?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
In nttransact_create, we also need to check for delete readonly
[Samba/vl.git] / source3 / smbd / nttrans.c
blob9ff1cac140064e19d7c25e4c54d75cae635da4da
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 extern int max_send;
24 extern enum protocol_types Protocol;
25 extern struct current_user current_user;
26
27 static const char *known_nt_pipes[] = {
28 "\\LANMAN",
29 "\\srvsvc",
30 "\\samr",
31 "\\wkssvc",
32 "\\NETLOGON",
33 "\\ntlsa",
34 "\\ntsvcs",
35 "\\lsass",
36 "\\lsarpc",
37 "\\winreg",
38 "\\initshutdown",
39 "\\spoolss",
40 "\\netdfs",
41 "\\rpcecho",
42 "\\svcctl",
43 "\\eventlog",
44 "\\unixinfo",
45 NULL
46 };
47
48 static char *nttrans_realloc(char **ptr, size_t size)
49 {
50 if (ptr==NULL) {
51 smb_panic("nttrans_realloc() called with NULL ptr");
52 }
53
54 *ptr = (char *)SMB_REALLOC(*ptr, size);
55 if(*ptr == NULL) {
56 return NULL;
57 }
58 memset(*ptr,'\0',size);
59 return *ptr;
60 }
61
62 /****************************************************************************
63 Send the required number of replies back.
64 We assume all fields other than the data fields are
65 set correctly for the type of call.
66 HACK ! Always assumes smb_setup field is zero.
67 ****************************************************************************/
68
69 void send_nt_replies(struct smb_request *req, NTSTATUS nt_error,
70 char *params, int paramsize,
71 char *pdata, int datasize)
72 {
73 int data_to_send = datasize;
74 int params_to_send = paramsize;
75 int useable_space;
76 char *pp = params;
77 char *pd = pdata;
78 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
79 int alignment_offset = 3;
80 int data_alignment_offset = 0;
81
82 /*
83 * If there genuinely are no parameters or data to send just send
84 * the empty packet.
85 */
86
87 if(params_to_send == 0 && data_to_send == 0) {
88 reply_outbuf(req, 18, 0);
89 show_msg((char *)req->outbuf);
90 return;
91 }
92
93 /*
94 * When sending params and data ensure that both are nicely aligned.
95 * Only do this alignment when there is also data to send - else
96 * can cause NT redirector problems.
97 */
98
99 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
100 data_alignment_offset = 4 - (params_to_send % 4);
101 }
102
103 /*
104 * Space is bufsize minus Netbios over TCP header minus SMB header.
105 * The alignment_offset is to align the param bytes on a four byte
106 * boundary (2 bytes for data len, one byte pad).
107 * NT needs this to work correctly.
108 */
109
110 useable_space = max_send - (smb_size
111 + 2 * 18 /* wct */
112 + alignment_offset
113 + data_alignment_offset);
114
115 /*
116 * useable_space can never be more than max_send minus the
117 * alignment offset.
118 */
119
120 useable_space = MIN(useable_space,
121 max_send - (alignment_offset+data_alignment_offset));
122
123
124 while (params_to_send || data_to_send) {
125
126 /*
127 * Calculate whether we will totally or partially fill this packet.
128 */
129
130 total_sent_thistime = params_to_send + data_to_send +
131 alignment_offset + data_alignment_offset;
132
133 /*
134 * We can never send more than useable_space.
135 */
136
137 total_sent_thistime = MIN(total_sent_thistime, useable_space);
138
139 reply_outbuf(req, 18, total_sent_thistime);
140
141 /*
142 * Set total params and data to be sent.
143 */
144
145 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
146 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
147
148 /*
149 * Calculate how many parameters and data we can fit into
150 * this packet. Parameters get precedence.
151 */
152
153 params_sent_thistime = MIN(params_to_send,useable_space);
154 data_sent_thistime = useable_space - params_sent_thistime;
155 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
156
157 SIVAL(req->outbuf, smb_ntr_ParameterCount,
158 params_sent_thistime);
159
160 if(params_sent_thistime == 0) {
161 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
162 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
163 } else {
164 /*
165 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
166 * parameter bytes, however the first 4 bytes of outbuf are
167 * the Netbios over TCP header. Thus use smb_base() to subtract
168 * them from the calculation.
169 */
170
171 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
172 ((smb_buf(req->outbuf)+alignment_offset)
173 - smb_base(req->outbuf)));
174 /*
175 * Absolute displacement of param bytes sent in this packet.
176 */
177
178 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
179 pp - params);
180 }
181
182 /*
183 * Deal with the data portion.
184 */
185
186 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
187
188 if(data_sent_thistime == 0) {
189 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
190 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
191 } else {
192 /*
193 * The offset of the data bytes is the offset of the
194 * parameter bytes plus the number of parameters being sent this time.
195 */
196
197 SIVAL(req->outbuf, smb_ntr_DataOffset,
198 ((smb_buf(req->outbuf)+alignment_offset) -
199 smb_base(req->outbuf))
200 + params_sent_thistime + data_alignment_offset);
201 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
202 }
203
204 /*
205 * Copy the param bytes into the packet.
206 */
207
208 if(params_sent_thistime) {
209 if (alignment_offset != 0) {
210 memset(smb_buf(req->outbuf), 0,
211 alignment_offset);
212 }
213 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
214 params_sent_thistime);
215 }
216
217 /*
218 * Copy in the data bytes
219 */
220
221 if(data_sent_thistime) {
222 if (data_alignment_offset != 0) {
223 memset((smb_buf(req->outbuf)+alignment_offset+
224 params_sent_thistime), 0,
225 data_alignment_offset);
226 }
227 memcpy(smb_buf(req->outbuf)+alignment_offset
228 +params_sent_thistime+data_alignment_offset,
229 pd,data_sent_thistime);
230 }
231
232 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
233 params_sent_thistime, data_sent_thistime, useable_space));
234 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
235 params_to_send, data_to_send, paramsize, datasize));
236
237 if (NT_STATUS_V(nt_error)) {
238 error_packet_set((char *)req->outbuf,
239 0, 0, nt_error,
240 __LINE__,__FILE__);
241 }
242
243 /* Send the packet */
244 show_msg((char *)req->outbuf);
245 if (!send_smb(smbd_server_fd(),(char *)req->outbuf)) {
246 exit_server_cleanly("send_nt_replies: send_smb failed.");
247 }
248
249 TALLOC_FREE(req->outbuf);
250
251 pp += params_sent_thistime;
252 pd += data_sent_thistime;
253
254 params_to_send -= params_sent_thistime;
255 data_to_send -= data_sent_thistime;
256
257 /*
258 * Sanity check
259 */
260
261 if(params_to_send < 0 || data_to_send < 0) {
262 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
263 params_to_send, data_to_send));
264 return;
265 }
266 }
267 }
268
269 /****************************************************************************
270 Is it an NTFS stream name ?
271 ****************************************************************************/
272
273 bool is_ntfs_stream_name(const char *fname)
274 {
275 if (lp_posix_pathnames()) {
276 return False;
277 }
278 return (strchr_m(fname, ':') != NULL) ? True : False;
279 }
280
281 struct case_semantics_state {
282 connection_struct *conn;
283 bool case_sensitive;
284 bool case_preserve;
285 bool short_case_preserve;
286 };
287
288 /****************************************************************************
289 Restore case semantics.
290 ****************************************************************************/
291 static int restore_case_semantics(struct case_semantics_state *state)
292 {
293 state->conn->case_sensitive = state->case_sensitive;
294 state->conn->case_preserve = state->case_preserve;
295 state->conn->short_case_preserve = state->short_case_preserve;
296 return 0;
297 }
298
299 /****************************************************************************
300 Save case semantics.
301 ****************************************************************************/
302 static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
303 connection_struct *conn)
304 {
305 struct case_semantics_state *result;
306
307 if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
308 DEBUG(0, ("talloc failed\n"));
309 return NULL;
310 }
311
312 result->conn = conn;
313 result->case_sensitive = conn->case_sensitive;
314 result->case_preserve = conn->case_preserve;
315 result->short_case_preserve = conn->short_case_preserve;
316
317 /* Set to POSIX. */
318 conn->case_sensitive = True;
319 conn->case_preserve = True;
320 conn->short_case_preserve = True;
321
322 talloc_set_destructor(result, restore_case_semantics);
323
324 return result;
325 }
326
327 /****************************************************************************
328 Reply to an NT create and X call on a pipe
329 ****************************************************************************/
330
331 static void nt_open_pipe(char *fname, connection_struct *conn,
332 struct smb_request *req, int *ppnum)
333 {
334 smb_np_struct *p = NULL;
335 int i;
336
337 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
338
339 /* See if it is one we want to handle. */
340
341 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
342 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
343 ERRDOS, ERRbadpipe);
344 return;
345 }
346
347 for( i = 0; known_nt_pipes[i]; i++ ) {
348 if( strequal(fname,known_nt_pipes[i])) {
349 break;
350 }
351 }
352
353 if ( known_nt_pipes[i] == NULL ) {
354 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
355 ERRDOS, ERRbadpipe);
356 return;
357 }
358
359 /* Strip \\ off the name. */
360 fname++;
361
362 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
363
364 p = open_rpc_pipe_p(fname, conn, req->vuid);
365 if (!p) {
366 reply_doserror(req, ERRSRV, ERRnofids);
367 return;
368 }
369
370 /* TODO: Add pipe to db */
371
372 if ( !store_pipe_opendb( p ) ) {
373 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
374 }
375
376 *ppnum = p->pnum;
377 return;
378 }
379
380 /****************************************************************************
381 Reply to an NT create and X call for pipes.
382 ****************************************************************************/
383
384 static void do_ntcreate_pipe_open(connection_struct *conn,
385 struct smb_request *req)
386 {
387 char *fname = NULL;
388 int pnum = -1;
389 char *p = NULL;
390 uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
391 TALLOC_CTX *ctx = talloc_tos();
392
393 srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
394 smb_buf(req->inbuf), STR_TERMINATE);
395
396 if (!fname) {
397 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
398 ERRDOS, ERRbadpipe);
399 return;
400 }
401 nt_open_pipe(fname, conn, req, &pnum);
402
403 if (req->outbuf) {
404 /* error reply */
405 return;
406 }
407
408 /*
409 * Deal with pipe return.
410 */
411
412 if (flags & EXTENDED_RESPONSE_REQUIRED) {
413 /* This is very strange. We
414 * return 50 words, but only set
415 * the wcnt to 42 ? It's definately
416 * what happens on the wire....
417 */
418 reply_outbuf(req, 50, 0);
419 SCVAL(req->outbuf,smb_wct,42);
420 } else {
421 reply_outbuf(req, 34, 0);
422 }
423
424 p = (char *)req->outbuf + smb_vwv2;
425 p++;
426 SSVAL(p,0,pnum);
427 p += 2;
428 SIVAL(p,0,FILE_WAS_OPENED);
429 p += 4;
430 p += 32;
431 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
432 p += 20;
433 /* File type. */
434 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
435 /* Device state. */
436 SSVAL(p,2, 0x5FF); /* ? */
437 p += 4;
438
439 if (flags & EXTENDED_RESPONSE_REQUIRED) {
440 p += 25;
441 SIVAL(p,0,FILE_GENERIC_ALL);
442 /*
443 * For pipes W2K3 seems to return
444 * 0x12019B next.
445 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
446 */
447 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
448 }
449
450 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
451
452 chain_reply(req);
453 }
454
455 /****************************************************************************
456 Reply to an NT create and X call for a quota file.
457 ****************************************************************************/
458
459 static void reply_ntcreate_and_X_quota(connection_struct *conn,
460 struct smb_request *req,
461 enum FAKE_FILE_TYPE fake_file_type,
462 const char *fname)
463 {
464 char *p;
465 uint32 desired_access = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
466 files_struct *fsp;
467 NTSTATUS status;
468
469 status = open_fake_file(conn, fake_file_type, fname, desired_access,
470 &fsp);
471
472 if (!NT_STATUS_IS_OK(status)) {
473 reply_nterror(req, status);
474 return;
475 }
476
477 reply_outbuf(req, 34, 0);
478
479 p = (char *)req->outbuf + smb_vwv2;
480
481 /* SCVAL(p,0,NO_OPLOCK_RETURN); */
482 p++;
483 SSVAL(p,0,fsp->fnum);
484
485 DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
486
487 chain_reply(req);
488 }
489
490 /****************************************************************************
491 Reply to an NT create and X call.
492 ****************************************************************************/
493
494 void reply_ntcreate_and_X(connection_struct *conn,
495 struct smb_request *req)
496 {
497 char *fname = NULL;
498 uint32 flags;
499 uint32 access_mask;
500 uint32 file_attributes;
501 uint32 share_access;
502 uint32 create_disposition;
503 uint32 create_options;
504 uint16 root_dir_fid;
505 SMB_BIG_UINT allocation_size;
506 /* Breakout the oplock request bits so we can set the
507 reply bits separately. */
508 int oplock_request = 0;
509 uint32 fattr=0;
510 SMB_OFF_T file_len = 0;
511 SMB_STRUCT_STAT sbuf;
512 int info = 0;
513 files_struct *fsp = NULL;
514 char *p = NULL;
515 struct timespec c_timespec;
516 struct timespec a_timespec;
517 struct timespec m_timespec;
518 bool extended_oplock_granted = False;
519 NTSTATUS status;
520 struct case_semantics_state *case_state = NULL;
521 TALLOC_CTX *ctx = talloc_tos();
522
523 START_PROFILE(SMBntcreateX);
524
525 if (req->wct < 24) {
526 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
527 return;
528 }
529
530 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
531 access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
532 file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
533 share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
534 create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
535 create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
536 root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
537
538 allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_ntcreate_AllocationSize);
539 #ifdef LARGE_SMB_OFF_T
540 allocation_size |= (((SMB_BIG_UINT)IVAL(req->inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
541 #endif
542
543 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
544 "file_attributes = 0x%x, share_access = 0x%x, "
545 "create_disposition = 0x%x create_options = 0x%x "
546 "root_dir_fid = 0x%x\n",
547 (unsigned int)flags,
548 (unsigned int)access_mask,
549 (unsigned int)file_attributes,
550 (unsigned int)share_access,
551 (unsigned int)create_disposition,
552 (unsigned int)create_options,
553 (unsigned int)root_dir_fid ));
554
555 /*
556 * If it's an IPC, use the pipe handler.
