
7045
7046 for(i = 0; i < (int)num_locks; i++) {
7047 struct smbd_lock_element *e = &locks[i];
7048
7049 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7050 "%u, file %s timeout = %d\n",
7051 (double)e->offset,
7052 (double)e->count,
7053 (unsigned int)e->smbpid,
7054 fsp_str_dbg(fsp),
7055 (int)timeout));
7056
7057 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7058 struct blocking_lock_record *blr = NULL;
7059
7060 if (num_locks > 1) {
7061 /*
7062 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7063 * if the lock vector contains one entry. When given mutliple cancel
7064 * requests in a single PDU we expect the server to return an
7065 * error. Windows servers seem to accept the request but only
7066 * cancel the first lock.
7067 * JRA - Do what Windows does (tm) :-).
7068 */
7069
7070 #if 0
7071 /* MS-CIFS (2.2.4.32.1) behavior. */
7072 return NT_STATUS_DOS(ERRDOS,
7073 ERRcancelviolation);
7074 #else
7075 /* Windows behavior. */
7076 if (i != 0) {
7077 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7078 "cancel request\n"));
7079 continue;
7080 }
7081 #endif
7082 }
7083
7084 if (lp_blocking_locks(SNUM(conn))) {
7085
7086 /* Schedule a message to ourselves to
7087 remove the blocking lock record and
7088 return the right error. */
7089
7090 blr = blocking_lock_cancel(fsp,
7091 e->smbpid,
7092 e->offset,
7093 e->count,
7094 WINDOWS_LOCK,
7095 type,
7096 NT_STATUS_FILE_LOCK_CONFLICT);
7097 if (blr == NULL) {
7098 return NT_STATUS_DOS(
7099 ERRDOS,
7100 ERRcancelviolation);
7101 }
7102 }
7103 /* Remove a matching pending lock. */
7104 status = do_lock_cancel(fsp,
7105 e->smbpid,
7106 e->count,
7107 e->offset,
7108 WINDOWS_LOCK,
7109 blr);
7110 } else {
7111 bool blocking_lock = timeout ? true : false;
7112 bool defer_lock = false;
7113 struct byte_range_lock *br_lck;
7114 uint32_t block_smbpid;
7115
7116 br_lck = do_lock(smbd_messaging_context(),
7117 fsp,
7118 e->smbpid,
7119 e->count,
7120 e->offset,
7121 e->brltype,
7122 WINDOWS_LOCK,
7123 blocking_lock,
7124 &status,
7125 &block_smbpid,
7126 NULL);
7127
7128 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7129 /* Windows internal resolution for blocking locks seems
7130 to be about 200ms... Don't wait for less than that. JRA. */
7131 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7132 timeout = lp_lock_spin_time();
7133 }
7134 defer_lock = true;
7135 }
7136
7137 /* If a lock sent with timeout of zero would fail, and
7138 * this lock has been requested multiple times,
7139 * according to brl_lock_failed() we convert this
7140 * request to a blocking lock with a timeout of between
7141 * 150 - 300 milliseconds.
7142 *
7143 * If lp_lock_spin_time() has been set to 0, we skip
7144 * this blocking retry and fail immediately.
7145 *
7146 * Replacement for do_lock_spin(). JRA. */
7147
7148 if (br_lck && lp_blocking_locks(SNUM(conn)) &&
7149 lp_lock_spin_time() && !blocking_lock &&
7150 NT_STATUS_EQUAL((status),
7151 NT_STATUS_FILE_LOCK_CONFLICT))
7152 {
7153 defer_lock = true;
7154 timeout = lp_lock_spin_time();
7155 }
7156
7157 if (br_lck && defer_lock) {
7158 /*
7159 * A blocking lock was requested. Package up
7160 * this smb into a queued request and push it
7161 * onto the blocking lock queue.
7162 */
7163 if(push_blocking_lock_request(br_lck,
7164 req,
7165 fsp,
7166 timeout,
7167 i,
7168 e->smbpid,
7169 e->brltype,
7170 WINDOWS_LOCK,
7171 e->offset,
7172 e->count,
7173 block_smbpid)) {
7174 TALLOC_FREE(br_lck);
7175 *async = true;
7176 return NT_STATUS_OK;
7177 }
7178 }
7179
7180 TALLOC_FREE(br_lck);
7181 }
7182
7183 if (!NT_STATUS_IS_OK(status)) {
7184 break;
7185 }
7186 }
7187
7188 /* If any of the above locks failed, then we must unlock
7189 all of the previous locks (X/Open spec). */
7190
7191 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7192
7193 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7194 i = -1; /* we want to skip the for loop */
7195 }
7196
7197 /*
7198 * Ensure we don't do a remove on the lock that just failed,
7199 * as under POSIX rules, if we have a lock already there, we
7200 * will delete it (and we shouldn't) .....
