?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbd: Explicitly pass "file_id" to rename_open_files
[Samba/reqa.git] / source3 / smbd / reply.c
bloba66aa5a6dba2de4a42033a0325471a49a3be9b14
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const char *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
432 const char *name, int name_type)
433 {
434 char *trim_name;
435 char *trim_name_type;
436 const char *retarget_parm;
437 char *retarget;
438 char *p;
439 int retarget_type = 0x20;
440 int retarget_port = NBT_SMB_PORT;
441 struct sockaddr_storage retarget_addr;
442 struct sockaddr_in *in_addr;
443 bool ret = false;
444 uint8_t outbuf[10];
445
446 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
447 return false;
448 }
449
450 trim_name = talloc_strdup(talloc_tos(), name);
451 if (trim_name == NULL) {
452 goto fail;
453 }
454 trim_char(trim_name, ' ', ' ');
455
456 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
457 name_type);
458 if (trim_name_type == NULL) {
459 goto fail;
460 }
461
462 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
463 trim_name_type, NULL);
464 if (retarget_parm == NULL) {
465 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
466 trim_name, NULL);
467 }
468 if (retarget_parm == NULL) {
469 goto fail;
470 }
471
472 retarget = talloc_strdup(trim_name, retarget_parm);
473 if (retarget == NULL) {
474 goto fail;
475 }
476
477 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
478
479 p = strchr(retarget, ':');
480 if (p != NULL) {
481 *p++ = '\0';
482 retarget_port = atoi(p);
483 }
484
485 p = strchr_m(retarget, '#');
486 if (p != NULL) {
487 *p++ = '\0';
488 if (sscanf(p, "%x", &retarget_type) != 1) {
489 goto fail;
490 }
491 }
492
493 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
494 if (!ret) {
495 DEBUG(10, ("could not resolve %s\n", retarget));
496 goto fail;
497 }
498
499 if (retarget_addr.ss_family != AF_INET) {
500 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
501 goto fail;
502 }
503
504 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
505
506 _smb_setlen(outbuf, 6);
507 SCVAL(outbuf, 0, 0x84);
508 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
509 *(uint16_t *)(outbuf+8) = htons(retarget_port);
510
511 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
512 NULL)) {
513 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
514 "failed.");
515 }
516
517 ret = true;
518 fail:
519 TALLOC_FREE(trim_name);
520 return ret;
521 }
522
523 static void reply_called_name_not_present(char *outbuf)
524 {
525 smb_setlen(outbuf, 1);
526 SCVAL(outbuf, 0, 0x83);
527 SCVAL(outbuf, 4, 0x82);
528 }
529
530 /****************************************************************************
531 Reply to a (netbios-level) special message.
532 ****************************************************************************/
533
534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
535 {
536 int msg_type = CVAL(inbuf,0);
537 int msg_flags = CVAL(inbuf,1);
538 /*
539 * We only really use 4 bytes of the outbuf, but for the smb_setlen
540 * calculation & friends (srv_send_smb uses that) we need the full smb
541 * header.
542 */
543 char outbuf[smb_size];
544
545 memset(outbuf, '\0', sizeof(outbuf));
546
547 smb_setlen(outbuf,0);
548
549 switch (msg_type) {
550 case NBSSrequest: /* session request */
551 {
552 /* inbuf_size is guarenteed to be at least 4. */
553 fstring name1,name2;
554 int name_type1, name_type2;
555 int name_len1, name_len2;
556
557 *name1 = *name2 = 0;
558
559 if (sconn->nbt.got_session) {
560 exit_server_cleanly("multiple session request not permitted");
561 }
562
563 SCVAL(outbuf,0,NBSSpositive);
564 SCVAL(outbuf,3,0);
565
566 /* inbuf_size is guaranteed to be at least 4. */
567 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
568 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
569 DEBUG(0,("Invalid name length in session request\n"));
570 reply_called_name_not_present(outbuf);
571 break;
572 }
573 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
574 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
575 DEBUG(0,("Invalid name length in session request\n"));
576 reply_called_name_not_present(outbuf);
577 break;
578 }
579
580 name_type1 = name_extract((unsigned char *)inbuf,
581 inbuf_size,(unsigned int)4,name1);
582 name_type2 = name_extract((unsigned char *)inbuf,
583 inbuf_size,(unsigned int)(4 + name_len1),name2);
584
585 if (name_type1 == -1 || name_type2 == -1) {
586 DEBUG(0,("Invalid name type in session request\n"));
587 reply_called_name_not_present(outbuf);
588 break;
589 }
590
591 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
592 name1, name_type1, name2, name_type2));
593
594 if (netbios_session_retarget(sconn, name1, name_type1)) {
595 exit_server_cleanly("retargeted client");
596 }
597
598 /*
599 * Windows NT/2k uses "*SMBSERVER" and XP uses
600 * "*SMBSERV" arrggg!!!
601 */
602 if (strequal(name1, "*SMBSERVER ")
603 || strequal(name1, "*SMBSERV ")) {
604 char *raddr;
605
606 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
607 talloc_tos());
608 if (raddr == NULL) {
609 exit_server_cleanly("could not allocate raddr");
610 }
611
612 fstrcpy(name1, raddr);
613 }
614
615 set_local_machine_name(name1, True);
616 set_remote_machine_name(name2, True);
617
618 if (is_ipaddress(sconn->remote_hostname)) {
619 char *p = discard_const_p(char, sconn->remote_hostname);
620
621 talloc_free(p);
622
623 sconn->remote_hostname = talloc_strdup(sconn,
624 get_remote_machine_name());
625 if (sconn->remote_hostname == NULL) {
626 exit_server_cleanly("could not copy remote name");
627 }
628 sconn->conn->remote_hostname = sconn->remote_hostname;
629 }
630
631 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
632 get_local_machine_name(), get_remote_machine_name(),
633 name_type2));
634
635 if (name_type2 == 'R') {
636 /* We are being asked for a pathworks session ---
637 no thanks! */
638 reply_called_name_not_present(outbuf);
639 break;
640 }
641
642 reload_services(sconn, conn_snum_used, true);
643 reopen_logs();
644
645 sconn->nbt.got_session = true;
646 break;
647 }
648
649 case 0x89: /* session keepalive request
650 (some old clients produce this?) */
651 SCVAL(outbuf,0,NBSSkeepalive);
652 SCVAL(outbuf,3,0);
653 break;
654
655 case NBSSpositive: /* positive session response */
656 case NBSSnegative: /* negative session response */
657 case NBSSretarget: /* retarget session response */
658 DEBUG(0,("Unexpected session response\n"));
659 break;
660
661 case NBSSkeepalive: /* session keepalive */
662 default:
663 return;
664 }
665
666 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
667 msg_type, msg_flags));
668
669 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
670
671 if (CVAL(outbuf, 0) != 0x82) {
672 exit_server_cleanly("invalid netbios session");
673 }
674 return;
675 }
676
677 /****************************************************************************
678 Reply to a tcon.
679 conn POINTER CAN BE NULL HERE !
680 ****************************************************************************/
681
682 void reply_tcon(struct smb_request *req)
683 {
684 connection_struct *conn = req->conn;
685 const char *service;
686 char *service_buf = NULL;
687 char *password = NULL;
688 char *dev = NULL;
689 int pwlen=0;
690 NTSTATUS nt_status;
691 const char *p;
692 TALLOC_CTX *ctx = talloc_tos();
693 struct smbd_server_connection *sconn = req->sconn;
694 NTTIME now = timeval_to_nttime(&req->request_time);
695
696 START_PROFILE(SMBtcon);
697
698 if (req->buflen < 4) {
699 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
700 END_PROFILE(SMBtcon);
701 return;
702 }
703
704 p = (const char *)req->buf + 1;
705 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
706 p += 1;
707 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
708 p += pwlen+1;
709 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
710 p += 1;
711
712 if (service_buf == NULL || password == NULL || dev == NULL) {
713 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
714 END_PROFILE(SMBtcon);
715 return;
716 }
717 p = strrchr_m(service_buf,'\\');
718 if (p) {
719 service = p+1;
720 } else {
721 service = service_buf;
722 }
723
724 conn = make_connection(sconn, now, service, dev,
725 req->vuid,&nt_status);
726 req->conn = conn;
727
728 if (!conn) {
729 reply_nterror(req, nt_status);
730 END_PROFILE(SMBtcon);
731 return;
732 }
733
734 reply_outbuf(req, 2, 0);
735 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
736 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
737 SSVAL(req->outbuf,smb_tid,conn->cnum);
738
739 DEBUG(3,("tcon service=%s cnum=%d\n",
740 service, conn->cnum));
741
742 END_PROFILE(SMBtcon);
743 return;
744 }
745
746 /****************************************************************************
747 Reply to a tcon and X.
748 conn POINTER CAN BE NULL HERE !
749 ****************************************************************************/
750
751 void reply_tcon_and_X(struct smb_request *req)
752 {
753 connection_struct *conn = req->conn;
754 const char *service = NULL;
755 TALLOC_CTX *ctx = talloc_tos();
756 /* what the cleint thinks the device is */
757 char *client_devicetype = NULL;
758 /* what the server tells the client the share represents */
759 const char *server_devicetype;
760 NTSTATUS nt_status;
761 int passlen;
762 char *path = NULL;
763 const char *p, *q;
764 uint16_t tcon_flags;
765 struct smbXsrv_session *session = NULL;
766 NTTIME now = timeval_to_nttime(&req->request_time);
767 bool session_key_updated = false;
768 uint16_t optional_support = 0;
769 struct smbd_server_connection *sconn = req->sconn;
770
771 START_PROFILE(SMBtconX);
772
773 if (req->wct < 4) {
774 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
775 END_PROFILE(SMBtconX);
776 return;
777 }
778
779 passlen = SVAL(req->vwv+3, 0);
780 tcon_flags = SVAL(req->vwv+2, 0);
781
782 /* we might have to close an old one */
783 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
784 struct smbXsrv_tcon *tcon;
785 NTSTATUS status;
786
787 tcon = conn->tcon;
788 req->conn = NULL;
789 conn = NULL;
790
791 /*
792 * TODO: cancel all outstanding requests on the tcon
793 */
794 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
795 if (!NT_STATUS_IS_OK(status)) {
796 DEBUG(0, ("reply_tcon_and_X: "
797 "smbXsrv_tcon_disconnect() failed: %s\n",
798 nt_errstr(status)));
799 /*
800 * If we hit this case, there is something completely
801 * wrong, so we better disconnect the transport connection.
802 */
803 END_PROFILE(SMBtconX);
804 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
805 return;
806 }
807
808 TALLOC_FREE(tcon);
809 }
810
811 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
812 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
813 END_PROFILE(SMBtconX);
814 return;
815 }
816
817 if (sconn->smb1.negprot.encrypted_passwords) {
818 p = (const char *)req->buf + passlen;
819 } else {
820 p = (const char *)req->buf + passlen + 1;
821 }
822
823 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
824
825 if (path == NULL) {
826 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
827 END_PROFILE(SMBtconX);
828 return;
829 }
830
831 /*
832 * the service name can be either: \\server\share
833 * or share directly like on the DELL PowerVault 705
834 */
835 if (*path=='\\') {
836 q = strchr_m(path+2,'\\');
837 if (!q) {
838 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
839 END_PROFILE(SMBtconX);
840 return;
841 }
842 service = q+1;
843 } else {
844 service = path;
845 }
846
847 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
848 &client_devicetype, p,
849 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
850
851 if (client_devicetype == NULL) {
852 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
853 END_PROFILE(SMBtconX);
854 return;
855 }
856
857 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
858
859 nt_status = smb1srv_session_lookup(req->sconn->conn,
860 req->vuid, now, &session);
861 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
862 reply_force_doserror(req, ERRSRV, ERRbaduid);
863 END_PROFILE(SMBtconX);
864 return;
865 }
866 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
867 reply_nterror(req, nt_status);
868 END_PROFILE(SMBtconX);
869 return;
870 }
871 if (!NT_STATUS_IS_OK(nt_status)) {
872 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
873 END_PROFILE(SMBtconX);
874 return;
875 }
876
877 if (session->global->auth_session_info == NULL) {
878 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
879 END_PROFILE(SMBtconX);
880 return;
881 }
882
883 /*
884 * If there is no application key defined yet
885 * we create one.
886 *
887 * This means we setup the application key on the
888 * first tcon that happens via the given session.
889 *
890 * Once the application key is defined, it does not
891 * change any more.
892 */
893 if (session->global->application_key.length == 0 &&
894 session->global->signing_key.length > 0)
895 {
896 struct smbXsrv_session *x = session;
897 struct auth_session_info *session_info =
898 session->global->auth_session_info;
899 uint8_t session_key[16];
900
901 ZERO_STRUCT(session_key);
902 memcpy(session_key, x->global->signing_key.data,
903 MIN(x->global->signing_key.length, sizeof(session_key)));
904
905 /*
906 * The application key is truncated/padded to 16 bytes
907 */
908 x->global->application_key = data_blob_talloc(x->global,
909 session_key,
910 sizeof(session_key));
911 ZERO_STRUCT(session_key);
912 if (x->global->application_key.data == NULL) {
913 reply_nterror(req, NT_STATUS_NO_MEMORY);
914 END_PROFILE(SMBtconX);
915 return;
916 }
917
918 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
919 smb_key_derivation(x->global->application_key.data,
920 x->global->application_key.length,
921 x->global->application_key.data);
922 optional_support |= SMB_EXTENDED_SIGNATURES;
923 }
924
925 /*
926 * Place the application key into the session_info
927 */
928 data_blob_clear_free(&session_info->session_key);
929 session_info->session_key = data_blob_dup_talloc(session_info,
930 x->global->application_key);
931 if (session_info->session_key.data == NULL) {
932 data_blob_clear_free(&x->global->application_key);
933 reply_nterror(req, NT_STATUS_NO_MEMORY);
934 END_PROFILE(SMBtconX);
935 return;
936 }
937 session_key_updated = true;
938 }
939
940 conn = make_connection(sconn, now, service, client_devicetype,
941 req->vuid, &nt_status);
942 req->conn =conn;
943
944 if (!conn) {
945 if (session_key_updated) {
946 struct smbXsrv_session *x = session;
947 struct auth_session_info *session_info =
948 session->global->auth_session_info;
949 data_blob_clear_free(&x->global->application_key);
950 data_blob_clear_free(&session_info->session_key);
951 }
952 reply_nterror(req, nt_status);
953 END_PROFILE(SMBtconX);
954 return;
955 }
956
957 if ( IS_IPC(conn) )
958 server_devicetype = "IPC";
959 else if ( IS_PRINT(conn) )
960 server_devicetype = "LPT1:";
961 else
962 server_devicetype = "A:";
963
964 if (get_Protocol() < PROTOCOL_NT1) {
965 reply_outbuf(req, 2, 0);
966 if (message_push_string(&req->outbuf, server_devicetype,
967 STR_TERMINATE|STR_ASCII) == -1) {
968 reply_nterror(req, NT_STATUS_NO_MEMORY);
969 END_PROFILE(SMBtconX);
970 return;
971 }
972 } else {
973 /* NT sets the fstype of IPC$ to the null string */
974 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
975
976 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
977 /* Return permissions. */
978 uint32 perm1 = 0;
979 uint32 perm2 = 0;
980
981 reply_outbuf(req, 7, 0);
982
983 if (IS_IPC(conn)) {
984 perm1 = FILE_ALL_ACCESS;
985 perm2 = FILE_ALL_ACCESS;
986 } else {
987 perm1 = conn->share_access;
988 }
989
990 SIVAL(req->outbuf, smb_vwv3, perm1);
991 SIVAL(req->outbuf, smb_vwv5, perm2);
992 } else {
993 reply_outbuf(req, 3, 0);
994 }
995
996 if ((message_push_string(&req->outbuf, server_devicetype,
997 STR_TERMINATE|STR_ASCII) == -1)
998 || (message_push_string(&req->outbuf, fstype,
999 STR_TERMINATE) == -1)) {
1000 reply_nterror(req, NT_STATUS_NO_MEMORY);
1001 END_PROFILE(SMBtconX);
1002 return;
1003 }
1004
1005 /* what does setting this bit do? It is set by NT4 and
1006 may affect the ability to autorun mounted cdroms */
1007 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008 optional_support |=
1009 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012 DEBUG(2,("Serving %s as a Dfs root\n",
1013 lp_servicename(ctx, SNUM(conn)) ));
1014 optional_support |= SMB_SHARE_IN_DFS;
1015 }
1016
1017 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018 }
1019
1020 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1022
1023 DEBUG(3,("tconX service=%s \n",
1024 service));
1025
1026 /* set the incoming and outgoing tid to the just created one */
1027 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028 SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030 END_PROFILE(SMBtconX);
1031
1032 req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036 Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042 smb_fn_name(type), type, type));
1043 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044 return;
1045 }
1046
1047 /****************************************************************************
1048 Reply to an ioctl.
1049 conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054 connection_struct *conn = req->conn;
1055 uint16 device;
1056 uint16 function;
1057 uint32 ioctl_code;
1058 int replysize;
1059 char *p;
1060
1061 START_PROFILE(SMBioctl);
1062
1063 if (req->wct < 3) {
1064 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065 END_PROFILE(SMBioctl);
1066 return;
1067 }
1068
1069 device = SVAL(req->vwv+1, 0);
1070 function = SVAL(req->vwv+2, 0);
1071 ioctl_code = (device << 16) + function;
1072
1073 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075 switch (ioctl_code) {
1076 case IOCTL_QUERY_JOB_INFO:
1077 replysize = 32;
1078 break;
1079 default:
1080 reply_force_doserror(req, ERRSRV, ERRnosupport);
1081 END_PROFILE(SMBioctl);
1082 return;
1083 }
1084
1085 reply_outbuf(req, 8, replysize+1);
1086 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1089 p = smb_buf(req->outbuf);
1090 memset(p, '\0', replysize+1); /* valgrind-safe. */
1091 p += 1; /* Allow for alignment */
1092
1093 switch (ioctl_code) {
1094 case IOCTL_QUERY_JOB_INFO:
1095 {
1096 files_struct *fsp = file_fsp(
1097 req, SVAL(req->vwv+0, 0));
1098 if (!fsp) {
1099 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100 END_PROFILE(SMBioctl);
1101 return;
1102 }
1103 /* Job number */
1104 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106 srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107 lp_netbios_name(), 15,
1108 STR_TERMINATE|STR_ASCII);
1109 if (conn) {
1110 srvstr_push((char *)req->outbuf, req->flags2,
1111 p+18,
1112 lp_servicename(talloc_tos(),
1113 SNUM(conn)),
1114 13, STR_TERMINATE|STR_ASCII);
1115 } else {
1116 memset(p+18, 0, 13);
1117 }
1118 break;
1119 }
1120 }
1121
1122 END_PROFILE(SMBioctl);
1123 return;
1124 }
1125
1126 /****************************************************************************
1127 Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132 /* Strange DOS error code semantics only for checkpath... */
1133 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135 /* We need to map to ERRbadpath */
1136 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137 }
1138 }
1139 return status;
1140 }
1141
1142 /****************************************************************************
1143 Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148 connection_struct *conn = req->conn;
1149 struct smb_filename *smb_fname = NULL;
1150 char *name = NULL;
1151 NTSTATUS status;
1152 TALLOC_CTX *ctx = talloc_tos();
1153
1154 START_PROFILE(SMBcheckpath);
1155
1156 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157 STR_TERMINATE, &status);
1158
1159 if (!NT_STATUS_IS_OK(status)) {
1160 status = map_checkpath_error(req->flags2, status);
1161 reply_nterror(req, status);
1162 END_PROFILE(SMBcheckpath);
1163 return;
1164 }
1165
1166 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168 status = filename_convert(ctx,
1169 conn,
1170 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171 name,
1172 0,
1173 NULL,
1174 &smb_fname);
1175
1176 if (!NT_STATUS_IS_OK(status)) {
1177 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179 ERRSRV, ERRbadpath);
1180 END_PROFILE(SMBcheckpath);
1181 return;
1182 }
1183 goto path_err;
1184 }
1185
1186 if (!VALID_STAT(smb_fname->st) &&
1187 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189 smb_fname_str_dbg(smb_fname), strerror(errno)));
1190 status = map_nt_error_from_unix(errno);
1191 goto path_err;
1192 }
1193
1194 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196 ERRDOS, ERRbadpath);
1197 goto out;
1198 }
1199
1200 reply_outbuf(req, 0, 0);
1201
1202 path_err:
1203 /* We special case this - as when a Windows machine
1204 is parsing a path is steps through the components
1205 one at a time - if a component fails it expects
1206 ERRbadpath, not ERRbadfile.
1207 */
1208 status = map_checkpath_error(req->flags2, status);
1209 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210 /*
1211 * Windows returns different error codes if
1212 * the parent directory is valid but not the
1213 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215 * if the path is invalid.
1216 */
1217 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218 ERRDOS, ERRbadpath);
1219 goto out;
1220 }
1221
1222 reply_nterror(req, status);
1223
1224 out:
1225 TALLOC_FREE(smb_fname);
1226 END_PROFILE(SMBcheckpath);
1227 return;
1228 }
1229
1230 /****************************************************************************
1231 Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236 connection_struct *conn = req->conn;
1237 struct smb_filename *smb_fname = NULL;
1238 char *fname = NULL;
1239 int mode=0;
1240 off_t size=0;
1241 time_t mtime=0;
1242 const char *p;
1243 NTSTATUS status;
1244 TALLOC_CTX *ctx = talloc_tos();
1245 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247 START_PROFILE(SMBgetatr);
1248
1249 p = (const char *)req->buf + 1;
1250 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251 if (!NT_STATUS_IS_OK(status)) {
1252 reply_nterror(req, status);
1253 goto out;
1254 }
1255
1256 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257 under WfWg - weird! */
1258 if (*fname == '\0') {
1259 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260 if (!CAN_WRITE(conn)) {
1261 mode |= FILE_ATTRIBUTE_READONLY;
1262 }
1263 size = 0;
1264 mtime = 0;
1265 } else {
1266 status = filename_convert(ctx,
1267 conn,
1268 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269 fname,
1270 0,
1271 NULL,
1272 &smb_fname);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276 ERRSRV, ERRbadpath);
1277 goto out;
1278 }
1279 reply_nterror(req, status);
1280 goto out;
1281 }
1282 if (!VALID_STAT(smb_fname->st) &&
1283 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285 smb_fname_str_dbg(smb_fname),
1286 strerror(errno)));
1287 reply_nterror(req, map_nt_error_from_unix(errno));
1288 goto out;
1289 }
1290
1291 mode = dos_mode(conn, smb_fname);
1292 size = smb_fname->st.st_ex_size;
1293
1294 if (ask_sharemode) {
1295 struct timespec write_time_ts;
1296 struct file_id fileid;
1297
1298 ZERO_STRUCT(write_time_ts);
1299 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300 get_file_infos(fileid, 0, NULL, &write_time_ts);
1301 if (!null_timespec(write_time_ts)) {
1302 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303 }
1304 }
1305
1306 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308 size = 0;
1309 }
1310 }
1311
1312 reply_outbuf(req, 10, 0);
1313
1314 SSVAL(req->outbuf,smb_vwv0,mode);
1315 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317 } else {
1318 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319 }
1320 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322 if (get_Protocol() >= PROTOCOL_NT1) {
1323 SSVAL(req->outbuf, smb_flg2,
1324 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325 }
1326
1327 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330 out:
1331 TALLOC_FREE(smb_fname);
1332 TALLOC_FREE(fname);
1333 END_PROFILE(SMBgetatr);
1334 return;
1335 }
1336
1337 /****************************************************************************
1338 Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343 struct smb_file_time ft;
1344 connection_struct *conn = req->conn;
1345 struct smb_filename *smb_fname = NULL;
1346 char *fname = NULL;
1347 int mode;
1348 time_t mtime;
1349 const char *p;
1350 NTSTATUS status;
1351 TALLOC_CTX *ctx = talloc_tos();
1352
1353 START_PROFILE(SMBsetatr);
1354
1355 ZERO_STRUCT(ft);
1356
1357 if (req->wct < 2) {
1358 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359 goto out;
1360 }
1361
1362 p = (const char *)req->buf + 1;
1363 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364 if (!NT_STATUS_IS_OK(status)) {
1365 reply_nterror(req, status);
1366 goto out;
1367 }
1368
1369 status = filename_convert(ctx,
1370 conn,
1371 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372 fname,
1373 0,
1374 NULL,
1375 &smb_fname);
1376 if (!NT_STATUS_IS_OK(status)) {
1377 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379 ERRSRV, ERRbadpath);
1380 goto out;
1381 }
1382 reply_nterror(req, status);
1383 goto out;
1384 }
1385
1386 if (smb_fname->base_name[0] == '.' &&
1387 smb_fname->base_name[1] == '\0') {
1388 /*
1389 * Not sure here is the right place to catch this
1390 * condition. Might be moved to somewhere else later -- vl
1391 */
1392 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393 goto out;
1394 }
1395
1396 mode = SVAL(req->vwv+0, 0);
1397 mtime = srv_make_unix_date3(req->vwv+1);
1398
1399 if (mode != FILE_ATTRIBUTE_NORMAL) {
1400 if (VALID_STAT_OF_DIR(smb_fname->st))
1401 mode |= FILE_ATTRIBUTE_DIRECTORY;
1402 else
1403 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405 status = check_access(conn, NULL, smb_fname,
1406 FILE_WRITE_ATTRIBUTES);
1407 if (!NT_STATUS_IS_OK(status)) {
1408 reply_nterror(req, status);
1409 goto out;
1410 }
1411
1412 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413 false) != 0) {
1414 reply_nterror(req, map_nt_error_from_unix(errno));
1415 goto out;
1416 }
1417 }
1418
1419 ft.mtime = convert_time_t_to_timespec(mtime);
1420 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421 if (!NT_STATUS_IS_OK(status)) {
1422 reply_nterror(req, status);
1423 goto out;
1424 }
1425
1426 reply_outbuf(req, 0, 0);
1427
1428 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429 mode));
1430 out:
1431 TALLOC_FREE(smb_fname);
1432 END_PROFILE(SMBsetatr);
1433 return;
1434 }
1435
1436 /****************************************************************************
1437 Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442 connection_struct *conn = req->conn;
1443 uint64_t dfree,dsize,bsize;
1444 START_PROFILE(SMBdskattr);
1445
1446 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447 reply_nterror(req, map_nt_error_from_unix(errno));
1448 END_PROFILE(SMBdskattr);
1449 return;
1450 }
1451
1452 reply_outbuf(req, 5, 0);
1453
1454 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455 double total_space, free_space;
1456 /* we need to scale this to a number that DOS6 can handle. We
1457 use floating point so we can handle large drives on systems
1458 that don't have 64 bit integers
1459
1460 we end up displaying a maximum of 2G to DOS systems
1461 */
1462 total_space = dsize * (double)bsize;
1463 free_space = dfree * (double)bsize;
1464
1465 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471 SSVAL(req->outbuf,smb_vwv0,dsize);
1472 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474 SSVAL(req->outbuf,smb_vwv3,dfree);
1475 } else {
1476 SSVAL(req->outbuf,smb_vwv0,dsize);
1477 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478 SSVAL(req->outbuf,smb_vwv2,512);
1479 SSVAL(req->outbuf,smb_vwv3,dfree);
1480 }
1481
1482 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484 END_PROFILE(SMBdskattr);
1485 return;
1486 }
1487
1488 /*
1489 * Utility function to split the filename from the directory.
1490 */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492 char **fname_dir_out,
1493 char **fname_mask_out)
1494 {
1495 const char *p = NULL;
1496 char *fname_dir = NULL;
1497 char *fname_mask = NULL;
1498
1499 p = strrchr_m(fname_in, '/');
1500 if (!p) {
1501 fname_dir = talloc_strdup(ctx, ".");
1502 fname_mask = talloc_strdup(ctx, fname_in);
1503 } else {
1504 fname_dir = talloc_strndup(ctx, fname_in,
1505 PTR_DIFF(p, fname_in));
1506 fname_mask = talloc_strdup(ctx, p+1);
1507 }
1508
1509 if (!fname_dir || !fname_mask) {
1510 TALLOC_FREE(fname_dir);
1511 TALLOC_FREE(fname_mask);
1512 return NT_STATUS_NO_MEMORY;
1513 }
1514
1515 *fname_dir_out = fname_dir;
1516 *fname_mask_out = fname_mask;
1517 return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521 Reply to a search.