557 */
558
559 if (IS_IPC(conn)) {
560 if (lp_nt_pipe_support()) {
561 do_ntcreate_pipe_open(conn, req);
562 END_PROFILE(SMBntcreateX);
563 return;
564 } else {
565 reply_doserror(req, ERRDOS, ERRnoaccess);
566 END_PROFILE(SMBntcreateX);
567 return;
568 }
569 }
570
571 if (create_options & FILE_OPEN_BY_FILE_ID) {
572 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
573 END_PROFILE(SMBntcreateX);
574 return;
575 }
576
577 /*
578 * Get the file name.
579 */
580
581 if(root_dir_fid != 0) {
582 /*
583 * This filename is relative to a directory fid.
584 */
585 char *rel_fname = NULL;
586 files_struct *dir_fsp = file_fsp(
587 SVAL(req->inbuf, smb_ntcreate_RootDirectoryFid));
588
589 if(!dir_fsp) {
590 reply_doserror(req, ERRDOS, ERRbadfid);
591 END_PROFILE(SMBntcreateX);
592 return;
593 }
594
595 if(!dir_fsp->is_directory) {
596
597 srvstr_get_path(ctx, (char *)req->inbuf,
598 req->flags2, &fname,
599 smb_buf(req->inbuf), 0,
600 STR_TERMINATE, &status);
601 if (!NT_STATUS_IS_OK(status)) {
602 reply_nterror(req, status);
603 END_PROFILE(SMBntcreateX);
604 return;
605 }
606
607 /*
608 * Check to see if this is a mac fork of some kind.
609 */
610
611 if( is_ntfs_stream_name(fname)) {
612 reply_nterror(
613 req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
614 END_PROFILE(SMBntcreateX);
615 return;
616 }
617
618 /*
619 we need to handle the case when we get a
620 relative open relative to a file and the
621 pathname is blank - this is a reopen!
622 (hint from demyn plantenberg)
623 */
624
625 reply_doserror(req, ERRDOS, ERRbadfid);
626 END_PROFILE(SMBntcreateX);
627 return;
628 }
629
630 if (ISDOT(dir_fsp->fsp_name)) {
631 /*
632 * We're at the toplevel dir, the final file name
633 * must not contain ./, as this is filtered out
634 * normally by srvstr_get_path and unix_convert
635 * explicitly rejects paths containing ./.
636 */
637 fname = talloc_strdup(ctx,"");
638 if (!fname) {
639 reply_nterror(req, NT_STATUS_NO_MEMORY);
640 END_PROFILE(SMBntcreateX);
641 return;
642 }
643 } else {
644 size_t dir_name_len = strlen(dir_fsp->fsp_name);
645
646 /*
647 * Copy in the base directory name.
648 */
649
650 fname = TALLOC_ARRAY(ctx, char, dir_name_len+2);
651 if (!fname) {
652 reply_nterror(
653 req, NT_STATUS_NO_MEMORY);
654 END_PROFILE(SMBntcreateX);
655 return;
656 }
657 memcpy(fname, dir_fsp->fsp_name, dir_name_len+1);
658
659 /*
660 * Ensure it ends in a '/'.
661 * We used TALLOC_SIZE +2 to add space for the '/'.
662 */
663
664 if(dir_name_len &&
665 (fname[dir_name_len-1] != '\\') &&
666 (fname[dir_name_len-1] != '/')) {
667 fname[dir_name_len] = '/';
668 fname[dir_name_len+1] = '\0';
669 }
670 }
671
672 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &rel_fname,
673 smb_buf(req->inbuf), 0,
674 STR_TERMINATE, &status);
675 if (!NT_STATUS_IS_OK(status)) {
676 reply_nterror(req, status);
677 END_PROFILE(SMBntcreateX);
678 return;
679 }
680 fname = talloc_asprintf(ctx, "%s%s",
681 fname,
682 rel_fname);
683 if (!fname) {
684 reply_nterror(
685 req, NT_STATUS_NO_MEMORY);
686 END_PROFILE(SMBntcreateX);
687 return;
688 }
689 } else {
690 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
691 smb_buf(req->inbuf), 0,
692 STR_TERMINATE, &status);
693 if (!NT_STATUS_IS_OK(status)) {
694 reply_nterror(req, status);
695 END_PROFILE(SMBntcreateX);
696 return;
697 }
698
699 /*
700 * Check to see if this is a mac fork of some kind.
701 */
702
703 if( is_ntfs_stream_name(fname)) {
704 enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
705 if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
706 /*
707 * Here we go! support for changing the disk quotas --metze
708 *
709 * We need to fake up to open this MAGIC QUOTA file
710 * and return a valid FID.
711 *
712 * w2k close this file directly after openening
713 * xp also tries a QUERY_FILE_INFO on the file and then close it
714 */
715 reply_ntcreate_and_X_quota(conn, req,
716 fake_file_type, fname);
717 } else {
718 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
719 }
720 END_PROFILE(SMBntcreateX);
721 return;
722 }
723 }
724
725 /*
726 * Now contruct the smb_open_mode value from the filename,
727 * desired access and the share access.
728 */
729 status = resolve_dfspath(ctx, conn,
730 req->flags2 & FLAGS2_DFS_PATHNAMES,
731 fname,
732 &fname);
733 if (!NT_STATUS_IS_OK(status)) {
734 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
735 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
736 ERRSRV, ERRbadpath);
737 }
738 else {
739 reply_nterror(req, status);
740 }
741 END_PROFILE(SMBntcreateX);
742 return;
743 }
744
745 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
746 if (oplock_request) {
747 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
748 }
749
750 /*
751 * Ordinary file or directory.
752 */
753
754 /*
755 * Check if POSIX semantics are wanted.
756 */
757
758 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
759 case_state = set_posix_case_semantics(NULL, conn);
760 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
761 }
762
763 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
764 if (!NT_STATUS_IS_OK(status)) {
765 TALLOC_FREE(case_state);
766 reply_nterror(req, status);
767 END_PROFILE(SMBntcreateX);
768 return;
769 }
770 /* All file access must go through check_name() */
771 status = check_name(conn, fname);
772 if (!NT_STATUS_IS_OK(status)) {
773 TALLOC_FREE(case_state);
774 reply_nterror(req, status);
775 END_PROFILE(SMBntcreateX);
776 return;
777 }
778
779 /* This is the correct thing to do (check every time) but can_delete is
780 expensive (it may have to read the parent directory permissions). So
781 for now we're not doing it unless we have a strong hint the client
782 is really going to delete this file. If the client is forcing FILE_CREATE
783 let the filesystem take care of the permissions. */
784
785 /* Setting FILE_SHARE_DELETE is the hint. */
786
787 if (lp_acl_check_permissions(SNUM(conn))
788 && (create_disposition != FILE_CREATE)
789 && (share_access & FILE_SHARE_DELETE)
790 && (access_mask & DELETE_ACCESS)) {
791 if (((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY)
792 && !lp_delete_readonly(SNUM(conn))) ||
793 !can_delete_file_in_directory(conn, fname)) {
794 TALLOC_FREE(case_state);
795 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
796 END_PROFILE(SMBntcreateX);
797 return;
798 }
799 }
800
801 #if 0
802 /* We need to support SeSecurityPrivilege for this. */
803 if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
804 !user_has_privileges(current_user.nt_user_token,
805 &se_security)) {
806 TALLOC_FREE(case_state);
807 END_PROFILE(SMBntcreateX);
808 return ERROR_NT(NT_STATUS_PRIVILEGE_NOT_HELD);
809 }
810 #endif
811
812 /*
813 * If it's a request for a directory open, deal with it separately.
814 */
815
816 if(create_options & FILE_DIRECTORY_FILE) {
817
818 /* Can't open a temp directory. IFS kit test. */
819 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
820 TALLOC_FREE(case_state);
821 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
822 END_PROFILE(SMBntcreateX);
823 return;
824 }
825
826 oplock_request = 0;
827 status = open_directory(conn, req, fname, &sbuf,
828 access_mask,
829 share_access,
830 create_disposition,
831 create_options,
832 file_attributes,
833 &info, &fsp);
834
835 } else {
836
837 /*
838 * Ordinary file case.
839 */
840
841 /* NB. We have a potential bug here. If we
842 * cause an oplock break to ourselves, then we
843 * could end up processing filename related
844 * SMB requests whilst we await the oplock
845 * break response. As we may have changed the
846 * filename case semantics to be POSIX-like,
847 * this could mean a filename request could
848 * fail when it should succeed. This is a rare
849 * condition, but eventually we must arrange
850 * to restore the correct case semantics
851 * before issuing an oplock break request to
852 * our client. JRA. */
853
854 status = open_file_ntcreate(conn, req, fname, &sbuf,
855 access_mask,
856 share_access,
857 create_disposition,
858 create_options,
859 file_attributes,
860 oplock_request,
861 &info, &fsp);
862
863 /* We cheat here. There are two cases we
864 * care about. One is a directory rename,
865 * where the NT client will attempt to
866 * open the source directory for
867 * DELETE access. Note that when the
868 * NT client does this it does *not*
869 * set the directory bit in the
870 * request packet. This is translated
871 * into a read/write open
872 * request. POSIX states that any open
873 * for write request on a directory
874 * will generate an EISDIR error, so
875 * we can catch this here and open a
876 * pseudo handle that is flagged as a
877 * directory. The second is an open
878 * for a permissions read only, which
879 * we handle in the open_file_stat case. JRA.
880 */
881
882 if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_IS_A_DIRECTORY)) {
883
884 /*
885 * Fail the open if it was explicitly a non-directory
886 * file.
887 */
888
889 if (create_options & FILE_NON_DIRECTORY_FILE) {
890 TALLOC_FREE(case_state);
891 reply_force_nterror(req,
892 NT_STATUS_FILE_IS_A_DIRECTORY);
893 END_PROFILE(SMBntcreateX);
894 return;
895 }
896
897 oplock_request = 0;
898 status = open_directory(conn, req, fname,
899 &sbuf,
900 access_mask,
901 share_access,
902 create_disposition,
903 create_options,
904 file_attributes,
905 &info, &fsp);
906 }
907 }
908
909 TALLOC_FREE(case_state);
910
911 if (!NT_STATUS_IS_OK(status)) {
912 if (open_was_deferred(req->mid)) {
913 /* We have re-scheduled this call. */
914 END_PROFILE(SMBntcreateX);
915 return;
916 }
917 reply_openerror(req, status);
918 END_PROFILE(SMBntcreateX);
919 return;
920 }
921
922 file_len = sbuf.st_size;
923 fattr = dos_mode(conn,fname,&sbuf);
924 if(fattr == 0) {
925 fattr = FILE_ATTRIBUTE_NORMAL;
926 }
927 if (!fsp->is_directory && (fattr & aDIR)) {
928 close_file(fsp,ERROR_CLOSE);
929 reply_doserror(req, ERRDOS, ERRnoaccess);
930 END_PROFILE(SMBntcreateX);
931 return;
932 }
933
934 /* Save the requested allocation size. */
935 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
936 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
937 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
938 if (fsp->is_directory) {
939 close_file(fsp,ERROR_CLOSE);
940 /* Can't set allocation size on a directory. */
941 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
942 END_PROFILE(SMBntcreateX);
943 return;
944 }
945 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
946 close_file(fsp,ERROR_CLOSE);
947 reply_nterror(req, NT_STATUS_DISK_FULL);
948 END_PROFILE(SMBntcreateX);
949 return;
950 }
951 } else {
952 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
953 }
954 }
955
956 /*
957 * If the caller set the extended oplock request bit
958 * and we granted one (by whatever means) - set the
959 * correct bit for extended oplock reply.
