?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd/conn_msg: pass smbd_server_connection as private_data to msg_force_tdis()
[Samba/vl.git] / source3 / smbd / reply.c
bloba06e7b83391c0700fc192922450fb52898ebfa23
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44
45 /****************************************************************************
46 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
47 path or anything including wildcards.
48 We're assuming here that '/' is not the second byte in any multibyte char
49 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
50 set.
51 ****************************************************************************/
52
53 /* Custom version for processing POSIX paths. */
54 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
55
56 static NTSTATUS check_path_syntax_internal(char *path,
57 bool posix_path,
58 bool *p_last_component_contains_wcard)
59 {
60 char *d = path;
61 const char *s = path;
62 NTSTATUS ret = NT_STATUS_OK;
63 bool start_of_name_component = True;
64 bool stream_started = false;
65
66 *p_last_component_contains_wcard = False;
67
68 while (*s) {
69 if (stream_started) {
70 switch (*s) {
71 case '/':
72 case '\\':
73 return NT_STATUS_OBJECT_NAME_INVALID;
74 case ':':
75 if (s[1] == '\0') {
76 return NT_STATUS_OBJECT_NAME_INVALID;
77 }
78 if (strchr_m(&s[1], ':')) {
79 return NT_STATUS_OBJECT_NAME_INVALID;
80 }
81 break;
82 }
83 }
84
85 if ((*s == ':') && !posix_path && !stream_started) {
86 if (*p_last_component_contains_wcard) {
87 return NT_STATUS_OBJECT_NAME_INVALID;
88 }
89 /* Stream names allow more characters than file names.
90 We're overloading posix_path here to allow a wider
91 range of characters. If stream_started is true this
92 is still a Windows path even if posix_path is true.
93 JRA.
94 */
95 stream_started = true;
96 start_of_name_component = false;
97 posix_path = true;
98
99 if (s[1] == '\0') {
100 return NT_STATUS_OBJECT_NAME_INVALID;
101 }
102 }
103
104 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
105 /*
106 * Safe to assume is not the second part of a mb char
107 * as this is handled below.
108 */
109 /* Eat multiple '/' or '\\' */
110 while (IS_PATH_SEP(*s,posix_path)) {
111 s++;
112 }
113 if ((d != path) && (*s != '\0')) {
114 /* We only care about non-leading or trailing '/' or '\\' */
115 *d++ = '/';
116 }
117
118 start_of_name_component = True;
119 /* New component. */
120 *p_last_component_contains_wcard = False;
121 continue;
122 }
123
124 if (start_of_name_component) {
125 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
126 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
127
128 /*
129 * No mb char starts with '.' so we're safe checking the directory separator here.
130 */
131
132 /* If we just added a '/' - delete it */
133 if ((d > path) && (*(d-1) == '/')) {
134 *(d-1) = '\0';
135 d--;
136 }
137
138 /* Are we at the start ? Can't go back further if so. */
139 if (d <= path) {
140 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
141 break;
142 }
143 /* Go back one level... */
144 /* We know this is safe as '/' cannot be part of a mb sequence. */
145 /* NOTE - if this assumption is invalid we are not in good shape... */
146 /* Decrement d first as d points to the *next* char to write into. */
147 for (d--; d > path; d--) {
148 if (*d == '/')
149 break;
150 }
151 s += 2; /* Else go past the .. */
152 /* We're still at the start of a name component, just the previous one. */
153 continue;
154
155 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
156 if (posix_path) {
157 /* Eat the '.' */
158 s++;
159 continue;
160 }
161 }
162
163 }
164
165 if (!(*s & 0x80)) {
166 if (!posix_path) {
167 if (*s <= 0x1f || *s == '|') {
168 return NT_STATUS_OBJECT_NAME_INVALID;
169 }
170 switch (*s) {
171 case '*':
172 case '?':
173 case '<':
174 case '>':
175 case '"':
176 *p_last_component_contains_wcard = True;
177 break;
178 default:
179 break;
180 }
181 }
182 *d++ = *s++;
183 } else {
184 size_t siz;
185 /* Get the size of the next MB character. */
186 next_codepoint(s,&siz);
187 switch(siz) {
188 case 5:
189 *d++ = *s++;
190 /*fall through*/
191 case 4:
192 *d++ = *s++;
193 /*fall through*/
194 case 3:
195 *d++ = *s++;
196 /*fall through*/
197 case 2:
198 *d++ = *s++;
199 /*fall through*/
200 case 1:
201 *d++ = *s++;
202 break;
203 default:
204 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
205 *d = '\0';
206 return NT_STATUS_INVALID_PARAMETER;
207 }
208 }
209 start_of_name_component = False;
210 }
211
212 *d = '\0';
213
214 return ret;
215 }
216
217 /****************************************************************************
218 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
219 No wildcards allowed.
220 ****************************************************************************/
221
222 NTSTATUS check_path_syntax(char *path)
223 {
224 bool ignore;
225 return check_path_syntax_internal(path, False, &ignore);
226 }
227
228 /****************************************************************************
229 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
230 Wildcards allowed - p_contains_wcard returns true if the last component contained
231 a wildcard.
232 ****************************************************************************/
233
234 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
235 {
236 return check_path_syntax_internal(path, False, p_contains_wcard);
237 }
238
239 /****************************************************************************
240 Check the path for a POSIX client.
241 We're assuming here that '/' is not the second byte in any multibyte char
242 set (a safe assumption).
243 ****************************************************************************/
244
245 NTSTATUS check_path_syntax_posix(char *path)
246 {
247 bool ignore;
248 return check_path_syntax_internal(path, True, &ignore);
249 }
250
251 /****************************************************************************
252 Pull a string and check the path allowing a wilcard - provide for error return.
253 ****************************************************************************/
254
255 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
256 const char *base_ptr,
257 uint16 smb_flags2,
258 char **pp_dest,
259 const char *src,
260 size_t src_len,
261 int flags,
262 NTSTATUS *err,
263 bool *contains_wcard)
264 {
265 size_t ret;
266
267 *pp_dest = NULL;
268
269 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
270 src_len, flags);
271
272 if (!*pp_dest) {
273 *err = NT_STATUS_INVALID_PARAMETER;
274 return ret;
275 }
276
277 *contains_wcard = False;
278
279 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
280 /*
281 * For a DFS path the function parse_dfs_path()
282 * will do the path processing, just make a copy.
283 */
284 *err = NT_STATUS_OK;
285 return ret;
286 }
287
288 if (lp_posix_pathnames()) {
289 *err = check_path_syntax_posix(*pp_dest);
290 } else {
291 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
292 }
293
294 return ret;
295 }
296
297 /****************************************************************************
298 Pull a string and check the path - provide for error return.
299 ****************************************************************************/
300
301 size_t srvstr_get_path(TALLOC_CTX *ctx,
302 const char *base_ptr,
303 uint16 smb_flags2,
304 char **pp_dest,
305 const char *src,
306 size_t src_len,
307 int flags,
308 NTSTATUS *err)
309 {
310 bool ignore;
311 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
312 src_len, flags, err, &ignore);
313 }
314
315 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
316 char **pp_dest, const char *src, int flags,
317 NTSTATUS *err, bool *contains_wcard)
318 {
319 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
320 pp_dest, src, smbreq_bufrem(req, src),
321 flags, err, contains_wcard);
322 }
323
324 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
325 char **pp_dest, const char *src, int flags,
326 NTSTATUS *err)
327 {
328 bool ignore;
329 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
330 flags, err, &ignore);
331 }
332
333 /****************************************************************************
334 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
335 ****************************************************************************/
336
337 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
338 files_struct *fsp)
339 {
340 if ((fsp == NULL) || (conn == NULL)) {
341 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
342 return False;
343 }
344 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
345 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
346 return False;
347 }
348 return True;
349 }
350
351 /****************************************************************************
352 Check if we have a correct fsp pointing to a file.
353 ****************************************************************************/
354
355 bool check_fsp(connection_struct *conn, struct smb_request *req,
356 files_struct *fsp)
357 {
358 if (!check_fsp_open(conn, req, fsp)) {
359 return False;
360 }
361 if (fsp->is_directory) {
362 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
363 return False;
364 }
365 if (fsp->fh->fd == -1) {
366 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
367 return False;
368 }
369 fsp->num_smb_operations++;
370 return True;
371 }
372
373 /****************************************************************************
374 Check if we have a correct fsp pointing to a quota fake file. Replacement for
375 the CHECK_NTQUOTA_HANDLE_OK macro.
376 ****************************************************************************/
377
378 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
379 files_struct *fsp)
380 {
381 if (!check_fsp_open(conn, req, fsp)) {
382 return false;
383 }
384
385 if (fsp->is_directory) {
386 return false;
387 }
388
389 if (fsp->fake_file_handle == NULL) {
390 return false;
391 }
392
393 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
394 return false;
395 }
396
397 if (fsp->fake_file_handle->private_data == NULL) {
398 return false;
399 }
400
401 return true;
402 }
403
404 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
405 const char *name, int name_type)
406 {
407 char *trim_name;
408 char *trim_name_type;
409 const char *retarget_parm;
410 char *retarget;
411 char *p;
412 int retarget_type = 0x20;
413 int retarget_port = 139;
414 struct sockaddr_storage retarget_addr;
415 struct sockaddr_in *in_addr;
416 bool ret = false;
417 uint8_t outbuf[10];
418
419 if (get_socket_port(sconn->sock) != 139) {
420 return false;
421 }
422
423 trim_name = talloc_strdup(talloc_tos(), name);
424 if (trim_name == NULL) {
425 goto fail;
426 }
427 trim_char(trim_name, ' ', ' ');
428
429 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
430 name_type);
431 if (trim_name_type == NULL) {
432 goto fail;
433 }
434
435 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
436 trim_name_type, NULL);
437 if (retarget_parm == NULL) {
438 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
439 trim_name, NULL);
440 }
441 if (retarget_parm == NULL) {
442 goto fail;
443 }
444
445 retarget = talloc_strdup(trim_name, retarget_parm);
446 if (retarget == NULL) {
447 goto fail;
448 }
449
450 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
451
452 p = strchr(retarget, ':');
453 if (p != NULL) {
454 *p++ = '\0';
455 retarget_port = atoi(p);
456 }
457
458 p = strchr_m(retarget, '#');
459 if (p != NULL) {
460 *p++ = '\0';
461 if (sscanf(p, "%x", &retarget_type) != 1) {
462 goto fail;
463 }
464 }
465
466 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
467 if (!ret) {
468 DEBUG(10, ("could not resolve %s\n", retarget));
469 goto fail;
470 }
471
472 if (retarget_addr.ss_family != AF_INET) {
473 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
474 goto fail;
475 }
476
477 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
478
479 _smb_setlen(outbuf, 6);
480 SCVAL(outbuf, 0, 0x84);
481 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
482 *(uint16_t *)(outbuf+8) = htons(retarget_port);
483
484 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
485 NULL)) {
486 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
487 "failed.");
488 }
489
490 ret = true;
491 fail:
492 TALLOC_FREE(trim_name);
493 return ret;
494 }
495
496 static void reply_called_name_not_present(char *outbuf)
497 {
498 smb_setlen(outbuf, 1);
499 SCVAL(outbuf, 0, 0x83);
500 SCVAL(outbuf, 4, 0x82);
501 }
502
503 /****************************************************************************
504 Reply to a (netbios-level) special message.
505 ****************************************************************************/
506
507 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
508 {
509 int msg_type = CVAL(inbuf,0);
510 int msg_flags = CVAL(inbuf,1);
511 /*
512 * We only really use 4 bytes of the outbuf, but for the smb_setlen
513 * calculation & friends (srv_send_smb uses that) we need the full smb
514 * header.