7201 */
7202 for(i--; i >= 0; i--) {
7203 struct smbd_lock_element *e = &locks[i];
7204
7205 do_unlock(smbd_messaging_context(),
7206 fsp,
7207 e->smbpid,
7208 e->count,
7209 e->offset,
7210 WINDOWS_LOCK);
7211 }
7212 return status;
7213 }
7214
7215 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7216 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7217
7218 return NT_STATUS_OK;
7219 }
7220
7221 /****************************************************************************
7222 Reply to a lockingX request.
7223 ****************************************************************************/
7224
7225 void reply_lockingX(struct smb_request *req)
7226 {
7227 connection_struct *conn = req->conn;
7228 files_struct *fsp;
7229 unsigned char locktype;
7230 unsigned char oplocklevel;
7231 uint16 num_ulocks;
7232 uint16 num_locks;
7233 int32 lock_timeout;
7234 int i;
7235 const uint8_t *data;
7236 bool large_file_format;
7237 bool err;
7238 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7239 struct smbd_lock_element *ulocks;
7240 struct smbd_lock_element *locks;
7241 bool async = false;
7242
7243 START_PROFILE(SMBlockingX);
7244
7245 if (req->wct < 8) {
7246 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7247 END_PROFILE(SMBlockingX);
7248 return;
7249 }
7250
7251 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7252 locktype = CVAL(req->vwv+3, 0);
7253 oplocklevel = CVAL(req->vwv+3, 1);
7254 num_ulocks = SVAL(req->vwv+6, 0);
7255 num_locks = SVAL(req->vwv+7, 0);
7256 lock_timeout = IVAL(req->vwv+4, 0);
7257 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7258
7259 if (!check_fsp(conn, req, fsp)) {
7260 END_PROFILE(SMBlockingX);
7261 return;
7262 }
7263
7264 data = req->buf;
7265
7266 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7267 /* we don't support these - and CANCEL_LOCK makes w2k
7268 and XP reboot so I don't really want to be
7269 compatible! (tridge) */
7270 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7271 END_PROFILE(SMBlockingX);
7272 return;
7273 }
7274
7275 /* Check if this is an oplock break on a file
7276 we have granted an oplock on.
7277 */
7278 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7279 /* Client can insist on breaking to none. */
7280 bool break_to_none = (oplocklevel == 0);
7281 bool result;
7282
7283 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7284 "for fnum = %d\n", (unsigned int)oplocklevel,
7285 fsp->fnum ));
7286
7287 /*
7288 * Make sure we have granted an exclusive or batch oplock on
7289 * this file.
7290 */
7291
7292 if (fsp->oplock_type == 0) {
7293
7294 /* The Samba4 nbench simulator doesn't understand
7295 the difference between break to level2 and break
7296 to none from level2 - it sends oplock break
7297 replies in both cases. Don't keep logging an error
7298 message here - just ignore it. JRA. */
7299
7300 DEBUG(5,("reply_lockingX: Error : oplock break from "
7301 "client for fnum = %d (oplock=%d) and no "
7302 "oplock granted on this file (%s).\n",
7303 fsp->fnum, fsp->oplock_type,
7304 fsp_str_dbg(fsp)));
7305
7306 /* if this is a pure oplock break request then don't
7307 * send a reply */
7308 if (num_locks == 0 && num_ulocks == 0) {
7309 END_PROFILE(SMBlockingX);
7310 return;
7311 } else {
7312 END_PROFILE(SMBlockingX);
7313 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7314 return;
7315 }
7316 }
7317
7318 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7319 (break_to_none)) {
7320 result = remove_oplock(fsp);
7321 } else {
7322 result = downgrade_oplock(fsp);
7323 }
7324
7325 if (!result) {
7326 DEBUG(0, ("reply_lockingX: error in removing "
7327 "oplock on file %s\n", fsp_str_dbg(fsp)));
7328 /* Hmmm. Is this panic justified? */
7329 smb_panic("internal tdb error");
7330 }
7331
7332 reply_to_oplock_break_requests(fsp);
7333
7334 /* if this is a pure oplock break request then don't send a
7335 * reply */
7336 if (num_locks == 0 && num_ulocks == 0) {
7337 /* Sanity check - ensure a pure oplock break is not a
7338 chained request. */
7339 if(CVAL(req->vwv+0, 0) != 0xff)
7340 DEBUG(0,("reply_lockingX: Error : pure oplock "
7341 "break is a chained %d request !\n",
7342 (unsigned int)CVAL(req->vwv+0, 0)));
7343 END_PROFILE(SMBlockingX);
7344 return;
7345 }
7346 }
7347
7348 if (req->buflen <
7349 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7350 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7351 END_PROFILE(SMBlockingX);
7352 return;
7353 }
7354