1522 Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527 connection_struct *conn = req->conn;
1528 char *path = NULL;
1529 const char *mask = NULL;
1530 char *directory = NULL;
1531 struct smb_filename *smb_fname = NULL;
1532 char *fname = NULL;
1533 off_t size;
1534 uint32 mode;
1535 struct timespec date;
1536 uint32 dirtype;
1537 unsigned int numentries = 0;
1538 unsigned int maxentries = 0;
1539 bool finished = False;
1540 const char *p;
1541 int status_len;
1542 char status[21];
1543 int dptr_num= -1;
1544 bool check_descend = False;
1545 bool expect_close = False;
1546 NTSTATUS nt_status;
1547 bool mask_contains_wcard = False;
1548 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549 TALLOC_CTX *ctx = talloc_tos();
1550 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551 struct dptr_struct *dirptr = NULL;
1552 struct smbd_server_connection *sconn = req->sconn;
1553
1554 START_PROFILE(SMBsearch);
1555
1556 if (req->wct < 2) {
1557 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558 goto out;
1559 }
1560
1561 if (lp_posix_pathnames()) {
1562 reply_unknown_new(req, req->cmd);
1563 goto out;
1564 }
1565
1566 /* If we were called as SMBffirst then we must expect close. */
1567 if(req->cmd == SMBffirst) {
1568 expect_close = True;
1569 }
1570
1571 reply_outbuf(req, 1, 3);
1572 maxentries = SVAL(req->vwv+0, 0);
1573 dirtype = SVAL(req->vwv+1, 0);
1574 p = (const char *)req->buf + 1;
1575 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576 &nt_status, &mask_contains_wcard);
1577 if (!NT_STATUS_IS_OK(nt_status)) {
1578 reply_nterror(req, nt_status);
1579 goto out;
1580 }
1581
1582 p++;
1583 status_len = SVAL(p, 0);
1584 p += 2;
1585
1586 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588 if (status_len == 0) {
1589 nt_status = filename_convert(ctx, conn,
1590 req->flags2 & FLAGS2_DFS_PATHNAMES,
1591 path,
1592 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593 &mask_contains_wcard,
1594 &smb_fname);
1595 if (!NT_STATUS_IS_OK(nt_status)) {
1596 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598 ERRSRV, ERRbadpath);
1599 goto out;
1600 }
1601 reply_nterror(req, nt_status);
1602 goto out;
1603 }
1604
1605 directory = smb_fname->base_name;
1606
1607 p = strrchr_m(directory,'/');
1608 if ((p != NULL) && (*directory != '/')) {
1609 mask = p + 1;
1610 directory = talloc_strndup(ctx, directory,
1611 PTR_DIFF(p, directory));
1612 } else {
1613 mask = directory;
1614 directory = talloc_strdup(ctx,".");
1615 }
1616
1617 if (!directory) {
1618 reply_nterror(req, NT_STATUS_NO_MEMORY);
1619 goto out;
1620 }
1621
1622 memset((char *)status,'\0',21);
1623 SCVAL(status,0,(dirtype & 0x1F));
1624
1625 nt_status = dptr_create(conn,
1626 NULL, /* req */
1627 NULL, /* fsp */
1628 directory,
1629 True,
1630 expect_close,
1631 req->smbpid,
1632 mask,
1633 mask_contains_wcard,
1634 dirtype,
1635 &dirptr);
1636 if (!NT_STATUS_IS_OK(nt_status)) {
1637 reply_nterror(req, nt_status);
1638 goto out;
1639 }
1640 dptr_num = dptr_dnum(dirptr);
1641 } else {
1642 int status_dirtype;
1643 const char *dirpath;
1644
1645 memcpy(status,p,21);
1646 status_dirtype = CVAL(status,0) & 0x1F;
1647 if (status_dirtype != (dirtype & 0x1F)) {
1648 dirtype = status_dirtype;
1649 }
1650
1651 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652 if (!dirptr) {
1653 goto SearchEmpty;
1654 }
1655 dirpath = dptr_path(sconn, dptr_num);
1656 directory = talloc_strdup(ctx, dirpath);
1657 if (!directory) {
1658 reply_nterror(req, NT_STATUS_NO_MEMORY);
1659 goto out;
1660 }
1661
1662 mask = dptr_wcard(sconn, dptr_num);
1663 if (!mask) {
1664 goto SearchEmpty;
1665 }
1666 /*
1667 * For a 'continue' search we have no string. So
1668 * check from the initial saved string.
1669 */
1670 mask_contains_wcard = ms_has_wild(mask);
1671 dirtype = dptr_attr(sconn, dptr_num);
1672 }
1673
1674 DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677 dptr_init_search_op(dirptr);
1678
1679 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680 char buf[DIR_STRUCT_SIZE];
1681 memcpy(buf,status,21);
1682 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684 reply_nterror(req, NT_STATUS_NO_MEMORY);
1685 goto out;
1686 }
1687 dptr_fill(sconn, buf+12,dptr_num);
1688 if (dptr_zero(buf+12) && (status_len==0)) {
1689 numentries = 1;
1690 } else {
1691 numentries = 0;
1692 }
1693 if (message_push_blob(&req->outbuf,
1694 data_blob_const(buf, sizeof(buf)))
1695 == -1) {
1696 reply_nterror(req, NT_STATUS_NO_MEMORY);
1697 goto out;
1698 }
1699 } else {
1700 unsigned int i;
1701 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1702 size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
1703
1704 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1705
1706 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1707 directory,lp_dont_descend(ctx, SNUM(conn))));
1708 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1709 check_descend = True;
1710 }
1711
1712 for (i=numentries;(i<maxentries) && !finished;i++) {
1713 finished = !get_dir_entry(ctx,
1714 dirptr,
1715 mask,
1716 dirtype,
1717 &fname,
1718 &size,
1719 &mode,
1720 &date,
1721 check_descend,
1722 ask_sharemode);
1723 if (!finished) {
1724 char buf[DIR_STRUCT_SIZE];
1725 memcpy(buf,status,21);
1726 if (!make_dir_struct(ctx,
1727 buf,
1728 mask,
1729 fname,
1730 size,
1731 mode,
1732 convert_timespec_to_time_t(date),
1733 !allow_long_path_components)) {
1734 reply_nterror(req, NT_STATUS_NO_MEMORY);
1735 goto out;
1736 }
1737 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1738 break;
1739 }
1740 if (message_push_blob(&req->outbuf,
1741 data_blob_const(buf, sizeof(buf)))
1742 == -1) {
1743 reply_nterror(req, NT_STATUS_NO_MEMORY);
1744 goto out;
1745 }
1746 numentries++;
1747 }
1748 }
1749 }
1750
1751 SearchEmpty:
1752
1753 /* If we were called as SMBffirst with smb_search_id == NULL
1754 and no entries were found then return error and close dirptr
1755 (X/Open spec) */
1756
1757 if (numentries == 0) {
1758 dptr_close(sconn, &dptr_num);
1759 } else if(expect_close && status_len == 0) {
1760 /* Close the dptr - we know it's gone */
1761 dptr_close(sconn, &dptr_num);
1762 }
1763
1764 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1765 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1766 dptr_close(sconn, &dptr_num);
1767 }
1768
1769 if ((numentries == 0) && !mask_contains_wcard) {
1770 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1771 goto out;
1772 }
1773
1774 SSVAL(req->outbuf,smb_vwv0,numentries);
1775 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1776 SCVAL(smb_buf(req->outbuf),0,5);
1777 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1778
1779 /* The replies here are never long name. */
1780 SSVAL(req->outbuf, smb_flg2,
1781 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1782 if (!allow_long_path_components) {
1783 SSVAL(req->outbuf, smb_flg2,
1784 SVAL(req->outbuf, smb_flg2)
1785 & (~FLAGS2_LONG_PATH_COMPONENTS));
1786 }
1787
1788 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1789 SSVAL(req->outbuf, smb_flg2,
1790 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1791
1792 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1793 smb_fn_name(req->cmd),
1794 mask,
1795 directory,
1796 dirtype,
1797 numentries,
1798 maxentries ));
1799 out:
1800 TALLOC_FREE(directory);
1801 TALLOC_FREE(smb_fname);
1802 END_PROFILE(SMBsearch);
1803 return;
1804 }
1805
1806 /****************************************************************************
1807 Reply to a fclose (stop directory search).
1808 ****************************************************************************/
1809
1810 void reply_fclose(struct smb_request *req)
1811 {
1812 int status_len;
1813 char status[21];
1814 int dptr_num= -2;
1815 const char *p;
1816 char *path = NULL;
1817 NTSTATUS err;
1818 bool path_contains_wcard = False;
1819 TALLOC_CTX *ctx = talloc_tos();
1820 struct smbd_server_connection *sconn = req->sconn;
1821
1822 START_PROFILE(SMBfclose);
1823
1824 if (lp_posix_pathnames()) {
1825 reply_unknown_new(req, req->cmd);
1826 END_PROFILE(SMBfclose);
1827 return;
1828 }
1829
1830 p = (const char *)req->buf + 1;
1831 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1832 &err, &path_contains_wcard);
1833 if (!NT_STATUS_IS_OK(err)) {
1834 reply_nterror(req, err);
1835 END_PROFILE(SMBfclose);
1836 return;
1837 }
1838 p++;
1839 status_len = SVAL(p,0);
1840 p += 2;
1841
1842 if (status_len == 0) {
1843 reply_force_doserror(req, ERRSRV, ERRsrverror);
1844 END_PROFILE(SMBfclose);
1845 return;
1846 }
1847
1848 memcpy(status,p,21);
1849
1850 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1851 /* Close the dptr - we know it's gone */
1852 dptr_close(sconn, &dptr_num);
1853 }
1854
1855 reply_outbuf(req, 1, 0);
1856 SSVAL(req->outbuf,smb_vwv0,0);
1857
1858 DEBUG(3,("search close\n"));
1859
1860 END_PROFILE(SMBfclose);
1861 return;
1862 }
1863
1864 /****************************************************************************
1865 Reply to an open.
1866 ****************************************************************************/
1867
1868 void reply_open(struct smb_request *req)
1869 {
1870 connection_struct *conn = req->conn;
1871 struct smb_filename *smb_fname = NULL;
1872 char *fname = NULL;
1873 uint32 fattr=0;
1874 off_t size = 0;
1875 time_t mtime=0;
1876 int info;
1877 files_struct *fsp;
1878 int oplock_request;
1879 int deny_mode;
1880 uint32 dos_attr;
1881 uint32 access_mask;
1882 uint32 share_mode;
1883 uint32 create_disposition;
1884 uint32 create_options = 0;
1885 uint32_t private_flags = 0;
1886 NTSTATUS status;
1887 TALLOC_CTX *ctx = talloc_tos();
1888
1889 START_PROFILE(SMBopen);
1890
1891 if (req->wct < 2) {
1892 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1893 goto out;
1894 }
1895
1896 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1897 deny_mode = SVAL(req->vwv+0, 0);
1898 dos_attr = SVAL(req->vwv+1, 0);
1899
1900 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1901 STR_TERMINATE, &status);
1902 if (!NT_STATUS_IS_OK(status)) {
1903 reply_nterror(req, status);
1904 goto out;
1905 }
1906
1907 if (!map_open_params_to_ntcreate(fname, deny_mode,
1908 OPENX_FILE_EXISTS_OPEN, &access_mask,
1909 &share_mode, &create_disposition,
1910 &create_options, &private_flags)) {
1911 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1912 goto out;
1913 }
1914
1915 status = filename_convert(ctx,
1916 conn,
1917 req->flags2 & FLAGS2_DFS_PATHNAMES,
1918 fname,
1919 UCF_PREP_CREATEFILE,
1920 NULL,
1921 &smb_fname);
1922 if (!NT_STATUS_IS_OK(status)) {
1923 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1924 reply_botherror(req,
1925 NT_STATUS_PATH_NOT_COVERED,
1926 ERRSRV, ERRbadpath);
1927 goto out;
1928 }
1929 reply_nterror(req, status);
1930 goto out;
1931 }
1932
1933 status = SMB_VFS_CREATE_FILE(
1934 conn, /* conn */
1935 req, /* req */
1936 0, /* root_dir_fid */
1937 smb_fname, /* fname */
1938 access_mask, /* access_mask */
1939 share_mode, /* share_access */
1940 create_disposition, /* create_disposition*/
1941 create_options, /* create_options */
1942 dos_attr, /* file_attributes */
1943 oplock_request, /* oplock_request */
1944 0, /* allocation_size */
1945 private_flags,
1946 NULL, /* sd */
1947 NULL, /* ea_list */
1948 &fsp, /* result */
1949 &info); /* pinfo */
1950
1951 if (!NT_STATUS_IS_OK(status)) {
1952 if (open_was_deferred(req->sconn, req->mid)) {
1953 /* We have re-scheduled this call. */
1954 goto out;
1955 }
1956 reply_openerror(req, status);
1957 goto out;
1958 }
1959
1960 /* Ensure we're pointing at the correct stat struct. */
1961 TALLOC_FREE(smb_fname);
1962 smb_fname = fsp->fsp_name;
1963
1964 size = smb_fname->st.st_ex_size;
1965 fattr = dos_mode(conn, smb_fname);
1966
1967 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1968
1969 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1970 DEBUG(3,("attempt to open a directory %s\n",
1971 fsp_str_dbg(fsp)));
1972 close_file(req, fsp, ERROR_CLOSE);
1973 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1974 ERRDOS, ERRnoaccess);
1975 goto out;
1976 }
1977
1978 reply_outbuf(req, 7, 0);
1979 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1980 SSVAL(req->outbuf,smb_vwv1,fattr);
1981 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1982 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1983 } else {
1984 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1985 }
1986 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1987 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1988
1989 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1990 SCVAL(req->outbuf,smb_flg,
1991 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1992 }
1993
1994 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1995 SCVAL(req->outbuf,smb_flg,
1996 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1997 }
1998 out:
1999 END_PROFILE(SMBopen);
2000 return;
2001 }
2002
2003 /****************************************************************************
2004 Reply to an open and X.
2005 ****************************************************************************/
2006
2007 void reply_open_and_X(struct smb_request *req)
2008 {
2009 connection_struct *conn = req->conn;
2010 struct smb_filename *smb_fname = NULL;
2011 char *fname = NULL;
2012 uint16 open_flags;
2013 int deny_mode;
2014 uint32 smb_attr;
2015 /* Breakout the oplock request bits so we can set the
2016 reply bits separately. */
2017 int ex_oplock_request;
2018 int core_oplock_request;
2019 int oplock_request;
2020 #if 0
2021 int smb_sattr = SVAL(req->vwv+4, 0);
2022 uint32 smb_time = make_unix_date3(req->vwv+6);
2023 #endif
2024 int smb_ofun;
2025 uint32 fattr=0;
2026 int mtime=0;
2027 int smb_action = 0;
2028 files_struct *fsp;
2029 NTSTATUS status;
2030 uint64_t allocation_size;
2031 ssize_t retval = -1;
2032 uint32 access_mask;
2033 uint32 share_mode;
2034 uint32 create_disposition;
2035 uint32 create_options = 0;
2036 uint32_t private_flags = 0;
2037 TALLOC_CTX *ctx = talloc_tos();
2038
2039 START_PROFILE(SMBopenX);
2040
2041 if (req->wct < 15) {
2042 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2043 goto out;
2044 }
2045
2046 open_flags = SVAL(req->vwv+2, 0);
2047 deny_mode = SVAL(req->vwv+3, 0);
2048 smb_attr = SVAL(req->vwv+5, 0);
2049 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2050 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2051 oplock_request = ex_oplock_request | core_oplock_request;
2052 smb_ofun = SVAL(req->vwv+8, 0);
2053 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2054
2055 /* If it's an IPC, pass off the pipe handler. */
2056 if (IS_IPC(conn)) {
2057 if (lp_nt_pipe_support()) {
2058 reply_open_pipe_and_X(conn, req);
2059 } else {
2060 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2061 }
2062 goto out;
2063 }
2064
2065 /* XXXX we need to handle passed times, sattr and flags */
2066 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2067 STR_TERMINATE, &status);
2068 if (!NT_STATUS_IS_OK(status)) {
2069 reply_nterror(req, status);
2070 goto out;
2071 }
2072
2073 if (!map_open_params_to_ntcreate(fname, deny_mode,
2074 smb_ofun,
2075 &access_mask, &share_mode,
2076 &create_disposition,
2077 &create_options,
2078 &private_flags)) {
2079 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2080 goto out;
2081 }
2082
2083 status = filename_convert(ctx,
2084 conn,
2085 req->flags2 & FLAGS2_DFS_PATHNAMES,
2086 fname,
2087 UCF_PREP_CREATEFILE,
2088 NULL,
2089 &smb_fname);
2090 if (!NT_STATUS_IS_OK(status)) {
2091 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2092 reply_botherror(req,
2093 NT_STATUS_PATH_NOT_COVERED,
2094 ERRSRV, ERRbadpath);
2095 goto out;
2096 }
2097 reply_nterror(req, status);
2098 goto out;
2099 }
2100
2101 status = SMB_VFS_CREATE_FILE(
2102 conn, /* conn */
2103 req, /* req */
2104 0, /* root_dir_fid */
2105 smb_fname, /* fname */
2106 access_mask, /* access_mask */
2107 share_mode, /* share_access */
2108 create_disposition, /* create_disposition*/
2109 create_options, /* create_options */
2110 smb_attr, /* file_attributes */
2111 oplock_request, /* oplock_request */
2112 0, /* allocation_size */
2113 private_flags,
2114 NULL, /* sd */
2115 NULL, /* ea_list */
2116 &fsp, /* result */
2117 &smb_action); /* pinfo */
2118
2119 if (!NT_STATUS_IS_OK(status)) {
2120 if (open_was_deferred(req->sconn, req->mid)) {
2121 /* We have re-scheduled this call. */
2122 goto out;
2123 }
2124 reply_openerror(req, status);
2125 goto out;
2126 }
2127
2128 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2129 if the file is truncated or created. */
2130 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2131 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2132 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2133 close_file(req, fsp, ERROR_CLOSE);
2134 reply_nterror(req, NT_STATUS_DISK_FULL);
2135 goto out;
2136 }
2137 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2138 if (retval < 0) {
2139 close_file(req, fsp, ERROR_CLOSE);
2140 reply_nterror(req, NT_STATUS_DISK_FULL);
2141 goto out;
2142 }
2143 status = vfs_stat_fsp(fsp);
2144 if (!NT_STATUS_IS_OK(status)) {
2145 close_file(req, fsp, ERROR_CLOSE);
2146 reply_nterror(req, status);
2147 goto out;
2148 }
2149 }
2150
2151 fattr = dos_mode(conn, fsp->fsp_name);
2152 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2153 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2154 close_file(req, fsp, ERROR_CLOSE);
2155 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2156 goto out;
2157 }
2158
2159 /* If the caller set the extended oplock request bit
2160 and we granted one (by whatever means) - set the
2161 correct bit for extended oplock reply.
2162 */
2163
2164 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2165 smb_action |= EXTENDED_OPLOCK_GRANTED;
2166 }
2167
2168 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2169 smb_action |= EXTENDED_OPLOCK_GRANTED;
2170 }
2171
2172 /* If the caller set the core oplock request bit
2173 and we granted one (by whatever means) - set the
2174 correct bit for core oplock reply.
2175 */
2176
2177 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2178 reply_outbuf(req, 19, 0);
2179 } else {
2180 reply_outbuf(req, 15, 0);
2181 }
2182
2183 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2184 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2185
2186 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2187 SCVAL(req->outbuf, smb_flg,
2188 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2189 }
2190
2191 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2192 SCVAL(req->outbuf, smb_flg,
2193 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2194 }
2195
2196 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2197 SSVAL(req->outbuf,smb_vwv3,fattr);
2198 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2199 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2200 } else {
2201 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2202 }
2203 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2204 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2205 SSVAL(req->outbuf,smb_vwv11,smb_action);
2206
2207 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2208 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2209 }
2210
2211 out:
2212 TALLOC_FREE(smb_fname);
2213 END_PROFILE(SMBopenX);
2214 return;
2215 }
2216
2217 /****************************************************************************
2218 Reply to a SMBulogoffX.
2219 ****************************************************************************/
2220
2221 void reply_ulogoffX(struct smb_request *req)
2222 {
2223 struct smbd_server_connection *sconn = req->sconn;
2224 struct user_struct *vuser;
2225 struct smbXsrv_session *session = NULL;
2226 NTSTATUS status;
2227
2228 START_PROFILE(SMBulogoffX);
2229
2230 vuser = get_valid_user_struct(sconn, req->vuid);
2231
2232 if(vuser == NULL) {
2233 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2234 (unsigned long long)req->vuid));
2235
2236 req->vuid = UID_FIELD_INVALID;
2237 reply_force_doserror(req, ERRSRV, ERRbaduid);
2238 END_PROFILE(SMBulogoffX);
2239 return;
2240 }
2241
2242 session = vuser->session;
2243 vuser = NULL;
2244
2245 /*
2246 * TODO: cancel all outstanding requests on the session
2247 */
2248 status = smbXsrv_session_logoff(session);
2249 if (!NT_STATUS_IS_OK(status)) {
2250 DEBUG(0, ("reply_ulogoff: "
2251 "smbXsrv_session_logoff() failed: %s\n",
2252 nt_errstr(status)));
2253 /*
2254 * If we hit this case, there is something completely
2255 * wrong, so we better disconnect the transport connection.
2256 */
2257 END_PROFILE(SMBulogoffX);
2258 exit_server(__location__ ": smbXsrv_session_logoff failed");
2259 return;
2260 }
2261
2262 TALLOC_FREE(session);
2263
2264 reply_outbuf(req, 2, 0);
2265 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2266 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2267
2268 DEBUG(3, ("ulogoffX vuid=%llu\n",
2269 (unsigned long long)req->vuid));
2270
2271 END_PROFILE(SMBulogoffX);
2272 req->vuid = UID_FIELD_INVALID;
2273 }
2274
2275 /****************************************************************************
2276 Reply to a mknew or a create.
2277 ****************************************************************************/
2278
2279 void reply_mknew(struct smb_request *req)
2280 {
2281 connection_struct *conn = req->conn;
2282 struct smb_filename *smb_fname = NULL;
2283 char *fname = NULL;
2284 uint32 fattr = 0;
2285 struct smb_file_time ft;
2286 files_struct *fsp;
2287 int oplock_request = 0;
2288 NTSTATUS status;
2289 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2290 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2291 uint32 create_disposition;
2292 uint32 create_options = 0;
2293 TALLOC_CTX *ctx = talloc_tos();
2294
2295 START_PROFILE(SMBcreate);
2296 ZERO_STRUCT(ft);
2297
2298 if (req->wct < 3) {
2299 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2300 goto out;
2301 }
2302
2303 fattr = SVAL(req->vwv+0, 0);
2304 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2305
2306 /* mtime. */
2307 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2308
2309 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2310 STR_TERMINATE, &status);
2311 if (!NT_STATUS_IS_OK(status)) {
2312 reply_nterror(req, status);
2313 goto out;
2314 }
2315
2316 status = filename_convert(ctx,
2317 conn,
2318 req->flags2 & FLAGS2_DFS_PATHNAMES,
2319 fname,
2320 UCF_PREP_CREATEFILE,
2321 NULL,
2322 &smb_fname);
2323 if (!NT_STATUS_IS_OK(status)) {
2324 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2325 reply_botherror(req,
2326 NT_STATUS_PATH_NOT_COVERED,
2327 ERRSRV, ERRbadpath);
2328 goto out;
2329 }
2330 reply_nterror(req, status);
2331 goto out;
2332 }
2333
2334 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2335 DEBUG(0,("Attempt to create file (%s) with volid set - "
2336 "please report this\n",
2337 smb_fname_str_dbg(smb_fname)));
2338 }
2339
2340 if(req->cmd == SMBmknew) {
2341 /* We should fail if file exists. */
2342 create_disposition = FILE_CREATE;
2343 } else {
2344 /* Create if file doesn't exist, truncate if it does. */
2345 create_disposition = FILE_OVERWRITE_IF;
2346 }
2347
2348 status = SMB_VFS_CREATE_FILE(
2349 conn, /* conn */
2350 req, /* req */
2351 0, /* root_dir_fid */
2352 smb_fname, /* fname */
2353 access_mask, /* access_mask */
2354 share_mode, /* share_access */
2355 create_disposition, /* create_disposition*/
2356 create_options, /* create_options */
2357 fattr, /* file_attributes */
2358 oplock_request, /* oplock_request */
2359 0, /* allocation_size */
2360 0, /* private_flags */
2361 NULL, /* sd */
2362 NULL, /* ea_list */
2363 &fsp, /* result */
2364 NULL); /* pinfo */
2365
2366 if (!NT_STATUS_IS_OK(status)) {
2367 if (open_was_deferred(req->sconn, req->mid)) {
2368 /* We have re-scheduled this call. */
2369 goto out;
2370 }
2371 reply_openerror(req, status);
2372 goto out;
2373 }
2374
2375 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2376 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2377 if (!NT_STATUS_IS_OK(status)) {
2378 END_PROFILE(SMBcreate);
2379 goto out;
2380 }
2381
2382 reply_outbuf(req, 1, 0);
2383 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2384
2385 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2386 SCVAL(req->outbuf,smb_flg,
2387 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2388 }
2389
2390 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2391 SCVAL(req->outbuf,smb_flg,
2392 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2393 }
2394
2395 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2396 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2397 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2398 (unsigned int)fattr));
2399
2400 out:
2401 TALLOC_FREE(smb_fname);
2402 END_PROFILE(SMBcreate);
2403 return;
2404 }
2405
2406 /****************************************************************************
2407 Reply to a create temporary file.
2408 ****************************************************************************/
2409
2410 void reply_ctemp(struct smb_request *req)
2411 {
2412 connection_struct *conn = req->conn;
2413 struct smb_filename *smb_fname = NULL;
2414 char *wire_name = NULL;
2415 char *fname = NULL;
2416 uint32 fattr;
2417 files_struct *fsp;
2418 int oplock_request;
2419 char *s;
2420 NTSTATUS status;
2421 int i;
2422 TALLOC_CTX *ctx = talloc_tos();
2423
2424 START_PROFILE(SMBctemp);
2425
2426 if (req->wct < 3) {
2427 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2428 goto out;
2429 }
2430
2431 fattr = SVAL(req->vwv+0, 0);
2432 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2433
2434 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2435 STR_TERMINATE, &status);
2436 if (!NT_STATUS_IS_OK(status)) {
2437 reply_nterror(req, status);
2438 goto out;
2439 }
2440
2441 for (i = 0; i < 10; i++) {
2442 if (*wire_name) {
2443 fname = talloc_asprintf(ctx,
2444 "%s/TMP%s",
2445 wire_name,
2446 generate_random_str_list(ctx, 5, "0123456789"));
2447 } else {
2448 fname = talloc_asprintf(ctx,
2449 "TMP%s",
2450 generate_random_str_list(ctx, 5, "0123456789"));
2451 }
2452
2453 if (!fname) {
2454 reply_nterror(req, NT_STATUS_NO_MEMORY);
2455 goto out;
2456 }
2457
2458 status = filename_convert(ctx, conn,
2459 req->flags2 & FLAGS2_DFS_PATHNAMES,
2460 fname,
2461 UCF_PREP_CREATEFILE,
2462 NULL,
2463 &smb_fname);
2464 if (!NT_STATUS_IS_OK(status)) {
2465 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2466 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2467 ERRSRV, ERRbadpath);
2468 goto out;
2469 }
2470 reply_nterror(req, status);
2471 goto out;
2472 }
2473
2474 /* Create the file. */
2475 status = SMB_VFS_CREATE_FILE(
2476 conn, /* conn */
2477 req, /* req */
2478 0, /* root_dir_fid */
2479 smb_fname, /* fname */
2480 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2481 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2482 FILE_CREATE, /* create_disposition*/
2483 0, /* create_options */
2484 fattr, /* file_attributes */
2485 oplock_request, /* oplock_request */
2486 0, /* allocation_size */
2487 0, /* private_flags */
2488 NULL, /* sd */
2489 NULL, /* ea_list */
2490 &fsp, /* result */
2491 NULL); /* pinfo */
2492
2493 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2494 TALLOC_FREE(fname);
2495 TALLOC_FREE(smb_fname);
2496 continue;
2497 }
2498
2499 if (!NT_STATUS_IS_OK(status)) {
2500 if (open_was_deferred(req->sconn, req->mid)) {
2501 /* We have re-scheduled this call. */
2502 goto out;
2503 }
2504 reply_openerror(req, status);
2505 goto out;
2506 }
2507
2508 break;
2509 }
2510
2511 if (i == 10) {
2512 /* Collision after 10 times... */
2513 reply_nterror(req, status);
2514 goto out;
2515 }
2516
2517 reply_outbuf(req, 1, 0);
2518 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2519
2520 /* the returned filename is relative to the directory */
2521 s = strrchr_m(fsp->fsp_name->base_name, '/');
2522 if (!s) {
2523 s = fsp->fsp_name->base_name;
2524 } else {
2525 s++;
2526 }
2527
2528 #if 0
2529 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2530 thing in the byte section. JRA */
2531 SSVALS(p, 0, -1); /* what is this? not in spec */
2532 #endif
2533 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2534 == -1) {
2535 reply_nterror(req, NT_STATUS_NO_MEMORY);
2536 goto out;
2537 }
2538
2539 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2540 SCVAL(req->outbuf, smb_flg,
2541 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2542 }
2543
2544 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2545 SCVAL(req->outbuf, smb_flg,
2546 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2547 }
2548
2549 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2550 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2551 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2552 out:
2553 TALLOC_FREE(smb_fname);
2554 TALLOC_FREE(wire_name);
2555 END_PROFILE(SMBctemp);
2556 return;