960 */
961
962 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
963 extended_oplock_granted = True;
964 }
965
966 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
967 extended_oplock_granted = True;
968 }
969
970 if (flags & EXTENDED_RESPONSE_REQUIRED) {
971 /* This is very strange. We
972 * return 50 words, but only set
973 * the wcnt to 42 ? It's definately
974 * what happens on the wire....
975 */
976 reply_outbuf(req, 50, 0);
977 SCVAL(req->outbuf,smb_wct,42);
978 } else {
979 reply_outbuf(req, 34, 0);
980 }
981
982 p = (char *)req->outbuf + smb_vwv2;
983
984 /*
985 * Currently as we don't support level II oplocks we just report
986 * exclusive & batch here.
987 */
988
989 if (extended_oplock_granted) {
990 if (flags & REQUEST_BATCH_OPLOCK) {
991 SCVAL(p,0, BATCH_OPLOCK_RETURN);
992 } else {
993 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
994 }
995 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
996 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
997 } else {
998 SCVAL(p,0,NO_OPLOCK_RETURN);
999 }
1000
1001 p++;
1002 SSVAL(p,0,fsp->fnum);
1003 p += 2;
1004 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1005 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1006 } else {
1007 SIVAL(p,0,info);
1008 }
1009 p += 4;
1010
1011 /* Create time. */
1012 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1013 a_timespec = get_atimespec(&sbuf);
1014 m_timespec = get_mtimespec(&sbuf);
1015
1016 if (lp_dos_filetime_resolution(SNUM(conn))) {
1017 dos_filetime_timespec(&c_timespec);
1018 dos_filetime_timespec(&a_timespec);
1019 dos_filetime_timespec(&m_timespec);
1020 }
1021
1022 put_long_date_timespec(p, c_timespec); /* create time. */
1023 p += 8;
1024 put_long_date_timespec(p, a_timespec); /* access time */
1025 p += 8;
1026 put_long_date_timespec(p, m_timespec); /* write time */
1027 p += 8;
1028 put_long_date_timespec(p, m_timespec); /* change time */
1029 p += 8;
1030 SIVAL(p,0,fattr); /* File Attributes. */
1031 p += 4;
1032 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1033 p += 8;
1034 SOFF_T(p,0,file_len);
1035 p += 8;
1036 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1037 SSVAL(p,2,0x7);
1038 }
1039 p += 4;
1040 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1041
1042 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1043 uint32 perms = 0;
1044 p += 25;
1045 if (fsp->is_directory || can_write_to_file(conn, fname, &sbuf)) {
1046 perms = FILE_GENERIC_ALL;
1047 } else {
1048 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1049 }
1050 SIVAL(p,0,perms);
1051 }
1052
1053 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
1054
1055 chain_reply(req);
1056 END_PROFILE(SMBntcreateX);
1057 return;
1058 }
1059
1060 /****************************************************************************
1061 Reply to a NT_TRANSACT_CREATE call to open a pipe.
1062 ****************************************************************************/
1063
1064 static void do_nt_transact_create_pipe(connection_struct *conn,
1065 struct smb_request *req,
1066 uint16 **ppsetup, uint32 setup_count,
1067 char **ppparams, uint32 parameter_count,
1068 char **ppdata, uint32 data_count)
1069 {
1070 char *fname = NULL;
1071 char *params = *ppparams;
1072 int pnum = -1;
1073 char *p = NULL;
1074 NTSTATUS status;
1075 size_t param_len;
1076 uint32 flags;
1077 TALLOC_CTX *ctx = talloc_tos();
1078
1079 /*
1080 * Ensure minimum number of parameters sent.
1081 */
1082
1083 if(parameter_count < 54) {
1084 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1085 reply_doserror(req, ERRDOS, ERRnoaccess);
1086 return;
1087 }
1088
1089 flags = IVAL(params,0);
1090
1091 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
1092 parameter_count-53, STR_TERMINATE,
1093 &status);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 reply_nterror(req, status);
1096 return;
1097 }
1098
1099 nt_open_pipe(fname, conn, req, &pnum);
1100
1101 if (req->outbuf) {
1102 /* Error return */
1103 return;
1104 }
1105
1106 /* Realloc the size of parameters and data we will return */
1107 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1108 /* Extended response is 32 more byyes. */
1109 param_len = 101;
1110 } else {
1111 param_len = 69;
1112 }
1113 params = nttrans_realloc(ppparams, param_len);
1114 if(params == NULL) {
1115 reply_doserror(req, ERRDOS, ERRnomem);
1116 return;
1117 }
1118
1119 p = params;
1120 SCVAL(p,0,NO_OPLOCK_RETURN);
1121
1122 p += 2;
1123 SSVAL(p,0,pnum);
1124 p += 2;
1125 SIVAL(p,0,FILE_WAS_OPENED);
1126 p += 8;
1127
1128 p += 32;
1129 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1130 p += 20;
1131 /* File type. */
1132 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1133 /* Device state. */
1134 SSVAL(p,2, 0x5FF); /* ? */
1135 p += 4;
1136
1137 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1138 p += 25;
1139 SIVAL(p,0,FILE_GENERIC_ALL);
1140 /*
1141 * For pipes W2K3 seems to return
1142 * 0x12019B next.
1143 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
1144 */
1145 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
1146 }
1147
1148 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1149
1150 /* Send the required number of replies */
1151 send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1152
1153 return;
1154 }
1155
1156 /****************************************************************************
1157 Internal fn to set security descriptors.
1158 ****************************************************************************/
1159
1160 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1161 {
1162 prs_struct pd;
1163 SEC_DESC *psd = NULL;
1164 TALLOC_CTX *mem_ctx;
1165 NTSTATUS status;
1166
1167 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
1168 return NT_STATUS_OK;
1169 }
1170
1171 /*
1172 * Init the parse struct we will unmarshall from.
1173 */
1174
1175 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1176 DEBUG(0,("set_sd: talloc_init failed.\n"));
1177 return NT_STATUS_NO_MEMORY;
1178 }
1179
1180 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1181
1182 /*
1183 * Setup the prs_struct to point at the memory we just
1184 * allocated.
1185 */
1186
1187 prs_give_memory( &pd, data, sd_len, False);
1188
1189 /*
1190 * Finally, unmarshall from the data buffer.
1191 */
1192
1193 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1194 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1195 /*
1196 * Return access denied for want of a better error message..
1197 */
1198 talloc_destroy(mem_ctx);
1199 return NT_STATUS_NO_MEMORY;
1200 }
1201
1202 if (psd->owner_sid==0) {
1203 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1204 }
1205 if (psd->group_sid==0) {
1206 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1207 }
1208 if (psd->sacl==0) {
1209 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1210 }
1211 if (psd->dacl==0) {
1212 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1213 }
1214
1215 status = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1216
1217 talloc_destroy(mem_ctx);
1218 return status;
1219 }
1220
1221 /****************************************************************************
1222 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1223 ****************************************************************************/
1224
1225 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1226 {
1227 struct ea_list *ea_list_head = NULL;
1228 size_t offset = 0;
1229
1230 if (data_size < 4) {
1231 return NULL;
1232 }
1233
1234 while (offset + 4 <= data_size) {
1235 size_t next_offset = IVAL(pdata,offset);
1236 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1237
1238 if (!eal) {
1239 return NULL;
1240 }
1241
1242 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1243 if (next_offset == 0) {
1244 break;
1245 }
1246 offset += next_offset;
1247 }
1248
1249 return ea_list_head;
1250 }
1251
1252 /****************************************************************************
1253 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1254 ****************************************************************************/
1255
1256 static void call_nt_transact_create(connection_struct *conn,
1257 struct smb_request *req,
1258 uint16 **ppsetup, uint32 setup_count,
1259 char **ppparams, uint32 parameter_count,
1260 char **ppdata, uint32 data_count,
1261 uint32 max_data_count)
1262 {
1263 char *fname = NULL;
1264 char *params = *ppparams;
1265 char *data = *ppdata;
1266 /* Breakout the oplock request bits so we can set the reply bits separately. */
1267 int oplock_request = 0;
1268 uint32 fattr=0;
1269 SMB_OFF_T file_len = 0;
1270 SMB_STRUCT_STAT sbuf;
1271 int info = 0;
1272 files_struct *fsp = NULL;
1273 char *p = NULL;
1274 bool extended_oplock_granted = False;
1275 uint32 flags;
1276 uint32 access_mask;
1277 uint32 file_attributes;
1278 uint32 share_access;
1279 uint32 create_disposition;
1280 uint32 create_options;
1281 uint32 sd_len;
1282 uint32 ea_len;
1283 uint16 root_dir_fid;
1284 struct timespec c_timespec;
1285 struct timespec a_timespec;
1286 struct timespec m_timespec;
1287 struct ea_list *ea_list = NULL;
1288 char *pdata = NULL;
1289 NTSTATUS status;
1290 size_t param_len;
1291 struct case_semantics_state *case_state = NULL;
1292 TALLOC_CTX *ctx = talloc_tos();
1293
1294 DEBUG(5,("call_nt_transact_create\n"));
1295
1296 /*
1297 * If it's an IPC, use the pipe handler.
1298 */
1299
1300 if (IS_IPC(conn)) {
1301 if (lp_nt_pipe_support()) {
1302 do_nt_transact_create_pipe(
1303 conn, req,
1304 ppsetup, setup_count,
1305 ppparams, parameter_count,
1306 ppdata, data_count);
1307 return;
1308 } else {
1309 reply_doserror(req, ERRDOS, ERRnoaccess);
1310 return;
1311 }
1312 }
1313
1314 /*
1315 * Ensure minimum number of parameters sent.
1316 */
1317
1318 if(parameter_count < 54) {
1319 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1320 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1321 return;
1322 }
1323
1324 flags = IVAL(params,0);
1325 access_mask = IVAL(params,8);
1326 file_attributes = IVAL(params,20);
1327 share_access = IVAL(params,24);
1328 create_disposition = IVAL(params,28);
1329 create_options = IVAL(params,32);
1330 sd_len = IVAL(params,36);
1331 ea_len = IVAL(params,40);
1332 root_dir_fid = (uint16)IVAL(params,4);
1333
1334 /* Ensure the data_len is correct for the sd and ea values given. */
1335 if ((ea_len + sd_len > data_count) ||
1336 (ea_len > data_count) || (sd_len > data_count) ||
1337 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1338 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1339 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1340 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1341 return;
1342 }
1343
1344 if (ea_len) {
1345 if (!lp_ea_support(SNUM(conn))) {
1346 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1347 (unsigned int)ea_len ));
1348 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1349 return;
1350 }
1351
1352 if (ea_len < 10) {
1353 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1354 (unsigned int)ea_len ));
1355 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1356 return;
1357 }
1358 }
1359
1360 if (create_options & FILE_OPEN_BY_FILE_ID) {
1361 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1362 return;
1363 }
1364
1365 /*
1366 * Get the file name.
1367 */
1368
1369 if(root_dir_fid != 0) {
1370 /*
1371 * This filename is relative to a directory fid.
1372 */
1373 char *tmpname = NULL;
1374 files_struct *dir_fsp = file_fsp(SVAL(params,4));
1375
1376 if(!dir_fsp) {
1377 reply_doserror(req, ERRDOS, ERRbadfid);
1378 return;
1379 }
1380
1381 if(!dir_fsp->is_directory) {
1382 srvstr_get_path(ctx, params, req->flags2, &fname,
1383 params+53,
1384 parameter_count-53, STR_TERMINATE,
1385 &status);
1386 if (!NT_STATUS_IS_OK(status)) {
1387 reply_nterror(req, status);
1388 return;
1389 }
1390
1391 /*
1392 * Check to see if this is a mac fork of some kind.
1393 */
1394
1395 if( is_ntfs_stream_name(fname)) {
1396 reply_nterror(req,
1397 NT_STATUS_OBJECT_PATH_NOT_FOUND);
1398 return;
1399 }
1400
1401 reply_doserror(req, ERRDOS, ERRbadfid);
1402 return;
1403 }
1404
1405 if (ISDOT(dir_fsp->fsp_name)) {
1406 /*
1407 * We're at the toplevel dir, the final file name
1408 * must not contain ./, as this is filtered out
1409 * normally by srvstr_get_path and unix_convert
1410 * explicitly rejects paths containing ./.
1411 */
1412 fname = talloc_strdup(ctx,"");
1413 if (!fname) {
1414 reply_nterror(req, NT_STATUS_NO_MEMORY);
1415 return;
1416 }
1417 } else {
1418 size_t dir_name_len = strlen(dir_fsp->fsp_name);
1419
1420 /*
1421 * Copy in the base directory name.
1422 */
1423
1424 fname = TALLOC_ARRAY(ctx, char, dir_name_len+2);
1425 if (!fname) {
1426 reply_nterror(req, NT_STATUS_NO_MEMORY);
1427 return;
1428 }
1429 memcpy(fname, dir_fsp->fsp_name, dir_name_len+1);
1430
1431 /*
1432 * Ensure it ends in a '/'.