7355 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7356 if (ulocks == NULL) {
7357 reply_nterror(req, NT_STATUS_NO_MEMORY);
7358 END_PROFILE(SMBlockingX);
7359 return;
7360 }
7361
7362 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7363 if (locks == NULL) {
7364 reply_nterror(req, NT_STATUS_NO_MEMORY);
7365 END_PROFILE(SMBlockingX);
7366 return;
7367 }
7368
7369 /* Data now points at the beginning of the list
7370 of smb_unlkrng structs */
7371 for(i = 0; i < (int)num_ulocks; i++) {
7372 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7373 ulocks[i].count = get_lock_count(data, i, large_file_format);
7374 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7375 ulocks[i].brltype = UNLOCK_LOCK;
7376
7377 /*
7378 * There is no error code marked "stupid client bug".... :-).
7379 */
7380 if(err) {
7381 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7382 END_PROFILE(SMBlockingX);
7383 return;
7384 }
7385 }
7386
7387 /* Now do any requested locks */
7388 data += ((large_file_format ? 20 : 10)*num_ulocks);
7389
7390 /* Data now points at the beginning of the list
7391 of smb_lkrng structs */
7392
7393 for(i = 0; i < (int)num_locks; i++) {
7394 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7395 locks[i].count = get_lock_count(data, i, large_file_format);
7396 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7397
7398 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7399 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7400 locks[i].brltype = PENDING_READ_LOCK;
7401 } else {
7402 locks[i].brltype = READ_LOCK;
7403 }
7404 } else {
7405 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7406 locks[i].brltype = PENDING_WRITE_LOCK;
7407 } else {
7408 locks[i].brltype = WRITE_LOCK;
7409 }
7410 }
7411
7412 /*
7413 * There is no error code marked "stupid client bug".... :-).
7414 */
7415 if(err) {
7416 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7417 END_PROFILE(SMBlockingX);
7418 return;
7419 }
7420 }
7421
7422 status = smbd_do_locking(req, fsp,
7423 locktype, lock_timeout,
7424 num_ulocks, ulocks,
7425 num_locks, locks,
7426 &async);
7427 if (!NT_STATUS_IS_OK(status)) {
7428 END_PROFILE(SMBlockingX);
7429 reply_nterror(req, status);
7430 return;
7431 }
7432 if (async) {
7433 END_PROFILE(SMBlockingX);
7434 return;
7435 }
7436
7437 reply_outbuf(req, 2, 0);
7438
7439 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7440 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7441
7442 END_PROFILE(SMBlockingX);
7443 chain_reply(req);
7444 }
7445
7446 #undef DBGC_CLASS
7447 #define DBGC_CLASS DBGC_ALL
7448
7449 /****************************************************************************
7450 Reply to a SMBreadbmpx (read block multiplex) request.
7451 Always reply with an error, if someone has a platform really needs this,
7452 please contact vl@samba.org
7453 ****************************************************************************/
7454
7455 void reply_readbmpx(struct smb_request *req)
7456 {
7457 START_PROFILE(SMBreadBmpx);
7458 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7459 END_PROFILE(SMBreadBmpx);
7460 return;
7461 }
7462
7463 /****************************************************************************
7464 Reply to a SMBreadbs (read block multiplex secondary) request.
7465 Always reply with an error, if someone has a platform really needs this,
7466 please contact vl@samba.org
7467 ****************************************************************************/
7468
7469 void reply_readbs(struct smb_request *req)
7470 {
7471 START_PROFILE(SMBreadBs);
7472 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7473 END_PROFILE(SMBreadBs);
7474 return;
7475 }
7476
7477 /****************************************************************************
7478 Reply to a SMBsetattrE.
7479 ****************************************************************************/
7480
7481 void reply_setattrE(struct smb_request *req)
7482 {
7483 connection_struct *conn = req->conn;
7484 struct smb_file_time ft;
7485 files_struct *fsp;
7486 NTSTATUS status;
7487
7488 START_PROFILE(SMBsetattrE);
7489 ZERO_STRUCT(ft);
7490
7491 if (req->wct < 7) {
7492 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7493 goto out;
7494 }
7495
7496 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7497
7498 if(!fsp || (fsp->conn != conn)) {
7499 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7500 goto out;
7501 }
7502
7503 /*
7504 * Convert the DOS times into unix times.