2557 }
2558
2559 /*******************************************************************
2560 Check if a user is allowed to rename a file.
2561 ********************************************************************/
2562
2563 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2564 uint16 dirtype)
2565 {
2566 if (!CAN_WRITE(conn)) {
2567 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2568 }
2569
2570 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2571 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2572 /* Only bother to read the DOS attribute if we might deny the
2573 rename on the grounds of attribute missmatch. */
2574 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2575 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2576 return NT_STATUS_NO_SUCH_FILE;
2577 }
2578 }
2579
2580 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2581 if (fsp->posix_open) {
2582 return NT_STATUS_OK;
2583 }
2584
2585 /* If no pathnames are open below this
2586 directory, allow the rename. */
2587
2588 if (file_find_subpath(fsp)) {
2589 return NT_STATUS_ACCESS_DENIED;
2590 }
2591 return NT_STATUS_OK;
2592 }
2593
2594 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2595 return NT_STATUS_OK;
2596 }
2597
2598 return NT_STATUS_ACCESS_DENIED;
2599 }
2600
2601 /*******************************************************************
2602 * unlink a file with all relevant access checks
2603 *******************************************************************/
2604
2605 static NTSTATUS do_unlink(connection_struct *conn,
2606 struct smb_request *req,
2607 struct smb_filename *smb_fname,
2608 uint32 dirtype)
2609 {
2610 uint32 fattr;
2611 files_struct *fsp;
2612 uint32 dirtype_orig = dirtype;
2613 NTSTATUS status;
2614 int ret;
2615 bool posix_paths = lp_posix_pathnames();
2616
2617 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2618 smb_fname_str_dbg(smb_fname),
2619 dirtype));
2620
2621 if (!CAN_WRITE(conn)) {
2622 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2623 }
2624
2625 if (posix_paths) {
2626 ret = SMB_VFS_LSTAT(conn, smb_fname);
2627 } else {
2628 ret = SMB_VFS_STAT(conn, smb_fname);
2629 }
2630 if (ret != 0) {
2631 return map_nt_error_from_unix(errno);
2632 }
2633
2634 fattr = dos_mode(conn, smb_fname);
2635
2636 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2637 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2638 }
2639
2640 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2641 if (!dirtype) {
2642 return NT_STATUS_NO_SUCH_FILE;
2643 }
2644
2645 if (!dir_check_ftype(fattr, dirtype)) {
2646 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2647 return NT_STATUS_FILE_IS_A_DIRECTORY;
2648 }
2649 return NT_STATUS_NO_SUCH_FILE;
2650 }
2651
2652 if (dirtype_orig & 0x8000) {
2653 /* These will never be set for POSIX. */
2654 return NT_STATUS_NO_SUCH_FILE;
2655 }
2656
2657 #if 0
2658 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2659 return NT_STATUS_FILE_IS_A_DIRECTORY;
2660 }
2661
2662 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2663 return NT_STATUS_NO_SUCH_FILE;
2664 }
2665
2666 if (dirtype & 0xFF00) {
2667 /* These will never be set for POSIX. */
2668 return NT_STATUS_NO_SUCH_FILE;
2669 }
2670
2671 dirtype &= 0xFF;
2672 if (!dirtype) {
2673 return NT_STATUS_NO_SUCH_FILE;
2674 }
2675
2676 /* Can't delete a directory. */
2677 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2678 return NT_STATUS_FILE_IS_A_DIRECTORY;
2679 }
2680 #endif
2681
2682 #if 0 /* JRATEST */
2683 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2684 return NT_STATUS_OBJECT_NAME_INVALID;
2685 #endif /* JRATEST */
2686
2687 /* On open checks the open itself will check the share mode, so
2688 don't do it here as we'll get it wrong. */
2689
2690 status = SMB_VFS_CREATE_FILE
2691 (conn, /* conn */
2692 req, /* req */
2693 0, /* root_dir_fid */
2694 smb_fname, /* fname */
2695 DELETE_ACCESS, /* access_mask */
2696 FILE_SHARE_NONE, /* share_access */
2697 FILE_OPEN, /* create_disposition*/
2698 FILE_NON_DIRECTORY_FILE, /* create_options */
2699 /* file_attributes */
2700 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2701 FILE_ATTRIBUTE_NORMAL,
2702 0, /* oplock_request */
2703 0, /* allocation_size */
2704 0, /* private_flags */
2705 NULL, /* sd */
2706 NULL, /* ea_list */
2707 &fsp, /* result */
2708 NULL); /* pinfo */
2709
2710 if (!NT_STATUS_IS_OK(status)) {
2711 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2712 nt_errstr(status)));
2713 return status;
2714 }
2715
2716 status = can_set_delete_on_close(fsp, fattr);
2717 if (!NT_STATUS_IS_OK(status)) {
2718 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2719 "(%s)\n",
2720 smb_fname_str_dbg(smb_fname),
2721 nt_errstr(status)));
2722 close_file(req, fsp, NORMAL_CLOSE);
2723 return status;
2724 }
2725
2726 /* The set is across all open files on this dev/inode pair. */
2727 if (!set_delete_on_close(fsp, True,
2728 conn->session_info->security_token,
2729 conn->session_info->unix_token)) {
2730 close_file(req, fsp, NORMAL_CLOSE);
2731 return NT_STATUS_ACCESS_DENIED;
2732 }
2733
2734 return close_file(req, fsp, NORMAL_CLOSE);
2735 }
2736
2737 /****************************************************************************
2738 The guts of the unlink command, split out so it may be called by the NT SMB
2739 code.
2740 ****************************************************************************/
2741
2742 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2743 uint32 dirtype, struct smb_filename *smb_fname,
2744 bool has_wild)
2745 {
2746 char *fname_dir = NULL;
2747 char *fname_mask = NULL;
2748 int count=0;
2749 NTSTATUS status = NT_STATUS_OK;
2750 TALLOC_CTX *ctx = talloc_tos();
2751
2752 /* Split up the directory from the filename/mask. */
2753 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2754 &fname_dir, &fname_mask);
2755 if (!NT_STATUS_IS_OK(status)) {
2756 goto out;
2757 }
2758
2759 /*
2760 * We should only check the mangled cache
2761 * here if unix_convert failed. This means
2762 * that the path in 'mask' doesn't exist
2763 * on the file system and so we need to look
2764 * for a possible mangle. This patch from
2765 * Tine Smukavec <valentin.smukavec@hermes.si>.
2766 */
2767
2768 if (!VALID_STAT(smb_fname->st) &&
2769 mangle_is_mangled(fname_mask, conn->params)) {
2770 char *new_mask = NULL;
2771 mangle_lookup_name_from_8_3(ctx, fname_mask,
2772 &new_mask, conn->params);
2773 if (new_mask) {
2774 TALLOC_FREE(fname_mask);
2775 fname_mask = new_mask;
2776 }
2777 }
2778
2779 if (!has_wild) {
2780
2781 /*
2782 * Only one file needs to be unlinked. Append the mask back
2783 * onto the directory.
2784 */
2785 TALLOC_FREE(smb_fname->base_name);
2786 if (ISDOT(fname_dir)) {
2787 /* Ensure we use canonical names on open. */
2788 smb_fname->base_name = talloc_asprintf(smb_fname,
2789 "%s",
2790 fname_mask);
2791 } else {
2792 smb_fname->base_name = talloc_asprintf(smb_fname,
2793 "%s/%s",
2794 fname_dir,
2795 fname_mask);
2796 }
2797 if (!smb_fname->base_name) {
2798 status = NT_STATUS_NO_MEMORY;
2799 goto out;
2800 }
2801 if (dirtype == 0) {
2802 dirtype = FILE_ATTRIBUTE_NORMAL;
2803 }
2804
2805 status = check_name(conn, smb_fname->base_name);
2806 if (!NT_STATUS_IS_OK(status)) {
2807 goto out;
2808 }
2809
2810 status = do_unlink(conn, req, smb_fname, dirtype);
2811 if (!NT_STATUS_IS_OK(status)) {
2812 goto out;
2813 }
2814
2815 count++;
2816 } else {
2817 struct smb_Dir *dir_hnd = NULL;
2818 long offset = 0;
2819 const char *dname = NULL;
2820 char *talloced = NULL;
2821
2822 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2823 status = NT_STATUS_OBJECT_NAME_INVALID;
2824 goto out;
2825 }
2826
2827 if (strequal(fname_mask,"????????.???")) {
2828 TALLOC_FREE(fname_mask);
2829 fname_mask = talloc_strdup(ctx, "*");
2830 if (!fname_mask) {
2831 status = NT_STATUS_NO_MEMORY;
2832 goto out;
2833 }
2834 }
2835
2836 status = check_name(conn, fname_dir);
2837 if (!NT_STATUS_IS_OK(status)) {
2838 goto out;
2839 }
2840
2841 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2842 dirtype);
2843 if (dir_hnd == NULL) {
2844 status = map_nt_error_from_unix(errno);
2845 goto out;
2846 }
2847
2848 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2849 the pattern matches against the long name, otherwise the short name
2850 We don't implement this yet XXXX
2851 */
2852
2853 status = NT_STATUS_NO_SUCH_FILE;
2854
2855 while ((dname = ReadDirName(dir_hnd, &offset,
2856 &smb_fname->st, &talloced))) {
2857 TALLOC_CTX *frame = talloc_stackframe();
2858
2859 if (!is_visible_file(conn, fname_dir, dname,
2860 &smb_fname->st, true)) {
2861 TALLOC_FREE(frame);
2862 TALLOC_FREE(talloced);
2863 continue;
2864 }
2865
2866 /* Quick check for "." and ".." */
2867 if (ISDOT(dname) || ISDOTDOT(dname)) {
2868 TALLOC_FREE(frame);
2869 TALLOC_FREE(talloced);
2870 continue;
2871 }
2872
2873 if(!mask_match(dname, fname_mask,
2874 conn->case_sensitive)) {
2875 TALLOC_FREE(frame);
2876 TALLOC_FREE(talloced);
2877 continue;
2878 }
2879
2880 TALLOC_FREE(smb_fname->base_name);
2881 if (ISDOT(fname_dir)) {
2882 /* Ensure we use canonical names on open. */
2883 smb_fname->base_name =
2884 talloc_asprintf(smb_fname, "%s",
2885 dname);
2886 } else {
2887 smb_fname->base_name =
2888 talloc_asprintf(smb_fname, "%s/%s",
2889 fname_dir, dname);
2890 }
2891
2892 if (!smb_fname->base_name) {
2893 TALLOC_FREE(dir_hnd);
2894 status = NT_STATUS_NO_MEMORY;
2895 TALLOC_FREE(frame);
2896 TALLOC_FREE(talloced);
2897 goto out;
2898 }
2899
2900 status = check_name(conn, smb_fname->base_name);
2901 if (!NT_STATUS_IS_OK(status)) {
2902 TALLOC_FREE(dir_hnd);
2903 TALLOC_FREE(frame);
2904 TALLOC_FREE(talloced);
2905 goto out;
2906 }
2907
2908 status = do_unlink(conn, req, smb_fname, dirtype);
2909 if (!NT_STATUS_IS_OK(status)) {
2910 TALLOC_FREE(frame);
2911 TALLOC_FREE(talloced);
2912 continue;
2913 }
2914
2915 count++;
2916 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2917 smb_fname->base_name));
2918
2919 TALLOC_FREE(frame);
2920 TALLOC_FREE(talloced);
2921 }
2922 TALLOC_FREE(dir_hnd);
2923 }
2924
2925 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2926 status = map_nt_error_from_unix(errno);
2927 }
2928
2929 out:
2930 TALLOC_FREE(fname_dir);
2931 TALLOC_FREE(fname_mask);
2932 return status;
2933 }
2934
2935 /****************************************************************************
2936 Reply to a unlink
2937 ****************************************************************************/
2938
2939 void reply_unlink(struct smb_request *req)
2940 {
2941 connection_struct *conn = req->conn;
2942 char *name = NULL;
2943 struct smb_filename *smb_fname = NULL;
2944 uint32 dirtype;
2945 NTSTATUS status;
2946 bool path_contains_wcard = False;
2947 TALLOC_CTX *ctx = talloc_tos();
2948
2949 START_PROFILE(SMBunlink);
2950
2951 if (req->wct < 1) {
2952 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2953 goto out;
2954 }
2955
2956 dirtype = SVAL(req->vwv+0, 0);
2957
2958 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2959 STR_TERMINATE, &status,
2960 &path_contains_wcard);
2961 if (!NT_STATUS_IS_OK(status)) {
2962 reply_nterror(req, status);
2963 goto out;
2964 }
2965
2966 status = filename_convert(ctx, conn,
2967 req->flags2 & FLAGS2_DFS_PATHNAMES,
2968 name,
2969 UCF_COND_ALLOW_WCARD_LCOMP,
2970 &path_contains_wcard,
2971 &smb_fname);
2972 if (!NT_STATUS_IS_OK(status)) {
2973 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2974 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2975 ERRSRV, ERRbadpath);
2976 goto out;
2977 }
2978 reply_nterror(req, status);
2979 goto out;
2980 }
2981
2982 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2983
2984 status = unlink_internals(conn, req, dirtype, smb_fname,
2985 path_contains_wcard);
2986 if (!NT_STATUS_IS_OK(status)) {
2987 if (open_was_deferred(req->sconn, req->mid)) {
2988 /* We have re-scheduled this call. */
2989 goto out;
2990 }
2991 reply_nterror(req, status);
2992 goto out;
2993 }
2994
2995 reply_outbuf(req, 0, 0);
2996 out:
2997 TALLOC_FREE(smb_fname);
2998 END_PROFILE(SMBunlink);
2999 return;
3000 }
3001
3002 /****************************************************************************
3003 Fail for readbraw.
3004 ****************************************************************************/
3005
3006 static void fail_readraw(void)
3007 {
3008 const char *errstr = talloc_asprintf(talloc_tos(),
3009 "FAIL ! reply_readbraw: socket write fail (%s)",
3010 strerror(errno));
3011 if (!errstr) {
3012 errstr = "";
3013 }
3014 exit_server_cleanly(errstr);
3015 }
3016
3017 /****************************************************************************
3018 Fake (read/write) sendfile. Returns -1 on read or write fail.
3019 ****************************************************************************/
3020
3021 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3022 {
3023 size_t bufsize;
3024 size_t tosend = nread;
3025 char *buf;
3026
3027 if (nread == 0) {
3028 return 0;
3029 }
3030
3031 bufsize = MIN(nread, 65536);
3032
3033 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3034 return -1;
3035 }
3036
3037 while (tosend > 0) {
3038 ssize_t ret;
3039 size_t cur_read;
3040
3041 if (tosend > bufsize) {
3042 cur_read = bufsize;
3043 } else {
3044 cur_read = tosend;
3045 }
3046 ret = read_file(fsp,buf,startpos,cur_read);
3047 if (ret == -1) {
3048 SAFE_FREE(buf);
3049 return -1;
3050 }
3051
3052 /* If we had a short read, fill with zeros. */
3053 if (ret < cur_read) {
3054 memset(buf + ret, '\0', cur_read - ret);
3055 }
3056
3057 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3058 != cur_read) {
3059 char addr[INET6_ADDRSTRLEN];
3060 /*
3061 * Try and give an error message saying what
3062 * client failed.
3063 */
3064 DEBUG(0, ("write_data failed for client %s. "
3065 "Error %s\n",
3066 get_peer_addr(fsp->conn->sconn->sock, addr,
3067 sizeof(addr)),
3068 strerror(errno)));
3069 SAFE_FREE(buf);
3070 return -1;
3071 }
3072 tosend -= cur_read;
3073 startpos += cur_read;
3074 }
3075
3076 SAFE_FREE(buf);
3077 return (ssize_t)nread;
3078 }
3079
3080 /****************************************************************************
3081 Deal with the case of sendfile reading less bytes from the file than
3082 requested. Fill with zeros (all we can do).
3083 ****************************************************************************/
3084
3085 void sendfile_short_send(files_struct *fsp,
3086 ssize_t nread,
3087 size_t headersize,
3088 size_t smb_maxcnt)
3089 {
3090 #define SHORT_SEND_BUFSIZE 1024
3091 if (nread < headersize) {
3092 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3093 "header for file %s (%s). Terminating\n",
3094 fsp_str_dbg(fsp), strerror(errno)));
3095 exit_server_cleanly("sendfile_short_send failed");
3096 }
3097
3098 nread -= headersize;
3099
3100 if (nread < smb_maxcnt) {
3101 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3102 if (!buf) {
3103 exit_server_cleanly("sendfile_short_send: "
3104 "malloc failed");
3105 }
3106
3107 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3108 "with zeros !\n", fsp_str_dbg(fsp)));
3109
3110 while (nread < smb_maxcnt) {
3111 /*
3112 * We asked for the real file size and told sendfile
3113 * to not go beyond the end of the file. But it can
3114 * happen that in between our fstat call and the
3115 * sendfile call the file was truncated. This is very
3116 * bad because we have already announced the larger
3117 * number of bytes to the client.
3118 *
3119 * The best we can do now is to send 0-bytes, just as
3120 * a read from a hole in a sparse file would do.
3121 *
3122 * This should happen rarely enough that I don't care
3123 * about efficiency here :-)
3124 */
3125 size_t to_write;
3126
3127 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3128 if (write_data(fsp->conn->sconn->sock, buf, to_write)
3129 != to_write) {
3130 char addr[INET6_ADDRSTRLEN];
3131 /*
3132 * Try and give an error message saying what
3133 * client failed.
3134 */
3135 DEBUG(0, ("write_data failed for client %s. "
3136 "Error %s\n",
3137 get_peer_addr(
3138 fsp->conn->sconn->sock, addr,
3139 sizeof(addr)),
3140 strerror(errno)));
3141 exit_server_cleanly("sendfile_short_send: "
3142 "write_data failed");
3143 }
3144 nread += to_write;
3145 }
3146 SAFE_FREE(buf);
3147 }
3148 }
3149
3150 /****************************************************************************
3151 Return a readbraw error (4 bytes of zero).
3152 ****************************************************************************/
3153
3154 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3155 {
3156 char header[4];
3157
3158 SIVAL(header,0,0);
3159
3160 smbd_lock_socket(sconn);
3161 if (write_data(sconn->sock,header,4) != 4) {
3162 char addr[INET6_ADDRSTRLEN];
3163 /*
3164 * Try and give an error message saying what
3165 * client failed.
3166 */
3167 DEBUG(0, ("write_data failed for client %s. "
3168 "Error %s\n",
3169 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3170 strerror(errno)));
3171
3172 fail_readraw();
3173 }
3174 smbd_unlock_socket(sconn);
3175 }
3176
3177 /****************************************************************************
3178 Use sendfile in readbraw.
3179 ****************************************************************************/
3180
3181 static void send_file_readbraw(connection_struct *conn,
3182 struct smb_request *req,
3183 files_struct *fsp,
3184 off_t startpos,
3185 size_t nread,
3186 ssize_t mincount)
3187 {
3188 struct smbd_server_connection *sconn = req->sconn;
3189 char *outbuf = NULL;
3190 ssize_t ret=0;
3191
3192 /*
3193 * We can only use sendfile on a non-chained packet
3194 * but we can use on a non-oplocked file. tridge proved this
3195 * on a train in Germany :-). JRA.
3196 * reply_readbraw has already checked the length.
3197 */
3198
3199 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3200 (fsp->wcp == NULL) &&
3201 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3202 ssize_t sendfile_read = -1;
3203 char header[4];
3204 DATA_BLOB header_blob;
3205
3206 _smb_setlen(header,nread);
3207 header_blob = data_blob_const(header, 4);
3208
3209 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3210 &header_blob, startpos,
3211 nread);
3212 if (sendfile_read == -1) {
3213 /* Returning ENOSYS means no data at all was sent.
3214 * Do this as a normal read. */
3215 if (errno == ENOSYS) {
3216 goto normal_readbraw;
3217 }
3218
3219 /*
3220 * Special hack for broken Linux with no working sendfile. If we
3221 * return EINTR we sent the header but not the rest of the data.
3222 * Fake this up by doing read/write calls.
3223 */
3224 if (errno == EINTR) {
3225 /* Ensure we don't do this again. */
3226 set_use_sendfile(SNUM(conn), False);
3227 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3228
3229 if (fake_sendfile(fsp, startpos, nread) == -1) {
3230 DEBUG(0,("send_file_readbraw: "
3231 "fake_sendfile failed for "
3232 "file %s (%s).\n",
3233 fsp_str_dbg(fsp),
3234 strerror(errno)));
3235 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3236 }
3237 return;
3238 }
3239
3240 DEBUG(0,("send_file_readbraw: sendfile failed for "
3241 "file %s (%s). Terminating\n",
3242 fsp_str_dbg(fsp), strerror(errno)));
3243 exit_server_cleanly("send_file_readbraw sendfile failed");
3244 } else if (sendfile_read == 0) {
3245 /*
3246 * Some sendfile implementations return 0 to indicate
3247 * that there was a short read, but nothing was
3248 * actually written to the socket. In this case,
3249 * fallback to the normal read path so the header gets
3250 * the correct byte count.
3251 */
3252 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3253 "bytes falling back to the normal read: "
3254 "%s\n", fsp_str_dbg(fsp)));
3255 goto normal_readbraw;
3256 }
3257
3258 /* Deal with possible short send. */
3259 if (sendfile_read != 4+nread) {
3260 sendfile_short_send(fsp, sendfile_read, 4, nread);
3261 }
3262 return;
3263 }
3264
3265 normal_readbraw:
3266
3267 outbuf = talloc_array(NULL, char, nread+4);
3268 if (!outbuf) {
3269 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3270 (unsigned)(nread+4)));
3271 reply_readbraw_error(sconn);
3272 return;
3273 }
3274
3275 if (nread > 0) {
3276 ret = read_file(fsp,outbuf+4,startpos,nread);
3277 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3278 if (ret < mincount)
3279 ret = 0;
3280 #else
3281 if (ret < nread)
3282 ret = 0;
3283 #endif
3284 }
3285
3286 _smb_setlen(outbuf,ret);
3287 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3288 char addr[INET6_ADDRSTRLEN];
3289 /*
3290 * Try and give an error message saying what
3291 * client failed.
3292 */
3293 DEBUG(0, ("write_data failed for client %s. "
3294 "Error %s\n",
3295 get_peer_addr(fsp->conn->sconn->sock, addr,
3296 sizeof(addr)),
3297 strerror(errno)));
3298
3299 fail_readraw();
3300 }
3301
3302 TALLOC_FREE(outbuf);
3303 }
3304
3305 /****************************************************************************
3306 Reply to a readbraw (core+ protocol).
3307 ****************************************************************************/
3308
3309 void reply_readbraw(struct smb_request *req)
3310 {
3311 connection_struct *conn = req->conn;
3312 struct smbd_server_connection *sconn = req->sconn;
3313 ssize_t maxcount,mincount;
3314 size_t nread = 0;
3315 off_t startpos;
3316 files_struct *fsp;
3317 struct lock_struct lock;
3318 off_t size = 0;
3319
3320 START_PROFILE(SMBreadbraw);
3321
3322 if (srv_is_signing_active(sconn) || req->encrypted) {
3323 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3324 "raw reads/writes are disallowed.");
3325 }
3326
3327 if (req->wct < 8) {
3328 reply_readbraw_error(sconn);
3329 END_PROFILE(SMBreadbraw);
3330 return;
3331 }
3332
3333 if (sconn->smb1.echo_handler.trusted_fde) {
3334 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3335 "'async smb echo handler = yes'\n"));
3336 reply_readbraw_error(sconn);
3337 END_PROFILE(SMBreadbraw);
3338 return;
3339 }
3340
3341 /*
3342 * Special check if an oplock break has been issued
3343 * and the readraw request croses on the wire, we must
3344 * return a zero length response here.
3345 */
3346
3347 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3348
3349 /*
3350 * We have to do a check_fsp by hand here, as
3351 * we must always return 4 zero bytes on error,
3352 * not a NTSTATUS.
3353 */
3354
3355 if (!fsp || !conn || conn != fsp->conn ||
3356 req->vuid != fsp->vuid ||
3357 fsp->is_directory || fsp->fh->fd == -1) {
3358 /*
3359 * fsp could be NULL here so use the value from the packet. JRA.
3360 */
3361 DEBUG(3,("reply_readbraw: fnum %d not valid "
3362 "- cache prime?\n",
3363 (int)SVAL(req->vwv+0, 0)));
3364 reply_readbraw_error(sconn);
3365 END_PROFILE(SMBreadbraw);
3366 return;
3367 }
3368
3369 /* Do a "by hand" version of CHECK_READ. */
3370 if (!(fsp->can_read ||
3371 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3372 (fsp->access_mask & FILE_EXECUTE)))) {
3373 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3374 (int)SVAL(req->vwv+0, 0)));
3375 reply_readbraw_error(sconn);
3376 END_PROFILE(SMBreadbraw);
3377 return;
3378 }
3379
3380 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3381
3382 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3383 if(req->wct == 10) {
3384 /*
3385 * This is a large offset (64 bit) read.