1433 * We used TALLOC_SIZE +2 to add space for the '/'.
1434 */
1435
1436 if(dir_name_len &&
1437 (fname[dir_name_len-1] != '\\') &&
1438 (fname[dir_name_len-1] != '/')) {
1439 fname[dir_name_len] = '/';
1440 fname[dir_name_len+1] = '\0';
1441 }
1442 }
1443
1444 srvstr_get_path(ctx, params, req->flags2, &tmpname,
1445 params+53,
1446 parameter_count-53, STR_TERMINATE,
1447 &status);
1448 if (!NT_STATUS_IS_OK(status)) {
1449 reply_nterror(req, status);
1450 return;
1451 }
1452 fname = talloc_asprintf(ctx, "%s%s",
1453 fname,
1454 tmpname);
1455 if (!fname) {
1456 reply_nterror(
1457 req, NT_STATUS_NO_MEMORY);
1458 return;
1459 }
1460 } else {
1461 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
1462 parameter_count-53,
1463 STR_TERMINATE, &status);
1464 if (!NT_STATUS_IS_OK(status)) {
1465 reply_nterror(req, status);
1466 return;
1467 }
1468
1469 /*
1470 * Check to see if this is a mac fork of some kind.
1471 */
1472
1473 if( is_ntfs_stream_name(fname)) {
1474 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
1475 return;
1476 }
1477 }
1478
1479 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1480 if (oplock_request) {
1481 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1482 }
1483
1484 /*
1485 * Ordinary file or directory.
1486 */
1487
1488 /*
1489 * Check if POSIX semantics are wanted.
1490 */
1491
1492 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1493 case_state = set_posix_case_semantics(NULL, conn);
1494 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1495 }
1496
1497 status = resolve_dfspath(ctx, conn,
1498 req->flags2 & FLAGS2_DFS_PATHNAMES,
1499 fname,
1500 &fname);
1501 if (!NT_STATUS_IS_OK(status)) {
1502 TALLOC_FREE(case_state);
1503 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1504 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1505 ERRSRV, ERRbadpath);
1506 return;
1507 }
1508 reply_nterror(req, status);
1509 return;
1510 }
1511
1512 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1513 if (!NT_STATUS_IS_OK(status)) {
1514 TALLOC_FREE(case_state);
1515 reply_nterror(req, status);
1516 return;
1517 }
1518 /* All file access must go through check_name() */
1519 status = check_name(conn, fname);
1520 if (!NT_STATUS_IS_OK(status)) {
1521 TALLOC_FREE(case_state);
1522 reply_nterror(req, status);
1523 return;
1524 }
1525
1526 /* This is the correct thing to do (check every time) but can_delete is
1527 expensive (it may have to read the parent directory permissions). So
1528 for now we're not doing it unless we have a strong hint the client
1529 is really going to delete this file. If the client is forcing FILE_CREATE
1530 let the filesystem take care of the permissions. */
1531
1532 /* Setting FILE_SHARE_DELETE is the hint. */
1533
1534 if (lp_acl_check_permissions(SNUM(conn))
1535 && (create_disposition != FILE_CREATE)
1536 && (share_access & FILE_SHARE_DELETE)
1537 && (access_mask & DELETE_ACCESS)) {
1538 if (((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY)
1539 && !lp_delete_readonly(SNUM(conn))) ||
1540 !can_delete_file_in_directory(conn, fname)) {
1541 TALLOC_FREE(case_state);
1542 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1543 return;
1544 }
1545 }
1546
1547 #if 0
1548 /* We need to support SeSecurityPrivilege for this. */
1549 if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
1550 !user_has_privileges(current_user.nt_user_token,
1551 &se_security)) {
1552 TALLOC_FREE(case_state);
1553 reply_nterror(req, NT_STATUS_PRIVILEGE_NOT_HELD);
1554 return;
1555 }
1556 #endif
1557
1558 if (ea_len) {
1559 pdata = data + sd_len;
1560
1561 /* We have already checked that ea_len <= data_count here. */
1562 ea_list = read_nttrans_ea_list(talloc_tos(), pdata,
1563 ea_len);
1564 if (!ea_list ) {
1565 TALLOC_FREE(case_state);
1566 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1567 return;
1568 }
1569 }
1570
1571 /*
1572 * If it's a request for a directory open, deal with it separately.
1573 */
1574
1575 if(create_options & FILE_DIRECTORY_FILE) {
1576
1577 /* Can't open a temp directory. IFS kit test. */
1578 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1579 TALLOC_FREE(case_state);
1580 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1581 return;
1582 }
1583
1584 /*
1585 * We will get a create directory here if the Win32
1586 * app specified a security descriptor in the
1587 * CreateDirectory() call.
1588 */
1589
1590 oplock_request = 0;
1591 status = open_directory(conn, req, fname, &sbuf,
1592 access_mask,
1593 share_access,
1594 create_disposition,
1595 create_options,
1596 file_attributes,
1597 &info, &fsp);
1598 } else {
1599
1600 /*
1601 * Ordinary file case.
1602 */
1603
1604 status = open_file_ntcreate(conn,req,fname,&sbuf,
1605 access_mask,
1606 share_access,
1607 create_disposition,
1608 create_options,
1609 file_attributes,
1610 oplock_request,
1611 &info, &fsp);
1612
1613 if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_IS_A_DIRECTORY)) {
1614
1615 /*
1616 * Fail the open if it was explicitly a non-directory file.
1617 */
1618
1619 if (create_options & FILE_NON_DIRECTORY_FILE) {
1620 TALLOC_FREE(case_state);
1621 reply_force_nterror(
1622 req,
1623 NT_STATUS_FILE_IS_A_DIRECTORY);
1624 return;
1625 }
1626
1627 oplock_request = 0;
1628 status = open_directory(conn, req, fname,
1629 &sbuf,
1630 access_mask,
1631 share_access,
1632 create_disposition,
1633 create_options,
1634 file_attributes,
1635 &info, &fsp);
1636 }
1637 }
1638
1639 TALLOC_FREE(case_state);
1640
1641 if(!NT_STATUS_IS_OK(status)) {
1642 if (open_was_deferred(req->mid)) {
1643 /* We have re-scheduled this call. */
1644 return;
1645 }
1646 reply_openerror(req, status);
1647 return;
1648 }
1649
1650 /*
1651 * According to the MS documentation, the only time the security
1652 * descriptor is applied to the opened file is iff we *created* the
1653 * file; an existing file stays the same.
1654 *
1655 * Also, it seems (from observation) that you can open the file with
1656 * any access mask but you can still write the sd. We need to override
1657 * the granted access before we call set_sd
1658 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1659 */
1660
1661 if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1662 uint32 saved_access_mask = fsp->access_mask;
1663
1664 /* We have already checked that sd_len <= data_count here. */
1665
1666 fsp->access_mask = FILE_GENERIC_ALL;
1667
1668 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1669 if (!NT_STATUS_IS_OK(status)) {
1670 close_file(fsp,ERROR_CLOSE);
1671 TALLOC_FREE(case_state);
1672 reply_nterror(req, status);
1673 return;
1674 }
1675 fsp->access_mask = saved_access_mask;
1676 }
1677
1678 if (ea_len && (info == FILE_WAS_CREATED)) {
1679 status = set_ea(conn, fsp, fname, ea_list);
1680 if (!NT_STATUS_IS_OK(status)) {
1681 close_file(fsp,ERROR_CLOSE);
1682 TALLOC_FREE(case_state);
1683 reply_nterror(req, status);
1684 return;
1685 }
1686 }
1687
1688 TALLOC_FREE(case_state);
1689
1690 file_len = sbuf.st_size;
1691 fattr = dos_mode(conn,fname,&sbuf);
1692 if(fattr == 0) {
1693 fattr = FILE_ATTRIBUTE_NORMAL;
1694 }
1695 if (!fsp->is_directory && (fattr & aDIR)) {
1696 close_file(fsp,ERROR_CLOSE);
1697 reply_doserror(req, ERRDOS, ERRnoaccess);
1698 return;
1699 }
1700
1701 /* Save the requested allocation size. */
1702 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
1703 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1704 #ifdef LARGE_SMB_OFF_T
1705 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1706 #endif
1707 if (allocation_size && (allocation_size > file_len)) {
1708 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1709 if (fsp->is_directory) {
1710 close_file(fsp,ERROR_CLOSE);
1711 /* Can't set allocation size on a directory. */
1712 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1713 return;
1714 }
1715 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1716 close_file(fsp,ERROR_CLOSE);
1717 reply_nterror(req, NT_STATUS_DISK_FULL);
1718 return;
1719 }
1720 } else {
1721 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1722 }
1723 }
1724
1725 /*
1726 * If the caller set the extended oplock request bit
1727 * and we granted one (by whatever means) - set the
1728 * correct bit for extended oplock reply.
1729 */
1730
1731 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1732 extended_oplock_granted = True;
1733 }
1734
1735 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1736 extended_oplock_granted = True;
1737 }
1738
1739 /* Realloc the size of parameters and data we will return */
1740 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1741 /* Extended response is 32 more byyes. */
1742 param_len = 101;
1743 } else {
1744 param_len = 69;
1745 }
1746 params = nttrans_realloc(ppparams, param_len);
1747 if(params == NULL) {
1748 reply_doserror(req, ERRDOS, ERRnomem);
1749 return;
1750 }
1751
1752 p = params;
1753 if (extended_oplock_granted) {
1754 if (flags & REQUEST_BATCH_OPLOCK) {
1755 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1756 } else {
1757 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1758 }
1759 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1760 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1761 } else {
1762 SCVAL(p,0,NO_OPLOCK_RETURN);
1763 }
1764
1765 p += 2;
1766 SSVAL(p,0,fsp->fnum);
1767 p += 2;
1768 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1769 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1770 } else {
1771 SIVAL(p,0,info);
1772 }
1773 p += 8;
1774
1775 /* Create time. */
1776 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1777 a_timespec = get_atimespec(&sbuf);
1778 m_timespec = get_mtimespec(&sbuf);
1779
1780 if (lp_dos_filetime_resolution(SNUM(conn))) {
1781 dos_filetime_timespec(&c_timespec);
1782 dos_filetime_timespec(&a_timespec);
1783 dos_filetime_timespec(&m_timespec);
1784 }
1785
1786 put_long_date_timespec(p, c_timespec); /* create time. */
1787 p += 8;
1788 put_long_date_timespec(p, a_timespec); /* access time */
1789 p += 8;
1790 put_long_date_timespec(p, m_timespec); /* write time */
1791 p += 8;
1792 put_long_date_timespec(p, m_timespec); /* change time */
1793 p += 8;
1794 SIVAL(p,0,fattr); /* File Attributes. */
1795 p += 4;
1796 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1797 p += 8;
1798 SOFF_T(p,0,file_len);
1799 p += 8;
1800 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1801 SSVAL(p,2,0x7);
1802 }
1803 p += 4;
1804 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1805
1806 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1807 uint32 perms = 0;
1808 p += 25;
1809 if (fsp->is_directory || can_write_to_file(conn, fname, &sbuf)) {
1810 perms = FILE_GENERIC_ALL;
1811 } else {
1812 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1813 }
1814 SIVAL(p,0,perms);
1815 }
1816
1817 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1818
1819 /* Send the required number of replies */
1820 send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1821
1822 return;
1823 }
1824
1825 /****************************************************************************
1826 Reply to a NT CANCEL request.
1827 conn POINTER CAN BE NULL HERE !
1828 ****************************************************************************/
1829
1830 void reply_ntcancel(connection_struct *conn, struct smb_request *req)
1831 {
1832 /*
1833 * Go through and cancel any pending change notifies.