515 */
516 char outbuf[smb_size];
517
518 memset(outbuf, '\0', sizeof(outbuf));
519
520 smb_setlen(outbuf,0);
521
522 switch (msg_type) {
523 case NBSSrequest: /* session request */
524 {
525 /* inbuf_size is guarenteed to be at least 4. */
526 fstring name1,name2;
527 int name_type1, name_type2;
528 int name_len1, name_len2;
529
530 *name1 = *name2 = 0;
531
532 if (sconn->nbt.got_session) {
533 exit_server_cleanly("multiple session request not permitted");
534 }
535
536 SCVAL(outbuf,0,NBSSpositive);
537 SCVAL(outbuf,3,0);
538
539 /* inbuf_size is guaranteed to be at least 4. */
540 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
541 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
542 DEBUG(0,("Invalid name length in session request\n"));
543 reply_called_name_not_present(outbuf);
544 break;
545 }
546 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
547 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
548 DEBUG(0,("Invalid name length in session request\n"));
549 reply_called_name_not_present(outbuf);
550 break;
551 }
552
553 name_type1 = name_extract((unsigned char *)inbuf,
554 inbuf_size,(unsigned int)4,name1);
555 name_type2 = name_extract((unsigned char *)inbuf,
556 inbuf_size,(unsigned int)(4 + name_len1),name2);
557
558 if (name_type1 == -1 || name_type2 == -1) {
559 DEBUG(0,("Invalid name type in session request\n"));
560 reply_called_name_not_present(outbuf);
561 break;
562 }
563
564 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
565 name1, name_type1, name2, name_type2));
566
567 if (netbios_session_retarget(sconn, name1, name_type1)) {
568 exit_server_cleanly("retargeted client");
569 }
570
571 /*
572 * Windows NT/2k uses "*SMBSERVER" and XP uses
573 * "*SMBSERV" arrggg!!!
574 */
575 if (strequal(name1, "*SMBSERVER ")
576 || strequal(name1, "*SMBSERV ")) {
577 char *raddr;
578
579 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
580 talloc_tos());
581 if (raddr == NULL) {
582 exit_server_cleanly("could not allocate raddr");
583 }
584
585 fstrcpy(name1, raddr);
586 }
587
588 set_local_machine_name(name1, True);
589 set_remote_machine_name(name2, True);
590
591 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
592 get_local_machine_name(), get_remote_machine_name(),
593 name_type2));
594
595 if (name_type2 == 'R') {
596 /* We are being asked for a pathworks session ---
597 no thanks! */
598 reply_called_name_not_present(outbuf);
599 break;
600 }
601
602 /* only add the client's machine name to the list
603 of possibly valid usernames if we are operating
604 in share mode security */
605 if (lp_security() == SEC_SHARE) {
606 add_session_user(sconn, get_remote_machine_name());
607 }
608
609 reload_services(sconn->msg_ctx, sconn->sock, True);
610 reopen_logs();
611
612 sconn->nbt.got_session = true;
613 break;
614 }
615
616 case 0x89: /* session keepalive request
617 (some old clients produce this?) */
618 SCVAL(outbuf,0,NBSSkeepalive);
619 SCVAL(outbuf,3,0);
620 break;
621
622 case NBSSpositive: /* positive session response */
623 case NBSSnegative: /* negative session response */
624 case NBSSretarget: /* retarget session response */
625 DEBUG(0,("Unexpected session response\n"));
626 break;
627
628 case NBSSkeepalive: /* session keepalive */
629 default:
630 return;
631 }
632
633 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
634 msg_type, msg_flags));
635
636 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
637
638 if (CVAL(outbuf, 0) != 0x82) {
639 exit_server_cleanly("invalid netbios session");
640 }
641 return;
642 }
643
644 /****************************************************************************
645 Reply to a tcon.
646 conn POINTER CAN BE NULL HERE !
647 ****************************************************************************/
648
649 void reply_tcon(struct smb_request *req)
650 {
651 connection_struct *conn = req->conn;
652 const char *service;
653 char *service_buf = NULL;
654 char *password = NULL;
655 char *dev = NULL;
656 int pwlen=0;
657 NTSTATUS nt_status;
658 const char *p;
659 DATA_BLOB password_blob;
660 TALLOC_CTX *ctx = talloc_tos();
661 struct smbd_server_connection *sconn = req->sconn;
662
663 START_PROFILE(SMBtcon);
664
665 if (req->buflen < 4) {
666 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
667 END_PROFILE(SMBtcon);
668 return;
669 }
670
671 p = (const char *)req->buf + 1;
672 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
673 p += 1;
674 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
675 p += pwlen+1;
676 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
677 p += 1;
678
679 if (service_buf == NULL || password == NULL || dev == NULL) {
680 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
681 END_PROFILE(SMBtcon);
682 return;
683 }
684 p = strrchr_m(service_buf,'\\');
685 if (p) {
686 service = p+1;
687 } else {
688 service = service_buf;
689 }
690
691 password_blob = data_blob(password, pwlen+1);
692
693 conn = make_connection(sconn,service,password_blob,dev,
694 req->vuid,&nt_status);
695 req->conn = conn;
696
697 data_blob_clear_free(&password_blob);
698
699 if (!conn) {
700 reply_nterror(req, nt_status);
701 END_PROFILE(SMBtcon);
702 return;
703 }
704
705 reply_outbuf(req, 2, 0);
706 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
707 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
708 SSVAL(req->outbuf,smb_tid,conn->cnum);
709
710 DEBUG(3,("tcon service=%s cnum=%d\n",
711 service, conn->cnum));
712
713 END_PROFILE(SMBtcon);
714 return;
715 }
716
717 /****************************************************************************
718 Reply to a tcon and X.
719 conn POINTER CAN BE NULL HERE !
720 ****************************************************************************/
721
722 void reply_tcon_and_X(struct smb_request *req)
723 {
724 connection_struct *conn = req->conn;
725 const char *service = NULL;
726 DATA_BLOB password;
727 TALLOC_CTX *ctx = talloc_tos();
728 /* what the cleint thinks the device is */
729 char *client_devicetype = NULL;
730 /* what the server tells the client the share represents */
731 const char *server_devicetype;
732 NTSTATUS nt_status;
733 int passlen;
734 char *path = NULL;
735 const char *p, *q;
736 uint16 tcon_flags;
737 struct smbd_server_connection *sconn = req->sconn;
738
739 START_PROFILE(SMBtconX);
740
741 if (req->wct < 4) {
742 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
743 END_PROFILE(SMBtconX);
744 return;
745 }
746
747 passlen = SVAL(req->vwv+3, 0);
748 tcon_flags = SVAL(req->vwv+2, 0);
749
750 /* we might have to close an old one */
751 if ((tcon_flags & 0x1) && conn) {
752 close_cnum(conn,req->vuid);
753 req->conn = NULL;
754 conn = NULL;
755 }
756
757 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
758 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
759 END_PROFILE(SMBtconX);
760 return;
761 }
762
763 if (sconn->smb1.negprot.encrypted_passwords) {
764 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
765 if (lp_security() == SEC_SHARE) {
766 /*
767 * Security = share always has a pad byte
768 * after the password.
769 */
770 p = (const char *)req->buf + passlen + 1;
771 } else {
772 p = (const char *)req->buf + passlen;
773 }
774 } else {
775 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
776 /* Ensure correct termination */
777 password.data[passlen]=0;
778 p = (const char *)req->buf + passlen + 1;
779 }
780
781 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
782
783 if (path == NULL) {
784 data_blob_clear_free(&password);
785 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
786 END_PROFILE(SMBtconX);
787 return;
788 }
789
790 /*
791 * the service name can be either: \\server\share
792 * or share directly like on the DELL PowerVault 705
793 */
794 if (*path=='\\') {
795 q = strchr_m(path+2,'\\');
796 if (!q) {
797 data_blob_clear_free(&password);
798 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
799 END_PROFILE(SMBtconX);
800 return;
801 }
802 service = q+1;
803 } else {
804 service = path;
805 }
806
807 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
808 &client_devicetype, p,
809 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
810
811 if (client_devicetype == NULL) {
812 data_blob_clear_free(&password);
813 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
814 END_PROFILE(SMBtconX);
815 return;
816 }
817
818 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
819
820 conn = make_connection(sconn, service, password, client_devicetype,
821 req->vuid, &nt_status);
822 req->conn =conn;
823
824 data_blob_clear_free(&password);
825
826 if (!conn) {
827 reply_nterror(req, nt_status);
828 END_PROFILE(SMBtconX);
829 return;
830 }
831
832 if ( IS_IPC(conn) )
833 server_devicetype = "IPC";
834 else if ( IS_PRINT(conn) )
835 server_devicetype = "LPT1:";
836 else
837 server_devicetype = "A:";
838
839 if (get_Protocol() < PROTOCOL_NT1) {
840 reply_outbuf(req, 2, 0);
841 if (message_push_string(&req->outbuf, server_devicetype,
842 STR_TERMINATE|STR_ASCII) == -1) {
843 reply_nterror(req, NT_STATUS_NO_MEMORY);
844 END_PROFILE(SMBtconX);
845 return;
846 }
847 } else {
848 /* NT sets the fstype of IPC$ to the null string */
849 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
850
851 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
852 /* Return permissions. */
853 uint32 perm1 = 0;
854 uint32 perm2 = 0;
855
856 reply_outbuf(req, 7, 0);
857
858 if (IS_IPC(conn)) {
859 perm1 = FILE_ALL_ACCESS;
860 perm2 = FILE_ALL_ACCESS;
861 } else {
862 perm1 = conn->share_access;
863 }
864
865 SIVAL(req->outbuf, smb_vwv3, perm1);
866 SIVAL(req->outbuf, smb_vwv5, perm2);
867 } else {
868 reply_outbuf(req, 3, 0);
869 }
870
871 if ((message_push_string(&req->outbuf, server_devicetype,
872 STR_TERMINATE|STR_ASCII) == -1)
873 || (message_push_string(&req->outbuf, fstype,
874 STR_TERMINATE) == -1)) {
875 reply_nterror(req, NT_STATUS_NO_MEMORY);
876 END_PROFILE(SMBtconX);
877 return;
878 }
879
880 /* what does setting this bit do? It is set by NT4 and
881 may affect the ability to autorun mounted cdroms */
882 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
883 (lp_csc_policy(SNUM(conn)) << 2));
884
885 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
886 DEBUG(2,("Serving %s as a Dfs root\n",
887 lp_servicename(SNUM(conn)) ));
888 SSVAL(req->outbuf, smb_vwv2,
889 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
890 }
891 }
892
893
894 DEBUG(3,("tconX service=%s \n",
895 service));
896
897 /* set the incoming and outgoing tid to the just created one */
898 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
899 SSVAL(req->outbuf,smb_tid,conn->cnum);
900
901 END_PROFILE(SMBtconX);
902
903 req->tid = conn->cnum;
904 chain_reply(req);
905 return;
906 }
907
908 /****************************************************************************