3386 */
3387
3388 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3389
3390 if(startpos < 0) {
3391 DEBUG(0,("reply_readbraw: negative 64 bit "
3392 "readraw offset (%.0f) !\n",
3393 (double)startpos ));
3394 reply_readbraw_error(sconn);
3395 END_PROFILE(SMBreadbraw);
3396 return;
3397 }
3398 }
3399
3400 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3401 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3402
3403 /* ensure we don't overrun the packet size */
3404 maxcount = MIN(65535,maxcount);
3405
3406 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3407 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3408 &lock);
3409
3410 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3411 reply_readbraw_error(sconn);
3412 END_PROFILE(SMBreadbraw);
3413 return;
3414 }
3415
3416 if (fsp_stat(fsp) == 0) {
3417 size = fsp->fsp_name->st.st_ex_size;
3418 }
3419
3420 if (startpos >= size) {
3421 nread = 0;
3422 } else {
3423 nread = MIN(maxcount,(size - startpos));
3424 }
3425
3426 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3427 if (nread < mincount)
3428 nread = 0;
3429 #endif
3430
3431 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3432 "min=%lu nread=%lu\n",
3433 fsp_fnum_dbg(fsp), (double)startpos,
3434 (unsigned long)maxcount,
3435 (unsigned long)mincount,
3436 (unsigned long)nread ) );
3437
3438 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3439
3440 DEBUG(5,("reply_readbraw finished\n"));
3441
3442 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3443
3444 END_PROFILE(SMBreadbraw);
3445 return;
3446 }
3447
3448 #undef DBGC_CLASS
3449 #define DBGC_CLASS DBGC_LOCKING
3450
3451 /****************************************************************************
3452 Reply to a lockread (core+ protocol).
3453 ****************************************************************************/
3454
3455 void reply_lockread(struct smb_request *req)
3456 {
3457 connection_struct *conn = req->conn;
3458 ssize_t nread = -1;
3459 char *data;
3460 off_t startpos;
3461 size_t numtoread;
3462 size_t maxtoread;
3463 NTSTATUS status;
3464 files_struct *fsp;
3465 struct byte_range_lock *br_lck = NULL;
3466 char *p = NULL;
3467 struct smbd_server_connection *sconn = req->sconn;
3468
3469 START_PROFILE(SMBlockread);
3470
3471 if (req->wct < 5) {
3472 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3473 END_PROFILE(SMBlockread);
3474 return;
3475 }
3476
3477 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3478
3479 if (!check_fsp(conn, req, fsp)) {
3480 END_PROFILE(SMBlockread);
3481 return;
3482 }
3483
3484 if (!CHECK_READ(fsp,req)) {
3485 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3486 END_PROFILE(SMBlockread);
3487 return;
3488 }
3489
3490 numtoread = SVAL(req->vwv+1, 0);
3491 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3492
3493 /*
3494 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3495 * protocol request that predates the read/write lock concept.
3496 * Thus instead of asking for a read lock here we need to ask
3497 * for a write lock. JRA.
3498 * Note that the requested lock size is unaffected by max_send.
3499 */
3500
3501 br_lck = do_lock(req->sconn->msg_ctx,
3502 fsp,
3503 (uint64_t)req->smbpid,
3504 (uint64_t)numtoread,
3505 (uint64_t)startpos,
3506 WRITE_LOCK,
3507 WINDOWS_LOCK,
3508 False, /* Non-blocking lock. */
3509 &status,
3510 NULL,
3511 NULL);
3512 TALLOC_FREE(br_lck);
3513
3514 if (NT_STATUS_V(status)) {
3515 reply_nterror(req, status);
3516 END_PROFILE(SMBlockread);
3517 return;
3518 }
3519
3520 /*
3521 * However the requested READ size IS affected by max_send. Insanity.... JRA.
3522 */
3523 maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3524
3525 if (numtoread > maxtoread) {
3526 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3527 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3528 (unsigned int)numtoread, (unsigned int)maxtoread,
3529 (unsigned int)sconn->smb1.sessions.max_send));
3530 numtoread = maxtoread;
3531 }
3532
3533 reply_outbuf(req, 5, numtoread + 3);
3534
3535 data = smb_buf(req->outbuf) + 3;
3536
3537 nread = read_file(fsp,data,startpos,numtoread);
3538
3539 if (nread < 0) {
3540 reply_nterror(req, map_nt_error_from_unix(errno));
3541 END_PROFILE(SMBlockread);
3542 return;
3543 }
3544
3545 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3546
3547 SSVAL(req->outbuf,smb_vwv0,nread);
3548 SSVAL(req->outbuf,smb_vwv5,nread+3);
3549 p = smb_buf(req->outbuf);
3550 SCVAL(p,0,0); /* pad byte. */
3551 SSVAL(p,1,nread);
3552
3553 DEBUG(3,("lockread %s num=%d nread=%d\n",
3554 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3555
3556 END_PROFILE(SMBlockread);
3557 return;
3558 }
3559
3560 #undef DBGC_CLASS
3561 #define DBGC_CLASS DBGC_ALL
3562
3563 /****************************************************************************
3564 Reply to a read.
3565 ****************************************************************************/
3566
3567 void reply_read(struct smb_request *req)
3568 {
3569 connection_struct *conn = req->conn;
3570 size_t numtoread;
3571 size_t maxtoread;
3572 ssize_t nread = 0;
3573 char *data;
3574 off_t startpos;
3575 files_struct *fsp;
3576 struct lock_struct lock;
3577 struct smbd_server_connection *sconn = req->sconn;
3578
3579 START_PROFILE(SMBread);
3580
3581 if (req->wct < 3) {
3582 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3583 END_PROFILE(SMBread);
3584 return;
3585 }
3586
3587 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3588
3589 if (!check_fsp(conn, req, fsp)) {
3590 END_PROFILE(SMBread);
3591 return;
3592 }
3593
3594 if (!CHECK_READ(fsp,req)) {
3595 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3596 END_PROFILE(SMBread);
3597 return;
3598 }
3599
3600 numtoread = SVAL(req->vwv+1, 0);
3601 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3602
3603 /*
3604 * The requested read size cannot be greater than max_send. JRA.
3605 */
3606 maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3607
3608 if (numtoread > maxtoread) {
3609 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3610 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3611 (unsigned int)numtoread, (unsigned int)maxtoread,
3612 (unsigned int)sconn->smb1.sessions.max_send));
3613 numtoread = maxtoread;
3614 }
3615
3616 reply_outbuf(req, 5, numtoread+3);
3617
3618 data = smb_buf(req->outbuf) + 3;
3619
3620 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3621 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3622 &lock);
3623
3624 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3625 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3626 END_PROFILE(SMBread);
3627 return;
3628 }
3629
3630 if (numtoread > 0)
3631 nread = read_file(fsp,data,startpos,numtoread);
3632
3633 if (nread < 0) {
3634 reply_nterror(req, map_nt_error_from_unix(errno));
3635 goto strict_unlock;
3636 }
3637
3638 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3639
3640 SSVAL(req->outbuf,smb_vwv0,nread);
3641 SSVAL(req->outbuf,smb_vwv5,nread+3);
3642 SCVAL(smb_buf(req->outbuf),0,1);
3643 SSVAL(smb_buf(req->outbuf),1,nread);
3644
3645 DEBUG(3, ("read %s num=%d nread=%d\n",
3646 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3647
3648 strict_unlock:
3649 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3650
3651 END_PROFILE(SMBread);
3652 return;
3653 }
3654
3655 /****************************************************************************
3656 Setup readX header.
3657 ****************************************************************************/
3658
3659 static int setup_readX_header(struct smb_request *req, char *outbuf,
3660 size_t smb_maxcnt)
3661 {
3662 int outsize;
3663
3664 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3665
3666 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3667
3668 SCVAL(outbuf,smb_vwv0,0xFF);
3669 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3670 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3671 SSVAL(outbuf,smb_vwv6,
3672 (smb_wct - 4) /* offset from smb header to wct */
3673 + 1 /* the wct field */
3674 + 12 * sizeof(uint16_t) /* vwv */
3675 + 2); /* the buflen field */
3676 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3677 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3678 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3679 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3680 return outsize;
3681 }
3682
3683 /****************************************************************************
3684 Reply to a read and X - possibly using sendfile.
3685 ****************************************************************************/
3686
3687 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3688 files_struct *fsp, off_t startpos,
3689 size_t smb_maxcnt)
3690 {
3691 ssize_t nread = -1;
3692 struct lock_struct lock;
3693 int saved_errno = 0;
3694
3695 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3696 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3697 &lock);
3698
3699 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3700 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3701 return;
3702 }
3703
3704 /*
3705 * We can only use sendfile on a non-chained packet
3706 * but we can use on a non-oplocked file. tridge proved this
3707 * on a train in Germany :-). JRA.
3708 */
3709
3710 if (!req_is_in_chain(req) &&
3711 !req->encrypted &&
3712 (fsp->base_fsp == NULL) &&
3713 (fsp->wcp == NULL) &&
3714 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3715 uint8 headerbuf[smb_size + 12 * 2];
3716 DATA_BLOB header;
3717
3718 if(fsp_stat(fsp) == -1) {
3719 reply_nterror(req, map_nt_error_from_unix(errno));
3720 goto strict_unlock;
3721 }
3722
3723 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3724 (startpos > fsp->fsp_name->st.st_ex_size) ||
3725 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3726 /*
3727 * We already know that we would do a short read, so don't
3728 * try the sendfile() path.
3729 */
3730 goto nosendfile_read;
3731 }
3732
3733 /*
3734 * Set up the packet header before send. We
3735 * assume here the sendfile will work (get the
3736 * correct amount of data).
3737 */
3738
3739 header = data_blob_const(headerbuf, sizeof(headerbuf));
3740
3741 construct_reply_common_req(req, (char *)headerbuf);
3742 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3743
3744 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3745 startpos, smb_maxcnt);
3746 if (nread == -1) {
3747 /* Returning ENOSYS means no data at all was sent.
3748 Do this as a normal read. */
3749 if (errno == ENOSYS) {
3750 goto normal_read;
3751 }
3752
3753 /*
3754 * Special hack for broken Linux with no working sendfile. If we
3755 * return EINTR we sent the header but not the rest of the data.
3756 * Fake this up by doing read/write calls.
3757 */
3758
3759 if (errno == EINTR) {
3760 /* Ensure we don't do this again. */
3761 set_use_sendfile(SNUM(conn), False);
3762 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3763 nread = fake_sendfile(fsp, startpos,
3764 smb_maxcnt);
3765 if (nread == -1) {
3766 DEBUG(0,("send_file_readX: "
3767 "fake_sendfile failed for "
3768 "file %s (%s).\n",
3769 fsp_str_dbg(fsp),
3770 strerror(errno)));
3771 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3772 }
3773 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3774 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3775 /* No outbuf here means successful sendfile. */
3776 goto strict_unlock;
3777 }
3778
3779 DEBUG(0,("send_file_readX: sendfile failed for file "
3780 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3781 strerror(errno)));
3782 exit_server_cleanly("send_file_readX sendfile failed");
3783 } else if (nread == 0) {
3784 /*
3785 * Some sendfile implementations return 0 to indicate
3786 * that there was a short read, but nothing was
3787 * actually written to the socket. In this case,
3788 * fallback to the normal read path so the header gets
3789 * the correct byte count.
3790 */
3791 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3792 "falling back to the normal read: %s\n",
3793 fsp_str_dbg(fsp)));
3794 goto normal_read;
3795 }
3796
3797 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3798 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3799
3800 /* Deal with possible short send. */
3801 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3802 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3803 }
3804 /* No outbuf here means successful sendfile. */
3805 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3806 SMB_PERFCOUNT_END(&req->pcd);
3807 goto strict_unlock;
3808 }
3809
3810 normal_read:
3811
3812 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3813 uint8 headerbuf[smb_size + 2*12];
3814
3815 construct_reply_common_req(req, (char *)headerbuf);
3816 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3817
3818 /* Send out the header. */
3819 if (write_data(req->sconn->sock, (char *)headerbuf,
3820 sizeof(headerbuf)) != sizeof(headerbuf)) {
3821
3822 char addr[INET6_ADDRSTRLEN];
3823 /*
3824 * Try and give an error message saying what
3825 * client failed.
3826 */
3827 DEBUG(0, ("write_data failed for client %s. "
3828 "Error %s\n",
3829 get_peer_addr(req->sconn->sock, addr,
3830 sizeof(addr)),
3831 strerror(errno)));
3832
3833 DEBUG(0,("send_file_readX: write_data failed for file "
3834 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3835 strerror(errno)));
3836 exit_server_cleanly("send_file_readX sendfile failed");
3837 }
3838 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3839 if (nread == -1) {
3840 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3841 "file %s (%s).\n", fsp_str_dbg(fsp),
3842 strerror(errno)));
3843 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3844 }
3845 goto strict_unlock;
3846 }
3847
3848 nosendfile_read:
3849
3850 reply_outbuf(req, 12, smb_maxcnt);
3851 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3852 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3853
3854 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3855 saved_errno = errno;
3856
3857 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3858
3859 if (nread < 0) {
3860 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3861 return;
3862 }
3863
3864 setup_readX_header(req, (char *)req->outbuf, nread);
3865
3866 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3867 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3868 return;
3869
3870 strict_unlock:
3871 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3872 TALLOC_FREE(req->outbuf);
3873 return;
3874 }
3875
3876 /****************************************************************************
3877 Work out how much space we have for a read return.
3878 ****************************************************************************/
3879
3880 static size_t calc_max_read_pdu(const struct smb_request *req)
3881 {
3882 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3883 return req->sconn->smb1.sessions.max_send;
3884 }
3885
3886 if (!lp_large_readwrite()) {
3887 return req->sconn->smb1.sessions.max_send;
3888 }
3889
3890 if (req_is_in_chain(req)) {
3891 return req->sconn->smb1.sessions.max_send;
3892 }
3893
3894 if (req->encrypted) {
3895 /*
3896 * Don't take encrypted traffic up to the
3897 * limit. There are padding considerations
3898 * that make that tricky.
3899 */
3900 return req->sconn->smb1.sessions.max_send;
3901 }
3902
3903 if (srv_is_signing_active(req->sconn)) {
3904 return 0x1FFFF;
3905 }
3906
3907 if (!lp_unix_extensions()) {
3908 return 0x1FFFF;
3909 }
3910
3911 /*
3912 * We can do ultra-large POSIX reads.
3913 */
3914 return 0xFFFFFF;
3915 }
3916
3917 /****************************************************************************
3918 Calculate how big a read can be. Copes with all clients. It's always
3919 safe to return a short read - Windows does this.
3920 ****************************************************************************/
3921
3922 static size_t calc_read_size(const struct smb_request *req,
3923 size_t upper_size,
3924 size_t lower_size)
3925 {
3926 size_t max_pdu = calc_max_read_pdu(req);
3927 size_t total_size = 0;
3928 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3929 size_t max_len = max_pdu - hdr_len;
3930
3931 /*
3932 * Windows explicitly ignores upper size of 0xFFFF.
3933 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3934 * We must do the same as these will never fit even in
3935 * an extended size NetBIOS packet.
3936 */
3937 if (upper_size == 0xFFFF) {
3938 upper_size = 0;
3939 }
3940
3941 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3942 upper_size = 0;
3943 }
3944
3945 total_size = ((upper_size<<16) | lower_size);
3946
3947 /*
3948 * LARGE_READX test shows it's always safe to return
3949 * a short read. Windows does so.
3950 */
3951 return MIN(total_size, max_len);
3952 }
3953
3954 /****************************************************************************
3955 Reply to a read and X.
3956 ****************************************************************************/
3957
3958 void reply_read_and_X(struct smb_request *req)
3959 {
3960 connection_struct *conn = req->conn;
3961 files_struct *fsp;
3962 off_t startpos;
3963 size_t smb_maxcnt;
3964 size_t upper_size;
3965 bool big_readX = False;
3966 #if 0
3967 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3968 #endif
3969
3970 START_PROFILE(SMBreadX);
3971
3972 if ((req->wct != 10) && (req->wct != 12)) {
3973 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3974 return;
3975 }
3976
3977 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3978 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3979 smb_maxcnt = SVAL(req->vwv+5, 0);
3980
3981 /* If it's an IPC, pass off the pipe handler. */
3982 if (IS_IPC(conn)) {
3983 reply_pipe_read_and_X(req);
3984 END_PROFILE(SMBreadX);
3985 return;
3986 }
3987
3988 if (!check_fsp(conn, req, fsp)) {
3989 END_PROFILE(SMBreadX);
3990 return;
3991 }
3992
3993 if (!CHECK_READ(fsp,req)) {
3994 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3995 END_PROFILE(SMBreadX);
3996 return;
3997 }
3998
3999 upper_size = SVAL(req->vwv+7, 0);
4000 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4001 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4002 /*
4003 * This is a heuristic to avoid keeping large
4004 * outgoing buffers around over long-lived aio
4005 * requests.
4006 */
4007 big_readX = True;
4008 }
4009
4010 if (req->wct == 12) {
4011 /*
4012 * This is a large offset (64 bit) read.
4013 */
4014 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4015
4016 }
4017
4018 if (!big_readX) {
4019 NTSTATUS status = schedule_aio_read_and_X(conn,
4020 req,
4021 fsp,
4022 startpos,
4023 smb_maxcnt);
4024 if (NT_STATUS_IS_OK(status)) {
4025 /* Read scheduled - we're done. */
4026 goto out;
4027 }
4028 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4029 /* Real error - report to client. */
4030 END_PROFILE(SMBreadX);
4031 reply_nterror(req, status);
4032 return;
4033 }
4034 /* NT_STATUS_RETRY - fall back to sync read. */
4035 }
4036
4037 smbd_lock_socket(req->sconn);
4038 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4039 smbd_unlock_socket(req->sconn);
4040
4041 out:
4042 END_PROFILE(SMBreadX);
4043 return;
4044 }
4045
4046 /****************************************************************************
4047 Error replies to writebraw must have smb_wct == 1. Fix this up.
4048 ****************************************************************************/
4049
4050 void error_to_writebrawerr(struct smb_request *req)
4051 {
4052 uint8 *old_outbuf = req->outbuf;
4053
4054 reply_outbuf(req, 1, 0);
4055
4056 memcpy(req->outbuf, old_outbuf, smb_size);
4057 TALLOC_FREE(old_outbuf);
4058 }
4059
4060 /****************************************************************************
4061 Read 4 bytes of a smb packet and return the smb length of the packet.
4062 Store the result in the buffer. This version of the function will
4063 never return a session keepalive (length of zero).
4064 Timeout is in milliseconds.
4065 ****************************************************************************/
4066
4067 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4068 size_t *len)
4069 {
4070 uint8_t msgtype = NBSSkeepalive;
4071
4072 while (msgtype == NBSSkeepalive) {
4073 NTSTATUS status;
4074
4075 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4076 len);
4077 if (!NT_STATUS_IS_OK(status)) {
4078 char addr[INET6_ADDRSTRLEN];
4079 /* Try and give an error message
4080 * saying what client failed. */
4081 DEBUG(0, ("read_fd_with_timeout failed for "
4082 "client %s read error = %s.\n",
4083 get_peer_addr(fd,addr,sizeof(addr)),
4084 nt_errstr(status)));
4085 return status;
4086 }
4087
4088 msgtype = CVAL(inbuf, 0);
4089 }
4090
4091 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4092 (unsigned long)len));
4093
4094 return NT_STATUS_OK;
4095 }
4096
4097 /****************************************************************************
4098 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4099 ****************************************************************************/
4100
4101 void reply_writebraw(struct smb_request *req)
4102 {
4103 connection_struct *conn = req->conn;
4104 char *buf = NULL;
4105 ssize_t nwritten=0;
4106 ssize_t total_written=0;
4107 size_t numtowrite=0;
4108 size_t tcount;
4109 off_t startpos;
4110 const char *data=NULL;
4111 bool write_through;
4112 files_struct *fsp;
4113 struct lock_struct lock;
4114 NTSTATUS status;
4115
4116 START_PROFILE(SMBwritebraw);
4117
4118 /*
4119 * If we ever reply with an error, it must have the SMB command
4120 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4121 * we're finished.
4122 */
4123 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4124
4125 if (srv_is_signing_active(req->sconn)) {
4126 END_PROFILE(SMBwritebraw);
4127 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4128 "raw reads/writes are disallowed.");
4129 }
4130
4131 if (req->wct < 12) {
4132 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4133 error_to_writebrawerr(req);
4134 END_PROFILE(SMBwritebraw);
4135 return;
4136 }
4137
4138 if (req->sconn->smb1.echo_handler.trusted_fde) {
4139 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4140 "'async smb echo handler = yes'\n"));
4141 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4142 error_to_writebrawerr(req);
4143 END_PROFILE(SMBwritebraw);
4144 return;
4145 }
4146
4147 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4148 if (!check_fsp(conn, req, fsp)) {
4149 error_to_writebrawerr(req);
4150 END_PROFILE(SMBwritebraw);
4151 return;
4152 }
4153
4154 if (!CHECK_WRITE(fsp)) {
4155 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4156 error_to_writebrawerr(req);
4157 END_PROFILE(SMBwritebraw);
4158 return;
4159 }
4160
4161 tcount = IVAL(req->vwv+1, 0);
4162 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4163 write_through = BITSETW(req->vwv+7,0);
4164
4165 /* We have to deal with slightly different formats depending
4166 on whether we are using the core+ or lanman1.0 protocol */
4167
4168 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4169 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4170 data = smb_buf_const(req->inbuf);
4171 } else {
4172 numtowrite = SVAL(req->vwv+10, 0);
4173 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4174 }
4175
4176 /* Ensure we don't write bytes past the end of this packet. */
4177 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4178 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4179 error_to_writebrawerr(req);
4180 END_PROFILE(SMBwritebraw);
4181 return;
4182 }
4183
4184 if (!fsp->print_file) {
4185 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4186 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4187 &lock);
4188
4189 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4190 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4191 error_to_writebrawerr(req);
4192 END_PROFILE(SMBwritebraw);
4193 return;
4194 }
4195 }
4196
4197 if (numtowrite>0) {
4198 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4199 }
4200
4201 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4202 "wrote=%d sync=%d\n",
4203 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4204 (int)nwritten, (int)write_through));
4205
4206 if (nwritten < (ssize_t)numtowrite) {
4207 reply_nterror(req, NT_STATUS_DISK_FULL);
4208 error_to_writebrawerr(req);
4209 goto strict_unlock;
4210 }
4211
4212 total_written = nwritten;
4213
4214 /* Allocate a buffer of 64k + length. */
4215 buf = talloc_array(NULL, char, 65540);
4216 if (!buf) {
4217 reply_nterror(req, NT_STATUS_NO_MEMORY);
4218 error_to_writebrawerr(req);
4219 goto strict_unlock;
4220 }
4221
4222 /* Return a SMBwritebraw message to the redirector to tell
4223 * it to send more bytes */
4224
4225 memcpy(buf, req->inbuf, smb_size);
4226 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4227 SCVAL(buf,smb_com,SMBwritebraw);
4228 SSVALS(buf,smb_vwv0,0xFFFF);
4229 show_msg(buf);
4230 if (!srv_send_smb(req->sconn,
4231 buf,
4232 false, 0, /* no signing */
4233 IS_CONN_ENCRYPTED(conn),
4234 &req->pcd)) {
4235 exit_server_cleanly("reply_writebraw: srv_send_smb "
4236 "failed.");
4237 }
4238
4239 /* Now read the raw data into the buffer and write it */
4240 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4241 &numtowrite);
4242 if (!NT_STATUS_IS_OK(status)) {
4243 exit_server_cleanly("secondary writebraw failed");
4244 }
4245
4246 /* Set up outbuf to return the correct size */
4247 reply_outbuf(req, 1, 0);
4248
4249 if (numtowrite != 0) {
4250
4251 if (numtowrite > 0xFFFF) {
4252 DEBUG(0,("reply_writebraw: Oversize secondary write "
4253 "raw requested (%u). Terminating\n",
4254 (unsigned int)numtowrite ));
4255 exit_server_cleanly("secondary writebraw failed");
4256 }
4257
4258 if (tcount > nwritten+numtowrite) {
4259 DEBUG(3,("reply_writebraw: Client overestimated the "
4260 "write %d %d %d\n",
4261 (int)tcount,(int)nwritten,(int)numtowrite));
4262 }
4263
4264 status = read_data(req->sconn->sock, buf+4, numtowrite);
4265
4266 if (!NT_STATUS_IS_OK(status)) {
4267 char addr[INET6_ADDRSTRLEN];
4268 /* Try and give an error message
4269 * saying what client failed. */
4270 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4271 "raw read failed (%s) for client %s. "
4272 "Terminating\n", nt_errstr(status),
4273 get_peer_addr(req->sconn->sock, addr,
4274 sizeof(addr))));
4275 exit_server_cleanly("secondary writebraw failed");
4276 }
4277
4278 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4279 if (nwritten == -1) {
4280 TALLOC_FREE(buf);
4281 reply_nterror(req, map_nt_error_from_unix(errno));
4282 error_to_writebrawerr(req);
4283 goto strict_unlock;
4284 }
4285
4286 if (nwritten < (ssize_t)numtowrite) {
4287 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4288 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4289 }
4290
4291 if (nwritten > 0) {
4292 total_written += nwritten;
4293 }
4294 }
4295
4296 TALLOC_FREE(buf);
4297 SSVAL(req->outbuf,smb_vwv0,total_written);
4298
4299 status = sync_file(conn, fsp, write_through);
4300 if (!NT_STATUS_IS_OK(status)) {
4301 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4302 fsp_str_dbg(fsp), nt_errstr(status)));
4303 reply_nterror(req, status);
4304 error_to_writebrawerr(req);
4305 goto strict_unlock;
4306 }
4307
4308 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4309 "wrote=%d\n",
4310 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4311 (int)total_written));
4312
4313 if (!fsp->print_file) {
4314 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4315 }
4316
4317 /* We won't return a status if write through is not selected - this
4318 * follows what WfWg does */
4319 END_PROFILE(SMBwritebraw);
4320
4321 if (!write_through && total_written==tcount) {
4322
4323 #if RABBIT_PELLET_FIX
4324 /*
4325 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4326 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4327 * JRA.
4328 */
4329 if (!send_keepalive(req->sconn->sock)) {
4330 exit_server_cleanly("reply_writebraw: send of "
4331 "keepalive failed");
4332 }
4333 #endif
4334 TALLOC_FREE(req->outbuf);
4335 }
4336 return;
4337
4338 strict_unlock:
4339 if (!fsp->print_file) {
4340 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4341 }
4342
4343 END_PROFILE(SMBwritebraw);
4344 return;
4345 }
4346
4347 #undef DBGC_CLASS
4348 #define DBGC_CLASS DBGC_LOCKING
4349
4350 /****************************************************************************
4351 Reply to a writeunlock (core+).
4352 ****************************************************************************/
4353
4354 void reply_writeunlock(struct smb_request *req)
4355 {
4356 connection_struct *conn = req->conn;
4357 ssize_t nwritten = -1;
4358 size_t numtowrite;
4359 off_t startpos;
4360 const char *data;
4361 NTSTATUS status = NT_STATUS_OK;
4362 files_struct *fsp;
4363 struct lock_struct lock;
4364 int saved_errno = 0;
4365
4366 START_PROFILE(SMBwriteunlock);
4367
4368 if (req->wct < 5) {
4369 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4370 END_PROFILE(SMBwriteunlock);
4371 return;
4372 }
4373
4374 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4375
4376 if (!check_fsp(conn, req, fsp)) {
4377 END_PROFILE(SMBwriteunlock);
4378 return;
4379 }
4380
4381 if (!CHECK_WRITE(fsp)) {
4382 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4383 END_PROFILE(SMBwriteunlock);
4384 return;
4385 }
4386
4387 numtowrite = SVAL(req->vwv+1, 0);
4388 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4389 data = (const char *)req->buf + 3;
4390
4391 if (!fsp->print_file && numtowrite > 0) {
4392 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4393 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4394 &lock);
4395
4396 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4397 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4398 END_PROFILE(SMBwriteunlock);
4399 return;
4400 }
4401 }
4402
4403 /* The special X/Open SMB protocol handling of
4404 zero length writes is *NOT* done for
4405 this call */
4406 if(numtowrite == 0) {
4407 nwritten = 0;
4408 } else {
4409 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4410 saved_errno = errno;
4411 }
4412
4413 status = sync_file(conn, fsp, False /* write through */);
4414 if (!NT_STATUS_IS_OK(status)) {
4415 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4416 fsp_str_dbg(fsp), nt_errstr(status)));
4417 reply_nterror(req, status);
4418 goto strict_unlock;
4419 }
4420
4421 if(nwritten < 0) {
4422 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4423 goto strict_unlock;
4424 }
4425
4426 if((nwritten < numtowrite) && (numtowrite != 0)) {
4427 reply_nterror(req, NT_STATUS_DISK_FULL);
4428 goto strict_unlock;
4429 }
4430
4431 if (numtowrite && !fsp->print_file) {
4432 status = do_unlock(req->sconn->msg_ctx,
4433 fsp,
4434 (uint64_t)req->smbpid,
4435 (uint64_t)numtowrite,
4436 (uint64_t)startpos,
4437 WINDOWS_LOCK);
4438
4439 if (NT_STATUS_V(status)) {
4440 reply_nterror(req, status);
4441 goto strict_unlock;
4442 }
4443 }
4444
4445 reply_outbuf(req, 1, 0);
4446
4447 SSVAL(req->outbuf,smb_vwv0,nwritten);
4448
4449 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4450 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4451
4452 strict_unlock:
4453 if (numtowrite && !fsp->print_file) {
4454 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4455 }
4456
4457 END_PROFILE(SMBwriteunlock);
4458 return;
4459 }
4460
4461 #undef DBGC_CLASS
4462 #define DBGC_CLASS DBGC_ALL
4463
4464 /****************************************************************************
4465 Reply to a write.
4466 ****************************************************************************/
4467
4468 void reply_write(struct smb_request *req)
4469 {
4470 connection_struct *conn = req->conn;
4471 size_t numtowrite;
4472 ssize_t nwritten = -1;
4473 off_t startpos;
4474 const char *data;
4475 files_struct *fsp;
4476 struct lock_struct lock;
4477 NTSTATUS status;
4478 int saved_errno = 0;
4479
4480 START_PROFILE(SMBwrite);
4481
4482 if (req->wct < 5) {
4483 END_PROFILE(SMBwrite);
4484 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4485 return;
4486 }
4487
4488 /* If it's an IPC, pass off the pipe handler. */
4489 if (IS_IPC(conn)) {
4490 reply_pipe_write(req);
4491 END_PROFILE(SMBwrite);
4492 return;
4493 }
4494
4495 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4496
4497 if (!check_fsp(conn, req, fsp)) {
4498 END_PROFILE(SMBwrite);
4499 return;
4500 }
4501
4502 if (!CHECK_WRITE(fsp)) {
4503 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4504 END_PROFILE(SMBwrite);
4505 return;
4506 }
4507
4508 numtowrite = SVAL(req->vwv+1, 0);
4509 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4510 data = (const char *)req->buf + 3;
4511
4512 if (!fsp->print_file) {
4513 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4514 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4515 &lock);
4516
4517 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4518 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4519 END_PROFILE(SMBwrite);
4520 return;
4521 }
4522 }
4523
4524 /*
4525 * X/Open SMB protocol says that if smb_vwv1 is
4526 * zero then the file size should be extended or
4527 * truncated to the size given in smb_vwv[2-3].