1834 */
1835
1836 START_PROFILE(SMBntcancel);
1837 remove_pending_change_notify_requests_by_mid(req->mid);
1838 remove_pending_lock_requests_by_mid(req->mid);
1839 srv_cancel_sign_response(req->mid);
1840
1841 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1842
1843 END_PROFILE(SMBntcancel);
1844 return;
1845 }
1846
1847 /****************************************************************************
1848 Copy a file.
1849 ****************************************************************************/
1850
1851 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1852 connection_struct *conn,
1853 struct smb_request *req,
1854 const char *oldname_in,
1855 const char *newname_in,
1856 uint32 attrs)
1857 {
1858 SMB_STRUCT_STAT sbuf1, sbuf2;
1859 char *oldname = NULL;
1860 char *newname = NULL;
1861 char *last_component_oldname = NULL;
1862 char *last_component_newname = NULL;
1863 files_struct *fsp1,*fsp2;
1864 uint32 fattr;
1865 int info;
1866 SMB_OFF_T ret=-1;
1867 NTSTATUS status = NT_STATUS_OK;
1868
1869 ZERO_STRUCT(sbuf1);
1870 ZERO_STRUCT(sbuf2);
1871
1872 if (!CAN_WRITE(conn)) {
1873 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1874 }
1875
1876 status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1877 &last_component_oldname, &sbuf1);
1878 if (!NT_STATUS_IS_OK(status)) {
1879 return status;
1880 }
1881
1882 status = check_name(conn, oldname);
1883 if (!NT_STATUS_IS_OK(status)) {
1884 return status;
1885 }
1886
1887 /* Source must already exist. */
1888 if (!VALID_STAT(sbuf1)) {
1889 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1890 }
1891 /* Ensure attributes match. */
1892 fattr = dos_mode(conn,oldname,&sbuf1);
1893 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1894 return NT_STATUS_NO_SUCH_FILE;
1895 }
1896
1897 status = unix_convert(ctx, conn, newname_in, False, &newname,
1898 &last_component_newname, &sbuf2);
1899 if (!NT_STATUS_IS_OK(status)) {
1900 return status;
1901 }
1902
1903 status = check_name(conn, newname);
1904 if (!NT_STATUS_IS_OK(status)) {
1905 return status;
1906 }
1907
1908 /* Disallow if newname already exists. */
1909 if (VALID_STAT(sbuf2)) {
1910 return NT_STATUS_OBJECT_NAME_COLLISION;
1911 }
1912
1913 /* No links from a directory. */
1914 if (S_ISDIR(sbuf1.st_mode)) {
1915 return NT_STATUS_FILE_IS_A_DIRECTORY;
1916 }
1917
1918 /* Ensure this is within the share. */
1919 status = check_reduced_name(conn, oldname);
1920 if (!NT_STATUS_IS_OK(status)) {
1921 return status;
1922 }
1923
1924 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1925 oldname, newname));
1926
1927 status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1928 FILE_READ_DATA, /* Read-only. */
1929 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1930 FILE_OPEN,
1931 0, /* No create options. */
1932 FILE_ATTRIBUTE_NORMAL,
1933 NO_OPLOCK,
1934 &info, &fsp1);
1935
1936 if (!NT_STATUS_IS_OK(status)) {
1937 return status;
1938 }
1939
1940 status = open_file_ntcreate(conn, req, newname, &sbuf2,
1941 FILE_WRITE_DATA, /* Read-only. */
1942 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1943 FILE_CREATE,
1944 0, /* No create options. */
1945 fattr,
1946 NO_OPLOCK,
1947 &info, &fsp2);
1948
1949 if (!NT_STATUS_IS_OK(status)) {
1950 close_file(fsp1,ERROR_CLOSE);
1951 return status;
1952 }
1953
1954 if (sbuf1.st_size) {
1955 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1956 }
1957
1958 /*
1959 * As we are opening fsp1 read-only we only expect
1960 * an error on close on fsp2 if we are out of space.
1961 * Thus we don't look at the error return from the
1962 * close of fsp1.
1963 */
1964 close_file(fsp1,NORMAL_CLOSE);
1965
1966 /* Ensure the modtime is set correctly on the destination file. */
1967 fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1));
1968
1969 status = close_file(fsp2,NORMAL_CLOSE);
1970
1971 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1972 creates the file. This isn't the correct thing to do in the copy
1973 case. JRA */
1974 file_set_dosmode(conn, newname, fattr, &sbuf2,
1975 parent_dirname(newname),false);
1976
1977 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1978 return NT_STATUS_DISK_FULL;
1979 }
1980
1981 if (!NT_STATUS_IS_OK(status)) {
1982 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1983 nt_errstr(status), oldname, newname));
1984 }
1985 return status;
1986 }
1987
1988 /****************************************************************************
1989 Reply to a NT rename request.
1990 ****************************************************************************/
1991
1992 void reply_ntrename(connection_struct *conn, struct smb_request *req)
1993 {
1994 char *oldname = NULL;
1995 char *newname = NULL;
1996 char *p;
1997 NTSTATUS status;
1998 bool src_has_wcard = False;
1999 bool dest_has_wcard = False;
2000 uint32 attrs;
2001 uint16 rename_type;
2002 TALLOC_CTX *ctx = talloc_tos();
2003
2004 START_PROFILE(SMBntrename);
2005
2006 if (req->wct < 4) {
2007 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2008 END_PROFILE(SMBntrename);
2009 return;
2010 }
2011
2012 attrs = SVAL(req->inbuf,smb_vwv0);
2013 rename_type = SVAL(req->inbuf,smb_vwv1);
2014
2015 p = smb_buf(req->inbuf) + 1;
2016 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
2017 0, STR_TERMINATE, &status,
2018 &src_has_wcard);
2019 if (!NT_STATUS_IS_OK(status)) {
2020 reply_nterror(req, status);
2021 END_PROFILE(SMBntrename);
2022 return;
2023 }
2024
2025 if( is_ntfs_stream_name(oldname)) {
2026 /* Can't rename a stream. */
2027 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2028 END_PROFILE(SMBntrename);
2029 return;
2030 }
2031
2032 if (ms_has_wild(oldname)) {
2033 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
2034 END_PROFILE(SMBntrename);
2035 return;
2036 }
2037
2038 p++;
2039 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
2040 0, STR_TERMINATE, &status,
2041 &dest_has_wcard);
2042 if (!NT_STATUS_IS_OK(status)) {
2043 reply_nterror(req, status);
2044 END_PROFILE(SMBntrename);
2045 return;
2046 }
2047
2048 status = resolve_dfspath(ctx, conn,
2049 req->flags2 & FLAGS2_DFS_PATHNAMES,
2050 oldname,
2051 &oldname);
2052 if (!NT_STATUS_IS_OK(status)) {
2053 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2054 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2055 ERRSRV, ERRbadpath);
2056 END_PROFILE(SMBntrename);
2057 return;
2058 }
2059 reply_nterror(req, status);
2060 END_PROFILE(SMBntrename);
2061 return;
2062 }
2063
2064 status = resolve_dfspath(ctx, conn,
2065 req->flags2 & FLAGS2_DFS_PATHNAMES,
2066 newname,
2067 &newname);
2068 if (!NT_STATUS_IS_OK(status)) {
2069 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2070 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2071 ERRSRV, ERRbadpath);
2072 END_PROFILE(SMBntrename);
2073 return;
2074 }
2075 reply_nterror(req, status);
2076 END_PROFILE(SMBntrename);
2077 return;
2078 }
2079
2080 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
2081
2082 switch(rename_type) {
2083 case RENAME_FLAG_RENAME:
2084 status = rename_internals(ctx, conn, req, oldname,
2085 newname, attrs, False, src_has_wcard,
2086 dest_has_wcard);
2087 break;
2088 case RENAME_FLAG_HARD_LINK:
2089 if (src_has_wcard || dest_has_wcard) {
2090 /* No wildcards. */
2091 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
2092 } else {
2093 status = hardlink_internals(ctx,
2094 conn,
2095 oldname,
2096 newname);
2097 }
2098 break;
2099 case RENAME_FLAG_COPY:
2100 if (src_has_wcard || dest_has_wcard) {
2101 /* No wildcards. */
2102 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
2103 } else {
2104 status = copy_internals(ctx, conn, req, oldname,
2105 newname, attrs);
2106 }
2107 break;
2108 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
2109 status = NT_STATUS_INVALID_PARAMETER;
2110 break;
2111 default:
2112 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
2113 break;
2114 }
2115
2116 if (!NT_STATUS_IS_OK(status)) {
2117 if (open_was_deferred(req->mid)) {
2118 /* We have re-scheduled this call. */
2119 END_PROFILE(SMBntrename);
2120 return;
2121 }
2122
2123 reply_nterror(req, status);
2124 END_PROFILE(SMBntrename);
2125 return;
2126 }
2127
2128 reply_outbuf(req, 0, 0);
2129
2130 END_PROFILE(SMBntrename);
2131 return;
2132 }
2133
2134 /****************************************************************************
2135 Reply to a notify change - queue the request and
2136 don't allow a directory to be opened.
2137 ****************************************************************************/
2138
2139 static void call_nt_transact_notify_change(connection_struct *conn,
2140 struct smb_request *req,
2141 uint16 **ppsetup,
2142 uint32 setup_count,
2143 char **ppparams,
2144 uint32 parameter_count,
2145 char **ppdata, uint32 data_count,
2146 uint32 max_data_count,
2147 uint32 max_param_count)
2148 {
2149 uint16 *setup = *ppsetup;
2150 files_struct *fsp;
2151 uint32 filter;
2152 NTSTATUS status;
2153 bool recursive;
2154
2155 if(setup_count < 6) {
2156 reply_doserror(req, ERRDOS, ERRbadfunc);
2157 return;
2158 }
2159
2160 fsp = file_fsp(SVAL(setup,4));
2161 filter = IVAL(setup, 0);
2162 recursive = (SVAL(setup, 6) != 0) ? True : False;
2163
2164 DEBUG(3,("call_nt_transact_notify_change\n"));
2165
2166 if(!fsp) {
2167 reply_doserror(req, ERRDOS, ERRbadfid);
2168 return;
2169 }
2170
2171 {
2172 char *filter_string;
2173
2174 if (!(filter_string = notify_filter_string(NULL, filter))) {
2175 reply_nterror(req,NT_STATUS_NO_MEMORY);
2176 return;
2177 }
2178
2179 DEBUG(3,("call_nt_transact_notify_change: notify change "
2180 "called on %s, filter = %s, recursive = %d\n",
2181 fsp->fsp_name, filter_string, recursive));
2182
2183 TALLOC_FREE(filter_string);
2184 }
2185
2186 if((!fsp->is_directory) || (conn != fsp->conn)) {
2187 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2188 return;
2189 }
2190
2191 if (fsp->notify == NULL) {
2192
2193 status = change_notify_create(fsp, filter, recursive);
2194
2195 if (!NT_STATUS_IS_OK(status)) {
2196 DEBUG(10, ("change_notify_create returned %s\n",
2197 nt_errstr(status)));
2198 reply_nterror(req, status);
2199 return;
2200 }
2201 }
2202
2203 if (fsp->notify->num_changes != 0) {
2204
2205 /*
2206 * We've got changes pending, respond immediately
2207 */
2208
2209 /*
2210 * TODO: write a torture test to check the filtering behaviour
2211 * here.
2212 */
2213
2214 change_notify_reply(req->inbuf, max_param_count, fsp->notify);
2215
2216 /*
2217 * change_notify_reply() above has independently sent its
2218 * results
2219 */
2220 return;
2221 }
2222
2223 /*
2224 * No changes pending, queue the request
2225 */
2226
2227 status = change_notify_add_request(req->inbuf, max_param_count, filter,
2228 recursive, fsp);
2229 if (!NT_STATUS_IS_OK(status)) {
2230 reply_nterror(req, status);
2231 }
2232 return;
2233 }
2234
2235 /****************************************************************************
2236 Reply to an NT transact rename command.
2237 ****************************************************************************/
2238
2239 static void call_nt_transact_rename(connection_struct *conn,
2240 struct smb_request *req,
2241 uint16 **ppsetup, uint32 setup_count,
2242 char **ppparams, uint32 parameter_count,
2243 char **ppdata, uint32 data_count,
2244 uint32 max_data_count)
2245 {
2246 char *params = *ppparams;
2247 char *new_name = NULL;
2248 files_struct *fsp = NULL;
2249 bool replace_if_exists = False;
2250 bool dest_has_wcard = False;
2251 NTSTATUS status;
2252 TALLOC_CTX *ctx = talloc_tos();
2253
2254 if(parameter_count < 5) {
2255 reply_doserror(req, ERRDOS, ERRbadfunc);
2256 return;
2257 }
2258
2259 fsp = file_fsp(SVAL(params, 0));
2260 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
2261 if (!check_fsp(conn, req, fsp, &current_user)) {
2262 return;
2263 }
2264 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
2265 parameter_count - 4,
2266 STR_TERMINATE, &status, &dest_has_wcard);
2267 if (!NT_STATUS_IS_OK(status)) {
2268 reply_nterror(req, status);
2269 return;
2270 }
2271
2272 status = rename_internals(ctx,
2273 conn,
2274 req,
2275 fsp->fsp_name,
2276 new_name,
2277 0,
2278 replace_if_exists,
2279 False,
2280 dest_has_wcard);
2281
2282 if (!NT_STATUS_IS_OK(status)) {
2283 if (open_was_deferred(req->mid)) {
2284 /* We have re-scheduled this call. */
2285 return;
2286 }
2287 reply_nterror(req, status);
2288 return;
2289 }
2290
2291 /*
2292 * Rename was successful.