909 Reply to an unknown type.
910 ****************************************************************************/
911
912 void reply_unknown_new(struct smb_request *req, uint8 type)
913 {
914 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
915 smb_fn_name(type), type, type));
916 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
917 return;
918 }
919
920 /****************************************************************************
921 Reply to an ioctl.
922 conn POINTER CAN BE NULL HERE !
923 ****************************************************************************/
924
925 void reply_ioctl(struct smb_request *req)
926 {
927 connection_struct *conn = req->conn;
928 uint16 device;
929 uint16 function;
930 uint32 ioctl_code;
931 int replysize;
932 char *p;
933
934 START_PROFILE(SMBioctl);
935
936 if (req->wct < 3) {
937 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
938 END_PROFILE(SMBioctl);
939 return;
940 }
941
942 device = SVAL(req->vwv+1, 0);
943 function = SVAL(req->vwv+2, 0);
944 ioctl_code = (device << 16) + function;
945
946 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
947
948 switch (ioctl_code) {
949 case IOCTL_QUERY_JOB_INFO:
950 replysize = 32;
951 break;
952 default:
953 reply_force_doserror(req, ERRSRV, ERRnosupport);
954 END_PROFILE(SMBioctl);
955 return;
956 }
957
958 reply_outbuf(req, 8, replysize+1);
959 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
960 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
961 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
962 p = smb_buf(req->outbuf);
963 memset(p, '\0', replysize+1); /* valgrind-safe. */
964 p += 1; /* Allow for alignment */
965
966 switch (ioctl_code) {
967 case IOCTL_QUERY_JOB_INFO:
968 {
969 files_struct *fsp = file_fsp(
970 req, SVAL(req->vwv+0, 0));
971 if (!fsp) {
972 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
973 END_PROFILE(SMBioctl);
974 return;
975 }
976 /* Job number */
977 if (fsp->print_file) {
978 SSVAL(p, 0, fsp->print_file->rap_jobid);
979 } else {
980 SSVAL(p, 0, 0);
981 }
982 srvstr_push((char *)req->outbuf, req->flags2, p+2,
983 lp_netbios_name(), 15,
984 STR_TERMINATE|STR_ASCII);
985 if (conn) {
986 srvstr_push((char *)req->outbuf, req->flags2,
987 p+18, lp_servicename(SNUM(conn)),
988 13, STR_TERMINATE|STR_ASCII);
989 } else {
990 memset(p+18, 0, 13);
991 }
992 break;
993 }
994 }
995
996 END_PROFILE(SMBioctl);
997 return;
998 }
999
1000 /****************************************************************************
1001 Strange checkpath NTSTATUS mapping.
1002 ****************************************************************************/
1003
1004 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1005 {
1006 /* Strange DOS error code semantics only for checkpath... */
1007 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1008 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1009 /* We need to map to ERRbadpath */
1010 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1011 }
1012 }
1013 return status;
1014 }
1015
1016 /****************************************************************************
1017 Reply to a checkpath.
1018 ****************************************************************************/
1019
1020 void reply_checkpath(struct smb_request *req)
1021 {
1022 connection_struct *conn = req->conn;
1023 struct smb_filename *smb_fname = NULL;
1024 char *name = NULL;
1025 NTSTATUS status;
1026 TALLOC_CTX *ctx = talloc_tos();
1027
1028 START_PROFILE(SMBcheckpath);
1029
1030 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1031 STR_TERMINATE, &status);
1032
1033 if (!NT_STATUS_IS_OK(status)) {
1034 status = map_checkpath_error(req->flags2, status);
1035 reply_nterror(req, status);
1036 END_PROFILE(SMBcheckpath);
1037 return;
1038 }
1039
1040 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1041
1042 status = filename_convert(ctx,
1043 conn,
1044 req->flags2 & FLAGS2_DFS_PATHNAMES,
1045 name,
1046 0,
1047 NULL,
1048 &smb_fname);
1049
1050 if (!NT_STATUS_IS_OK(status)) {
1051 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1052 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1053 ERRSRV, ERRbadpath);
1054 END_PROFILE(SMBcheckpath);
1055 return;
1056 }
1057 goto path_err;
1058 }
1059
1060 if (!VALID_STAT(smb_fname->st) &&
1061 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1062 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1063 smb_fname_str_dbg(smb_fname), strerror(errno)));
1064 status = map_nt_error_from_unix(errno);
1065 goto path_err;
1066 }
1067
1068 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1069 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1070 ERRDOS, ERRbadpath);
1071 goto out;
1072 }
1073
1074 reply_outbuf(req, 0, 0);
1075
1076 path_err:
1077 /* We special case this - as when a Windows machine
1078 is parsing a path is steps through the components
1079 one at a time - if a component fails it expects
1080 ERRbadpath, not ERRbadfile.
1081 */
1082 status = map_checkpath_error(req->flags2, status);
1083 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1084 /*
1085 * Windows returns different error codes if
1086 * the parent directory is valid but not the
1087 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1088 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1089 * if the path is invalid.
1090 */
1091 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1092 ERRDOS, ERRbadpath);
1093 goto out;
1094 }
1095
1096 reply_nterror(req, status);
1097
1098 out:
1099 TALLOC_FREE(smb_fname);
1100 END_PROFILE(SMBcheckpath);
1101 return;
1102 }
1103
1104 /****************************************************************************
1105 Reply to a getatr.
1106 ****************************************************************************/
1107
1108 void reply_getatr(struct smb_request *req)
1109 {
1110 connection_struct *conn = req->conn;
1111 struct smb_filename *smb_fname = NULL;
1112 char *fname = NULL;
1113 int mode=0;
1114 SMB_OFF_T size=0;
1115 time_t mtime=0;
1116 const char *p;
1117 NTSTATUS status;
1118 TALLOC_CTX *ctx = talloc_tos();
1119 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1120
1121 START_PROFILE(SMBgetatr);
1122
1123 p = (const char *)req->buf + 1;
1124 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1125 if (!NT_STATUS_IS_OK(status)) {
1126 reply_nterror(req, status);
1127 goto out;
1128 }
1129
1130 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1131 under WfWg - weird! */
1132 if (*fname == '\0') {
1133 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1134 if (!CAN_WRITE(conn)) {
1135 mode |= FILE_ATTRIBUTE_READONLY;
1136 }
1137 size = 0;
1138 mtime = 0;
1139 } else {
1140 status = filename_convert(ctx,
1141 conn,
1142 req->flags2 & FLAGS2_DFS_PATHNAMES,
1143 fname,
1144 0,
1145 NULL,
1146 &smb_fname);
1147 if (!NT_STATUS_IS_OK(status)) {
1148 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1149 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1150 ERRSRV, ERRbadpath);
1151 goto out;
1152 }
1153 reply_nterror(req, status);
1154 goto out;
1155 }
1156 if (!VALID_STAT(smb_fname->st) &&
1157 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1158 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1159 smb_fname_str_dbg(smb_fname),
1160 strerror(errno)));
1161 reply_nterror(req, map_nt_error_from_unix(errno));
1162 goto out;
1163 }
1164
1165 mode = dos_mode(conn, smb_fname);
1166 size = smb_fname->st.st_ex_size;
1167
1168 if (ask_sharemode) {
1169 struct timespec write_time_ts;
1170 struct file_id fileid;
1171
1172 ZERO_STRUCT(write_time_ts);
1173 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1174 get_file_infos(fileid, 0, NULL, &write_time_ts);
1175 if (!null_timespec(write_time_ts)) {
1176 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1177 }
1178 }
1179
1180 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1181 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1182 size = 0;
1183 }
1184 }
1185
1186 reply_outbuf(req, 10, 0);
1187
1188 SSVAL(req->outbuf,smb_vwv0,mode);
1189 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1190 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1191 } else {
1192 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1193 }
1194 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1195
1196 if (get_Protocol() >= PROTOCOL_NT1) {
1197 SSVAL(req->outbuf, smb_flg2,
1198 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1199 }
1200
1201 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1202 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1203
1204 out:
1205 TALLOC_FREE(smb_fname);
1206 TALLOC_FREE(fname);
1207 END_PROFILE(SMBgetatr);
1208 return;
1209 }
1210
1211 /****************************************************************************