4528 */
4529
4530 if(numtowrite == 0) {
4531 /*
4532 * This is actually an allocate call, and set EOF. JRA.
4533 */
4534 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4535 if (nwritten < 0) {
4536 reply_nterror(req, NT_STATUS_DISK_FULL);
4537 goto strict_unlock;
4538 }
4539 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4540 if (nwritten < 0) {
4541 reply_nterror(req, NT_STATUS_DISK_FULL);
4542 goto strict_unlock;
4543 }
4544 trigger_write_time_update_immediate(fsp);
4545 } else {
4546 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4547 }
4548
4549 status = sync_file(conn, fsp, False);
4550 if (!NT_STATUS_IS_OK(status)) {
4551 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4552 fsp_str_dbg(fsp), nt_errstr(status)));
4553 reply_nterror(req, status);
4554 goto strict_unlock;
4555 }
4556
4557 if(nwritten < 0) {
4558 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4559 goto strict_unlock;
4560 }
4561
4562 if((nwritten == 0) && (numtowrite != 0)) {
4563 reply_nterror(req, NT_STATUS_DISK_FULL);
4564 goto strict_unlock;
4565 }
4566
4567 reply_outbuf(req, 1, 0);
4568
4569 SSVAL(req->outbuf,smb_vwv0,nwritten);
4570
4571 if (nwritten < (ssize_t)numtowrite) {
4572 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4573 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4574 }
4575
4576 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4577
4578 strict_unlock:
4579 if (!fsp->print_file) {
4580 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4581 }
4582
4583 END_PROFILE(SMBwrite);
4584 return;
4585 }
4586
4587 /****************************************************************************
4588 Ensure a buffer is a valid writeX for recvfile purposes.
4589 ****************************************************************************/
4590
4591 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4592 (2*14) + /* word count (including bcc) */ \
4593 1 /* pad byte */)
4594
4595 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4596 const uint8_t *inbuf)
4597 {
4598 size_t numtowrite;
4599 connection_struct *conn = NULL;
4600 unsigned int doff = 0;
4601 size_t len = smb_len_large(inbuf);
4602 struct smbXsrv_tcon *tcon;
4603 NTSTATUS status;
4604 NTTIME now = 0;
4605
4606 if (is_encrypted_packet(sconn, inbuf)) {
4607 /* Can't do this on encrypted
4608 * connections. */
4609 return false;
4610 }
4611
4612 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4613 return false;
4614 }
4615
4616 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4617 CVAL(inbuf,smb_wct) != 14) {
4618 DEBUG(10,("is_valid_writeX_buffer: chained or "
4619 "invalid word length.\n"));
4620 return false;
4621 }
4622
4623 status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4624 now, &tcon);
4625 if (!NT_STATUS_IS_OK(status)) {
4626 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4627 return false;
4628 }
4629 conn = tcon->compat;
4630
4631 if (IS_IPC(conn)) {
4632 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4633 return false;
4634 }
4635 if (IS_PRINT(conn)) {
4636 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4637 return false;
4638 }
4639 doff = SVAL(inbuf,smb_vwv11);
4640
4641 numtowrite = SVAL(inbuf,smb_vwv10);
4642
4643 if (len > doff && len - doff > 0xFFFF) {
4644 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4645 }
4646
4647 if (numtowrite == 0) {
4648 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4649 return false;
4650 }
4651
4652 /* Ensure the sizes match up. */
4653 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4654 /* no pad byte...old smbclient :-( */
4655 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4656 (unsigned int)doff,
4657 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4658 return false;
4659 }
4660
4661 if (len - doff != numtowrite) {
4662 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4663 "len = %u, doff = %u, numtowrite = %u\n",
4664 (unsigned int)len,
4665 (unsigned int)doff,
4666 (unsigned int)numtowrite ));
4667 return false;
4668 }
4669
4670 DEBUG(10,("is_valid_writeX_buffer: true "
4671 "len = %u, doff = %u, numtowrite = %u\n",
4672 (unsigned int)len,
4673 (unsigned int)doff,
4674 (unsigned int)numtowrite ));
4675
4676 return true;
4677 }
4678
4679 /****************************************************************************
4680 Reply to a write and X.
4681 ****************************************************************************/
4682
4683 void reply_write_and_X(struct smb_request *req)
4684 {
4685 connection_struct *conn = req->conn;
4686 files_struct *fsp;
4687 struct lock_struct lock;
4688 off_t startpos;
4689 size_t numtowrite;
4690 bool write_through;
4691 ssize_t nwritten;
4692 unsigned int smb_doff;
4693 unsigned int smblen;
4694 const char *data;
4695 NTSTATUS status;
4696 int saved_errno = 0;
4697
4698 START_PROFILE(SMBwriteX);
4699
4700 if ((req->wct != 12) && (req->wct != 14)) {
4701 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4702 goto out;
4703 }
4704
4705 numtowrite = SVAL(req->vwv+10, 0);
4706 smb_doff = SVAL(req->vwv+11, 0);
4707 smblen = smb_len(req->inbuf);
4708
4709 if (req->unread_bytes > 0xFFFF ||
4710 (smblen > smb_doff &&
4711 smblen - smb_doff > 0xFFFF)) {
4712 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4713 }
4714
4715 if (req->unread_bytes) {
4716 /* Can't do a recvfile write on IPC$ */
4717 if (IS_IPC(conn)) {
4718 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4719 goto out;
4720 }
4721 if (numtowrite != req->unread_bytes) {
4722 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4723 goto out;
4724 }
4725 } else {
4726 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4727 smb_doff + numtowrite > smblen) {
4728 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4729 goto out;
4730 }
4731 }
4732
4733 /* If it's an IPC, pass off the pipe handler. */
4734 if (IS_IPC(conn)) {
4735 if (req->unread_bytes) {
4736 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4737 goto out;
4738 }
4739 reply_pipe_write_and_X(req);
4740 goto out;
4741 }
4742
4743 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4744 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4745 write_through = BITSETW(req->vwv+7,0);
4746
4747 if (!check_fsp(conn, req, fsp)) {
4748 goto out;
4749 }
4750
4751 if (!CHECK_WRITE(fsp)) {
4752 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4753 goto out;
4754 }
4755
4756 data = smb_base(req->inbuf) + smb_doff;
4757
4758 if(req->wct == 14) {
4759 /*
4760 * This is a large offset (64 bit) write.
4761 */
4762 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4763
4764 }
4765
4766 /* X/Open SMB protocol says that, unlike SMBwrite
4767 if the length is zero then NO truncation is
4768 done, just a write of zero. To truncate a file,
4769 use SMBwrite. */
4770
4771 if(numtowrite == 0) {
4772 nwritten = 0;
4773 } else {
4774 if (req->unread_bytes == 0) {
4775 status = schedule_aio_write_and_X(conn,
4776 req,
4777 fsp,
4778 data,
4779 startpos,
4780 numtowrite);
4781
4782 if (NT_STATUS_IS_OK(status)) {
4783 /* write scheduled - we're done. */
4784 goto out;
4785 }
4786 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4787 /* Real error - report to client. */
4788 reply_nterror(req, status);
4789 goto out;
4790 }
4791 /* NT_STATUS_RETRY - fall through to sync write. */
4792 }
4793
4794 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4795 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4796 &lock);
4797
4798 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4799 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4800 goto out;
4801 }
4802
4803 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4804 saved_errno = errno;
4805
4806 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4807 }
4808
4809 if(nwritten < 0) {
4810 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4811 goto out;
4812 }
4813
4814 if((nwritten == 0) && (numtowrite != 0)) {
4815 reply_nterror(req, NT_STATUS_DISK_FULL);
4816 goto out;
4817 }
4818
4819 reply_outbuf(req, 6, 0);
4820 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4821 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4822 SSVAL(req->outbuf,smb_vwv2,nwritten);
4823 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4824
4825 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4826 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4827
4828 status = sync_file(conn, fsp, write_through);
4829 if (!NT_STATUS_IS_OK(status)) {
4830 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4831 fsp_str_dbg(fsp), nt_errstr(status)));
4832 reply_nterror(req, status);
4833 goto out;
4834 }
4835
4836 END_PROFILE(SMBwriteX);
4837 return;
4838
4839 out:
4840 if (req->unread_bytes) {
4841 /* writeX failed. drain socket. */
4842 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4843 req->unread_bytes) {
4844 smb_panic("failed to drain pending bytes");
4845 }
4846 req->unread_bytes = 0;
4847 }
4848
4849 END_PROFILE(SMBwriteX);
4850 return;
4851 }
4852
4853 /****************************************************************************
4854 Reply to a lseek.
4855 ****************************************************************************/
4856
4857 void reply_lseek(struct smb_request *req)
4858 {
4859 connection_struct *conn = req->conn;
4860 off_t startpos;
4861 off_t res= -1;
4862 int mode,umode;
4863 files_struct *fsp;
4864
4865 START_PROFILE(SMBlseek);
4866
4867 if (req->wct < 4) {
4868 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4869 END_PROFILE(SMBlseek);
4870 return;
4871 }
4872
4873 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4874
4875 if (!check_fsp(conn, req, fsp)) {
4876 return;
4877 }
4878
4879 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4880
4881 mode = SVAL(req->vwv+1, 0) & 3;
4882 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4883 startpos = (off_t)IVALS(req->vwv+2, 0);
4884
4885 switch (mode) {
4886 case 0:
4887 umode = SEEK_SET;
4888 res = startpos;
4889 break;
4890 case 1:
4891 umode = SEEK_CUR;
4892 res = fsp->fh->pos + startpos;
4893 break;
4894 case 2:
4895 umode = SEEK_END;
4896 break;
4897 default:
4898 umode = SEEK_SET;
4899 res = startpos;
4900 break;
4901 }
4902
4903 if (umode == SEEK_END) {
4904 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4905 if(errno == EINVAL) {
4906 off_t current_pos = startpos;
4907
4908 if(fsp_stat(fsp) == -1) {
4909 reply_nterror(req,
4910 map_nt_error_from_unix(errno));
4911 END_PROFILE(SMBlseek);
4912 return;
4913 }
4914
4915 current_pos += fsp->fsp_name->st.st_ex_size;
4916 if(current_pos < 0)
4917 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4918 }
4919 }
4920
4921 if(res == -1) {
4922 reply_nterror(req, map_nt_error_from_unix(errno));
4923 END_PROFILE(SMBlseek);
4924 return;
4925 }
4926 }
4927
4928 fsp->fh->pos = res;
4929
4930 reply_outbuf(req, 2, 0);
4931 SIVAL(req->outbuf,smb_vwv0,res);
4932
4933 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4934 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4935
4936 END_PROFILE(SMBlseek);
4937 return;
4938 }
4939
4940 /****************************************************************************
4941 Reply to a flush.
4942 ****************************************************************************/
4943
4944 void reply_flush(struct smb_request *req)
4945 {
4946 connection_struct *conn = req->conn;
4947 uint16 fnum;
4948 files_struct *fsp;
4949
4950 START_PROFILE(SMBflush);
4951
4952 if (req->wct < 1) {
4953 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4954 return;
4955 }
4956
4957 fnum = SVAL(req->vwv+0, 0);
4958 fsp = file_fsp(req, fnum);
4959
4960 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4961 return;
4962 }
4963
4964 if (!fsp) {
4965 file_sync_all(conn);
4966 } else {
4967 NTSTATUS status = sync_file(conn, fsp, True);
4968 if (!NT_STATUS_IS_OK(status)) {
4969 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4970 fsp_str_dbg(fsp), nt_errstr(status)));
4971 reply_nterror(req, status);
4972 END_PROFILE(SMBflush);
4973 return;
4974 }
4975 }
4976
4977 reply_outbuf(req, 0, 0);
4978
4979 DEBUG(3,("flush\n"));
4980 END_PROFILE(SMBflush);
4981 return;
4982 }
4983
4984 /****************************************************************************
4985 Reply to a exit.
4986 conn POINTER CAN BE NULL HERE !
4987 ****************************************************************************/
4988
4989 void reply_exit(struct smb_request *req)
4990 {
4991 START_PROFILE(SMBexit);
4992
4993 file_close_pid(req->sconn, req->smbpid, req->vuid);
4994
4995 reply_outbuf(req, 0, 0);
4996
4997 DEBUG(3,("exit\n"));
4998
4999 END_PROFILE(SMBexit);
5000 return;
5001 }
5002
5003 struct reply_close_state {
5004 files_struct *fsp;
5005 struct smb_request *smbreq;
5006 };
5007
5008 static void do_smb1_close(struct tevent_req *req);
5009
5010 void reply_close(struct smb_request *req)
5011 {
5012 connection_struct *conn = req->conn;
5013 NTSTATUS status = NT_STATUS_OK;
5014 files_struct *fsp = NULL;
5015 START_PROFILE(SMBclose);
5016
5017 if (req->wct < 3) {
5018 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5019 END_PROFILE(SMBclose);
5020 return;
5021 }
5022
5023 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5024
5025 /*
5026 * We can only use check_fsp if we know it's not a directory.
5027 */
5028
5029 if (!check_fsp_open(conn, req, fsp)) {
5030 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5031 END_PROFILE(SMBclose);
5032 return;
5033 }
5034
5035 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5036 fsp->is_directory ? "directory" : "file",
5037 fsp->fh->fd, fsp_fnum_dbg(fsp),
5038 conn->num_files_open));
5039
5040 if (!fsp->is_directory) {
5041 time_t t;
5042
5043 /*
5044 * Take care of any time sent in the close.
5045 */
5046
5047 t = srv_make_unix_date3(req->vwv+1);
5048 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5049 }
5050
5051 if (fsp->num_aio_requests != 0) {
5052
5053 struct reply_close_state *state;
5054
5055 DEBUG(10, ("closing with aio %u requests pending\n",
5056 fsp->num_aio_requests));
5057
5058 /*
5059 * We depend on the aio_extra destructor to take care of this
5060 * close request once fsp->num_aio_request drops to 0.
5061 */
5062
5063 fsp->deferred_close = tevent_wait_send(
5064 fsp, fsp->conn->sconn->ev_ctx);
5065 if (fsp->deferred_close == NULL) {
5066 status = NT_STATUS_NO_MEMORY;
5067 goto done;
5068 }
5069
5070 state = talloc(fsp, struct reply_close_state);
5071 if (state == NULL) {
5072 TALLOC_FREE(fsp->deferred_close);
5073 status = NT_STATUS_NO_MEMORY;
5074 goto done;
5075 }
5076 state->fsp = fsp;
5077 state->smbreq = talloc_move(fsp, &req);
5078 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5079 state);
5080 END_PROFILE(SMBclose);
5081 return;
5082 }
5083
5084 /*
5085 * close_file() returns the unix errno if an error was detected on
5086 * close - normally this is due to a disk full error. If not then it
5087 * was probably an I/O error.
5088 */
5089
5090 status = close_file(req, fsp, NORMAL_CLOSE);
5091 done:
5092 if (!NT_STATUS_IS_OK(status)) {
5093 reply_nterror(req, status);
5094 END_PROFILE(SMBclose);
5095 return;
5096 }
5097
5098 reply_outbuf(req, 0, 0);
5099 END_PROFILE(SMBclose);
5100 return;
5101 }
5102
5103 static void do_smb1_close(struct tevent_req *req)
5104 {
5105 struct reply_close_state *state = tevent_req_callback_data(
5106 req, struct reply_close_state);
5107 struct smb_request *smbreq;
5108 NTSTATUS status;
5109 int ret;
5110
5111 ret = tevent_wait_recv(req);
5112 TALLOC_FREE(req);
5113 if (ret != 0) {
5114 DEBUG(10, ("tevent_wait_recv returned %s\n",
5115 strerror(ret)));
5116 /*
5117 * Continue anyway, this should never happen
5118 */
5119 }
5120
5121 /*
5122 * fsp->smb2_close_request right now is a talloc grandchild of
5123 * fsp. When we close_file(fsp), it would go with it. No chance to
5124 * reply...
5125 */
5126 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5127
5128 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5129 if (NT_STATUS_IS_OK(status)) {
5130 reply_outbuf(smbreq, 0, 0);
5131 } else {
5132 reply_nterror(smbreq, status);
5133 }
5134 if (!srv_send_smb(smbreq->sconn,
5135 (char *)smbreq->outbuf,
5136 true,
5137 smbreq->seqnum+1,
5138 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5139 NULL)) {
5140 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5141 "failed.");
5142 }
5143 TALLOC_FREE(smbreq);
5144 }
5145
5146 /****************************************************************************
5147 Reply to a writeclose (Core+ protocol).
5148 ****************************************************************************/
5149
5150 void reply_writeclose(struct smb_request *req)
5151 {
5152 connection_struct *conn = req->conn;
5153 size_t numtowrite;
5154 ssize_t nwritten = -1;
5155 NTSTATUS close_status = NT_STATUS_OK;
5156 off_t startpos;
5157 const char *data;
5158 struct timespec mtime;
5159 files_struct *fsp;
5160 struct lock_struct lock;
5161
5162 START_PROFILE(SMBwriteclose);
5163
5164 if (req->wct < 6) {
5165 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5166 END_PROFILE(SMBwriteclose);
5167 return;
5168 }
5169
5170 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5171
5172 if (!check_fsp(conn, req, fsp)) {
5173 END_PROFILE(SMBwriteclose);
5174 return;
5175 }
5176 if (!CHECK_WRITE(fsp)) {
5177 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5178 END_PROFILE(SMBwriteclose);
5179 return;
5180 }
5181
5182 numtowrite = SVAL(req->vwv+1, 0);
5183 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5184 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5185 data = (const char *)req->buf + 1;
5186
5187 if (fsp->print_file == NULL) {
5188 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5189 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5190 &lock);
5191
5192 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5193 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5194 END_PROFILE(SMBwriteclose);
5195 return;
5196 }
5197 }
5198
5199 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5200
5201 if (fsp->print_file == NULL) {
5202 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5203 }
5204
5205 set_close_write_time(fsp, mtime);
5206
5207 /*
5208 * More insanity. W2K only closes the file if writelen > 0.
5209 * JRA.
5210 */
5211
5212 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5213 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5214 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5215
5216 if (numtowrite) {
5217 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5218 "file %s\n", fsp_str_dbg(fsp)));
5219 close_status = close_file(req, fsp, NORMAL_CLOSE);
5220 fsp = NULL;
5221 }
5222
5223 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5224 reply_nterror(req, NT_STATUS_DISK_FULL);
5225 goto out;
5226 }
5227
5228 if(!NT_STATUS_IS_OK(close_status)) {
5229 reply_nterror(req, close_status);
5230 goto out;
5231 }
5232
5233 reply_outbuf(req, 1, 0);
5234
5235 SSVAL(req->outbuf,smb_vwv0,nwritten);
5236
5237 out:
5238
5239 END_PROFILE(SMBwriteclose);
5240 return;
5241 }
5242
5243 #undef DBGC_CLASS
5244 #define DBGC_CLASS DBGC_LOCKING
5245
5246 /****************************************************************************
5247 Reply to a lock.
5248 ****************************************************************************/
5249
5250 void reply_lock(struct smb_request *req)
5251 {
5252 connection_struct *conn = req->conn;
5253 uint64_t count,offset;
5254 NTSTATUS status;
5255 files_struct *fsp;
5256 struct byte_range_lock *br_lck = NULL;
5257
5258 START_PROFILE(SMBlock);
5259
5260 if (req->wct < 5) {
5261 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5262 END_PROFILE(SMBlock);
5263 return;
5264 }
5265
5266 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5267
5268 if (!check_fsp(conn, req, fsp)) {
5269 END_PROFILE(SMBlock);
5270 return;
5271 }
5272
5273 count = (uint64_t)IVAL(req->vwv+1, 0);
5274 offset = (uint64_t)IVAL(req->vwv+3, 0);
5275
5276 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5277 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5278
5279 br_lck = do_lock(req->sconn->msg_ctx,
5280 fsp,
5281 (uint64_t)req->smbpid,
5282 count,
5283 offset,
5284 WRITE_LOCK,
5285 WINDOWS_LOCK,
5286 False, /* Non-blocking lock. */
5287 &status,
5288 NULL,
5289 NULL);
5290
5291 TALLOC_FREE(br_lck);
5292
5293 if (NT_STATUS_V(status)) {
5294 reply_nterror(req, status);
5295 END_PROFILE(SMBlock);
5296 return;
5297 }
5298
5299 reply_outbuf(req, 0, 0);
5300
5301 END_PROFILE(SMBlock);
5302 return;
5303 }
5304
5305 /****************************************************************************
5306 Reply to a unlock.
5307 ****************************************************************************/
5308
5309 void reply_unlock(struct smb_request *req)
5310 {
5311 connection_struct *conn = req->conn;
5312 uint64_t count,offset;
5313 NTSTATUS status;
5314 files_struct *fsp;
5315
5316 START_PROFILE(SMBunlock);
5317
5318 if (req->wct < 5) {
5319 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5320 END_PROFILE(SMBunlock);
5321 return;
5322 }
5323
5324 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5325
5326 if (!check_fsp(conn, req, fsp)) {
5327 END_PROFILE(SMBunlock);
5328 return;
5329 }
5330
5331 count = (uint64_t)IVAL(req->vwv+1, 0);
5332 offset = (uint64_t)IVAL(req->vwv+3, 0);
5333
5334 status = do_unlock(req->sconn->msg_ctx,
5335 fsp,
5336 (uint64_t)req->smbpid,
5337 count,
5338 offset,
5339 WINDOWS_LOCK);
5340
5341 if (NT_STATUS_V(status)) {
5342 reply_nterror(req, status);
5343 END_PROFILE(SMBunlock);
5344 return;
5345 }
5346
5347 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5348 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5349
5350 reply_outbuf(req, 0, 0);
5351
5352 END_PROFILE(SMBunlock);
5353 return;
5354 }
5355
5356 #undef DBGC_CLASS
5357 #define DBGC_CLASS DBGC_ALL
5358
5359 /****************************************************************************
5360 Reply to a tdis.
5361 conn POINTER CAN BE NULL HERE !
5362 ****************************************************************************/
5363
5364 void reply_tdis(struct smb_request *req)
5365 {
5366 NTSTATUS status;
5367 connection_struct *conn = req->conn;
5368 struct smbXsrv_tcon *tcon;
5369
5370 START_PROFILE(SMBtdis);
5371
5372 if (!conn) {
5373 DEBUG(4,("Invalid connection in tdis\n"));
5374 reply_force_doserror(req, ERRSRV, ERRinvnid);
5375 END_PROFILE(SMBtdis);
5376 return;
5377 }
5378
5379 tcon = conn->tcon;
5380 req->conn = NULL;
5381
5382 /*
5383 * TODO: cancel all outstanding requests on the tcon
5384 */
5385 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5386 if (!NT_STATUS_IS_OK(status)) {
5387 DEBUG(0, ("reply_tdis: "
5388 "smbXsrv_tcon_disconnect() failed: %s\n",
5389 nt_errstr(status)));
5390 /*
5391 * If we hit this case, there is something completely
5392 * wrong, so we better disconnect the transport connection.
5393 */
5394 END_PROFILE(SMBtdis);
5395 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5396 return;
5397 }
5398
5399 TALLOC_FREE(tcon);
5400
5401 reply_outbuf(req, 0, 0);
5402 END_PROFILE(SMBtdis);
5403 return;
5404 }
5405
5406 /****************************************************************************
5407 Reply to a echo.
5408 conn POINTER CAN BE NULL HERE !