2293 */
2294 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2295
2296 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
2297 fsp->fsp_name, new_name));
2298
2299 return;
2300 }
2301
2302 /******************************************************************************
2303 Fake up a completely empty SD.
2304 *******************************************************************************/
2305
2306 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
2307 {
2308 size_t sd_size;
2309
2310 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2311 if(!*ppsd) {
2312 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2313 return NT_STATUS_NO_MEMORY;
2314 }
2315
2316 return NT_STATUS_OK;
2317 }
2318
2319 /****************************************************************************
2320 Reply to query a security descriptor.
2321 ****************************************************************************/
2322
2323 static void call_nt_transact_query_security_desc(connection_struct *conn,
2324 struct smb_request *req,
2325 uint16 **ppsetup,
2326 uint32 setup_count,
2327 char **ppparams,
2328 uint32 parameter_count,
2329 char **ppdata,
2330 uint32 data_count,
2331 uint32 max_data_count)
2332 {
2333 char *params = *ppparams;
2334 char *data = *ppdata;
2335 prs_struct pd;
2336 SEC_DESC *psd = NULL;
2337 size_t sd_size;
2338 uint32 security_info_wanted;
2339 TALLOC_CTX *mem_ctx;
2340 files_struct *fsp = NULL;
2341 NTSTATUS status;
2342
2343 if(parameter_count < 8) {
2344 reply_doserror(req, ERRDOS, ERRbadfunc);
2345 return;
2346 }
2347
2348 fsp = file_fsp(SVAL(params,0));
2349 if(!fsp) {
2350 reply_doserror(req, ERRDOS, ERRbadfid);
2351 return;
2352 }
2353
2354 security_info_wanted = IVAL(params,4);
2355
2356 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2357 (unsigned int)security_info_wanted ));
2358
2359 params = nttrans_realloc(ppparams, 4);
2360 if(params == NULL) {
2361 reply_doserror(req, ERRDOS, ERRnomem);
2362 return;
2363 }
2364
2365 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2366 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2367 reply_doserror(req, ERRDOS, ERRnomem);
2368 return;
2369 }
2370
2371 /*
2372 * Get the permissions to return.
2373 */
2374
2375 if (!lp_nt_acl_support(SNUM(conn))) {
2376 status = get_null_nt_acl(mem_ctx, &psd);
2377 } else {
2378 status = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd,
2379 security_info_wanted, &psd);
2380 }
2381
2382 if (!NT_STATUS_IS_OK(status)) {
2383 talloc_destroy(mem_ctx);
2384 reply_nterror(req, status);
2385 return;
2386 }
2387
2388 sd_size = sec_desc_size(psd);
2389
2390 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2391
2392 SIVAL(params,0,(uint32)sd_size);
2393
2394 if(max_data_count < sd_size) {
2395
2396 send_nt_replies(req, NT_STATUS_BUFFER_TOO_SMALL,
2397 params, 4, *ppdata, 0);
2398 talloc_destroy(mem_ctx);
2399 return;
2400 }
2401
2402 /*
2403 * Allocate the data we will point this at.
2404 */
2405
2406 data = nttrans_realloc(ppdata, sd_size);
2407 if(data == NULL) {
2408 talloc_destroy(mem_ctx);
2409 reply_doserror(req, ERRDOS, ERRnomem);
2410 return;
2411 }
2412
2413 /*
2414 * Init the parse struct we will marshall into.
2415 */
2416
2417 prs_init(&pd, 0, mem_ctx, MARSHALL);
2418
2419 /*
2420 * Setup the prs_struct to point at the memory we just
2421 * allocated.
2422 */
2423
2424 prs_give_memory( &pd, data, (uint32)sd_size, False);
2425
2426 /*
2427 * Finally, linearize into the outgoing buffer.
2428 */
2429
2430 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2431 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2432 security descriptor.\n"));
2433 /*
2434 * Return access denied for want of a better error message..
2435 */
2436 talloc_destroy(mem_ctx);
2437 reply_unixerror(req, ERRDOS, ERRnoaccess);
2438 return;
2439 }
2440
2441 /*
2442 * Now we can delete the security descriptor.
2443 */
2444
2445 talloc_destroy(mem_ctx);
2446
2447 send_nt_replies(req, NT_STATUS_OK, params, 4, data, (int)sd_size);
2448 return;
2449 }
2450
2451 /****************************************************************************
2452 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2453 ****************************************************************************/
2454
2455 static void call_nt_transact_set_security_desc(connection_struct *conn,
2456 struct smb_request *req,
2457 uint16 **ppsetup,
2458 uint32 setup_count,
2459 char **ppparams,
2460 uint32 parameter_count,
2461 char **ppdata,
2462 uint32 data_count,
2463 uint32 max_data_count)
2464 {
2465 char *params= *ppparams;
2466 char *data = *ppdata;
2467 files_struct *fsp = NULL;
2468 uint32 security_info_sent = 0;
2469 NTSTATUS nt_status;
2470
2471 if(parameter_count < 8) {
2472 reply_doserror(req, ERRDOS, ERRbadfunc);
2473 return;
2474 }
2475
2476 if((fsp = file_fsp(SVAL(params,0))) == NULL) {
2477 reply_doserror(req, ERRDOS, ERRbadfid);
2478 return;
2479 }
2480
2481 if(!lp_nt_acl_support(SNUM(conn))) {
2482 goto done;
2483 }
2484
2485 security_info_sent = IVAL(params,4);
2486
2487 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2488 (unsigned int)security_info_sent ));
2489
2490 if (data_count == 0) {
2491 reply_doserror(req, ERRDOS, ERRnoaccess);
2492 return;
2493 }
2494
2495 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2496 reply_nterror(req, nt_status);
2497 return;
2498 }
2499
2500 done:
2501
2502 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2503 return;
2504 }
2505
2506 /****************************************************************************
2507 Reply to NT IOCTL
2508 ****************************************************************************/
2509
2510 static void call_nt_transact_ioctl(connection_struct *conn,
2511 struct smb_request *req,
2512 uint16 **ppsetup, uint32 setup_count,
2513 char **ppparams, uint32 parameter_count,
2514 char **ppdata, uint32 data_count,
2515 uint32 max_data_count)
2516 {
2517 uint32 function;
2518 uint16 fidnum;
2519 files_struct *fsp;
2520 uint8 isFSctl;
2521 uint8 compfilter;
2522 static bool logged_message;
2523 char *pdata = *ppdata;
2524
2525 if (setup_count != 8) {
2526 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2527 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2528 return;
2529 }
2530
2531 function = IVAL(*ppsetup, 0);
2532 fidnum = SVAL(*ppsetup, 4);
2533 isFSctl = CVAL(*ppsetup, 6);
2534 compfilter = CVAL(*ppsetup, 7);
2535
2536 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2537 function, fidnum, isFSctl, compfilter));
2538
2539 fsp=file_fsp(fidnum);
2540 /* this check is done in each implemented function case for now
2541 because I don't want to break anything... --metze
2542 FSP_BELONGS_CONN(fsp,conn);*/
2543
2544 switch (function) {
2545 case FSCTL_SET_SPARSE:
2546 /* pretend this succeeded - tho strictly we should
2547 mark the file sparse (if the local fs supports it)
2548 so we can know if we need to pre-allocate or not */
2549
2550 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2551 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2552 return;
2553
2554 case FSCTL_CREATE_OR_GET_OBJECT_ID:
2555 {
2556 unsigned char objid[16];
2557
2558 /* This should return the object-id on this file.
2559 * I think I'll make this be the inode+dev. JRA.
2560 */
2561
2562 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
2563
2564 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
2565 return;
2566 }
2567
2568 data_count = 64;
2569 pdata = nttrans_realloc(ppdata, data_count);
2570 if (pdata == NULL) {
2571 reply_nterror(req, NT_STATUS_NO_MEMORY);
2572 return;
2573 }
2574 push_file_id_16(pdata, &fsp->file_id);
2575 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
2576 push_file_id_16(pdata+32, &fsp->file_id);
2577 send_nt_replies(req, NT_STATUS_OK, NULL, 0,
2578 pdata, data_count);
2579 return;
2580 }
2581
2582 case FSCTL_GET_REPARSE_POINT:
2583 /* pretend this fail - my winXP does it like this
2584 * --metze
2585 */
2586
2587 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2588 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2589 return;
2590
2591 case FSCTL_SET_REPARSE_POINT:
2592 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2593 * --metze
2594 */
2595
2596 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2597 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2598 return;
2599
2600 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2601 {
2602 /*
2603 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2604 * and return their volume names. If max_data_count is 16, then it is just
2605 * asking for the number of volumes and length of the combined names.
2606 *
2607 * pdata is the data allocated by our caller, but that uses
2608 * total_data_count (which is 0 in our case) rather than max_data_count.
2609 * Allocate the correct amount and return the pointer to let
2610 * it be deallocated when we return.
2611 */
2612 SHADOW_COPY_DATA *shadow_data = NULL;
2613 TALLOC_CTX *shadow_mem_ctx = NULL;
2614 bool labels = False;
2615 uint32 labels_data_count = 0;
2616 uint32 i;
2617 char *cur_pdata;
2618
2619 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
2620 return;
2621 }
2622
2623 if (max_data_count < 16) {
2624 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2625 max_data_count));
2626 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2627 return;
2628 }
2629
2630 if (max_data_count > 16) {
2631 labels = True;
2632 }
2633
2634 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2635 if (shadow_mem_ctx == NULL) {
2636 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2637 reply_nterror(req, NT_STATUS_NO_MEMORY);
2638 return;
2639 }
2640
2641 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2642 if (shadow_data == NULL) {
2643 DEBUG(0,("TALLOC_ZERO() failed!\n"));
2644 talloc_destroy(shadow_mem_ctx);
2645 reply_nterror(req, NT_STATUS_NO_MEMORY);
2646 return;
2647 }
2648
2649 shadow_data->mem_ctx = shadow_mem_ctx;
2650
2651 /*
2652 * Call the VFS routine to actually do the work.
2653 */
2654 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2655 talloc_destroy(shadow_data->mem_ctx);
2656 if (errno == ENOSYS) {
2657 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2658 conn->connectpath));
2659 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2660 return;
2661 } else {
2662 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2663 conn->connectpath));
2664 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
2665 return;
2666 }
2667 }
2668
2669 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2670
2671 if (!labels) {
2672 data_count = 16;
2673 } else {
2674 data_count = 12+labels_data_count+4;
2675 }
2676
2677 if (max_data_count<data_count) {
2678 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2679 max_data_count,data_count));
2680 talloc_destroy(shadow_data->mem_ctx);
2681 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2682 return;
2683 }
2684
2685 pdata = nttrans_realloc(ppdata, data_count);
2686 if (pdata == NULL) {
2687 talloc_destroy(shadow_data->mem_ctx);
2688 reply_nterror(req, NT_STATUS_NO_MEMORY);
2689 return;
2690 }
2691
2692 cur_pdata = pdata;
2693
2694 /* num_volumes 4 bytes */
2695 SIVAL(pdata,0,shadow_data->num_volumes);
2696
2697 if (labels) {
2698 /* num_labels 4 bytes */
2699 SIVAL(pdata,4,shadow_data->num_volumes);
2700 }
2701
2702 /* needed_data_count 4 bytes */
2703 SIVAL(pdata,8,labels_data_count);
2704
2705 cur_pdata+=12;
2706
2707 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2708 shadow_data->num_volumes,fsp->fsp_name));
2709 if (labels && shadow_data->labels) {
2710 for (i=0;i<shadow_data->num_volumes;i++) {
2711 srvstr_push(pdata, req->flags2,
2712 cur_pdata, shadow_data->labels[i],
2713 2*sizeof(SHADOW_COPY_LABEL),
2714 STR_UNICODE|STR_TERMINATE);
2715 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2716 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2717 }
2718 }
2719
2720 talloc_destroy(shadow_data->mem_ctx);
2721
2722 send_nt_replies(req, NT_STATUS_OK, NULL, 0,
2723 pdata, data_count);
2724
2725 return;
2726 }
2727
2728 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2729 {
2730 /* pretend this succeeded -
2731 *
2732 * we have to send back a list with all files owned by this SID
2733 *
2734 * but I have to check that --metze
2735 */
2736 DOM_SID sid;
2737 uid_t uid;
2738 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2739
2740 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2741
2742 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
2743 return;
2744 }
2745
2746 /* unknown 4 bytes: this is not the length of the sid :-( */
2747 /*unknown = IVAL(pdata,0);*/
2748
2749 sid_parse(pdata+4,sid_len,&sid);
2750 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2751
2752 if (!sid_to_uid(&sid, &uid)) {
2753 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2754 sid_string_static(&sid),(unsigned long)sid_len));
2755 uid = (-1);
2756 }
2757
2758 /* we can take a look at the find source :-)
2759 *
2760 * find ./ -uid $uid -name '*' is what we need here
2761 *
2762 *
2763 * and send 4bytes len and then NULL terminated unicode strings
2764 * for each file
2765 *
2766 * but I don't know how to deal with the paged results
2767 * (maybe we can hang the result anywhere in the fsp struct)
2768 *
2769 * we don't send all files at once
2770 * and at the next we should *not* start from the beginning,
2771 * so we have to cache the result
2772 *
2773 * --metze
2774 */
2775
2776 /* this works for now... */
2777 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2778 return;
2779 }
2780 default:
2781 if (!logged_message) {
2782 logged_message = True; /* Only print this once... */
2783 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2784 function));
2785 }
2786 }
2787
2788 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2789 }
2790
2791
2792 #ifdef HAVE_SYS_QUOTAS
2793 /****************************************************************************
2794 Reply to get user quota
2795 ****************************************************************************/
2796
2797 static void call_nt_transact_get_user_quota(connection_struct *conn,
2798 struct smb_request *req,
2799 uint16 **ppsetup,
2800 uint32 setup_count,
2801 char **ppparams,
2802 uint32 parameter_count,
2803 char **ppdata,
2804 uint32 data_count,
2805 uint32 max_data_count)
2806 {
2807 NTSTATUS nt_status = NT_STATUS_OK;
2808 char *params = *ppparams;
2809 char *pdata = *ppdata;
2810 char *entry;
2811 int data_len=0,param_len=0;
2812 int qt_len=0;
2813 int entry_len = 0;
2814 files_struct *fsp = NULL;
2815 uint16 level = 0;
2816 size_t sid_len;
2817 DOM_SID sid;
2818 bool start_enum = True;
2819 SMB_NTQUOTA_STRUCT qt;
2820 SMB_NTQUOTA_LIST *tmp_list;
2821 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2822
2823 ZERO_STRUCT(qt);
2824
2825 /* access check */
2826 if (current_user.ut.uid != 0) {
2827 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2828 lp_servicename(SNUM(conn)),conn->user));
2829 reply_doserror(req, ERRDOS, ERRnoaccess);
2830 return;
2831 }
2832
2833 /*
2834 * Ensure minimum number of parameters sent.