1212 Reply to a setatr.
1213 ****************************************************************************/
1214
1215 void reply_setatr(struct smb_request *req)
1216 {
1217 struct smb_file_time ft;
1218 connection_struct *conn = req->conn;
1219 struct smb_filename *smb_fname = NULL;
1220 char *fname = NULL;
1221 int mode;
1222 time_t mtime;
1223 const char *p;
1224 NTSTATUS status;
1225 TALLOC_CTX *ctx = talloc_tos();
1226
1227 START_PROFILE(SMBsetatr);
1228
1229 ZERO_STRUCT(ft);
1230
1231 if (req->wct < 2) {
1232 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1233 goto out;
1234 }
1235
1236 p = (const char *)req->buf + 1;
1237 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1238 if (!NT_STATUS_IS_OK(status)) {
1239 reply_nterror(req, status);
1240 goto out;
1241 }
1242
1243 status = filename_convert(ctx,
1244 conn,
1245 req->flags2 & FLAGS2_DFS_PATHNAMES,
1246 fname,
1247 0,
1248 NULL,
1249 &smb_fname);
1250 if (!NT_STATUS_IS_OK(status)) {
1251 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1252 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1253 ERRSRV, ERRbadpath);
1254 goto out;
1255 }
1256 reply_nterror(req, status);
1257 goto out;
1258 }
1259
1260 if (smb_fname->base_name[0] == '.' &&
1261 smb_fname->base_name[1] == '\0') {
1262 /*
1263 * Not sure here is the right place to catch this
1264 * condition. Might be moved to somewhere else later -- vl
1265 */
1266 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1267 goto out;
1268 }
1269
1270 mode = SVAL(req->vwv+0, 0);
1271 mtime = srv_make_unix_date3(req->vwv+1);
1272
1273 if (mode != FILE_ATTRIBUTE_NORMAL) {
1274 if (VALID_STAT_OF_DIR(smb_fname->st))
1275 mode |= FILE_ATTRIBUTE_DIRECTORY;
1276 else
1277 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1278
1279 status = check_access(conn, NULL, smb_fname,
1280 FILE_WRITE_ATTRIBUTES);
1281 if (!NT_STATUS_IS_OK(status)) {
1282 reply_nterror(req, status);
1283 goto out;
1284 }
1285
1286 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1287 false) != 0) {
1288 reply_nterror(req, map_nt_error_from_unix(errno));
1289 goto out;
1290 }
1291 }
1292
1293 ft.mtime = convert_time_t_to_timespec(mtime);
1294 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1295 if (!NT_STATUS_IS_OK(status)) {
1296 reply_nterror(req, status);
1297 goto out;
1298 }
1299
1300 reply_outbuf(req, 0, 0);
1301
1302 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1303 mode));
1304 out:
1305 TALLOC_FREE(smb_fname);
1306 END_PROFILE(SMBsetatr);
1307 return;
1308 }
1309
1310 /****************************************************************************
1311 Reply to a dskattr.
1312 ****************************************************************************/
1313
1314 void reply_dskattr(struct smb_request *req)
1315 {
1316 connection_struct *conn = req->conn;
1317 uint64_t dfree,dsize,bsize;
1318 START_PROFILE(SMBdskattr);
1319
1320 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1321 reply_nterror(req, map_nt_error_from_unix(errno));
1322 END_PROFILE(SMBdskattr);
1323 return;
1324 }
1325
1326 reply_outbuf(req, 5, 0);
1327
1328 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1329 double total_space, free_space;
1330 /* we need to scale this to a number that DOS6 can handle. We
1331 use floating point so we can handle large drives on systems
1332 that don't have 64 bit integers
1333
1334 we end up displaying a maximum of 2G to DOS systems
1335 */
1336 total_space = dsize * (double)bsize;
1337 free_space = dfree * (double)bsize;
1338
1339 dsize = (uint64_t)((total_space+63*512) / (64*512));
1340 dfree = (uint64_t)((free_space+63*512) / (64*512));
1341
1342 if (dsize > 0xFFFF) dsize = 0xFFFF;
1343 if (dfree > 0xFFFF) dfree = 0xFFFF;
1344
1345 SSVAL(req->outbuf,smb_vwv0,dsize);
1346 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1347 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1348 SSVAL(req->outbuf,smb_vwv3,dfree);
1349 } else {
1350 SSVAL(req->outbuf,smb_vwv0,dsize);
1351 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1352 SSVAL(req->outbuf,smb_vwv2,512);
1353 SSVAL(req->outbuf,smb_vwv3,dfree);
1354 }
1355
1356 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1357
1358 END_PROFILE(SMBdskattr);
1359 return;
1360 }
1361
1362 /*
1363 * Utility function to split the filename from the directory.
1364 */
1365 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1366 char **fname_dir_out,
1367 char **fname_mask_out)
1368 {
1369 const char *p = NULL;
1370 char *fname_dir = NULL;
1371 char *fname_mask = NULL;
1372
1373 p = strrchr_m(fname_in, '/');
1374 if (!p) {
1375 fname_dir = talloc_strdup(ctx, ".");
1376 fname_mask = talloc_strdup(ctx, fname_in);
1377 } else {
1378 fname_dir = talloc_strndup(ctx, fname_in,
1379 PTR_DIFF(p, fname_in));
1380 fname_mask = talloc_strdup(ctx, p+1);
1381 }
1382
1383 if (!fname_dir || !fname_mask) {
1384 TALLOC_FREE(fname_dir);
1385 TALLOC_FREE(fname_mask);
1386 return NT_STATUS_NO_MEMORY;
1387 }
1388
1389 *fname_dir_out = fname_dir;
1390 *fname_mask_out = fname_mask;
1391 return NT_STATUS_OK;
1392 }
1393
1394 /****************************************************************************
1395 Reply to a search.
1396 Can be called from SMBsearch, SMBffirst or SMBfunique.
1397 ****************************************************************************/
1398
1399 void reply_search(struct smb_request *req)
1400 {
1401 connection_struct *conn = req->conn;
1402 char *path = NULL;
1403 const char *mask = NULL;
1404 char *directory = NULL;
1405 struct smb_filename *smb_fname = NULL;
1406 char *fname = NULL;
1407 SMB_OFF_T size;
1408 uint32 mode;
1409 struct timespec date;
1410 uint32 dirtype;
1411 unsigned int numentries = 0;
1412 unsigned int maxentries = 0;
1413 bool finished = False;
1414 const char *p;
1415 int status_len;
1416 char status[21];
1417 int dptr_num= -1;
1418 bool check_descend = False;
1419 bool expect_close = False;
1420 NTSTATUS nt_status;
1421 bool mask_contains_wcard = False;
1422 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1423 TALLOC_CTX *ctx = talloc_tos();
1424 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1425 struct dptr_struct *dirptr = NULL;
1426 struct smbd_server_connection *sconn = req->sconn;
1427
1428 START_PROFILE(SMBsearch);
1429
1430 if (req->wct < 2) {
1431 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1432 goto out;
1433 }
1434
1435 if (lp_posix_pathnames()) {
1436 reply_unknown_new(req, req->cmd);
1437 goto out;
1438 }
1439
1440 /* If we were called as SMBffirst then we must expect close. */
1441 if(req->cmd == SMBffirst) {
1442 expect_close = True;
1443 }
1444
1445 reply_outbuf(req, 1, 3);
1446 maxentries = SVAL(req->vwv+0, 0);
1447 dirtype = SVAL(req->vwv+1, 0);
1448 p = (const char *)req->buf + 1;
1449 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1450 &nt_status, &mask_contains_wcard);
1451 if (!NT_STATUS_IS_OK(nt_status)) {
1452 reply_nterror(req, nt_status);
1453 goto out;
1454 }
1455
1456 p++;
1457 status_len = SVAL(p, 0);
1458 p += 2;
1459
1460 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1461
1462 if (status_len == 0) {
1463 nt_status = filename_convert(ctx, conn,
1464 req->flags2 & FLAGS2_DFS_PATHNAMES,
1465 path,
1466 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1467 &mask_contains_wcard,
1468 &smb_fname);
1469 if (!NT_STATUS_IS_OK(nt_status)) {
1470 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1471 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1472 ERRSRV, ERRbadpath);
1473 goto out;
1474 }
1475 reply_nterror(req, nt_status);
1476 goto out;
1477 }
1478
1479 directory = smb_fname->base_name;
1480
1481 p = strrchr_m(directory,'/');
1482 if ((p != NULL) && (*directory != '/')) {
1483 mask = p + 1;
1484 directory = talloc_strndup(ctx, directory,
1485 PTR_DIFF(p, directory));
1486 } else {
1487 mask = directory;
1488 directory = talloc_strdup(ctx,".");
1489 }
1490
1491 if (!directory) {
1492 reply_nterror(req, NT_STATUS_NO_MEMORY);
1493 goto out;
1494 }
1495
1496 memset((char *)status,'\0',21);
1497 SCVAL(status,0,(dirtype & 0x1F));
1498
1499 nt_status = dptr_create(conn,
1500 NULL, /* fsp */
1501 directory,
1502 True,
1503 expect_close,
1504 req->smbpid,
1505 mask,
1506 mask_contains_wcard,
1507 dirtype,
1508 &dirptr);
1509 if (!NT_STATUS_IS_OK(nt_status)) {
1510 reply_nterror(req, nt_status);
1511 goto out;
1512 }
1513 dptr_num = dptr_dnum(dirptr);
1514 } else {
1515 int status_dirtype;
1516 const char *dirpath;
1517
1518 memcpy(status,p,21);
1519 status_dirtype = CVAL(status,0) & 0x1F;
1520 if (status_dirtype != (dirtype & 0x1F)) {
1521 dirtype = status_dirtype;
1522 }
1523
1524 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1525 if (!dirptr) {
1526 goto SearchEmpty;
1527 }
1528 dirpath = dptr_path(sconn, dptr_num);
1529 directory = talloc_strdup(ctx, dirpath);
1530 if (!directory) {
1531 reply_nterror(req, NT_STATUS_NO_MEMORY);
1532 goto out;
1533 }
1534
1535 mask = dptr_wcard(sconn, dptr_num);
1536 if (!mask) {
1537 goto SearchEmpty;
1538 }
1539 /*
1540 * For a 'continue' search we have no string. So
1541 * check from the initial saved string.