5409 ****************************************************************************/
5410
5411 void reply_echo(struct smb_request *req)
5412 {
5413 connection_struct *conn = req->conn;
5414 struct smb_perfcount_data local_pcd;
5415 struct smb_perfcount_data *cur_pcd;
5416 int smb_reverb;
5417 int seq_num;
5418
5419 START_PROFILE(SMBecho);
5420
5421 smb_init_perfcount_data(&local_pcd);
5422
5423 if (req->wct < 1) {
5424 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5425 END_PROFILE(SMBecho);
5426 return;
5427 }
5428
5429 smb_reverb = SVAL(req->vwv+0, 0);
5430
5431 reply_outbuf(req, 1, req->buflen);
5432
5433 /* copy any incoming data back out */
5434 if (req->buflen > 0) {
5435 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5436 }
5437
5438 if (smb_reverb > 100) {
5439 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5440 smb_reverb = 100;
5441 }
5442
5443 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5444
5445 /* this makes sure we catch the request pcd */
5446 if (seq_num == smb_reverb) {
5447 cur_pcd = &req->pcd;
5448 } else {
5449 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5450 cur_pcd = &local_pcd;
5451 }
5452
5453 SSVAL(req->outbuf,smb_vwv0,seq_num);
5454
5455 show_msg((char *)req->outbuf);
5456 if (!srv_send_smb(req->sconn,
5457 (char *)req->outbuf,
5458 true, req->seqnum+1,
5459 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5460 cur_pcd))
5461 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5462 }
5463
5464 DEBUG(3,("echo %d times\n", smb_reverb));
5465
5466 TALLOC_FREE(req->outbuf);
5467
5468 END_PROFILE(SMBecho);
5469 return;
5470 }
5471
5472 /****************************************************************************
5473 Reply to a printopen.
5474 ****************************************************************************/
5475
5476 void reply_printopen(struct smb_request *req)
5477 {
5478 connection_struct *conn = req->conn;
5479 files_struct *fsp;
5480 NTSTATUS status;
5481
5482 START_PROFILE(SMBsplopen);
5483
5484 if (req->wct < 2) {
5485 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5486 END_PROFILE(SMBsplopen);
5487 return;
5488 }
5489
5490 if (!CAN_PRINT(conn)) {
5491 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5492 END_PROFILE(SMBsplopen);
5493 return;
5494 }
5495
5496 status = file_new(req, conn, &fsp);
5497 if(!NT_STATUS_IS_OK(status)) {
5498 reply_nterror(req, status);
5499 END_PROFILE(SMBsplopen);
5500 return;
5501 }
5502
5503 /* Open for exclusive use, write only. */
5504 status = print_spool_open(fsp, NULL, req->vuid);
5505
5506 if (!NT_STATUS_IS_OK(status)) {
5507 file_free(req, fsp);
5508 reply_nterror(req, status);
5509 END_PROFILE(SMBsplopen);
5510 return;
5511 }
5512
5513 reply_outbuf(req, 1, 0);
5514 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5515
5516 DEBUG(3,("openprint fd=%d %s\n",
5517 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5518
5519 END_PROFILE(SMBsplopen);
5520 return;
5521 }
5522
5523 /****************************************************************************
5524 Reply to a printclose.
5525 ****************************************************************************/
5526
5527 void reply_printclose(struct smb_request *req)
5528 {
5529 connection_struct *conn = req->conn;
5530 files_struct *fsp;
5531 NTSTATUS status;
5532
5533 START_PROFILE(SMBsplclose);
5534
5535 if (req->wct < 1) {
5536 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5537 END_PROFILE(SMBsplclose);
5538 return;
5539 }
5540
5541 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5542
5543 if (!check_fsp(conn, req, fsp)) {
5544 END_PROFILE(SMBsplclose);
5545 return;
5546 }
5547
5548 if (!CAN_PRINT(conn)) {
5549 reply_force_doserror(req, ERRSRV, ERRerror);
5550 END_PROFILE(SMBsplclose);
5551 return;
5552 }
5553
5554 DEBUG(3,("printclose fd=%d %s\n",
5555 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5556
5557 status = close_file(req, fsp, NORMAL_CLOSE);
5558
5559 if(!NT_STATUS_IS_OK(status)) {
5560 reply_nterror(req, status);
5561 END_PROFILE(SMBsplclose);
5562 return;
5563 }
5564
5565 reply_outbuf(req, 0, 0);
5566
5567 END_PROFILE(SMBsplclose);
5568 return;
5569 }
5570
5571 /****************************************************************************
5572 Reply to a printqueue.
5573 ****************************************************************************/
5574
5575 void reply_printqueue(struct smb_request *req)
5576 {
5577 connection_struct *conn = req->conn;
5578 int max_count;
5579 int start_index;
5580
5581 START_PROFILE(SMBsplretq);
5582
5583 if (req->wct < 2) {
5584 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5585 END_PROFILE(SMBsplretq);
5586 return;
5587 }
5588
5589 max_count = SVAL(req->vwv+0, 0);
5590 start_index = SVAL(req->vwv+1, 0);
5591
5592 /* we used to allow the client to get the cnum wrong, but that
5593 is really quite gross and only worked when there was only
5594 one printer - I think we should now only accept it if they
5595 get it right (tridge) */
5596 if (!CAN_PRINT(conn)) {
5597 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5598 END_PROFILE(SMBsplretq);
5599 return;
5600 }
5601
5602 reply_outbuf(req, 2, 3);
5603 SSVAL(req->outbuf,smb_vwv0,0);
5604 SSVAL(req->outbuf,smb_vwv1,0);
5605 SCVAL(smb_buf(req->outbuf),0,1);
5606 SSVAL(smb_buf(req->outbuf),1,0);
5607
5608 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5609 start_index, max_count));
5610
5611 {
5612 TALLOC_CTX *mem_ctx = talloc_tos();
5613 NTSTATUS status;
5614 WERROR werr;
5615 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5616 struct rpc_pipe_client *cli = NULL;
5617 struct dcerpc_binding_handle *b = NULL;
5618 struct policy_handle handle;
5619 struct spoolss_DevmodeContainer devmode_ctr;
5620 union spoolss_JobInfo *info;
5621 uint32_t count;
5622 uint32_t num_to_get;
5623 uint32_t first;
5624 uint32_t i;
5625
5626 ZERO_STRUCT(handle);
5627
5628 status = rpc_pipe_open_interface(conn,
5629 &ndr_table_spoolss,
5630 conn->session_info,
5631 conn->sconn->remote_address,
5632 conn->sconn->msg_ctx,
5633 &cli);
5634 if (!NT_STATUS_IS_OK(status)) {
5635 DEBUG(0, ("reply_printqueue: "
5636 "could not connect to spoolss: %s\n",
5637 nt_errstr(status)));
5638 reply_nterror(req, status);
5639 goto out;
5640 }
5641 b = cli->binding_handle;
5642
5643 ZERO_STRUCT(devmode_ctr);
5644
5645 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5646 sharename,
5647 NULL, devmode_ctr,
5648 SEC_FLAG_MAXIMUM_ALLOWED,
5649 &handle,
5650 &werr);
5651 if (!NT_STATUS_IS_OK(status)) {
5652 reply_nterror(req, status);
5653 goto out;
5654 }
5655 if (!W_ERROR_IS_OK(werr)) {
5656 reply_nterror(req, werror_to_ntstatus(werr));
5657 goto out;
5658 }
5659
5660 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5661 &handle,
5662 0, /* firstjob */
5663 0xff, /* numjobs */
5664 2, /* level */
5665 0, /* offered */
5666 &count,
5667 &info);
5668 if (!W_ERROR_IS_OK(werr)) {
5669 reply_nterror(req, werror_to_ntstatus(werr));
5670 goto out;
5671 }
5672
5673 if (max_count > 0) {
5674 first = start_index;
5675 } else {
5676 first = start_index + max_count + 1;
5677 }
5678
5679 if (first >= count) {
5680 num_to_get = first;
5681 } else {
5682 num_to_get = first + MIN(ABS(max_count), count - first);
5683 }
5684
5685 for (i = first; i < num_to_get; i++) {
5686 char blob[28];
5687 char *p = blob;
5688 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5689 int qstatus;
5690 uint16_t qrapjobid = pjobid_to_rap(sharename,
5691 info[i].info2.job_id);
5692
5693 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5694 qstatus = 2;
5695 } else {
5696 qstatus = 3;
5697 }
5698
5699 srv_put_dos_date2(p, 0, qtime);
5700 SCVAL(p, 4, qstatus);
5701 SSVAL(p, 5, qrapjobid);
5702 SIVAL(p, 7, info[i].info2.size);
5703 SCVAL(p, 11, 0);
5704 srvstr_push(blob, req->flags2, p+12,
5705 info[i].info2.notify_name, 16, STR_ASCII);
5706
5707 if (message_push_blob(
5708 &req->outbuf,
5709 data_blob_const(
5710 blob, sizeof(blob))) == -1) {
5711 reply_nterror(req, NT_STATUS_NO_MEMORY);
5712 goto out;
5713 }
5714 }
5715
5716 if (count > 0) {
5717 SSVAL(req->outbuf,smb_vwv0,count);
5718 SSVAL(req->outbuf,smb_vwv1,
5719 (max_count>0?first+count:first-1));
5720 SCVAL(smb_buf(req->outbuf),0,1);
5721 SSVAL(smb_buf(req->outbuf),1,28*count);
5722 }
5723
5724
5725 DEBUG(3, ("%u entries returned in queue\n",
5726 (unsigned)count));
5727
5728 out:
5729 if (b && is_valid_policy_hnd(&handle)) {
5730 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5731 }
5732
5733 }
5734
5735 END_PROFILE(SMBsplretq);
5736 return;
5737 }
5738
5739 /****************************************************************************
5740 Reply to a printwrite.
5741 ****************************************************************************/
5742
5743 void reply_printwrite(struct smb_request *req)
5744 {
5745 connection_struct *conn = req->conn;
5746 int numtowrite;
5747 const char *data;
5748 files_struct *fsp;
5749
5750 START_PROFILE(SMBsplwr);
5751
5752 if (req->wct < 1) {
5753 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5754 END_PROFILE(SMBsplwr);
5755 return;
5756 }
5757
5758 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5759
5760 if (!check_fsp(conn, req, fsp)) {
5761 END_PROFILE(SMBsplwr);
5762 return;
5763 }
5764
5765 if (!fsp->print_file) {
5766 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5767 END_PROFILE(SMBsplwr);
5768 return;
5769 }
5770
5771 if (!CHECK_WRITE(fsp)) {
5772 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5773 END_PROFILE(SMBsplwr);
5774 return;
5775 }
5776
5777 numtowrite = SVAL(req->buf, 1);
5778
5779 if (req->buflen < numtowrite + 3) {
5780 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5781 END_PROFILE(SMBsplwr);
5782 return;
5783 }
5784
5785 data = (const char *)req->buf + 3;
5786
5787 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5788 reply_nterror(req, map_nt_error_from_unix(errno));
5789 END_PROFILE(SMBsplwr);
5790 return;
5791 }
5792
5793 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5794
5795 END_PROFILE(SMBsplwr);
5796 return;
5797 }
5798
5799 /****************************************************************************
5800 Reply to a mkdir.
5801 ****************************************************************************/
5802
5803 void reply_mkdir(struct smb_request *req)
5804 {
5805 connection_struct *conn = req->conn;
5806 struct smb_filename *smb_dname = NULL;
5807 char *directory = NULL;
5808 NTSTATUS status;
5809 TALLOC_CTX *ctx = talloc_tos();
5810
5811 START_PROFILE(SMBmkdir);
5812
5813 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5814 STR_TERMINATE, &status);
5815 if (!NT_STATUS_IS_OK(status)) {
5816 reply_nterror(req, status);
5817 goto out;
5818 }
5819
5820 status = filename_convert(ctx, conn,
5821 req->flags2 & FLAGS2_DFS_PATHNAMES,
5822 directory,
5823 UCF_PREP_CREATEFILE,
5824 NULL,
5825 &smb_dname);
5826 if (!NT_STATUS_IS_OK(status)) {
5827 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5828 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5829 ERRSRV, ERRbadpath);
5830 goto out;
5831 }
5832 reply_nterror(req, status);
5833 goto out;
5834 }
5835
5836 status = create_directory(conn, req, smb_dname);
5837
5838 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5839
5840 if (!NT_STATUS_IS_OK(status)) {
5841
5842 if (!use_nt_status()
5843 && NT_STATUS_EQUAL(status,
5844 NT_STATUS_OBJECT_NAME_COLLISION)) {
5845 /*
5846 * Yes, in the DOS error code case we get a
5847 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5848 * samba4 torture test.
5849 */
5850 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5851 }
5852
5853 reply_nterror(req, status);
5854 goto out;
5855 }
5856
5857 reply_outbuf(req, 0, 0);
5858
5859 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5860 out:
5861 TALLOC_FREE(smb_dname);
5862 END_PROFILE(SMBmkdir);
5863 return;
5864 }
5865
5866 /****************************************************************************
5867 Reply to a rmdir.
5868 ****************************************************************************/
5869
5870 void reply_rmdir(struct smb_request *req)
5871 {
5872 connection_struct *conn = req->conn;
5873 struct smb_filename *smb_dname = NULL;
5874 char *directory = NULL;
5875 NTSTATUS status;
5876 TALLOC_CTX *ctx = talloc_tos();
5877 files_struct *fsp = NULL;
5878 int info = 0;
5879 struct smbd_server_connection *sconn = req->sconn;
5880
5881 START_PROFILE(SMBrmdir);
5882
5883 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5884 STR_TERMINATE, &status);
5885 if (!NT_STATUS_IS_OK(status)) {
5886 reply_nterror(req, status);
5887 goto out;
5888 }
5889
5890 status = filename_convert(ctx, conn,
5891 req->flags2 & FLAGS2_DFS_PATHNAMES,
5892 directory,
5893 0,
5894 NULL,
5895 &smb_dname);
5896 if (!NT_STATUS_IS_OK(status)) {
5897 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5898 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5899 ERRSRV, ERRbadpath);
5900 goto out;
5901 }
5902 reply_nterror(req, status);
5903 goto out;
5904 }
5905
5906 if (is_ntfs_stream_smb_fname(smb_dname)) {
5907 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5908 goto out;
5909 }
5910
5911 status = SMB_VFS_CREATE_FILE(
5912 conn, /* conn */
5913 req, /* req */
5914 0, /* root_dir_fid */
5915 smb_dname, /* fname */
5916 DELETE_ACCESS, /* access_mask */
5917 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5918 FILE_SHARE_DELETE),
5919 FILE_OPEN, /* create_disposition*/
5920 FILE_DIRECTORY_FILE, /* create_options */
5921 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5922 0, /* oplock_request */
5923 0, /* allocation_size */
5924 0, /* private_flags */
5925 NULL, /* sd */
5926 NULL, /* ea_list */
5927 &fsp, /* result */
5928 &info); /* pinfo */
5929
5930 if (!NT_STATUS_IS_OK(status)) {
5931 if (open_was_deferred(req->sconn, req->mid)) {
5932 /* We have re-scheduled this call. */
5933 goto out;
5934 }
5935 reply_nterror(req, status);
5936 goto out;
5937 }
5938
5939 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5940 if (!NT_STATUS_IS_OK(status)) {
5941 close_file(req, fsp, ERROR_CLOSE);
5942 reply_nterror(req, status);
5943 goto out;
5944 }
5945
5946 if (!set_delete_on_close(fsp, true,
5947 conn->session_info->security_token,
5948 conn->session_info->unix_token)) {
5949 close_file(req, fsp, ERROR_CLOSE);
5950 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5951 goto out;
5952 }
5953
5954 status = close_file(req, fsp, NORMAL_CLOSE);
5955 if (!NT_STATUS_IS_OK(status)) {
5956 reply_nterror(req, status);
5957 } else {
5958 reply_outbuf(req, 0, 0);
5959 }
5960
5961 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5962
5963 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5964 out:
5965 TALLOC_FREE(smb_dname);
5966 END_PROFILE(SMBrmdir);
5967 return;
5968 }
5969
5970 /*******************************************************************
5971 Resolve wildcards in a filename rename.
5972 ********************************************************************/
5973
5974 static bool resolve_wildcards(TALLOC_CTX *ctx,
5975 const char *name1,
5976 const char *name2,
5977 char **pp_newname)
5978 {
5979 char *name2_copy = NULL;
5980 char *root1 = NULL;
5981 char *root2 = NULL;
5982 char *ext1 = NULL;
5983 char *ext2 = NULL;
5984 char *p,*p2, *pname1, *pname2;
5985
5986 name2_copy = talloc_strdup(ctx, name2);
5987 if (!name2_copy) {
5988 return False;
5989 }
5990
5991 pname1 = strrchr_m(name1,'/');
5992 pname2 = strrchr_m(name2_copy,'/');
5993
5994 if (!pname1 || !pname2) {
5995 return False;
5996 }
5997
5998 /* Truncate the copy of name2 at the last '/' */
5999 *pname2 = '\0';
6000
6001 /* Now go past the '/' */
6002 pname1++;
6003 pname2++;
6004
6005 root1 = talloc_strdup(ctx, pname1);
6006 root2 = talloc_strdup(ctx, pname2);
6007
6008 if (!root1 || !root2) {
6009 return False;
6010 }
6011
6012 p = strrchr_m(root1,'.');
6013 if (p) {
6014 *p = 0;
6015 ext1 = talloc_strdup(ctx, p+1);
6016 } else {
6017 ext1 = talloc_strdup(ctx, "");
6018 }
6019 p = strrchr_m(root2,'.');
6020 if (p) {
6021 *p = 0;
6022 ext2 = talloc_strdup(ctx, p+1);
6023 } else {
6024 ext2 = talloc_strdup(ctx, "");
6025 }
6026
6027 if (!ext1 || !ext2) {
6028 return False;
6029 }
6030
6031 p = root1;
6032 p2 = root2;
6033 while (*p2) {
6034 if (*p2 == '?') {
6035 /* Hmmm. Should this be mb-aware ? */
6036 *p2 = *p;
6037 p2++;
6038 } else if (*p2 == '*') {
6039 *p2 = '\0';
6040 root2 = talloc_asprintf(ctx, "%s%s",
6041 root2,
6042 p);
6043 if (!root2) {
6044 return False;
6045 }
6046 break;
6047 } else {
6048 p2++;
6049 }
6050 if (*p) {
6051 p++;
6052 }
6053 }
6054
6055 p = ext1;
6056 p2 = ext2;
6057 while (*p2) {
6058 if (*p2 == '?') {
6059 /* Hmmm. Should this be mb-aware ? */
6060 *p2 = *p;
6061 p2++;
6062 } else if (*p2 == '*') {
6063 *p2 = '\0';
6064 ext2 = talloc_asprintf(ctx, "%s%s",
6065 ext2,
6066 p);
6067 if (!ext2) {
6068 return False;
6069 }
6070 break;
6071 } else {
6072 p2++;
6073 }
6074 if (*p) {
6075 p++;
6076 }
6077 }
6078
6079 if (*ext2) {
6080 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6081 name2_copy,
6082 root2,
6083 ext2);
6084 } else {
6085 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6086 name2_copy,
6087 root2);
6088 }
6089
6090 if (!*pp_newname) {
6091 return False;
6092 }
6093
6094 return True;
6095 }
6096
6097 /****************************************************************************
6098 Ensure open files have their names updated. Updated to notify other smbd's
6099 asynchronously.
6100 ****************************************************************************/
6101
6102 static void rename_open_files(connection_struct *conn,
6103 struct share_mode_lock *lck,
6104 struct file_id id,
6105 uint32_t orig_name_hash,
6106 const struct smb_filename *smb_fname_dst)
6107 {
6108 files_struct *fsp;
6109 bool did_rename = False;
6110 NTSTATUS status;
6111 uint32_t new_name_hash = 0;
6112
6113 for(fsp = file_find_di_first(conn->sconn, id); fsp;
6114 fsp = file_find_di_next(fsp)) {
6115 /* fsp_name is a relative path under the fsp. To change this for other
6116 sharepaths we need to manipulate relative paths. */
6117 /* TODO - create the absolute path and manipulate the newname
6118 relative to the sharepath. */
6119 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6120 continue;
6121 }
6122 if (fsp->name_hash != orig_name_hash) {
6123 continue;
6124 }
6125 DEBUG(10, ("rename_open_files: renaming file %s "
6126 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6127 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6128 smb_fname_str_dbg(smb_fname_dst)));
6129
6130 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6131 if (NT_STATUS_IS_OK(status)) {
6132 did_rename = True;
6133 new_name_hash = fsp->name_hash;
6134 }
6135 }
6136
6137 if (!did_rename) {
6138 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6139 "for %s\n", file_id_string_tos(&id),
6140 smb_fname_str_dbg(smb_fname_dst)));
6141 }
6142
6143 /* Send messages to all smbd's (not ourself) that the name has changed. */
6144 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6145 orig_name_hash, new_name_hash,
6146 smb_fname_dst);
6147
6148 }
6149
6150 /****************************************************************************
6151 We need to check if the source path is a parent directory of the destination
6152 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6153 refuse the rename with a sharing violation. Under UNIX the above call can
6154 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6155 probably need to check that the client is a Windows one before disallowing
6156 this as a UNIX client (one with UNIX extensions) can know the source is a
6157 symlink and make this decision intelligently. Found by an excellent bug
6158 report from <AndyLiebman@aol.com>.
6159 ****************************************************************************/
6160
6161 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6162 const struct smb_filename *smb_fname_dst)
6163 {
6164 const char *psrc = smb_fname_src->base_name;
6165 const char *pdst = smb_fname_dst->base_name;
6166 size_t slen;
6167
6168 if (psrc[0] == '.' && psrc[1] == '/') {
6169 psrc += 2;
6170 }
6171 if (pdst[0] == '.' && pdst[1] == '/') {
6172 pdst += 2;
6173 }
6174 if ((slen = strlen(psrc)) > strlen(pdst)) {
6175 return False;
6176 }
6177 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6178 }
6179
6180 /*
6181 * Do the notify calls from a rename
6182 */
6183
6184 static void notify_rename(connection_struct *conn, bool is_dir,
6185 const struct smb_filename *smb_fname_src,
6186 const struct smb_filename *smb_fname_dst)
6187 {
6188 char *parent_dir_src = NULL;
6189 char *parent_dir_dst = NULL;
6190 uint32 mask;
6191
6192 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6193 : FILE_NOTIFY_CHANGE_FILE_NAME;
6194
6195 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6196 &parent_dir_src, NULL) ||
6197 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6198 &parent_dir_dst, NULL)) {
6199 goto out;
6200 }
6201
6202 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6203 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6204 smb_fname_src->base_name);
6205 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6206 smb_fname_dst->base_name);
6207 }
6208 else {
6209 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6210 smb_fname_src->base_name);
6211 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6212 smb_fname_dst->base_name);
6213 }
6214
6215 /* this is a strange one. w2k3 gives an additional event for
6216 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6217 files, but not directories */
6218 if (!is_dir) {
6219 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6220 FILE_NOTIFY_CHANGE_ATTRIBUTES
6221 |FILE_NOTIFY_CHANGE_CREATION,
6222 smb_fname_dst->base_name);
6223 }
6224 out:
6225 TALLOC_FREE(parent_dir_src);
6226 TALLOC_FREE(parent_dir_dst);
6227 }
6228
6229 /****************************************************************************
6230 Returns an error if the parent directory for a filename is open in an
6231 incompatible way.
6232 ****************************************************************************/
6233
6234 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6235 const struct smb_filename *smb_fname_dst_in)
6236 {
6237 char *parent_dir = NULL;
6238 struct smb_filename smb_fname_parent;
6239 struct file_id id;
6240 files_struct *fsp = NULL;
6241 int ret;
6242
6243 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6244 &parent_dir, NULL)) {
6245 return NT_STATUS_NO_MEMORY;
6246 }
6247 ZERO_STRUCT(smb_fname_parent);
6248 smb_fname_parent.base_name = parent_dir;
6249
6250 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6251 if (ret == -1) {
6252 return map_nt_error_from_unix(errno);
6253 }
6254
6255 /*
6256 * We're only checking on this smbd here, mostly good
6257 * enough.. and will pass tests.
6258 */
6259
6260 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6261 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6262 fsp = file_find_di_next(fsp)) {
6263 if (fsp->access_mask & DELETE_ACCESS) {
6264 return NT_STATUS_SHARING_VIOLATION;
6265 }
6266 }
6267 return NT_STATUS_OK;
6268 }
6269
6270 /****************************************************************************
6271 Rename an open file - given an fsp.
6272 ****************************************************************************/
6273
6274 NTSTATUS rename_internals_fsp(connection_struct *conn,
6275 files_struct *fsp,
6276 const struct smb_filename *smb_fname_dst_in,
6277 uint32 attrs,
6278 bool replace_if_exists)
6279 {
6280 TALLOC_CTX *ctx = talloc_tos();
6281 struct smb_filename *smb_fname_dst = NULL;
6282 NTSTATUS status = NT_STATUS_OK;
6283 struct share_mode_lock *lck = NULL;
6284 bool dst_exists, old_is_stream, new_is_stream;
6285
6286 status = check_name(conn, smb_fname_dst_in->base_name);
6287 if (!NT_STATUS_IS_OK(status)) {
6288 return status;
6289 }
6290
6291 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6292 if (!NT_STATUS_IS_OK(status)) {
6293 return status;
6294 }
6295
6296 /* Make a copy of the dst smb_fname structs */
6297
6298 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6299 if (smb_fname_dst == NULL) {
6300 status = NT_STATUS_NO_MEMORY;
6301 goto out;
6302 }
6303
6304 /*
6305 * Check for special case with case preserving and not
6306 * case sensitive. If the old last component differs from the original
6307 * last component only by case, then we should allow
6308 * the rename (user is trying to change the case of the
6309 * filename).
6310 */
6311 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6312 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6313 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6314 char *last_slash;
6315 char *fname_dst_lcomp_base_mod = NULL;
6316 struct smb_filename *smb_fname_orig_lcomp = NULL;
6317
6318 /*
6319 * Get the last component of the destination name.
6320 */
6321 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6322 if (last_slash) {
6323 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6324 } else {
6325 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6326 }
6327 if (!fname_dst_lcomp_base_mod) {
6328 status = NT_STATUS_NO_MEMORY;
6329 goto out;
6330 }
6331
6332 /*
6333 * Create an smb_filename struct using the original last
6334 * component of the destination.
6335 */
6336 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6337 ctx, smb_fname_dst->original_lcomp, NULL);
6338 if (smb_fname_orig_lcomp == NULL) {
6339 status = NT_STATUS_NO_MEMORY;
6340 TALLOC_FREE(fname_dst_lcomp_base_mod);
6341 goto out;
6342 }
6343
6344 /* If the base names only differ by case, use original. */
6345 if(!strcsequal(fname_dst_lcomp_base_mod,
6346 smb_fname_orig_lcomp->base_name)) {
6347 char *tmp;
6348 /*
6349 * Replace the modified last component with the
6350 * original.
6351 */
6352 if (last_slash) {
6353 *last_slash = '\0'; /* Truncate at the '/' */
6354 tmp = talloc_asprintf(smb_fname_dst,
6355 "%s/%s",
6356 smb_fname_dst->base_name,
6357 smb_fname_orig_lcomp->base_name);
6358 } else {
6359 tmp = talloc_asprintf(smb_fname_dst,
6360 "%s",
6361 smb_fname_orig_lcomp->base_name);
6362 }
6363 if (tmp == NULL) {
6364 status = NT_STATUS_NO_MEMORY;
6365 TALLOC_FREE(fname_dst_lcomp_base_mod);
6366 TALLOC_FREE(smb_fname_orig_lcomp);
6367 goto out;
6368 }
6369 TALLOC_FREE(smb_fname_dst->base_name);
6370 smb_fname_dst->base_name = tmp;
6371 }
6372
6373 /* If the stream_names only differ by case, use original. */
6374 if(!strcsequal(smb_fname_dst->stream_name,
6375 smb_fname_orig_lcomp->stream_name)) {
6376 char *tmp = NULL;
6377 /* Use the original stream. */
6378 tmp = talloc_strdup(smb_fname_dst,
6379 smb_fname_orig_lcomp->stream_name);
6380 if (tmp == NULL) {
6381 status = NT_STATUS_NO_MEMORY;
6382 TALLOC_FREE(fname_dst_lcomp_base_mod);
6383 TALLOC_FREE(smb_fname_orig_lcomp);
6384 goto out;
6385 }
6386 TALLOC_FREE(smb_fname_dst->stream_name);
6387 smb_fname_dst->stream_name = tmp;
6388 }
6389 TALLOC_FREE(fname_dst_lcomp_base_mod);
6390 TALLOC_FREE(smb_fname_orig_lcomp);
6391 }
6392
6393 /*
6394 * If the src and dest names are identical - including case,
6395 * don't do the rename, just return success.
6396 */
6397
6398 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6399 strcsequal(fsp->fsp_name->stream_name,
6400 smb_fname_dst->stream_name)) {
6401 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6402 "- returning success\n",
6403 smb_fname_str_dbg(smb_fname_dst)));
6404 status = NT_STATUS_OK;
6405 goto out;
6406 }
6407
6408 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6409 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6410
6411 /* Return the correct error code if both names aren't streams. */
6412 if (!old_is_stream && new_is_stream) {
6413 status = NT_STATUS_OBJECT_NAME_INVALID;
6414 goto out;
6415 }
6416
6417 if (old_is_stream && !new_is_stream) {
6418 status = NT_STATUS_INVALID_PARAMETER;
6419 goto out;
6420 }
6421
6422 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6423
6424 if(!replace_if_exists && dst_exists) {
6425 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6426 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6427 smb_fname_str_dbg(smb_fname_dst)));
6428 status = NT_STATUS_OBJECT_NAME_COLLISION;
6429 goto out;
6430 }
6431
6432 if (dst_exists) {
6433 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6434 &smb_fname_dst->st);
6435 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6436 fileid);
6437 /* The file can be open when renaming a stream */
6438 if (dst_fsp && !new_is_stream) {
6439 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6440 status = NT_STATUS_ACCESS_DENIED;
6441 goto out;
6442 }
6443 }
6444
6445 /* Ensure we have a valid stat struct for the source. */
6446 status = vfs_stat_fsp(fsp);
6447 if (!NT_STATUS_IS_OK(status)) {
6448 goto out;
6449 }
6450
6451 status = can_rename(conn, fsp, attrs);
6452
6453 if (!NT_STATUS_IS_OK(status)) {
6454 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6455 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6456 smb_fname_str_dbg(smb_fname_dst)));
6457 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6458 status = NT_STATUS_ACCESS_DENIED;
6459 goto out;
6460 }
6461
6462 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6463 status = NT_STATUS_ACCESS_DENIED;
6464 }
6465
6466 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6467
6468 /*
6469 * We have the file open ourselves, so not being able to get the
6470 * corresponding share mode lock is a fatal error.