7505 */
7506
7507 ft.atime = convert_time_t_to_timespec(
7508 srv_make_unix_date2(req->vwv+3));
7509 ft.mtime = convert_time_t_to_timespec(
7510 srv_make_unix_date2(req->vwv+5));
7511 ft.create_time = convert_time_t_to_timespec(
7512 srv_make_unix_date2(req->vwv+1));
7513
7514 reply_outbuf(req, 0, 0);
7515
7516 /*
7517 * Patch from Ray Frush <frush@engr.colostate.edu>
7518 * Sometimes times are sent as zero - ignore them.
7519 */
7520
7521 /* Ensure we have a valid stat struct for the source. */
7522 status = vfs_stat_fsp(fsp);
7523 if (!NT_STATUS_IS_OK(status)) {
7524 reply_nterror(req, status);
7525 goto out;
7526 }
7527
7528 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7529 if (!NT_STATUS_IS_OK(status)) {
7530 reply_nterror(req, status);
7531 goto out;
7532 }
7533
7534 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7535 " createtime=%u\n",
7536 fsp->fnum,
7537 (unsigned int)ft.atime.tv_sec,
7538 (unsigned int)ft.mtime.tv_sec,
7539 (unsigned int)ft.create_time.tv_sec
7540 ));
7541 out:
7542 END_PROFILE(SMBsetattrE);
7543 return;
7544 }
7545
7546
7547 /* Back from the dead for OS/2..... JRA. */
7548
7549 /****************************************************************************
7550 Reply to a SMBwritebmpx (write block multiplex primary) request.
7551 Always reply with an error, if someone has a platform really needs this,
7552 please contact vl@samba.org
7553 ****************************************************************************/
7554
7555 void reply_writebmpx(struct smb_request *req)
7556 {
7557 START_PROFILE(SMBwriteBmpx);
7558 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7559 END_PROFILE(SMBwriteBmpx);
7560 return;
7561 }
7562
7563 /****************************************************************************
7564 Reply to a SMBwritebs (write block multiplex secondary) request.
7565 Always reply with an error, if someone has a platform really needs this,
7566 please contact vl@samba.org
7567 ****************************************************************************/
7568
7569 void reply_writebs(struct smb_request *req)
7570 {
7571 START_PROFILE(SMBwriteBs);
7572 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7573 END_PROFILE(SMBwriteBs);
7574 return;
7575 }
7576
7577 /****************************************************************************
7578 Reply to a SMBgetattrE.
7579 ****************************************************************************/
7580
7581 void reply_getattrE(struct smb_request *req)
7582 {
7583 connection_struct *conn = req->conn;
7584 int mode;
7585 files_struct *fsp;
7586 struct timespec create_ts;
7587
7588 START_PROFILE(SMBgetattrE);
7589
7590 if (req->wct < 1) {
7591 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7592 END_PROFILE(SMBgetattrE);
7593 return;
7594 }
7595
7596 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7597
7598 if(!fsp || (fsp->conn != conn)) {
7599 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7600 END_PROFILE(SMBgetattrE);
7601 return;
7602 }
7603
7604 /* Do an fstat on this file */
7605 if(fsp_stat(fsp)) {
7606 reply_nterror(req, map_nt_error_from_unix(errno));
7607 END_PROFILE(SMBgetattrE);
7608 return;
7609 }
7610
7611 mode = dos_mode(conn, fsp->fsp_name);
7612
7613 /*
7614 * Convert the times into dos times. Set create
7615 * date to be last modify date as UNIX doesn't save
7616 * this.
7617 */
7618
7619 reply_outbuf(req, 11, 0);
7620
7621 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7622 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7623 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7624 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7625 /* Should we check pending modtime here ? JRA */
7626 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7627 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7628
7629 if (mode & aDIR) {
7630 SIVAL(req->outbuf, smb_vwv6, 0);
7631 SIVAL(req->outbuf, smb_vwv8, 0);
7632 } else {
7633 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7634 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7635 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7636 }
7637 SSVAL(req->outbuf,smb_vwv10, mode);
7638
7639 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7640
7641 END_PROFILE(SMBgetattrE);
7642 return;
7643 }