1542 */
1543 mask_contains_wcard = ms_has_wild(mask);
1544 dirtype = dptr_attr(sconn, dptr_num);
1545 }
1546
1547 DEBUG(4,("dptr_num is %d\n",dptr_num));
1548
1549 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1550 dptr_init_search_op(dirptr);
1551
1552 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1553 char buf[DIR_STRUCT_SIZE];
1554 memcpy(buf,status,21);
1555 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1556 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1557 reply_nterror(req, NT_STATUS_NO_MEMORY);
1558 goto out;
1559 }
1560 dptr_fill(sconn, buf+12,dptr_num);
1561 if (dptr_zero(buf+12) && (status_len==0)) {
1562 numentries = 1;
1563 } else {
1564 numentries = 0;
1565 }
1566 if (message_push_blob(&req->outbuf,
1567 data_blob_const(buf, sizeof(buf)))
1568 == -1) {
1569 reply_nterror(req, NT_STATUS_NO_MEMORY);
1570 goto out;
1571 }
1572 } else {
1573 unsigned int i;
1574 maxentries = MIN(
1575 maxentries,
1576 ((BUFFER_SIZE -
1577 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1578 /DIR_STRUCT_SIZE));
1579
1580 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1581 directory,lp_dontdescend(SNUM(conn))));
1582 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1583 check_descend = True;
1584 }
1585
1586 for (i=numentries;(i<maxentries) && !finished;i++) {
1587 finished = !get_dir_entry(ctx,
1588 dirptr,
1589 mask,
1590 dirtype,
1591 &fname,
1592 &size,
1593 &mode,
1594 &date,
1595 check_descend,
1596 ask_sharemode);
1597 if (!finished) {
1598 char buf[DIR_STRUCT_SIZE];
1599 memcpy(buf,status,21);
1600 if (!make_dir_struct(ctx,
1601 buf,
1602 mask,
1603 fname,
1604 size,
1605 mode,
1606 convert_timespec_to_time_t(date),
1607 !allow_long_path_components)) {
1608 reply_nterror(req, NT_STATUS_NO_MEMORY);
1609 goto out;
1610 }
1611 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1612 break;
1613 }
1614 if (message_push_blob(&req->outbuf,
1615 data_blob_const(buf, sizeof(buf)))
1616 == -1) {
1617 reply_nterror(req, NT_STATUS_NO_MEMORY);
1618 goto out;
1619 }
1620 numentries++;
1621 }
1622 }
1623 }
1624
1625 SearchEmpty:
1626
1627 /* If we were called as SMBffirst with smb_search_id == NULL
1628 and no entries were found then return error and close dirptr
1629 (X/Open spec) */
1630
1631 if (numentries == 0) {
1632 dptr_close(sconn, &dptr_num);
1633 } else if(expect_close && status_len == 0) {
1634 /* Close the dptr - we know it's gone */
1635 dptr_close(sconn, &dptr_num);
1636 }
1637
1638 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1639 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1640 dptr_close(sconn, &dptr_num);
1641 }
1642
1643 if ((numentries == 0) && !mask_contains_wcard) {
1644 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1645 goto out;
1646 }
1647
1648 SSVAL(req->outbuf,smb_vwv0,numentries);
1649 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1650 SCVAL(smb_buf(req->outbuf),0,5);
1651 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1652
1653 /* The replies here are never long name. */
1654 SSVAL(req->outbuf, smb_flg2,
1655 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1656 if (!allow_long_path_components) {
1657 SSVAL(req->outbuf, smb_flg2,
1658 SVAL(req->outbuf, smb_flg2)
1659 & (~FLAGS2_LONG_PATH_COMPONENTS));
1660 }
1661
1662 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1663 SSVAL(req->outbuf, smb_flg2,
1664 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1665
1666 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1667 smb_fn_name(req->cmd),
1668 mask,
1669 directory,
1670 dirtype,
1671 numentries,
1672 maxentries ));
1673 out:
1674 TALLOC_FREE(directory);
1675 TALLOC_FREE(smb_fname);
1676 END_PROFILE(SMBsearch);
1677 return;
1678 }
1679
1680 /****************************************************************************
1681 Reply to a fclose (stop directory search).
1682 ****************************************************************************/
1683
1684 void reply_fclose(struct smb_request *req)
1685 {
1686 int status_len;
1687 char status[21];
1688 int dptr_num= -2;
1689 const char *p;
1690 char *path = NULL;
1691 NTSTATUS err;
1692 bool path_contains_wcard = False;
1693 TALLOC_CTX *ctx = talloc_tos();
1694 struct smbd_server_connection *sconn = req->sconn;
1695
1696 START_PROFILE(SMBfclose);
1697
1698 if (lp_posix_pathnames()) {
1699 reply_unknown_new(req, req->cmd);
1700 END_PROFILE(SMBfclose);
1701 return;
1702 }
1703
1704 p = (const char *)req->buf + 1;
1705 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1706 &err, &path_contains_wcard);
1707 if (!NT_STATUS_IS_OK(err)) {
1708 reply_nterror(req, err);
1709 END_PROFILE(SMBfclose);
1710 return;
1711 }
1712 p++;
1713 status_len = SVAL(p,0);
1714 p += 2;
1715
1716 if (status_len == 0) {
1717 reply_force_doserror(req, ERRSRV, ERRsrverror);
1718 END_PROFILE(SMBfclose);
1719 return;
1720 }
1721
1722 memcpy(status,p,21);
1723
1724 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1725 /* Close the dptr - we know it's gone */
1726 dptr_close(sconn, &dptr_num);
1727 }
1728
1729 reply_outbuf(req, 1, 0);
1730 SSVAL(req->outbuf,smb_vwv0,0);
1731
1732 DEBUG(3,("search close\n"));
1733
1734 END_PROFILE(SMBfclose);
1735 return;
1736 }
1737
1738 /****************************************************************************
1739 Reply to an open.
1740 ****************************************************************************/
1741
1742 void reply_open(struct smb_request *req)
1743 {
1744 connection_struct *conn = req->conn;
1745 struct smb_filename *smb_fname = NULL;
1746 char *fname = NULL;
1747 uint32 fattr=0;
1748 SMB_OFF_T size = 0;
1749 time_t mtime=0;
1750 int info;
1751 files_struct *fsp;
1752 int oplock_request;
1753 int deny_mode;
1754 uint32 dos_attr;
1755 uint32 access_mask;
1756 uint32 share_mode;
1757 uint32 create_disposition;
1758 uint32 create_options = 0;
1759 uint32_t private_flags = 0;
1760 NTSTATUS status;
1761 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1762 TALLOC_CTX *ctx = talloc_tos();
1763
1764 START_PROFILE(SMBopen);
1765
1766 if (req->wct < 2) {
1767 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1768 goto out;
1769 }
1770
1771 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1772 deny_mode = SVAL(req->vwv+0, 0);
1773 dos_attr = SVAL(req->vwv+1, 0);
1774
1775 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1776 STR_TERMINATE, &status);
1777 if (!NT_STATUS_IS_OK(status)) {
1778 reply_nterror(req, status);
1779 goto out;
1780 }
1781
1782 status = filename_convert(ctx,
1783 conn,
1784 req->flags2 & FLAGS2_DFS_PATHNAMES,
1785 fname,
1786 0,
1787 NULL,
1788 &smb_fname);
1789 if (!NT_STATUS_IS_OK(status)) {
1790 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1791 reply_botherror(req,
1792 NT_STATUS_PATH_NOT_COVERED,
1793 ERRSRV, ERRbadpath);
1794 goto out;
1795 }
1796 reply_nterror(req, status);
1797 goto out;
1798 }
1799
1800 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1801 OPENX_FILE_EXISTS_OPEN, &access_mask,
1802 &share_mode, &create_disposition,
1803 &create_options, &private_flags)) {
1804 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1805 goto out;
1806 }
1807
1808 status = SMB_VFS_CREATE_FILE(
1809 conn, /* conn */
1810 req, /* req */
1811 0, /* root_dir_fid */
1812 smb_fname, /* fname */
1813 access_mask, /* access_mask */
1814 share_mode, /* share_access */
1815 create_disposition, /* create_disposition*/
1816 create_options, /* create_options */
1817 dos_attr, /* file_attributes */
1818 oplock_request, /* oplock_request */
1819 0, /* allocation_size */
1820 private_flags,
1821 NULL, /* sd */
1822 NULL, /* ea_list */
1823 &fsp, /* result */
1824 &info); /* pinfo */
1825
1826 if (!NT_STATUS_IS_OK(status)) {
1827 if (open_was_deferred(req->sconn, req->mid)) {
1828 /* We have re-scheduled this call. */
1829 goto out;
1830 }
1831 reply_openerror(req, status);
1832 goto out;
1833 }
1834
1835 size = smb_fname->st.st_ex_size;
1836 fattr = dos_mode(conn, smb_fname);
1837
1838 /* Deal with other possible opens having a modified
1839 write time. JRA. */
1840 if (ask_sharemode) {
1841 struct timespec write_time_ts;
1842
1843 ZERO_STRUCT(write_time_ts);
1844 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1845 if (!null_timespec(write_time_ts)) {
1846 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1847 }
1848 }
1849
1850 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1851
1852 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1853 DEBUG(3,("attempt to open a directory %s\n",
1854 fsp_str_dbg(fsp)));
1855 close_file(req, fsp, ERROR_CLOSE);
1856 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1857 ERRDOS, ERRnoaccess);
1858 goto out;
1859 }
1860
1861 reply_outbuf(req, 7, 0);
1862 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1863 SSVAL(req->outbuf,smb_vwv1,fattr);
1864 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1865 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1866 } else {
1867 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1868 }
1869 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1870 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1871
1872 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1873 SCVAL(req->outbuf,smb_flg,
1874 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1875 }
1876
1877 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1878 SCVAL(req->outbuf,smb_flg,
1879 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1880 }
1881 out:
1882 TALLOC_FREE(smb_fname);
1883 END_PROFILE(SMBopen);
1884 return;
1885 }
1886
1887 /****************************************************************************