6471 */
6472
6473 SMB_ASSERT(lck != NULL);
6474
6475 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6476 uint32 create_options = fsp->fh->private_options;
6477
6478 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6479 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6480 smb_fname_str_dbg(smb_fname_dst)));
6481
6482 if (!fsp->is_directory &&
6483 !lp_posix_pathnames() &&
6484 (lp_map_archive(SNUM(conn)) ||
6485 lp_store_dos_attributes(SNUM(conn)))) {
6486 /* We must set the archive bit on the newly
6487 renamed file. */
6488 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6489 uint32_t old_dosmode = dos_mode(conn,
6490 smb_fname_dst);
6491 file_set_dosmode(conn,
6492 smb_fname_dst,
6493 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6494 NULL,
6495 true);
6496 }
6497 }
6498
6499 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6500 smb_fname_dst);
6501
6502 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6503 smb_fname_dst);
6504
6505 /*
6506 * A rename acts as a new file create w.r.t. allowing an initial delete
6507 * on close, probably because in Windows there is a new handle to the
6508 * new file. If initial delete on close was requested but not
6509 * originally set, we need to set it here. This is probably not 100% correct,
6510 * but will work for the CIFSFS client which in non-posix mode
6511 * depends on these semantics. JRA.
6512 */
6513
6514 if (create_options & FILE_DELETE_ON_CLOSE) {
6515 status = can_set_delete_on_close(fsp, 0);
6516
6517 if (NT_STATUS_IS_OK(status)) {
6518 /* Note that here we set the *inital* delete on close flag,
6519 * not the regular one. The magic gets handled in close. */
6520 fsp->initial_delete_on_close = True;
6521 }
6522 }
6523 TALLOC_FREE(lck);
6524 status = NT_STATUS_OK;
6525 goto out;
6526 }
6527
6528 TALLOC_FREE(lck);
6529
6530 if (errno == ENOTDIR || errno == EISDIR) {
6531 status = NT_STATUS_OBJECT_NAME_COLLISION;
6532 } else {
6533 status = map_nt_error_from_unix(errno);
6534 }
6535
6536 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6537 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6538 smb_fname_str_dbg(smb_fname_dst)));
6539
6540 out:
6541 TALLOC_FREE(smb_fname_dst);
6542
6543 return status;
6544 }
6545
6546 /****************************************************************************
6547 The guts of the rename command, split out so it may be called by the NT SMB
6548 code.
6549 ****************************************************************************/
6550
6551 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6552 connection_struct *conn,
6553 struct smb_request *req,
6554 struct smb_filename *smb_fname_src,
6555 struct smb_filename *smb_fname_dst,
6556 uint32 attrs,
6557 bool replace_if_exists,
6558 bool src_has_wild,
6559 bool dest_has_wild,
6560 uint32_t access_mask)
6561 {
6562 char *fname_src_dir = NULL;
6563 char *fname_src_mask = NULL;
6564 int count=0;
6565 NTSTATUS status = NT_STATUS_OK;
6566 struct smb_Dir *dir_hnd = NULL;
6567 const char *dname = NULL;
6568 char *talloced = NULL;
6569 long offset = 0;
6570 int create_options = 0;
6571 bool posix_pathnames = lp_posix_pathnames();
6572 int rc;
6573
6574 /*
6575 * Split the old name into directory and last component
6576 * strings. Note that unix_convert may have stripped off a
6577 * leading ./ from both name and newname if the rename is
6578 * at the root of the share. We need to make sure either both
6579 * name and newname contain a / character or neither of them do
6580 * as this is checked in resolve_wildcards().
6581 */
6582
6583 /* Split up the directory from the filename/mask. */
6584 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6585 &fname_src_dir, &fname_src_mask);
6586 if (!NT_STATUS_IS_OK(status)) {
6587 status = NT_STATUS_NO_MEMORY;
6588 goto out;
6589 }
6590
6591 /*
6592 * We should only check the mangled cache
6593 * here if unix_convert failed. This means
6594 * that the path in 'mask' doesn't exist
6595 * on the file system and so we need to look
6596 * for a possible mangle. This patch from
6597 * Tine Smukavec <valentin.smukavec@hermes.si>.
6598 */
6599
6600 if (!VALID_STAT(smb_fname_src->st) &&
6601 mangle_is_mangled(fname_src_mask, conn->params)) {
6602 char *new_mask = NULL;
6603 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6604 conn->params);
6605 if (new_mask) {
6606 TALLOC_FREE(fname_src_mask);
6607 fname_src_mask = new_mask;
6608 }
6609 }
6610
6611 if (!src_has_wild) {
6612 files_struct *fsp;
6613
6614 /*
6615 * Only one file needs to be renamed. Append the mask back
6616 * onto the directory.
6617 */
6618 TALLOC_FREE(smb_fname_src->base_name);
6619 if (ISDOT(fname_src_dir)) {
6620 /* Ensure we use canonical names on open. */
6621 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6622 "%s",
6623 fname_src_mask);
6624 } else {
6625 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6626 "%s/%s",
6627 fname_src_dir,
6628 fname_src_mask);
6629 }
6630 if (!smb_fname_src->base_name) {
6631 status = NT_STATUS_NO_MEMORY;
6632 goto out;
6633 }
6634
6635 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6636 "case_preserve = %d, short case preserve = %d, "
6637 "directory = %s, newname = %s, "
6638 "last_component_dest = %s\n",
6639 conn->case_sensitive, conn->case_preserve,
6640 conn->short_case_preserve,
6641 smb_fname_str_dbg(smb_fname_src),
6642 smb_fname_str_dbg(smb_fname_dst),
6643 smb_fname_dst->original_lcomp));
6644
6645 /* The dest name still may have wildcards. */
6646 if (dest_has_wild) {
6647 char *fname_dst_mod = NULL;
6648 if (!resolve_wildcards(smb_fname_dst,
6649 smb_fname_src->base_name,
6650 smb_fname_dst->base_name,
6651 &fname_dst_mod)) {
6652 DEBUG(6, ("rename_internals: resolve_wildcards "
6653 "%s %s failed\n",
6654 smb_fname_src->base_name,
6655 smb_fname_dst->base_name));
6656 status = NT_STATUS_NO_MEMORY;
6657 goto out;
6658 }
6659 TALLOC_FREE(smb_fname_dst->base_name);
6660 smb_fname_dst->base_name = fname_dst_mod;
6661 }
6662
6663 ZERO_STRUCT(smb_fname_src->st);
6664 if (posix_pathnames) {
6665 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6666 } else {
6667 rc = SMB_VFS_STAT(conn, smb_fname_src);
6668 }
6669 if (rc == -1) {
6670 status = map_nt_error_from_unix_common(errno);
6671 goto out;
6672 }
6673
6674 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6675 create_options |= FILE_DIRECTORY_FILE;
6676 }
6677
6678 status = SMB_VFS_CREATE_FILE(
6679 conn, /* conn */
6680 req, /* req */
6681 0, /* root_dir_fid */
6682 smb_fname_src, /* fname */
6683 access_mask, /* access_mask */
6684 (FILE_SHARE_READ | /* share_access */
6685 FILE_SHARE_WRITE),
6686 FILE_OPEN, /* create_disposition*/
6687 create_options, /* create_options */
6688 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6689 0, /* oplock_request */
6690 0, /* allocation_size */
6691 0, /* private_flags */
6692 NULL, /* sd */
6693 NULL, /* ea_list */
6694 &fsp, /* result */
6695 NULL); /* pinfo */
6696
6697 if (!NT_STATUS_IS_OK(status)) {
6698 DEBUG(3, ("Could not open rename source %s: %s\n",
6699 smb_fname_str_dbg(smb_fname_src),
6700 nt_errstr(status)));
6701 goto out;
6702 }
6703
6704 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6705 attrs, replace_if_exists);
6706
6707 close_file(req, fsp, NORMAL_CLOSE);
6708
6709 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6710 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6711 smb_fname_str_dbg(smb_fname_dst)));
6712
6713 goto out;
6714 }
6715
6716 /*
6717 * Wildcards - process each file that matches.
6718 */
6719 if (strequal(fname_src_mask, "????????.???")) {
6720 TALLOC_FREE(fname_src_mask);
6721 fname_src_mask = talloc_strdup(ctx, "*");
6722 if (!fname_src_mask) {
6723 status = NT_STATUS_NO_MEMORY;
6724 goto out;
6725 }
6726 }
6727
6728 status = check_name(conn, fname_src_dir);
6729 if (!NT_STATUS_IS_OK(status)) {
6730 goto out;
6731 }
6732
6733 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6734 attrs);
6735 if (dir_hnd == NULL) {
6736 status = map_nt_error_from_unix(errno);
6737 goto out;
6738 }
6739
6740 status = NT_STATUS_NO_SUCH_FILE;
6741 /*
6742 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6743 * - gentest fix. JRA
6744 */
6745
6746 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6747 &talloced))) {
6748 files_struct *fsp = NULL;
6749 char *destname = NULL;
6750 bool sysdir_entry = False;
6751
6752 /* Quick check for "." and ".." */
6753 if (ISDOT(dname) || ISDOTDOT(dname)) {
6754 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6755 sysdir_entry = True;
6756 } else {
6757 TALLOC_FREE(talloced);
6758 continue;
6759 }
6760 }
6761
6762 if (!is_visible_file(conn, fname_src_dir, dname,
6763 &smb_fname_src->st, false)) {
6764 TALLOC_FREE(talloced);
6765 continue;
6766 }
6767
6768 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6769 TALLOC_FREE(talloced);
6770 continue;
6771 }
6772
6773 if (sysdir_entry) {
6774 status = NT_STATUS_OBJECT_NAME_INVALID;
6775 break;
6776 }
6777
6778 TALLOC_FREE(smb_fname_src->base_name);
6779 if (ISDOT(fname_src_dir)) {
6780 /* Ensure we use canonical names on open. */
6781 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6782 "%s",
6783 dname);
6784 } else {
6785 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6786 "%s/%s",
6787 fname_src_dir,
6788 dname);
6789 }
6790 if (!smb_fname_src->base_name) {
6791 status = NT_STATUS_NO_MEMORY;
6792 goto out;
6793 }
6794
6795 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6796 smb_fname_dst->base_name,
6797 &destname)) {
6798 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6799 smb_fname_src->base_name, destname));
6800 TALLOC_FREE(talloced);
6801 continue;
6802 }
6803 if (!destname) {
6804 status = NT_STATUS_NO_MEMORY;
6805 goto out;
6806 }
6807
6808 TALLOC_FREE(smb_fname_dst->base_name);
6809 smb_fname_dst->base_name = destname;
6810
6811 ZERO_STRUCT(smb_fname_src->st);
6812 if (posix_pathnames) {
6813 SMB_VFS_LSTAT(conn, smb_fname_src);
6814 } else {
6815 SMB_VFS_STAT(conn, smb_fname_src);
6816 }
6817
6818 create_options = 0;
6819
6820 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6821 create_options |= FILE_DIRECTORY_FILE;
6822 }
6823
6824 status = SMB_VFS_CREATE_FILE(
6825 conn, /* conn */
6826 req, /* req */
6827 0, /* root_dir_fid */
6828 smb_fname_src, /* fname */
6829 access_mask, /* access_mask */
6830 (FILE_SHARE_READ | /* share_access */
6831 FILE_SHARE_WRITE),
6832 FILE_OPEN, /* create_disposition*/
6833 create_options, /* create_options */
6834 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6835 0, /* oplock_request */
6836 0, /* allocation_size */
6837 0, /* private_flags */
6838 NULL, /* sd */
6839 NULL, /* ea_list */
6840 &fsp, /* result */
6841 NULL); /* pinfo */
6842
6843 if (!NT_STATUS_IS_OK(status)) {
6844 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6845 "returned %s rename %s -> %s\n",
6846 nt_errstr(status),
6847 smb_fname_str_dbg(smb_fname_src),
6848 smb_fname_str_dbg(smb_fname_dst)));
6849 break;
6850 }
6851
6852 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6853 dname);
6854 if (!smb_fname_dst->original_lcomp) {
6855 status = NT_STATUS_NO_MEMORY;
6856 goto out;
6857 }
6858
6859 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6860 attrs, replace_if_exists);
6861
6862 close_file(req, fsp, NORMAL_CLOSE);
6863
6864 if (!NT_STATUS_IS_OK(status)) {
6865 DEBUG(3, ("rename_internals_fsp returned %s for "
6866 "rename %s -> %s\n", nt_errstr(status),
6867 smb_fname_str_dbg(smb_fname_src),
6868 smb_fname_str_dbg(smb_fname_dst)));
6869 break;
6870 }
6871
6872 count++;
6873
6874 DEBUG(3,("rename_internals: doing rename on %s -> "
6875 "%s\n", smb_fname_str_dbg(smb_fname_src),
6876 smb_fname_str_dbg(smb_fname_src)));
6877 TALLOC_FREE(talloced);
6878 }
6879 TALLOC_FREE(dir_hnd);
6880
6881 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6882 status = map_nt_error_from_unix(errno);
6883 }
6884
6885 out:
6886 TALLOC_FREE(talloced);
6887 TALLOC_FREE(fname_src_dir);
6888 TALLOC_FREE(fname_src_mask);
6889 return status;
6890 }
6891
6892 /****************************************************************************
6893 Reply to a mv.
6894 ****************************************************************************/
6895
6896 void reply_mv(struct smb_request *req)
6897 {
6898 connection_struct *conn = req->conn;
6899 char *name = NULL;
6900 char *newname = NULL;
6901 const char *p;
6902 uint32 attrs;
6903 NTSTATUS status;
6904 bool src_has_wcard = False;
6905 bool dest_has_wcard = False;
6906 TALLOC_CTX *ctx = talloc_tos();
6907 struct smb_filename *smb_fname_src = NULL;
6908 struct smb_filename *smb_fname_dst = NULL;
6909 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6910 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6911 bool stream_rename = false;
6912
6913 START_PROFILE(SMBmv);
6914
6915 if (req->wct < 1) {
6916 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6917 goto out;
6918 }
6919
6920 attrs = SVAL(req->vwv+0, 0);
6921
6922 p = (const char *)req->buf + 1;
6923 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6924 &status, &src_has_wcard);
6925 if (!NT_STATUS_IS_OK(status)) {
6926 reply_nterror(req, status);
6927 goto out;
6928 }
6929 p++;
6930 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6931 &status, &dest_has_wcard);
6932 if (!NT_STATUS_IS_OK(status)) {
6933 reply_nterror(req, status);
6934 goto out;
6935 }
6936
6937 if (!lp_posix_pathnames()) {
6938 /* The newname must begin with a ':' if the
6939 name contains a ':'. */
6940 if (strchr_m(name, ':')) {
6941 if (newname[0] != ':') {
6942 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6943 goto out;
6944 }
6945 stream_rename = true;
6946 }
6947 }
6948
6949 status = filename_convert(ctx,
6950 conn,
6951 req->flags2 & FLAGS2_DFS_PATHNAMES,
6952 name,
6953 src_ucf_flags,
6954 &src_has_wcard,
6955 &smb_fname_src);
6956
6957 if (!NT_STATUS_IS_OK(status)) {
6958 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6959 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6960 ERRSRV, ERRbadpath);
6961 goto out;
6962 }
6963 reply_nterror(req, status);
6964 goto out;
6965 }
6966
6967 status = filename_convert(ctx,
6968 conn,
6969 req->flags2 & FLAGS2_DFS_PATHNAMES,
6970 newname,
6971 dst_ucf_flags,
6972 &dest_has_wcard,
6973 &smb_fname_dst);
6974
6975 if (!NT_STATUS_IS_OK(status)) {
6976 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6977 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6978 ERRSRV, ERRbadpath);
6979 goto out;
6980 }
6981 reply_nterror(req, status);
6982 goto out;
6983 }
6984
6985 if (stream_rename) {
6986 /* smb_fname_dst->base_name must be the same as
6987 smb_fname_src->base_name. */
6988 TALLOC_FREE(smb_fname_dst->base_name);
6989 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6990 smb_fname_src->base_name);
6991 if (!smb_fname_dst->base_name) {
6992 reply_nterror(req, NT_STATUS_NO_MEMORY);
6993 goto out;
6994 }
6995 }
6996
6997 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6998 smb_fname_str_dbg(smb_fname_dst)));
6999
7000 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7001 attrs, False, src_has_wcard, dest_has_wcard,
7002 DELETE_ACCESS);
7003 if (!NT_STATUS_IS_OK(status)) {
7004 if (open_was_deferred(req->sconn, req->mid)) {
7005 /* We have re-scheduled this call. */
7006 goto out;
7007 }
7008 reply_nterror(req, status);
7009 goto out;
7010 }
7011
7012 reply_outbuf(req, 0, 0);
7013 out:
7014 TALLOC_FREE(smb_fname_src);
7015 TALLOC_FREE(smb_fname_dst);
7016 END_PROFILE(SMBmv);
7017 return;
7018 }
7019
7020 /*******************************************************************
7021 Copy a file as part of a reply_copy.
7022 ******************************************************************/
7023
7024 /*
7025 * TODO: check error codes on all callers
7026 */
7027
7028 NTSTATUS copy_file(TALLOC_CTX *ctx,
7029 connection_struct *conn,
7030 struct smb_filename *smb_fname_src,
7031 struct smb_filename *smb_fname_dst,
7032 int ofun,
7033 int count,
7034 bool target_is_directory)
7035 {
7036 struct smb_filename *smb_fname_dst_tmp = NULL;
7037 off_t ret=-1;
7038 files_struct *fsp1,*fsp2;
7039 uint32 dosattrs;
7040 uint32 new_create_disposition;
7041 NTSTATUS status;
7042
7043
7044 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7045 if (smb_fname_dst_tmp == NULL) {
7046 return NT_STATUS_NO_MEMORY;
7047 }
7048
7049 /*
7050 * If the target is a directory, extract the last component from the
7051 * src filename and append it to the dst filename
7052 */
7053 if (target_is_directory) {
7054 const char *p;
7055
7056 /* dest/target can't be a stream if it's a directory. */
7057 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7058
7059 p = strrchr_m(smb_fname_src->base_name,'/');
7060 if (p) {
7061 p++;
7062 } else {
7063 p = smb_fname_src->base_name;
7064 }
7065 smb_fname_dst_tmp->base_name =
7066 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7067 p);
7068 if (!smb_fname_dst_tmp->base_name) {
7069 status = NT_STATUS_NO_MEMORY;
7070 goto out;
7071 }
7072 }
7073
7074 status = vfs_file_exist(conn, smb_fname_src);
7075 if (!NT_STATUS_IS_OK(status)) {
7076 goto out;
7077 }
7078
7079 if (!target_is_directory && count) {
7080 new_create_disposition = FILE_OPEN;
7081 } else {
7082 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7083 0, ofun,
7084 NULL, NULL,
7085 &new_create_disposition,
7086 NULL,
7087 NULL)) {
7088 status = NT_STATUS_INVALID_PARAMETER;
7089 goto out;
7090 }
7091 }
7092
7093 /* Open the src file for reading. */
7094 status = SMB_VFS_CREATE_FILE(
7095 conn, /* conn */
7096 NULL, /* req */
7097 0, /* root_dir_fid */
7098 smb_fname_src, /* fname */
7099 FILE_GENERIC_READ, /* access_mask */
7100 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7101 FILE_OPEN, /* create_disposition*/
7102 0, /* create_options */
7103 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7104 INTERNAL_OPEN_ONLY, /* oplock_request */
7105 0, /* allocation_size */
7106 0, /* private_flags */
7107 NULL, /* sd */
7108 NULL, /* ea_list */
7109 &fsp1, /* result */
7110 NULL); /* psbuf */
7111
7112 if (!NT_STATUS_IS_OK(status)) {
7113 goto out;
7114 }
7115
7116 dosattrs = dos_mode(conn, smb_fname_src);
7117
7118 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7119 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7120 }
7121
7122 /* Open the dst file for writing. */
7123 status = SMB_VFS_CREATE_FILE(
7124 conn, /* conn */
7125 NULL, /* req */
7126 0, /* root_dir_fid */
7127 smb_fname_dst, /* fname */
7128 FILE_GENERIC_WRITE, /* access_mask */
7129 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7130 new_create_disposition, /* create_disposition*/
7131 0, /* create_options */
7132 dosattrs, /* file_attributes */
7133 INTERNAL_OPEN_ONLY, /* oplock_request */
7134 0, /* allocation_size */
7135 0, /* private_flags */
7136 NULL, /* sd */
7137 NULL, /* ea_list */
7138 &fsp2, /* result */
7139 NULL); /* psbuf */
7140
7141 if (!NT_STATUS_IS_OK(status)) {
7142 close_file(NULL, fsp1, ERROR_CLOSE);
7143 goto out;
7144 }
7145
7146 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7147 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7148 if (ret == -1) {
7149 DEBUG(0, ("error - vfs lseek returned error %s\n",
7150 strerror(errno)));
7151 status = map_nt_error_from_unix(errno);
7152 close_file(NULL, fsp1, ERROR_CLOSE);
7153 close_file(NULL, fsp2, ERROR_CLOSE);
7154 goto out;
7155 }
7156 }
7157
7158 /* Do the actual copy. */
7159 if (smb_fname_src->st.st_ex_size) {
7160 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7161 } else {
7162 ret = 0;
7163 }
7164
7165 close_file(NULL, fsp1, NORMAL_CLOSE);
7166
7167 /* Ensure the modtime is set correctly on the destination file. */
7168 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7169
7170 /*
7171 * As we are opening fsp1 read-only we only expect
7172 * an error on close on fsp2 if we are out of space.
7173 * Thus we don't look at the error return from the
7174 * close of fsp1.
7175 */
7176 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7177
7178 if (!NT_STATUS_IS_OK(status)) {
7179 goto out;
7180 }
7181
7182 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7183 status = NT_STATUS_DISK_FULL;
7184 goto out;
7185 }
7186
7187 status = NT_STATUS_OK;
7188
7189 out:
7190 TALLOC_FREE(smb_fname_dst_tmp);
7191 return status;
7192 }
7193
7194 /****************************************************************************
7195 Reply to a file copy.
7196 ****************************************************************************/
7197
7198 void reply_copy(struct smb_request *req)
7199 {
7200 connection_struct *conn = req->conn;
7201 struct smb_filename *smb_fname_src = NULL;
7202 struct smb_filename *smb_fname_dst = NULL;
7203 char *fname_src = NULL;
7204 char *fname_dst = NULL;
7205 char *fname_src_mask = NULL;
7206 char *fname_src_dir = NULL;
7207 const char *p;
7208 int count=0;
7209 int error = ERRnoaccess;
7210 int tid2;
7211 int ofun;
7212 int flags;
7213 bool target_is_directory=False;
7214 bool source_has_wild = False;
7215 bool dest_has_wild = False;
7216 NTSTATUS status;
7217 TALLOC_CTX *ctx = talloc_tos();
7218
7219 START_PROFILE(SMBcopy);
7220
7221 if (req->wct < 3) {
7222 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7223 goto out;
7224 }
7225
7226 tid2 = SVAL(req->vwv+0, 0);
7227 ofun = SVAL(req->vwv+1, 0);
7228 flags = SVAL(req->vwv+2, 0);
7229
7230 p = (const char *)req->buf;
7231 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7232 &status, &source_has_wild);
7233 if (!NT_STATUS_IS_OK(status)) {
7234 reply_nterror(req, status);
7235 goto out;
7236 }
7237 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7238 &status, &dest_has_wild);
7239 if (!NT_STATUS_IS_OK(status)) {
7240 reply_nterror(req, status);
7241 goto out;
7242 }
7243
7244 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7245
7246 if (tid2 != conn->cnum) {
7247 /* can't currently handle inter share copies XXXX */
7248 DEBUG(3,("Rejecting inter-share copy\n"));
7249 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7250 goto out;
7251 }
7252
7253 status = filename_convert(ctx, conn,
7254 req->flags2 & FLAGS2_DFS_PATHNAMES,
7255 fname_src,
7256 UCF_COND_ALLOW_WCARD_LCOMP,
7257 &source_has_wild,
7258 &smb_fname_src);
7259 if (!NT_STATUS_IS_OK(status)) {
7260 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7261 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7262 ERRSRV, ERRbadpath);
7263 goto out;
7264 }
7265 reply_nterror(req, status);
7266 goto out;
7267 }
7268
7269 status = filename_convert(ctx, conn,
7270 req->flags2 & FLAGS2_DFS_PATHNAMES,
7271 fname_dst,
7272 UCF_COND_ALLOW_WCARD_LCOMP,
7273 &dest_has_wild,
7274 &smb_fname_dst);
7275 if (!NT_STATUS_IS_OK(status)) {
7276 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7277 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7278 ERRSRV, ERRbadpath);
7279 goto out;
7280 }
7281 reply_nterror(req, status);
7282 goto out;
7283 }
7284
7285 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7286
7287 if ((flags&1) && target_is_directory) {
7288 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7289 goto out;
7290 }
7291
7292 if ((flags&2) && !target_is_directory) {
7293 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7294 goto out;
7295 }
7296
7297 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7298 /* wants a tree copy! XXXX */
7299 DEBUG(3,("Rejecting tree copy\n"));
7300 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7301 goto out;
7302 }
7303
7304 /* Split up the directory from the filename/mask. */
7305 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7306 &fname_src_dir, &fname_src_mask);
7307 if (!NT_STATUS_IS_OK(status)) {
7308 reply_nterror(req, NT_STATUS_NO_MEMORY);
7309 goto out;
7310 }
7311
7312 /*
7313 * We should only check the mangled cache
7314 * here if unix_convert failed. This means
7315 * that the path in 'mask' doesn't exist
7316 * on the file system and so we need to look
7317 * for a possible mangle. This patch from
7318 * Tine Smukavec <valentin.smukavec@hermes.si>.
7319 */
7320 if (!VALID_STAT(smb_fname_src->st) &&
7321 mangle_is_mangled(fname_src_mask, conn->params)) {
7322 char *new_mask = NULL;
7323 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7324 &new_mask, conn->params);
7325
7326 /* Use demangled name if one was successfully found. */
7327 if (new_mask) {
7328 TALLOC_FREE(fname_src_mask);
7329 fname_src_mask = new_mask;
7330 }
7331 }
7332
7333 if (!source_has_wild) {
7334
7335 /*
7336 * Only one file needs to be copied. Append the mask back onto
7337 * the directory.
7338 */
7339 TALLOC_FREE(smb_fname_src->base_name);
7340 if (ISDOT(fname_src_dir)) {
7341 /* Ensure we use canonical names on open. */
7342 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7343 "%s",
7344 fname_src_mask);
7345 } else {
7346 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7347 "%s/%s",
7348 fname_src_dir,
7349 fname_src_mask);
7350 }
7351 if (!smb_fname_src->base_name) {
7352 reply_nterror(req, NT_STATUS_NO_MEMORY);
7353 goto out;
7354 }
7355
7356 if (dest_has_wild) {
7357 char *fname_dst_mod = NULL;
7358 if (!resolve_wildcards(smb_fname_dst,
7359 smb_fname_src->base_name,
7360 smb_fname_dst->base_name,
7361 &fname_dst_mod)) {
7362 reply_nterror(req, NT_STATUS_NO_MEMORY);
7363 goto out;
7364 }
7365 TALLOC_FREE(smb_fname_dst->base_name);
7366 smb_fname_dst->base_name = fname_dst_mod;
7367 }
7368
7369 status = check_name(conn, smb_fname_src->base_name);
7370 if (!NT_STATUS_IS_OK(status)) {
7371 reply_nterror(req, status);
7372 goto out;
7373 }
7374
7375 status = check_name(conn, smb_fname_dst->base_name);
7376 if (!NT_STATUS_IS_OK(status)) {
7377 reply_nterror(req, status);
7378 goto out;
7379 }
7380
7381 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7382 ofun, count, target_is_directory);
7383
7384 if(!NT_STATUS_IS_OK(status)) {
7385 reply_nterror(req, status);
7386 goto out;
7387 } else {
7388 count++;
7389 }
7390 } else {
7391 struct smb_Dir *dir_hnd = NULL;
7392 const char *dname = NULL;
7393 char *talloced = NULL;
7394 long offset = 0;
7395
7396 /*
7397 * There is a wildcard that requires us to actually read the
7398 * src dir and copy each file matching the mask to the dst.