2835 */
2836
2837 if (parameter_count < 4) {
2838 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2839 reply_doserror(req, ERRDOS, ERRinvalidparam);
2840 return;
2841 }
2842
2843 /* maybe we can check the quota_fnum */
2844 fsp = file_fsp(SVAL(params,0));
2845 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2846 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2847 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2848 return;
2849 }
2850
2851 /* the NULL pointer checking for fsp->fake_file_handle->pd
2852 * is done by CHECK_NTQUOTA_HANDLE_OK()
2853 */
2854 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2855
2856 level = SVAL(params,2);
2857
2858 /* unknown 12 bytes leading in params */
2859
2860 switch (level) {
2861 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2862 /* seems that we should continue with the enum here --metze */
2863
2864 if (qt_handle->quota_list!=NULL &&
2865 qt_handle->tmp_list==NULL) {
2866
2867 /* free the list */
2868 free_ntquota_list(&(qt_handle->quota_list));
2869
2870 /* Realloc the size of parameters and data we will return */
2871 param_len = 4;
2872 params = nttrans_realloc(ppparams, param_len);
2873 if(params == NULL) {
2874 reply_doserror(req, ERRDOS, ERRnomem);
2875 return;
2876 }
2877
2878 data_len = 0;
2879 SIVAL(params,0,data_len);
2880
2881 break;
2882 }
2883
2884 start_enum = False;
2885
2886 case TRANSACT_GET_USER_QUOTA_LIST_START:
2887
2888 if (qt_handle->quota_list==NULL &&
2889 qt_handle->tmp_list==NULL) {
2890 start_enum = True;
2891 }
2892
2893 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2894 reply_doserror(req, ERRSRV, ERRerror);
2895 return;
2896 }
2897
2898 /* Realloc the size of parameters and data we will return */
2899 param_len = 4;
2900 params = nttrans_realloc(ppparams, param_len);
2901 if(params == NULL) {
2902 reply_doserror(req, ERRDOS, ERRnomem);
2903 return;
2904 }
2905
2906 /* we should not trust the value in max_data_count*/
2907 max_data_count = MIN(max_data_count,2048);
2908
2909 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2910 if(pdata == NULL) {
2911 reply_doserror(req, ERRDOS, ERRnomem);
2912 return;
2913 }
2914
2915 entry = pdata;
2916
2917 /* set params Size of returned Quota Data 4 bytes*/
2918 /* but set it later when we know it */
2919
2920 /* for each entry push the data */
2921
2922 if (start_enum) {
2923 qt_handle->tmp_list = qt_handle->quota_list;
2924 }
2925
2926 tmp_list = qt_handle->tmp_list;
2927
2928 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2929 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2930
2931 sid_len = sid_size(&tmp_list->quotas->sid);
2932 entry_len = 40 + sid_len;
2933
2934 /* nextoffset entry 4 bytes */
2935 SIVAL(entry,0,entry_len);
2936
2937 /* then the len of the SID 4 bytes */
2938 SIVAL(entry,4,sid_len);
2939
2940 /* unknown data 8 bytes SMB_BIG_UINT */
2941 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2942
2943 /* the used disk space 8 bytes SMB_BIG_UINT */
2944 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2945
2946 /* the soft quotas 8 bytes SMB_BIG_UINT */
2947 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2948
2949 /* the hard quotas 8 bytes SMB_BIG_UINT */
2950 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2951
2952 /* and now the SID */
2953 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2954 }
2955
2956 qt_handle->tmp_list = tmp_list;
2957
2958 /* overwrite the offset of the last entry */
2959 SIVAL(entry-entry_len,0,0);
2960
2961 data_len = 4+qt_len;
2962 /* overwrite the params quota_data_len */
2963 SIVAL(params,0,data_len);
2964
2965 break;
2966
2967 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2968
2969 /* unknown 4 bytes IVAL(pdata,0) */
2970
2971 if (data_count < 8) {
2972 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2973 reply_doserror(req, ERRDOS, ERRunknownlevel);
2974 return;
2975 }
2976
2977 sid_len = IVAL(pdata,4);
2978 /* Ensure this is less than 1mb. */
2979 if (sid_len > (1024*1024)) {
2980 reply_doserror(req, ERRDOS, ERRnomem);
2981 return;
2982 }
2983
2984 if (data_count < 8+sid_len) {
2985 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2986 reply_doserror(req, ERRDOS, ERRunknownlevel);
2987 return;
2988 }
2989
2990 data_len = 4+40+sid_len;
2991
2992 if (max_data_count < data_len) {
2993 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2994 max_data_count, data_len));
2995 param_len = 4;
2996 SIVAL(params,0,data_len);
2997 data_len = 0;
2998 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2999 break;
3000 }
3001
3002 sid_parse(pdata+8,sid_len,&sid);
3003
3004 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
3005 ZERO_STRUCT(qt);
3006 /*
3007 * we have to return zero's in all fields
3008 * instead of returning an error here
3009 * --metze
3010 */
3011 }
3012
3013 /* Realloc the size of parameters and data we will return */
3014 param_len = 4;
3015 params = nttrans_realloc(ppparams, param_len);
3016 if(params == NULL) {
3017 reply_doserror(req, ERRDOS, ERRnomem);
3018 return;
3019 }
3020
3021 pdata = nttrans_realloc(ppdata, data_len);
3022 if(pdata == NULL) {
3023 reply_doserror(req, ERRDOS, ERRnomem);
3024 return;
3025 }
3026
3027 entry = pdata;
3028
3029 /* set params Size of returned Quota Data 4 bytes*/
3030 SIVAL(params,0,data_len);
3031
3032 /* nextoffset entry 4 bytes */
3033 SIVAL(entry,0,0);
3034
3035 /* then the len of the SID 4 bytes */
3036 SIVAL(entry,4,sid_len);
3037
3038 /* unknown data 8 bytes SMB_BIG_UINT */
3039 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
3040
3041 /* the used disk space 8 bytes SMB_BIG_UINT */
3042 SBIG_UINT(entry,16,qt.usedspace);
3043
3044 /* the soft quotas 8 bytes SMB_BIG_UINT */
3045 SBIG_UINT(entry,24,qt.softlim);
3046
3047 /* the hard quotas 8 bytes SMB_BIG_UINT */
3048 SBIG_UINT(entry,32,qt.hardlim);
3049
3050 /* and now the SID */
3051 sid_linearize(entry+40, sid_len, &sid);
3052
3053 break;
3054
3055 default:
3056 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
3057 reply_doserror(req, ERRSRV, ERRerror);
3058 return;
3059 break;
3060 }
3061
3062 send_nt_replies(req, nt_status, params, param_len,
3063 pdata, data_len);
3064 }
3065
3066 /****************************************************************************
3067 Reply to set user quota
3068 ****************************************************************************/
3069
3070 static void call_nt_transact_set_user_quota(connection_struct *conn,
3071 struct smb_request *req,
3072 uint16 **ppsetup,
3073 uint32 setup_count,
3074 char **ppparams,
3075 uint32 parameter_count,
3076 char **ppdata,
3077 uint32 data_count,
3078 uint32 max_data_count)
3079 {
3080 char *params = *ppparams;
3081 char *pdata = *ppdata;
3082 int data_len=0,param_len=0;
3083 SMB_NTQUOTA_STRUCT qt;
3084 size_t sid_len;
3085 DOM_SID sid;
3086 files_struct *fsp = NULL;
3087
3088 ZERO_STRUCT(qt);
3089
3090 /* access check */
3091 if (current_user.ut.uid != 0) {
3092 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
3093 lp_servicename(SNUM(conn)),conn->user));
3094 reply_doserror(req, ERRDOS, ERRnoaccess);
3095 return;
3096 }
3097
3098 /*
3099 * Ensure minimum number of parameters sent.
3100 */
3101
3102 if (parameter_count < 2) {
3103 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
3104 reply_doserror(req, ERRDOS, ERRinvalidparam);
3105 return;
3106 }
3107
3108 /* maybe we can check the quota_fnum */
3109 fsp = file_fsp(SVAL(params,0));
3110 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
3111 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
3112 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
3113 return;
3114 }
3115
3116 if (data_count < 40) {
3117 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
3118 reply_doserror(req, ERRDOS, ERRunknownlevel);
3119 return;
3120 }
3121
3122 /* offset to next quota record.
3123 * 4 bytes IVAL(pdata,0)
3124 * unused here...
3125 */
3126
3127 /* sid len */
3128 sid_len = IVAL(pdata,4);
3129
3130 if (data_count < 40+sid_len) {
3131 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
3132 reply_doserror(req, ERRDOS, ERRunknownlevel);
3133 return;
3134 }
3135
3136 /* unknown 8 bytes in pdata
3137 * maybe its the change time in NTTIME
3138 */
3139
3140 /* the used space 8 bytes (SMB_BIG_UINT)*/
3141 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
3142 #ifdef LARGE_SMB_OFF_T
3143 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
3144 #else /* LARGE_SMB_OFF_T */
3145 if ((IVAL(pdata,20) != 0)&&
3146 ((qt.usedspace != 0xFFFFFFFF)||
3147 (IVAL(pdata,20)!=0xFFFFFFFF))) {
3148 /* more than 32 bits? */
3149 reply_doserror(req, ERRDOS, ERRunknownlevel);
3150 return;
3151 }
3152 #endif /* LARGE_SMB_OFF_T */
3153
3154 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
3155 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
3156 #ifdef LARGE_SMB_OFF_T
3157 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
3158 #else /* LARGE_SMB_OFF_T */
3159 if ((IVAL(pdata,28) != 0)&&
3160 ((qt.softlim != 0xFFFFFFFF)||
3161 (IVAL(pdata,28)!=0xFFFFFFFF))) {
3162 /* more than 32 bits? */
3163 reply_doserror(req, ERRDOS, ERRunknownlevel);
3164 return;
3165 }
3166 #endif /* LARGE_SMB_OFF_T */
3167
3168 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
3169 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
3170 #ifdef LARGE_SMB_OFF_T
3171 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
3172 #else /* LARGE_SMB_OFF_T */
3173 if ((IVAL(pdata,36) != 0)&&
3174 ((qt.hardlim != 0xFFFFFFFF)||
3175 (IVAL(pdata,36)!=0xFFFFFFFF))) {
3176 /* more than 32 bits? */
3177 reply_doserror(req, ERRDOS, ERRunknownlevel);
3178 return;
3179 }
3180 #endif /* LARGE_SMB_OFF_T */
3181
3182 sid_parse(pdata+40,sid_len,&sid);
3183 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
3184
3185 /* 44 unknown bytes left... */
3186
3187 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
3188 reply_doserror(req, ERRSRV, ERRerror);
3189 return;
3190 }
3191
3192 send_nt_replies(req, NT_STATUS_OK, params, param_len,
3193 pdata, data_len);
3194 }
3195 #endif /* HAVE_SYS_QUOTAS */
3196
3197 static void handle_nttrans(connection_struct *conn,
3198 struct trans_state *state,
3199 struct smb_request *req)
3200 {
3201 if (Protocol >= PROTOCOL_NT1) {
3202 req->flags2 |= 0x40; /* IS_LONG_NAME */
3203 SSVAL(req->inbuf,smb_flg2,req->flags2);
3204 }
3205
3206 /* Now we must call the relevant NT_TRANS function */
3207 switch(state->call) {
3208 case NT_TRANSACT_CREATE:
3209 {
3210 START_PROFILE(NT_transact_create);
3211 call_nt_transact_create(
3212 conn, req,
3213 &state->setup, state->setup_count,
3214 &state->param, state->total_param,
3215 &state->data, state->total_data,
3216 state->max_data_return);
3217 END_PROFILE(NT_transact_create);
3218 break;
3219 }
3220
3221 case NT_TRANSACT_IOCTL:
3222 {
3223 START_PROFILE(NT_transact_ioctl);
3224 call_nt_transact_ioctl(
3225 conn, req,
3226 &state->setup, state->setup_count,
3227 &state->param, state->total_param,
3228 &state->data, state->total_data,
3229 state->max_data_return);
3230 END_PROFILE(NT_transact_ioctl);
3231 break;
3232 }
3233
3234 case NT_TRANSACT_SET_SECURITY_DESC:
3235 {
3236 START_PROFILE(NT_transact_set_security_desc);
3237 call_nt_transact_set_security_desc(
3238 conn, req,
3239 &state->setup, state->setup_count,
3240 &state->param, state->total_param,
3241 &state->data, state->total_data,
3242 state->max_data_return);
3243 END_PROFILE(NT_transact_set_security_desc);
3244 break;
3245 }
3246
3247 case NT_TRANSACT_NOTIFY_CHANGE:
3248 {
3249 START_PROFILE(NT_transact_notify_change);
3250 call_nt_transact_notify_change(
3251 conn, req,
3252 &state->setup, state->setup_count,
3253 &state->param, state->total_param,
3254 &state->data, state->total_data,
3255 state->max_data_return,
3256 state->max_param_return);
3257 END_PROFILE(NT_transact_notify_change);
3258 break;
3259 }
3260
3261 case NT_TRANSACT_RENAME:
3262 {
3263 START_PROFILE(NT_transact_rename);
3264 call_nt_transact_rename(
3265 conn, req,
3266 &state->setup, state->setup_count,
3267 &state->param, state->total_param,
3268 &state->data, state->total_data,
3269 state->max_data_return);
3270 END_PROFILE(NT_transact_rename);
3271 break;
3272 }
3273
3274 case NT_TRANSACT_QUERY_SECURITY_DESC:
3275 {
3276 START_PROFILE(NT_transact_query_security_desc);
3277 call_nt_transact_query_security_desc(
3278 conn, req,
3279 &state->setup, state->setup_count,
3280 &state->param, state->total_param,
3281 &state->data, state->total_data,
3282 state->max_data_return);
3283 END_PROFILE(NT_transact_query_security_desc);
3284 break;
3285 }
3286
3287 #ifdef HAVE_SYS_QUOTAS
3288 case NT_TRANSACT_GET_USER_QUOTA:
3289 {
3290 START_PROFILE(NT_transact_get_user_quota);
3291 call_nt_transact_get_user_quota(
3292 conn, req,
3293 &state->setup, state->setup_count,
3294 &state->param, state->total_param,
3295 &state->data, state->total_data,
3296 state->max_data_return);
3297 END_PROFILE(NT_transact_get_user_quota);
3298 break;
3299 }
3300
3301 case NT_TRANSACT_SET_USER_QUOTA:
3302 {
3303 START_PROFILE(NT_transact_set_user_quota);
3304 call_nt_transact_set_user_quota(
3305 conn, req,
3306 &state->setup, state->setup_count,
3307 &state->param, state->total_param,
3308 &state->data, state->total_data,
3309 state->max_data_return);
3310 END_PROFILE(NT_transact_set_user_quota);
3311 break;
3312 }
3313 #endif /* HAVE_SYS_QUOTAS */
3314
3315 default:
3316 /* Error in request */
3317 DEBUG(0,("handle_nttrans: Unknown request %d in "
3318 "nttrans call\n", state->call));
3319 reply_doserror(req, ERRSRV, ERRerror);
3320 return;
3321 }
3322 return;
3323 }
3324
3325 /****************************************************************************