1888 Reply to an open and X.
1889 ****************************************************************************/
1890
1891 void reply_open_and_X(struct smb_request *req)
1892 {
1893 connection_struct *conn = req->conn;
1894 struct smb_filename *smb_fname = NULL;
1895 char *fname = NULL;
1896 uint16 open_flags;
1897 int deny_mode;
1898 uint32 smb_attr;
1899 /* Breakout the oplock request bits so we can set the
1900 reply bits separately. */
1901 int ex_oplock_request;
1902 int core_oplock_request;
1903 int oplock_request;
1904 #if 0
1905 int smb_sattr = SVAL(req->vwv+4, 0);
1906 uint32 smb_time = make_unix_date3(req->vwv+6);
1907 #endif
1908 int smb_ofun;
1909 uint32 fattr=0;
1910 int mtime=0;
1911 int smb_action = 0;
1912 files_struct *fsp;
1913 NTSTATUS status;
1914 uint64_t allocation_size;
1915 ssize_t retval = -1;
1916 uint32 access_mask;
1917 uint32 share_mode;
1918 uint32 create_disposition;
1919 uint32 create_options = 0;
1920 uint32_t private_flags = 0;
1921 TALLOC_CTX *ctx = talloc_tos();
1922
1923 START_PROFILE(SMBopenX);
1924
1925 if (req->wct < 15) {
1926 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1927 goto out;
1928 }
1929
1930 open_flags = SVAL(req->vwv+2, 0);
1931 deny_mode = SVAL(req->vwv+3, 0);
1932 smb_attr = SVAL(req->vwv+5, 0);
1933 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1934 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1935 oplock_request = ex_oplock_request | core_oplock_request;
1936 smb_ofun = SVAL(req->vwv+8, 0);
1937 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1938
1939 /* If it's an IPC, pass off the pipe handler. */
1940 if (IS_IPC(conn)) {
1941 if (lp_nt_pipe_support()) {
1942 reply_open_pipe_and_X(conn, req);
1943 } else {
1944 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1945 }
1946 goto out;
1947 }
1948
1949 /* XXXX we need to handle passed times, sattr and flags */
1950 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1951 STR_TERMINATE, &status);
1952 if (!NT_STATUS_IS_OK(status)) {
1953 reply_nterror(req, status);
1954 goto out;
1955 }
1956
1957 status = filename_convert(ctx,
1958 conn,
1959 req->flags2 & FLAGS2_DFS_PATHNAMES,
1960 fname,
1961 0,
1962 NULL,
1963 &smb_fname);
1964 if (!NT_STATUS_IS_OK(status)) {
1965 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1966 reply_botherror(req,
1967 NT_STATUS_PATH_NOT_COVERED,
1968 ERRSRV, ERRbadpath);
1969 goto out;
1970 }
1971 reply_nterror(req, status);
1972 goto out;
1973 }
1974
1975 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1976 smb_ofun,
1977 &access_mask, &share_mode,
1978 &create_disposition,
1979 &create_options,
1980 &private_flags)) {
1981 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1982 goto out;
1983 }
1984
1985 status = SMB_VFS_CREATE_FILE(
1986 conn, /* conn */
1987 req, /* req */
1988 0, /* root_dir_fid */
1989 smb_fname, /* fname */
1990 access_mask, /* access_mask */
1991 share_mode, /* share_access */
1992 create_disposition, /* create_disposition*/
1993 create_options, /* create_options */
1994 smb_attr, /* file_attributes */
1995 oplock_request, /* oplock_request */
1996 0, /* allocation_size */
1997 private_flags,
1998 NULL, /* sd */
1999 NULL, /* ea_list */
2000 &fsp, /* result */
2001 &smb_action); /* pinfo */
2002
2003 if (!NT_STATUS_IS_OK(status)) {
2004 if (open_was_deferred(req->sconn, req->mid)) {
2005 /* We have re-scheduled this call. */
2006 goto out;
2007 }
2008 reply_openerror(req, status);
2009 goto out;
2010 }
2011
2012 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2013 if the file is truncated or created. */
2014 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2015 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2016 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2017 close_file(req, fsp, ERROR_CLOSE);
2018 reply_nterror(req, NT_STATUS_DISK_FULL);
2019 goto out;
2020 }
2021 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
2022 if (retval < 0) {
2023 close_file(req, fsp, ERROR_CLOSE);
2024 reply_nterror(req, NT_STATUS_DISK_FULL);
2025 goto out;
2026 }
2027 status = vfs_stat_fsp(fsp);
2028 if (!NT_STATUS_IS_OK(status)) {
2029 close_file(req, fsp, ERROR_CLOSE);
2030 reply_nterror(req, status);
2031 goto out;
2032 }
2033 }
2034
2035 fattr = dos_mode(conn, fsp->fsp_name);
2036 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2037 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2038 close_file(req, fsp, ERROR_CLOSE);
2039 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2040 goto out;
2041 }
2042
2043 /* If the caller set the extended oplock request bit
2044 and we granted one (by whatever means) - set the
2045 correct bit for extended oplock reply.
2046 */
2047
2048 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2049 smb_action |= EXTENDED_OPLOCK_GRANTED;
2050 }
2051
2052 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2053 smb_action |= EXTENDED_OPLOCK_GRANTED;
2054 }
2055
2056 /* If the caller set the core oplock request bit
2057 and we granted one (by whatever means) - set the
2058 correct bit for core oplock reply.
2059 */
2060
2061 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2062 reply_outbuf(req, 19, 0);
2063 } else {
2064 reply_outbuf(req, 15, 0);
2065 }
2066
2067 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2068 SCVAL(req->outbuf, smb_flg,
2069 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2070 }
2071
2072 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2073 SCVAL(req->outbuf, smb_flg,
2074 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2075 }
2076
2077 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2078 SSVAL(req->outbuf,smb_vwv3,fattr);
2079 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2080 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2081 } else {
2082 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2083 }
2084 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2085 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2086 SSVAL(req->outbuf,smb_vwv11,smb_action);
2087
2088 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2089 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2090 }
2091
2092 chain_reply(req);
2093 out:
2094 TALLOC_FREE(smb_fname);
2095 END_PROFILE(SMBopenX);
2096 return;
2097 }
2098
2099 /****************************************************************************
2100 Reply to a SMBulogoffX.
2101 ****************************************************************************/
2102
2103 void reply_ulogoffX(struct smb_request *req)
2104 {
2105 struct smbd_server_connection *sconn = req->sconn;
2106 user_struct *vuser;
2107
2108 START_PROFILE(SMBulogoffX);
2109
2110 vuser = get_valid_user_struct(sconn, req->vuid);
2111
2112 if(vuser == NULL) {
2113 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2114 req->vuid));
2115 }
2116
2117 /* in user level security we are supposed to close any files
2118 open by this user */
2119 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2120 file_close_user(sconn, req->vuid);
2121 }
2122
2123 invalidate_vuid(sconn, req->vuid);
2124
2125 reply_outbuf(req, 2, 0);
2126
2127 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2128
2129 END_PROFILE(SMBulogoffX);
2130 req->vuid = UID_FIELD_INVALID;
2131 chain_reply(req);
2132 }
2133
2134 /****************************************************************************
2135 Reply to a mknew or a create.
2136 ****************************************************************************/
2137
2138 void reply_mknew(struct smb_request *req)
2139 {
2140 connection_struct *conn = req->conn;
2141 struct smb_filename *smb_fname = NULL;
2142 char *fname = NULL;
2143 uint32 fattr = 0;
2144 struct smb_file_time ft;
2145 files_struct *fsp;
2146 int oplock_request = 0;
2147 NTSTATUS status;
2148 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2149 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2150 uint32 create_disposition;
2151 uint32 create_options = 0;
2152 TALLOC_CTX *ctx = talloc_tos();
2153
2154 START_PROFILE(SMBcreate);
2155 ZERO_STRUCT(ft);
2156
2157 if (req->wct < 3) {
2158 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2159 goto out;
2160 }
2161
2162 fattr = SVAL(req->vwv+0, 0);
2163 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2164
2165 /* mtime. */
2166 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2167
2168 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2169 STR_TERMINATE, &status);
2170 if (!NT_STATUS_IS_OK(status)) {
2171 reply_nterror(req, status);
2172 goto out;
2173 }
2174
2175 status = filename_convert(ctx,
2176 conn,
2177 req->flags2 & FLAGS2_DFS_PATHNAMES,
2178 fname,
2179 0,
2180 NULL,
2181 &smb_fname);
2182 if (!NT_STATUS_IS_OK(status)) {
2183 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2184 reply_botherror(req,
2185 NT_STATUS_PATH_NOT_COVERED,
2186 ERRSRV, ERRbadpath);
2187 goto out;
2188 }
2189 reply_nterror(req, status);
2190 goto out;
2191 }
2192
2193 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2194 DEBUG(0,("Attempt to create file (%s) with volid set - "
2195 "please report this\n",
2196 smb_fname_str_dbg(smb_fname)));
2197 }
2198
2199 if(req->cmd == SMBmknew) {
2200 /* We should fail if file exists. */
2201 create_disposition = FILE_CREATE;
2202 } else {
2203 /* Create if file doesn't exist, truncate if it does. */
2204 create_disposition = FILE_OVERWRITE_IF;
2205 }
2206
2207 status = SMB_VFS_CREATE_FILE(
2208 conn, /* conn */
2209 req, /* req */
2210 0, /* root_dir_fid */
2211 smb_fname, /* fname */
2212 access_mask, /* access_mask */
2213 share_mode, /* share_access */
2214 create_disposition, /* create_disposition*/
2215 create_options, /* create_options */
2216 fattr, /* file_attributes */
2217 oplock_request, /* oplock_request */
2218 0, /* allocation_size */
2219 0, /* private_flags */
2220 NULL, /* sd */
2221 NULL, /* ea_list */
2222 &fsp, /* result */
2223 NULL); /* pinfo */
2224
2225 if (!NT_STATUS_IS_OK(status)) {
2226 if (open_was_deferred(req->sconn, req->mid)) {
2227 /* We have re-scheduled this call. */
2228 goto out;
2229 }
2230 reply_openerror(req, status);
2231 goto out;
2232 }
2233
2234 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2235 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2236 if (!NT_STATUS_IS_OK(status)) {
2237 END_PROFILE(SMBcreate);
2238 goto out;
2239 }
2240
2241 reply_outbuf(req, 1, 0);
2242 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2243
2244 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2245 SCVAL(req->outbuf,smb_flg,
2246 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2247 }
2248
2249 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2250 SCVAL(req->outbuf,smb_flg,
2251 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2252 }
2253
2254 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2255 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2256 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2257 (unsigned int)fattr));
2258
2259 out:
2260 TALLOC_FREE(smb_fname);
2261 END_PROFILE(SMBcreate);
2262 return;
2263 }
2264
2265 /****************************************************************************