7399 * Right now streams won't be copied, but this could
7400 * presumably be added with a nested loop for reach dir entry.
7401 */
7402 SMB_ASSERT(!smb_fname_src->stream_name);
7403 SMB_ASSERT(!smb_fname_dst->stream_name);
7404
7405 smb_fname_src->stream_name = NULL;
7406 smb_fname_dst->stream_name = NULL;
7407
7408 if (strequal(fname_src_mask,"????????.???")) {
7409 TALLOC_FREE(fname_src_mask);
7410 fname_src_mask = talloc_strdup(ctx, "*");
7411 if (!fname_src_mask) {
7412 reply_nterror(req, NT_STATUS_NO_MEMORY);
7413 goto out;
7414 }
7415 }
7416
7417 status = check_name(conn, fname_src_dir);
7418 if (!NT_STATUS_IS_OK(status)) {
7419 reply_nterror(req, status);
7420 goto out;
7421 }
7422
7423 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7424 if (dir_hnd == NULL) {
7425 status = map_nt_error_from_unix(errno);
7426 reply_nterror(req, status);
7427 goto out;
7428 }
7429
7430 error = ERRbadfile;
7431
7432 /* Iterate over the src dir copying each entry to the dst. */
7433 while ((dname = ReadDirName(dir_hnd, &offset,
7434 &smb_fname_src->st, &talloced))) {
7435 char *destname = NULL;
7436
7437 if (ISDOT(dname) || ISDOTDOT(dname)) {
7438 TALLOC_FREE(talloced);
7439 continue;
7440 }
7441
7442 if (!is_visible_file(conn, fname_src_dir, dname,
7443 &smb_fname_src->st, false)) {
7444 TALLOC_FREE(talloced);
7445 continue;
7446 }
7447
7448 if(!mask_match(dname, fname_src_mask,
7449 conn->case_sensitive)) {
7450 TALLOC_FREE(talloced);
7451 continue;
7452 }
7453
7454 error = ERRnoaccess;
7455
7456 /* Get the src smb_fname struct setup. */
7457 TALLOC_FREE(smb_fname_src->base_name);
7458 if (ISDOT(fname_src_dir)) {
7459 /* Ensure we use canonical names on open. */
7460 smb_fname_src->base_name =
7461 talloc_asprintf(smb_fname_src, "%s",
7462 dname);
7463 } else {
7464 smb_fname_src->base_name =
7465 talloc_asprintf(smb_fname_src, "%s/%s",
7466 fname_src_dir, dname);
7467 }
7468
7469 if (!smb_fname_src->base_name) {
7470 TALLOC_FREE(dir_hnd);
7471 TALLOC_FREE(talloced);
7472 reply_nterror(req, NT_STATUS_NO_MEMORY);
7473 goto out;
7474 }
7475
7476 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7477 smb_fname_dst->base_name,
7478 &destname)) {
7479 TALLOC_FREE(talloced);
7480 continue;
7481 }
7482 if (!destname) {
7483 TALLOC_FREE(dir_hnd);
7484 TALLOC_FREE(talloced);
7485 reply_nterror(req, NT_STATUS_NO_MEMORY);
7486 goto out;
7487 }
7488
7489 TALLOC_FREE(smb_fname_dst->base_name);
7490 smb_fname_dst->base_name = destname;
7491
7492 status = check_name(conn, smb_fname_src->base_name);
7493 if (!NT_STATUS_IS_OK(status)) {
7494 TALLOC_FREE(dir_hnd);
7495 TALLOC_FREE(talloced);
7496 reply_nterror(req, status);
7497 goto out;
7498 }
7499
7500 status = check_name(conn, smb_fname_dst->base_name);
7501 if (!NT_STATUS_IS_OK(status)) {
7502 TALLOC_FREE(dir_hnd);
7503 TALLOC_FREE(talloced);
7504 reply_nterror(req, status);
7505 goto out;
7506 }
7507
7508 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7509 smb_fname_src->base_name,
7510 smb_fname_dst->base_name));
7511
7512 status = copy_file(ctx, conn, smb_fname_src,
7513 smb_fname_dst, ofun, count,
7514 target_is_directory);
7515 if (NT_STATUS_IS_OK(status)) {
7516 count++;
7517 }
7518
7519 TALLOC_FREE(talloced);
7520 }
7521 TALLOC_FREE(dir_hnd);
7522 }
7523
7524 if (count == 0) {
7525 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7526 goto out;
7527 }
7528
7529 reply_outbuf(req, 1, 0);
7530 SSVAL(req->outbuf,smb_vwv0,count);
7531 out:
7532 TALLOC_FREE(smb_fname_src);
7533 TALLOC_FREE(smb_fname_dst);
7534 TALLOC_FREE(fname_src);
7535 TALLOC_FREE(fname_dst);
7536 TALLOC_FREE(fname_src_mask);
7537 TALLOC_FREE(fname_src_dir);
7538
7539 END_PROFILE(SMBcopy);
7540 return;
7541 }
7542
7543 #undef DBGC_CLASS
7544 #define DBGC_CLASS DBGC_LOCKING
7545
7546 /****************************************************************************
7547 Get a lock pid, dealing with large count requests.
7548 ****************************************************************************/
7549
7550 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7551 bool large_file_format)
7552 {
7553 if(!large_file_format)
7554 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7555 else
7556 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7557 }
7558
7559 /****************************************************************************
7560 Get a lock count, dealing with large count requests.
7561 ****************************************************************************/
7562
7563 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7564 bool large_file_format)
7565 {
7566 uint64_t count = 0;
7567
7568 if(!large_file_format) {
7569 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7570 } else {
7571
7572 #if defined(HAVE_LONGLONG)
7573 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7574 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7575 #else /* HAVE_LONGLONG */
7576
7577 /*
7578 * NT4.x seems to be broken in that it sends large file (64 bit)
7579 * lockingX calls even if the CAP_LARGE_FILES was *not*
7580 * negotiated. For boxes without large unsigned ints truncate the
7581 * lock count by dropping the top 32 bits.
7582 */
7583
7584 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7585 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7586 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7587 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7588 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7589 }
7590
7591 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7592 #endif /* HAVE_LONGLONG */
7593 }
7594
7595 return count;
7596 }
7597
7598 #if !defined(HAVE_LONGLONG)
7599 /****************************************************************************
7600 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7601 ****************************************************************************/
7602
7603 static uint32 map_lock_offset(uint32 high, uint32 low)
7604 {
7605 unsigned int i;
7606 uint32 mask = 0;
7607 uint32 highcopy = high;
7608
7609 /*
7610 * Try and find out how many significant bits there are in high.
7611 */
7612
7613 for(i = 0; highcopy; i++)
7614 highcopy >>= 1;
7615
7616 /*
7617 * We use 31 bits not 32 here as POSIX
7618 * lock offsets may not be negative.
7619 */
7620
7621 mask = (~0) << (31 - i);
7622
7623 if(low & mask)
7624 return 0; /* Fail. */
7625
7626 high <<= (31 - i);
7627
7628 return (high|low);
7629 }
7630 #endif /* !defined(HAVE_LONGLONG) */
7631
7632 /****************************************************************************
7633 Get a lock offset, dealing with large offset requests.
7634 ****************************************************************************/
7635
7636 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7637 bool large_file_format, bool *err)
7638 {
7639 uint64_t offset = 0;
7640
7641 *err = False;
7642
7643 if(!large_file_format) {
7644 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7645 } else {
7646
7647 #if defined(HAVE_LONGLONG)
7648 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7649 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7650 #else /* HAVE_LONGLONG */
7651
7652 /*
7653 * NT4.x seems to be broken in that it sends large file (64 bit)
7654 * lockingX calls even if the CAP_LARGE_FILES was *not*
7655 * negotiated. For boxes without large unsigned ints mangle the
7656 * lock offset by mapping the top 32 bits onto the lower 32.
7657 */
7658
7659 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7660 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7661 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7662 uint32 new_low = 0;
7663
7664 if((new_low = map_lock_offset(high, low)) == 0) {
7665 *err = True;
7666 return (uint64_t)-1;
7667 }
7668
7669 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7670 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7671 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7672 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7673 }
7674
7675 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7676 #endif /* HAVE_LONGLONG */
7677 }
7678
7679 return offset;
7680 }
7681
7682 NTSTATUS smbd_do_locking(struct smb_request *req,
7683 files_struct *fsp,
7684 uint8_t type,
7685 int32_t timeout,
7686 uint16_t num_ulocks,
7687 struct smbd_lock_element *ulocks,
7688 uint16_t num_locks,
7689 struct smbd_lock_element *locks,
7690 bool *async)
7691 {
7692 connection_struct *conn = req->conn;
7693 int i;
7694 NTSTATUS status = NT_STATUS_OK;
7695
7696 *async = false;
7697
7698 /* Data now points at the beginning of the list
7699 of smb_unlkrng structs */
7700 for(i = 0; i < (int)num_ulocks; i++) {
7701 struct smbd_lock_element *e = &ulocks[i];
7702
7703 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7704 "pid %u, file %s\n",
7705 (double)e->offset,
7706 (double)e->count,
7707 (unsigned int)e->smblctx,
7708 fsp_str_dbg(fsp)));
7709
7710 if (e->brltype != UNLOCK_LOCK) {
7711 /* this can only happen with SMB2 */
7712 return NT_STATUS_INVALID_PARAMETER;
7713 }
7714
7715 status = do_unlock(req->sconn->msg_ctx,
7716 fsp,
7717 e->smblctx,
7718 e->count,
7719 e->offset,
7720 WINDOWS_LOCK);
7721
7722 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7723 nt_errstr(status)));
7724
7725 if (!NT_STATUS_IS_OK(status)) {
7726 return status;
7727 }
7728 }
7729
7730 /* Setup the timeout in seconds. */
7731
7732 if (!lp_blocking_locks(SNUM(conn))) {
7733 timeout = 0;
7734 }
7735
7736 /* Data now points at the beginning of the list
7737 of smb_lkrng structs */
7738
7739 for(i = 0; i < (int)num_locks; i++) {
7740 struct smbd_lock_element *e = &locks[i];
7741
7742 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7743 "%llu, file %s timeout = %d\n",
7744 (double)e->offset,
7745 (double)e->count,
7746 (unsigned long long)e->smblctx,
7747 fsp_str_dbg(fsp),
7748 (int)timeout));
7749
7750 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7751 struct blocking_lock_record *blr = NULL;
7752
7753 if (num_locks > 1) {
7754 /*
7755 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7756 * if the lock vector contains one entry. When given mutliple cancel
7757 * requests in a single PDU we expect the server to return an
7758 * error. Windows servers seem to accept the request but only
7759 * cancel the first lock.
7760 * JRA - Do what Windows does (tm) :-).
7761 */
7762
7763 #if 0
7764 /* MS-CIFS (2.2.4.32.1) behavior. */
7765 return NT_STATUS_DOS(ERRDOS,
7766 ERRcancelviolation);
7767 #else
7768 /* Windows behavior. */
7769 if (i != 0) {
7770 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7771 "cancel request\n"));
7772 continue;
7773 }
7774 #endif
7775 }
7776
7777 if (lp_blocking_locks(SNUM(conn))) {
7778
7779 /* Schedule a message to ourselves to
7780 remove the blocking lock record and
7781 return the right error. */
7782
7783 blr = blocking_lock_cancel_smb1(fsp,
7784 e->smblctx,
7785 e->offset,
7786 e->count,
7787 WINDOWS_LOCK,
7788 type,
7789 NT_STATUS_FILE_LOCK_CONFLICT);
7790 if (blr == NULL) {
7791 return NT_STATUS_DOS(
7792 ERRDOS,
7793 ERRcancelviolation);
7794 }
7795 }
7796 /* Remove a matching pending lock. */
7797 status = do_lock_cancel(fsp,
7798 e->smblctx,
7799 e->count,
7800 e->offset,
7801 WINDOWS_LOCK,
7802 blr);
7803 } else {
7804 bool blocking_lock = timeout ? true : false;
7805 bool defer_lock = false;
7806 struct byte_range_lock *br_lck;
7807 uint64_t block_smblctx;
7808
7809 br_lck = do_lock(req->sconn->msg_ctx,
7810 fsp,
7811 e->smblctx,
7812 e->count,
7813 e->offset,
7814 e->brltype,
7815 WINDOWS_LOCK,
7816 blocking_lock,
7817 &status,
7818 &block_smblctx,
7819 NULL);
7820
7821 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7822 /* Windows internal resolution for blocking locks seems
7823 to be about 200ms... Don't wait for less than that. JRA. */
7824 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7825 timeout = lp_lock_spin_time();
7826 }
7827 defer_lock = true;
7828 }
7829
7830 /* If a lock sent with timeout of zero would fail, and
7831 * this lock has been requested multiple times,
7832 * according to brl_lock_failed() we convert this
7833 * request to a blocking lock with a timeout of between
7834 * 150 - 300 milliseconds.
7835 *
7836 * If lp_lock_spin_time() has been set to 0, we skip
7837 * this blocking retry and fail immediately.
7838 *
7839 * Replacement for do_lock_spin(). JRA. */
7840
7841 if (!req->sconn->using_smb2 &&
7842 br_lck && lp_blocking_locks(SNUM(conn)) &&
7843 lp_lock_spin_time() && !blocking_lock &&
7844 NT_STATUS_EQUAL((status),
7845 NT_STATUS_FILE_LOCK_CONFLICT))
7846 {
7847 defer_lock = true;
7848 timeout = lp_lock_spin_time();
7849 }
7850
7851 if (br_lck && defer_lock) {
7852 /*
7853 * A blocking lock was requested. Package up
7854 * this smb into a queued request and push it
7855 * onto the blocking lock queue.
7856 */
7857 if(push_blocking_lock_request(br_lck,
7858 req,
7859 fsp,
7860 timeout,
7861 i,
7862 e->smblctx,
7863 e->brltype,
7864 WINDOWS_LOCK,
7865 e->offset,
7866 e->count,
7867 block_smblctx)) {
7868 TALLOC_FREE(br_lck);
7869 *async = true;
7870 return NT_STATUS_OK;
7871 }
7872 }
7873
7874 TALLOC_FREE(br_lck);
7875 }
7876
7877 if (!NT_STATUS_IS_OK(status)) {
7878 break;
7879 }
7880 }
7881
7882 /* If any of the above locks failed, then we must unlock
7883 all of the previous locks (X/Open spec). */
7884
7885 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7886
7887 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7888 i = -1; /* we want to skip the for loop */
7889 }
7890
7891 /*
7892 * Ensure we don't do a remove on the lock that just failed,
7893 * as under POSIX rules, if we have a lock already there, we
7894 * will delete it (and we shouldn't) .....
7895 */
7896 for(i--; i >= 0; i--) {
7897 struct smbd_lock_element *e = &locks[i];
7898
7899 do_unlock(req->sconn->msg_ctx,
7900 fsp,
7901 e->smblctx,
7902 e->count,
7903 e->offset,
7904 WINDOWS_LOCK);
7905 }
7906 return status;
7907 }
7908
7909 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7910 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7911
7912 return NT_STATUS_OK;
7913 }
7914
7915 /****************************************************************************
7916 Reply to a lockingX request.
7917 ****************************************************************************/
7918
7919 void reply_lockingX(struct smb_request *req)
7920 {
7921 connection_struct *conn = req->conn;
7922 files_struct *fsp;
7923 unsigned char locktype;
7924 unsigned char oplocklevel;
7925 uint16 num_ulocks;
7926 uint16 num_locks;
7927 int32 lock_timeout;
7928 int i;
7929 const uint8_t *data;
7930 bool large_file_format;
7931 bool err;
7932 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7933 struct smbd_lock_element *ulocks;
7934 struct smbd_lock_element *locks;
7935 bool async = false;
7936
7937 START_PROFILE(SMBlockingX);
7938
7939 if (req->wct < 8) {
7940 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7941 END_PROFILE(SMBlockingX);
7942 return;
7943 }
7944
7945 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7946 locktype = CVAL(req->vwv+3, 0);
7947 oplocklevel = CVAL(req->vwv+3, 1);
7948 num_ulocks = SVAL(req->vwv+6, 0);
7949 num_locks = SVAL(req->vwv+7, 0);
7950 lock_timeout = IVAL(req->vwv+4, 0);
7951 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7952
7953 if (!check_fsp(conn, req, fsp)) {
7954 END_PROFILE(SMBlockingX);
7955 return;
7956 }
7957
7958 data = req->buf;
7959
7960 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7961 /* we don't support these - and CANCEL_LOCK makes w2k
7962 and XP reboot so I don't really want to be
7963 compatible! (tridge) */
7964 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7965 END_PROFILE(SMBlockingX);
7966 return;
7967 }
7968
7969 /* Check if this is an oplock break on a file
7970 we have granted an oplock on.
7971 */
7972 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7973 /* Client can insist on breaking to none. */
7974 bool break_to_none = (oplocklevel == 0);
7975 bool result;
7976
7977 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7978 "for %s\n", (unsigned int)oplocklevel,
7979 fsp_fnum_dbg(fsp)));
7980
7981 /*
7982 * Make sure we have granted an exclusive or batch oplock on
7983 * this file.
7984 */
7985
7986 if (fsp->oplock_type == 0) {
7987
7988 /* The Samba4 nbench simulator doesn't understand
7989 the difference between break to level2 and break
7990 to none from level2 - it sends oplock break
7991 replies in both cases. Don't keep logging an error
7992 message here - just ignore it. JRA. */
7993
7994 DEBUG(5,("reply_lockingX: Error : oplock break from "
7995 "client for %s (oplock=%d) and no "
7996 "oplock granted on this file (%s).\n",
7997 fsp_fnum_dbg(fsp), fsp->oplock_type,
7998 fsp_str_dbg(fsp)));
7999
8000 /* if this is a pure oplock break request then don't
8001 * send a reply */
8002 if (num_locks == 0 && num_ulocks == 0) {
8003 END_PROFILE(SMBlockingX);
8004 return;
8005 } else {
8006 END_PROFILE(SMBlockingX);
8007 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8008 return;
8009 }
8010 }
8011
8012 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8013 (break_to_none)) {
8014 result = remove_oplock(fsp);
8015 } else {
8016 result = downgrade_oplock(fsp);
8017 }
8018
8019 if (!result) {
8020 DEBUG(0, ("reply_lockingX: error in removing "
8021 "oplock on file %s\n", fsp_str_dbg(fsp)));
8022 /* Hmmm. Is this panic justified? */
8023 smb_panic("internal tdb error");
8024 }
8025
8026 /* if this is a pure oplock break request then don't send a
8027 * reply */
8028 if (num_locks == 0 && num_ulocks == 0) {
8029 /* Sanity check - ensure a pure oplock break is not a
8030 chained request. */
8031 if(CVAL(req->vwv+0, 0) != 0xff)
8032 DEBUG(0,("reply_lockingX: Error : pure oplock "
8033 "break is a chained %d request !\n",
8034 (unsigned int)CVAL(req->vwv+0, 0)));
8035 END_PROFILE(SMBlockingX);
8036 return;
8037 }
8038 }
8039
8040 if (req->buflen <
8041 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8042 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8043 END_PROFILE(SMBlockingX);
8044 return;
8045 }
8046
8047 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8048 if (ulocks == NULL) {
8049 reply_nterror(req, NT_STATUS_NO_MEMORY);
8050 END_PROFILE(SMBlockingX);
8051 return;
8052 }
8053
8054 locks = talloc_array(req, struct smbd_lock_element, num_locks);
8055 if (locks == NULL) {
8056 reply_nterror(req, NT_STATUS_NO_MEMORY);
8057 END_PROFILE(SMBlockingX);
8058 return;
8059 }
8060
8061 /* Data now points at the beginning of the list
8062 of smb_unlkrng structs */
8063 for(i = 0; i < (int)num_ulocks; i++) {
8064 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8065 ulocks[i].count = get_lock_count(data, i, large_file_format);
8066 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8067 ulocks[i].brltype = UNLOCK_LOCK;
8068
8069 /*
8070 * There is no error code marked "stupid client bug".... :-).
8071 */
8072 if(err) {
8073 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8074 END_PROFILE(SMBlockingX);
8075 return;
8076 }
8077 }
8078
8079 /* Now do any requested locks */
8080 data += ((large_file_format ? 20 : 10)*num_ulocks);
8081
8082 /* Data now points at the beginning of the list
8083 of smb_lkrng structs */
8084
8085 for(i = 0; i < (int)num_locks; i++) {
8086 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8087 locks[i].count = get_lock_count(data, i, large_file_format);
8088 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8089
8090 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8091 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8092 locks[i].brltype = PENDING_READ_LOCK;
8093 } else {
8094 locks[i].brltype = READ_LOCK;
8095 }
8096 } else {
8097 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8098 locks[i].brltype = PENDING_WRITE_LOCK;
8099 } else {
8100 locks[i].brltype = WRITE_LOCK;
8101 }
8102 }
8103
8104 /*
8105 * There is no error code marked "stupid client bug".... :-).
8106 */
8107 if(err) {
8108 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8109 END_PROFILE(SMBlockingX);
8110 return;
8111 }
8112 }
8113
8114 status = smbd_do_locking(req, fsp,
8115 locktype, lock_timeout,
8116 num_ulocks, ulocks,
8117 num_locks, locks,
8118 &async);
8119 if (!NT_STATUS_IS_OK(status)) {
8120 END_PROFILE(SMBlockingX);
8121 reply_nterror(req, status);
8122 return;
8123 }
8124 if (async) {
8125 END_PROFILE(SMBlockingX);
8126 return;
8127 }
8128
8129 reply_outbuf(req, 2, 0);
8130 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8131 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8132
8133 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8134 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8135
8136 END_PROFILE(SMBlockingX);
8137 }
8138
8139 #undef DBGC_CLASS
8140 #define DBGC_CLASS DBGC_ALL
8141
8142 /****************************************************************************
8143 Reply to a SMBreadbmpx (read block multiplex) request.
8144 Always reply with an error, if someone has a platform really needs this,
8145 please contact vl@samba.org
8146 ****************************************************************************/
8147
8148 void reply_readbmpx(struct smb_request *req)
8149 {
8150 START_PROFILE(SMBreadBmpx);
8151 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8152 END_PROFILE(SMBreadBmpx);
8153 return;
8154 }
8155
8156 /****************************************************************************
8157 Reply to a SMBreadbs (read block multiplex secondary) request.
8158 Always reply with an error, if someone has a platform really needs this,
8159 please contact vl@samba.org
8160 ****************************************************************************/
8161
8162 void reply_readbs(struct smb_request *req)
8163 {
8164 START_PROFILE(SMBreadBs);
8165 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8166 END_PROFILE(SMBreadBs);
8167 return;
8168 }
8169
8170 /****************************************************************************
8171 Reply to a SMBsetattrE.
8172 ****************************************************************************/
8173
8174 void reply_setattrE(struct smb_request *req)
8175 {
8176 connection_struct *conn = req->conn;
8177 struct smb_file_time ft;
8178 files_struct *fsp;
8179 NTSTATUS status;
8180
8181 START_PROFILE(SMBsetattrE);
8182 ZERO_STRUCT(ft);
8183
8184 if (req->wct < 7) {
8185 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8186 goto out;
8187 }
8188
8189 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8190
8191 if(!fsp || (fsp->conn != conn)) {
8192 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8193 goto out;
8194 }
8195
8196 /*
8197 * Convert the DOS times into unix times.
8198 */
8199
8200 ft.atime = convert_time_t_to_timespec(
8201 srv_make_unix_date2(req->vwv+3));
8202 ft.mtime = convert_time_t_to_timespec(
8203 srv_make_unix_date2(req->vwv+5));
8204 ft.create_time = convert_time_t_to_timespec(
8205 srv_make_unix_date2(req->vwv+1));
8206
8207 reply_outbuf(req, 0, 0);
8208
8209 /*
8210 * Patch from Ray Frush <frush@engr.colostate.edu>
8211 * Sometimes times are sent as zero - ignore them.
8212 */
8213
8214 /* Ensure we have a valid stat struct for the source. */
8215 status = vfs_stat_fsp(fsp);
8216 if (!NT_STATUS_IS_OK(status)) {
8217 reply_nterror(req, status);
8218 goto out;
8219 }
8220
8221 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8222 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8223 goto out;
8224 }
8225
8226 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8227 if (!NT_STATUS_IS_OK(status)) {
8228 reply_nterror(req, status);
8229 goto out;
8230 }
8231
8232 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8233 " createtime=%u\n",
8234 fsp_fnum_dbg(fsp),
8235 (unsigned int)ft.atime.tv_sec,
8236 (unsigned int)ft.mtime.tv_sec,
8237 (unsigned int)ft.create_time.tv_sec
8238 ));
8239 out:
8240 END_PROFILE(SMBsetattrE);
8241 return;
8242 }
8243
8244
8245 /* Back from the dead for OS/2..... JRA. */
8246
8247 /****************************************************************************
8248 Reply to a SMBwritebmpx (write block multiplex primary) request.
8249 Always reply with an error, if someone has a platform really needs this,
8250 please contact vl@samba.org
8251 ****************************************************************************/
8252
8253 void reply_writebmpx(struct smb_request *req)
8254 {
8255 START_PROFILE(SMBwriteBmpx);
8256 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8257 END_PROFILE(SMBwriteBmpx);
8258 return;
8259 }
8260
8261 /****************************************************************************
8262 Reply to a SMBwritebs (write block multiplex secondary) request.
8263 Always reply with an error, if someone has a platform really needs this,
8264 please contact vl@samba.org
8265 ****************************************************************************/
8266
8267 void reply_writebs(struct smb_request *req)
8268 {
8269 START_PROFILE(SMBwriteBs);
8270 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8271 END_PROFILE(SMBwriteBs);
8272 return;
8273 }
8274
8275 /****************************************************************************
8276 Reply to a SMBgetattrE.
8277 ****************************************************************************/
8278
8279 void reply_getattrE(struct smb_request *req)
8280 {
8281 connection_struct *conn = req->conn;
8282 int mode;
8283 files_struct *fsp;
8284 struct timespec create_ts;
8285
8286 START_PROFILE(SMBgetattrE);
8287
8288 if (req->wct < 1) {
8289 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8290 END_PROFILE(SMBgetattrE);
8291 return;
8292 }
8293
8294 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8295
8296 if(!fsp || (fsp->conn != conn)) {
8297 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8298 END_PROFILE(SMBgetattrE);
8299 return;
8300 }
8301
8302 /* Do an fstat on this file */
8303 if(fsp_stat(fsp)) {
8304 reply_nterror(req, map_nt_error_from_unix(errno));
8305 END_PROFILE(SMBgetattrE);
8306 return;
8307 }
8308
8309 mode = dos_mode(conn, fsp->fsp_name);
8310
8311 /*
8312 * Convert the times into dos times. Set create
8313 * date to be last modify date as UNIX doesn't save
8314 * this.
8315 */
8316
8317 reply_outbuf(req, 11, 0);
8318
8319 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8320 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8321 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8322 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8323 /* Should we check pending modtime here ? JRA */
8324 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8325 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8326
8327 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8328 SIVAL(req->outbuf, smb_vwv6, 0);
8329 SIVAL(req->outbuf, smb_vwv8, 0);
8330 } else {
8331 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8332 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8333 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8334 }
8335 SSVAL(req->outbuf,smb_vwv10, mode);
8336
8337 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8338
8339 END_PROFILE(SMBgetattrE);
8340 return;
8341 }