3326 Reply to a SMBNTtrans.
3327 ****************************************************************************/
3328
3329 void reply_nttrans(connection_struct *conn, struct smb_request *req)
3330 {
3331 uint32 pscnt;
3332 uint32 psoff;
3333 uint32 dscnt;
3334 uint32 dsoff;
3335 uint16 function_code;
3336 NTSTATUS result;
3337 struct trans_state *state;
3338 int size;
3339
3340 START_PROFILE(SMBnttrans);
3341
3342 if (req->wct < 19) {
3343 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3344 END_PROFILE(SMBnttrans);
3345 return;
3346 }
3347
3348 size = smb_len(req->inbuf) + 4;
3349 pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
3350 psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
3351 dscnt = IVAL(req->inbuf,smb_nt_DataCount);
3352 dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
3353 function_code = SVAL(req->inbuf, smb_nt_Function);
3354
3355 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
3356 reply_doserror(req, ERRSRV, ERRaccess);
3357 END_PROFILE(SMBnttrans);
3358 return;
3359 }
3360
3361 result = allow_new_trans(conn->pending_trans, req->mid);
3362 if (!NT_STATUS_IS_OK(result)) {
3363 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
3364 reply_nterror(req, result);
3365 END_PROFILE(SMBnttrans);
3366 return;
3367 }
3368
3369 if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
3370 reply_doserror(req, ERRSRV, ERRaccess);
3371 END_PROFILE(SMBnttrans);
3372 return;
3373 }
3374
3375 state->cmd = SMBnttrans;
3376
3377 state->mid = req->mid;
3378 state->vuid = req->vuid;
3379 state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
3380 state->data = NULL;
3381 state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
3382 state->param = NULL;
3383 state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
3384 state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
3385
3386 /* setup count is in *words* */
3387 state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
3388 state->setup = NULL;
3389 state->call = function_code;
3390
3391 /*
3392 * All nttrans messages we handle have smb_wct == 19 +
3393 * state->setup_count. Ensure this is so as a sanity check.
3394 */
3395
3396 if(req->wct != 19 + (state->setup_count/2)) {
3397 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3398 req->wct, 19 + (state->setup_count/2)));
3399 goto bad_param;
3400 }
3401
3402 /* Don't allow more than 128mb for each value. */
3403 if ((state->total_data > (1024*1024*128)) ||
3404 (state->total_param > (1024*1024*128))) {
3405 reply_doserror(req, ERRDOS, ERRnomem);
3406 END_PROFILE(SMBnttrans);
3407 return;
3408 }
3409
3410 if ((dscnt > state->total_data) || (pscnt > state->total_param))
3411 goto bad_param;
3412
3413 if (state->total_data) {
3414 /* Can't use talloc here, the core routines do realloc on the
3415 * params and data. */
3416 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3417 DEBUG(0,("reply_nttrans: data malloc fail for %u "
3418 "bytes !\n", (unsigned int)state->total_data));
3419 TALLOC_FREE(state);
3420 reply_doserror(req, ERRDOS, ERRnomem);
3421 END_PROFILE(SMBnttrans);
3422 return;
3423 }
3424 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
3425 goto bad_param;
3426 if ((smb_base(req->inbuf)+dsoff+dscnt
3427 > (char *)req->inbuf + size) ||
3428 (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
3429 goto bad_param;
3430
3431 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
3432 }
3433
3434 if (state->total_param) {
3435 /* Can't use talloc here, the core routines do realloc on the
3436 * params and data. */
3437 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3438 DEBUG(0,("reply_nttrans: param malloc fail for %u "
3439 "bytes !\n", (unsigned int)state->total_param));
3440 SAFE_FREE(state->data);
3441 TALLOC_FREE(state);
3442 reply_doserror(req, ERRDOS, ERRnomem);
3443 END_PROFILE(SMBnttrans);
3444 return;
3445 }
3446 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
3447 goto bad_param;
3448 if ((smb_base(req->inbuf)+psoff+pscnt
3449 > (char *)req->inbuf + size) ||
3450 (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
3451 goto bad_param;
3452
3453 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
3454 }
3455
3456 state->received_data = dscnt;
3457 state->received_param = pscnt;
3458
3459 if(state->setup_count > 0) {
3460 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3461 state->setup_count));
3462 state->setup = (uint16 *)TALLOC(state, state->setup_count);
3463 if (state->setup == NULL) {
3464 DEBUG(0,("reply_nttrans : Out of memory\n"));
3465 SAFE_FREE(state->data);
3466 SAFE_FREE(state->param);
3467 TALLOC_FREE(state);
3468 reply_doserror(req, ERRDOS, ERRnomem);
3469 END_PROFILE(SMBnttrans);
3470 return;
3471 }
3472
3473 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
3474 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3475 goto bad_param;
3476 }
3477 if (smb_nt_SetupStart + state->setup_count > size) {
3478 goto bad_param;
3479 }
3480
3481 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
3482 state->setup_count);
3483 dump_data(10, (uint8 *)state->setup, state->setup_count);
3484 }
3485
3486 if ((state->received_data == state->total_data) &&
3487 (state->received_param == state->total_param)) {
3488 handle_nttrans(conn, state, req);
3489 SAFE_FREE(state->param);
3490 SAFE_FREE(state->data);
3491 TALLOC_FREE(state);
3492 END_PROFILE(SMBnttrans);
3493 return;
3494 }
3495
3496 DLIST_ADD(conn->pending_trans, state);
3497
3498 /* We need to send an interim response then receive the rest
3499 of the parameter/data bytes */
3500 reply_outbuf(req, 0, 0);
3501 show_msg((char *)req->outbuf);
3502 END_PROFILE(SMBnttrans);
3503 return;
3504
3505 bad_param:
3506
3507 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3508 SAFE_FREE(state->data);
3509 SAFE_FREE(state->param);
3510 TALLOC_FREE(state);
3511 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3512 END_PROFILE(SMBnttrans);
3513 return;
3514 }
3515
3516 /****************************************************************************
3517 Reply to a SMBnttranss
3518 ****************************************************************************/
3519
3520 void reply_nttranss(connection_struct *conn, struct smb_request *req)
3521 {
3522 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3523 struct trans_state *state;
3524
3525 int size;
3526
3527 START_PROFILE(SMBnttranss);
3528
3529 show_msg((char *)req->inbuf);
3530
3531 if (req->wct < 18) {
3532 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3533 END_PROFILE(SMBnttranss);
3534 return;
3535 }
3536
3537 for (state = conn->pending_trans; state != NULL;
3538 state = state->next) {
3539 if (state->mid == req->mid) {
3540 break;
3541 }
3542 }
3543
3544 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3545 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3546 END_PROFILE(SMBnttranss);
3547 return;
3548 }
3549
3550 /* Revise state->total_param and state->total_data in case they have
3551 changed downwards */
3552 if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
3553 < state->total_param) {
3554 state->total_param = IVAL(req->inbuf,
3555 smb_nts_TotalParameterCount);
3556 }
3557 if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
3558 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
3559 }
3560
3561 size = smb_len(req->inbuf) + 4;
3562
3563 pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
3564 poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
3565 pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
3566
3567 dcnt = IVAL(req->inbuf, smb_nts_DataCount);
3568 ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
3569 doff = IVAL(req->inbuf, smb_nts_DataOffset);
3570
3571 state->received_param += pcnt;
3572 state->received_data += dcnt;
3573
3574 if ((state->received_data > state->total_data) ||
3575 (state->received_param > state->total_param))
3576 goto bad_param;
3577
3578 if (pcnt) {
3579 if (pdisp+pcnt > state->total_param)
3580 goto bad_param;
3581 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3582 goto bad_param;
3583 if (pdisp > state->total_param)
3584 goto bad_param;
3585 if ((smb_base(req->inbuf) + poff + pcnt
3586 > (char *)req->inbuf + size) ||
3587 (smb_base(req->inbuf) + poff + pcnt
3588 < smb_base(req->inbuf)))
3589 goto bad_param;
3590 if (state->param + pdisp < state->param)
3591 goto bad_param;
3592
3593 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
3594 pcnt);
3595 }
3596
3597 if (dcnt) {
3598 if (ddisp+dcnt > state->total_data)
3599 goto bad_param;
3600 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3601 goto bad_param;
3602 if (ddisp > state->total_data)
3603 goto bad_param;
3604 if ((smb_base(req->inbuf) + doff + dcnt
3605 > (char *)req->inbuf + size) ||
3606 (smb_base(req->inbuf) + doff + dcnt
3607 < smb_base(req->inbuf)))
3608 goto bad_param;
3609 if (state->data + ddisp < state->data)
3610 goto bad_param;
3611
3612 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
3613 dcnt);
3614 }
3615
3616 if ((state->received_param < state->total_param) ||
3617 (state->received_data < state->total_data)) {
3618 END_PROFILE(SMBnttranss);
3619 return;
3620 }
3621
3622 /*
3623 * construct_reply_common will copy smb_com from inbuf to
3624 * outbuf. SMBnttranss is wrong here.
3625 */
3626 SCVAL(req->inbuf,smb_com,SMBnttrans);
3627
3628 handle_nttrans(conn, state, req);
3629
3630 DLIST_REMOVE(conn->pending_trans, state);
3631 SAFE_FREE(state->data);
3632 SAFE_FREE(state->param);
3633 TALLOC_FREE(state);
3634 END_PROFILE(SMBnttranss);
3635 return;
3636
3637 bad_param:
3638
3639 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3640 DLIST_REMOVE(conn->pending_trans, state);
3641 SAFE_FREE(state->data);
3642 SAFE_FREE(state->param);
3643 TALLOC_FREE(state);
3644 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3645 END_PROFILE(SMBnttranss);
3646 return;
3647 }