2266 Reply to a create temporary file.
2267 ****************************************************************************/
2268
2269 void reply_ctemp(struct smb_request *req)
2270 {
2271 connection_struct *conn = req->conn;
2272 struct smb_filename *smb_fname = NULL;
2273 char *fname = NULL;
2274 uint32 fattr;
2275 files_struct *fsp;
2276 int oplock_request;
2277 int tmpfd;
2278 char *s;
2279 NTSTATUS status;
2280 TALLOC_CTX *ctx = talloc_tos();
2281
2282 START_PROFILE(SMBctemp);
2283
2284 if (req->wct < 3) {
2285 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2286 goto out;
2287 }
2288
2289 fattr = SVAL(req->vwv+0, 0);
2290 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2291
2292 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2293 STR_TERMINATE, &status);
2294 if (!NT_STATUS_IS_OK(status)) {
2295 reply_nterror(req, status);
2296 goto out;
2297 }
2298 if (*fname) {
2299 fname = talloc_asprintf(ctx,
2300 "%s/TMXXXXXX",
2301 fname);
2302 } else {
2303 fname = talloc_strdup(ctx, "TMXXXXXX");
2304 }
2305
2306 if (!fname) {
2307 reply_nterror(req, NT_STATUS_NO_MEMORY);
2308 goto out;
2309 }
2310
2311 status = filename_convert(ctx, conn,
2312 req->flags2 & FLAGS2_DFS_PATHNAMES,
2313 fname,
2314 0,
2315 NULL,
2316 &smb_fname);
2317 if (!NT_STATUS_IS_OK(status)) {
2318 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2319 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2320 ERRSRV, ERRbadpath);
2321 goto out;
2322 }
2323 reply_nterror(req, status);
2324 goto out;
2325 }
2326
2327 tmpfd = mkstemp(smb_fname->base_name);
2328 if (tmpfd == -1) {
2329 reply_nterror(req, map_nt_error_from_unix(errno));
2330 goto out;
2331 }
2332
2333 SMB_VFS_STAT(conn, smb_fname);
2334
2335 /* We should fail if file does not exist. */
2336 status = SMB_VFS_CREATE_FILE(
2337 conn, /* conn */
2338 req, /* req */
2339 0, /* root_dir_fid */
2340 smb_fname, /* fname */
2341 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2342 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2343 FILE_OPEN, /* create_disposition*/
2344 0, /* create_options */
2345 fattr, /* file_attributes */
2346 oplock_request, /* oplock_request */
2347 0, /* allocation_size */
2348 0, /* private_flags */
2349 NULL, /* sd */
2350 NULL, /* ea_list */
2351 &fsp, /* result */
2352 NULL); /* pinfo */
2353
2354 /* close fd from mkstemp() */
2355 close(tmpfd);
2356
2357 if (!NT_STATUS_IS_OK(status)) {
2358 if (open_was_deferred(req->sconn, req->mid)) {
2359 /* We have re-scheduled this call. */
2360 goto out;
2361 }
2362 reply_openerror(req, status);
2363 goto out;
2364 }
2365
2366 reply_outbuf(req, 1, 0);
2367 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2368
2369 /* the returned filename is relative to the directory */
2370 s = strrchr_m(fsp->fsp_name->base_name, '/');
2371 if (!s) {
2372 s = fsp->fsp_name->base_name;
2373 } else {
2374 s++;
2375 }
2376
2377 #if 0
2378 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2379 thing in the byte section. JRA */
2380 SSVALS(p, 0, -1); /* what is this? not in spec */
2381 #endif
2382 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2383 == -1) {
2384 reply_nterror(req, NT_STATUS_NO_MEMORY);
2385 goto out;
2386 }
2387
2388 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2389 SCVAL(req->outbuf, smb_flg,
2390 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2391 }
2392
2393 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2394 SCVAL(req->outbuf, smb_flg,
2395 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2396 }
2397
2398 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2399 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2400 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2401 out:
2402 TALLOC_FREE(smb_fname);
2403 END_PROFILE(SMBctemp);
2404 return;
2405 }
2406
2407 /*******************************************************************
2408 Check if a user is allowed to rename a file.
2409 ********************************************************************/
2410
2411 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2412 uint16 dirtype)
2413 {
2414 if (!CAN_WRITE(conn)) {
2415 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2416 }
2417
2418 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2419 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2420 /* Only bother to read the DOS attribute if we might deny the
2421 rename on the grounds of attribute missmatch. */
2422 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2423 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2424 return NT_STATUS_NO_SUCH_FILE;
2425 }
2426 }
2427
2428 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2429 if (fsp->posix_open) {
2430 return NT_STATUS_OK;
2431 }
2432
2433 /* If no pathnames are open below this
2434 directory, allow the rename. */
2435
2436 if (file_find_subpath(fsp)) {
2437 return NT_STATUS_ACCESS_DENIED;
2438 }
2439 return NT_STATUS_OK;
2440 }
2441
2442 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2443 return NT_STATUS_OK;
2444 }
2445
2446 return NT_STATUS_ACCESS_DENIED;
2447 }
2448
2449 /*******************************************************************
2450 * unlink a file with all relevant access checks
2451 *******************************************************************/
2452
2453 static NTSTATUS do_unlink(connection_struct *conn,
2454 struct smb_request *req,
2455 struct smb_filename *smb_fname,
2456 uint32 dirtype)
2457 {
2458 uint32 fattr;
2459 files_struct *fsp;
2460 uint32 dirtype_orig = dirtype;
2461 NTSTATUS status;
2462 int ret;
2463 bool posix_paths = lp_posix_pathnames();
2464
2465 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2466 smb_fname_str_dbg(smb_fname),
2467 dirtype));
2468
2469 if (!CAN_WRITE(conn)) {
2470 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2471 }
2472
2473 if (posix_paths) {
2474 ret = SMB_VFS_LSTAT(conn, smb_fname);
2475 } else {
2476 ret = SMB_VFS_STAT(conn, smb_fname);
2477 }
2478 if (ret != 0) {
2479 return map_nt_error_from_unix(errno);
2480 }
2481
2482 fattr = dos_mode(conn, smb_fname);
2483
2484 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2485 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2486 }
2487
2488 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2489 if (!dirtype) {
2490 return NT_STATUS_NO_SUCH_FILE;
2491 }
2492
2493 if (!dir_check_ftype(conn, fattr, dirtype)) {
2494 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2495 return NT_STATUS_FILE_IS_A_DIRECTORY;
2496 }
2497 return NT_STATUS_NO_SUCH_FILE;
2498 }
2499
2500 if (dirtype_orig & 0x8000) {
2501 /* These will never be set for POSIX. */
2502 return NT_STATUS_NO_SUCH_FILE;
2503 }
2504
2505 #if 0
2506 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2507 return NT_STATUS_FILE_IS_A_DIRECTORY;
2508 }
2509
2510 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2511 return NT_STATUS_NO_SUCH_FILE;
2512 }
2513
2514 if (dirtype & 0xFF00) {
2515 /* These will never be set for POSIX. */
2516 return NT_STATUS_NO_SUCH_FILE;
2517 }
2518
2519 dirtype &= 0xFF;
2520 if (!dirtype) {
2521 return NT_STATUS_NO_SUCH_FILE;
2522 }
2523
2524 /* Can't delete a directory. */
2525 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2526 return NT_STATUS_FILE_IS_A_DIRECTORY;
2527 }
2528 #endif
2529
2530 #if 0 /* JRATEST */
2531 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2532 return NT_STATUS_OBJECT_NAME_INVALID;
2533 #endif /* JRATEST */
2534
2535 /* On open checks the open itself will check the share mode, so
2536 don't do it here as we'll get it wrong. */
2537
2538 status = SMB_VFS_CREATE_FILE
2539 (conn, /* conn */
2540 req, /* req */
2541 0, /* root_dir_fid */
2542 smb_fname, /* fname */
2543 DELETE_ACCESS, /* access_mask */
2544 FILE_SHARE_NONE, /* share_access */
2545 FILE_OPEN, /* create_disposition*/
2546 FILE_NON_DIRECTORY_FILE, /* create_options */
2547 /* file_attributes */
2548 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2549 FILE_ATTRIBUTE_NORMAL,
2550 0, /* oplock_request */
2551 0, /* allocation_size */
2552 0, /* private_flags */
2553 NULL, /* sd */
2554 NULL, /* ea_list */
2555 &fsp, /* result */
2556 NULL); /* pinfo */
2557
2558 if (!NT_STATUS_IS_OK(status)) {
2559 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2560 nt_errstr(status)));
2561 return status;
2562 }
2563
2564 status = can_set_delete_on_close(fsp, fattr);
2565 if (!NT_STATUS_IS_OK(status)) {
2566 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2567 "(%s)\n",
2568 smb_fname_str_dbg(smb_fname),
2569 nt_errstr(status)));
2570 close_file(req, fsp, NORMAL_CLOSE);
2571 return status;
2572 }
2573
2574 /* The set is across all open files on this dev/inode pair. */
2575 if (!set_delete_on_close(fsp, True, conn->session_info->unix_token)) {
2576 close_file(req, fsp, NORMAL_CLOSE);
2577 return NT_STATUS_ACCESS_DENIED;
2578 }
2579
2580 return close_file(req, fsp, NORMAL_CLOSE);
2581 }
2582
2583 /****************************************************************************
2584 The guts of the unlink command, split out so it may be called by the NT SMB
2585 code.
2586 ****************************************************************************/
2587
2588 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2589 uint32 dirtype, struct smb_filename *smb_fname,
2590 bool has_wild)
2591 {
2592 char *fname_dir = NULL;
2593 char *fname_mask = NULL;
2594 int count=0;
2595 NTSTATUS status = NT_STATUS_OK;
2596 TALLOC_CTX *ctx = talloc_tos();
2597
2598 /* Split up the directory from the filename/mask. */
2599 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2600 &fname_dir, &fname_mask);
2601 if (!NT_STATUS_IS_OK(status)) {
2602 goto out;
2603 }
2604
2605 /*
2606 * We should only check the mangled cache
2607 * here if unix_convert failed. This means
2608 * that the path in 'mask' doesn't exist
2609 * on the file system and so we need to look
2610 * for a possible mangle. This patch from
2611 * Tine Smukavec <valentin.smukavec@hermes.si>.
2612 */
2613
2614 if (!VALID_STAT(smb_fname->st) &&
2615 mangle_is_mangled(fname_mask, conn->params)) {
2616 char *new_mask = NULL;
2617 mangle_lookup_name_from_8_3(ctx, fname_mask,
2618 &new_mask, conn->params);
2619 if (new_mask) {
2620 TALLOC_FREE(fname_mask);
2621 fname_mask = new_mask;
2622 }
2623 }
2624
2625 if (!has_wild) {
2626
2627 /*
2628 * Only one file needs to be unlinked. Append the mask back
2629 * onto the directory.
2630 */
2631 TALLOC_FREE(smb_fname->base_name);
2632 if (ISDOT(fname_dir)) {
2633 /* Ensure we use canonical names on open. */
2634 smb_fname->base_name = talloc_asprintf(smb_fname,
2635 "%s",
2636 fname_mask);
2637 } else {
2638 smb_fname->base_name = talloc_asprintf(smb_fname,
2639 "%s/%s",
2640 fname_dir,
2641 fname_mask);
2642 }
2643 if (!smb_fname->base_name) {
2644 status = NT_STATUS_NO_MEMORY;
2645 goto out;
2646 }
2647 if (dirtype == 0) {
2648 dirtype = FILE_ATTRIBUTE_NORMAL;
2649 }
2650
2651 status = check_name(conn, smb_fname->base_name);
2652 if (!NT_STATUS_IS_OK(status)) {
2653 goto out;
2654 }
2655
2656 status = do_unlink(conn, req, smb_fname, dirtype);
2657 if (!NT_STATUS_IS_OK(status)) {
2658 goto out;
2659 }
2660
2661 count++;
2662 } else {
2663 struct smb_Dir *dir_hnd = NULL;
2664 long offset = 0;
2665 const char *dname = NULL;
2666 char *talloced = NULL;
2667
2668 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2669 status = NT_STATUS_OBJECT_NAME_INVALID;
2670 goto out;
2671 }
2672
2673 if (strequal(fname_mask,"????????.???")) {
2674 TALLOC_FREE(fname_mask);
2675 fname_mask = talloc_strdup(ctx, "*");
2676 if (!fname_mask) {
2677 status = NT_STATUS_NO_MEMORY;
2678 goto out;
2679 }
2680 }
2681
2682 status = check_name(conn, fname_dir);
2683 if (!NT_STATUS_IS_OK(status)) {
2684 goto out;
2685 }
2686
2687 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2688 dirtype);
2689 if (dir_hnd == NULL) {
2690 status = map_nt_error_from_unix(errno);
2691 goto out;
2692 }
2693
2694 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2695 the pattern matches against the long name, otherwise the short name
2696 We don't implement this yet XXXX
2697 */
2698
2699 status = NT_STATUS_NO_SUCH_FILE;
2700
2701 while ((dname = ReadDirName(dir_hnd, &offset,
2702 &smb_fname->st, &talloced))) {
2703 TALLOC_CTX *frame = talloc_stackframe();
2704
2705 if (!is_visible_file(conn, fname_dir, dname,
2706 &smb_fname->st, true)) {
2707 TALLOC_FREE(frame);
2708 TALLOC_FREE(talloced);
2709 continue;
2710 }
2711
2712 /* Quick check for "." and ".." */
2713 if (ISDOT(dname) || ISDOTDOT(dname)) {
2714 TALLOC_FREE(frame);
2715 TALLOC_FREE(talloced);
2716 continue;
2717 }
2718
2719 if(!mask_match(dname, fname_mask,
2720 conn->case_sensitive)) {
2721 TALLOC_FREE(frame);
2722 TALLOC_FREE(talloced);
2723 continue;
2724 }
2725
2726 TALLOC_FREE(smb_fname->base_name);
2727 if (ISDOT(fname_dir)) {
2728 /* Ensure we use canonical names on open. */
2729 smb_fname->base_name =
2730 talloc_asprintf(smb_fname, "%s",
2731 dname);
2732 } else {
2733 smb_fname->base_name =
2734 talloc_asprintf(smb_fname, "%s/%s",
2735 fname_dir, dname);
2736 }
2737
2738 if (!smb_fname->base_name) {
2739 TALLOC_FREE(dir_hnd);
2740 status = NT_STATUS_NO_MEMORY;
2741 TALLOC_FREE(frame);
2742 TALLOC_FREE(talloced);
2743 goto out;
2744 }
2745
2746 status = check_name(conn, smb_fname->base_name);
2747 if (!NT_STATUS_IS_OK(status)) {
2748 TALLOC_FREE(dir_hnd);
2749 TALLOC_FREE(frame);
2750 TALLOC_FREE(talloced);
2751 goto out;
2752 }
2753
2754 status = do_unlink(conn, req, smb_fname, dirtype);
2755 if (!NT_STATUS_IS_OK(status)) {
2756 TALLOC_FREE(frame);
2757 TALLOC_FREE(talloced);
2758 continue;
2759 }
2760
2761 count++;
2762 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2763 smb_fname->base_name));
2764
2765 TALLOC_FREE(frame);
2766 TALLOC_FREE(talloced);
2767 }
2768 TALLOC_FREE(dir_hnd);
2769 }
2770
2771 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2772 status = map_nt_error_from_unix(errno);
2773 }
2774
2775 out:
2776 TALLOC_FREE(fname_dir);
2777 TALLOC_FREE(fname_mask);
2778 return status;
2779 }
2780
2781 /****************************************************************************
2782 Reply to a unlink
2783 ****************************************************************************/
2784
2785 void reply_unlink(struct smb_request *req)
2786 {
2787 connection_struct *conn = req->conn;
2788 char *name = NULL;
2789 struct smb_filename *smb_fname = NULL;
2790 uint32 dirtype;
2791 NTSTATUS status;
2792 bool path_contains_wcard = False;
2793 TALLOC_CTX *ctx = talloc_tos();
2794
2795 START_PROFILE(SMBunlink);
2796
2797 if (req->wct < 1) {
2798 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2799 goto out;
2800 }
2801
2802 dirtype = SVAL(req->vwv+0, 0);
2803
2804 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2805 STR_TERMINATE, &status,
2806 &path_contains_wcard);
2807 if (!NT_STATUS_IS_OK(status)) {
2808 reply_nterror(req, status);
2809 goto out;
2810 }
2811
2812 status = filename_convert(ctx, conn,
2813 req->flags2 & FLAGS2_DFS_PATHNAMES,
2814 name,
2815 UCF_COND_ALLOW_WCARD_LCOMP,
2816 &path_contains_wcard,
2817 &smb_fname);
2818 if (!NT_STATUS_IS_OK(status)) {
2819 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2820 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2821 ERRSRV, ERRbadpath);
2822 goto out;
2823 }
2824 reply_nterror(req, status);
2825 goto out;
2826 }
2827
2828 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2829
2830 status = unlink_internals(conn, req, dirtype, smb_fname,
2831 path_contains_wcard);
2832 if (!NT_STATUS_IS_OK(status)) {
2833 if (open_was_deferred(req->sconn, req->mid)) {
2834 /* We have re-scheduled this call. */
2835 goto out;
2836 }
2837 reply_nterror(req, status);
2838 goto out;
2839 }
2840
2841 reply_outbuf(req, 0, 0);
2842 out:
2843 TALLOC_FREE(smb_fname);
2844 END_PROFILE(SMBunlink);
2845 return;
2846 }
2847
2848 /****************************************************************************
2849 Fail for readbraw.
2850 ****************************************************************************/
2851
2852 static void fail_readraw(void)
2853 {
2854 const char *errstr = talloc_asprintf(talloc_tos(),
2855 "FAIL ! reply_readbraw: socket write fail (%s)",
2856 strerror(errno));
2857 if (!errstr) {
2858 errstr = "";
2859 }
2860 exit_server_cleanly(errstr);
2861 }
2862
2863 /****************************************************************************
2864 Fake (read/write) sendfile. Returns -1 on read or write fail.
2865 ****************************************************************************/
2866
2867 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2868 {
2869 size_t bufsize;
2870 size_t tosend = nread;
2871 char *buf;
2872
2873 if (nread == 0) {
2874 return 0;
2875 }
2876
2877 bufsize = MIN(nread, 65536);
2878
2879 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2880 return -1;
2881 }
2882
2883 while (tosend > 0) {
2884 ssize_t ret;
2885 size_t cur_read;
2886
2887 if (tosend > bufsize) {
2888 cur_read = bufsize;
2889 } else {
2890 cur_read = tosend;
2891 }
2892 ret = read_file(fsp,buf,startpos,cur_read);
2893 if (ret == -1) {
2894 SAFE_FREE(buf);
2895 return -1;
2896 }
2897
2898 /* If we had a short read, fill with zeros. */
2899 if (ret < cur_read) {
2900 memset(buf + ret, '\0', cur_read - ret);
2901 }
2902
2903 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2904 != cur_read) {
2905 char addr[INET6_ADDRSTRLEN];
2906 /*
2907 * Try and give an error message saying what
2908 * client failed.
2909 */
2910 DEBUG(0, ("write_data failed for client %s. "
2911 "Error %s\n",
2912 get_peer_addr(fsp->conn->sconn->sock, addr,
2913 sizeof(addr)),
2914 strerror(errno)));
2915 SAFE_FREE(buf);
2916 return -1;
2917 }
2918 tosend -= cur_read;
2919 startpos += cur_read;
2920 }
2921
2922 SAFE_FREE(buf);
2923 return (ssize_t)nread;
2924 }
2925
2926 /****************************************************************************
2927 Deal with the case of sendfile reading less bytes from the file than
2928 requested. Fill with zeros (all we can do).
2929 ****************************************************************************/
2930
2931 void sendfile_short_send(files_struct *fsp,
2932 ssize_t nread,
2933 size_t headersize,
2934 size_t smb_maxcnt)
2935 {
2936 #define SHORT_SEND_BUFSIZE 1024
2937 if (nread < headersize) {
2938 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2939 "header for file %s (%s). Terminating\n",
2940 fsp_str_dbg(fsp), strerror(errno)));
2941 exit_server_cleanly("sendfile_short_send failed");
2942 }
2943
2944 nread -= headersize;
2945
2946 if (nread < smb_maxcnt) {
2947 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2948 if (!buf) {
2949 exit_server_cleanly("sendfile_short_send: "
2950 "malloc failed");
2951 }
2952
2953 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2954 "with zeros !\n", fsp_str_dbg(fsp)));
2955
2956 while (nread < smb_maxcnt) {
2957 /*
2958 * We asked for the real file size and told sendfile
2959 * to not go beyond the end of the file. But it can
2960 * happen that in between our fstat call and the
2961 * sendfile call the file was truncated. This is very
2962 * bad because we have already announced the larger
2963 * number of bytes to the client.
2964 *
2965 * The best we can do now is to send 0-bytes, just as
2966 * a read from a hole in a sparse file would do.
2967 *
2968 * This should happen rarely enough that I don't care
2969 * about efficiency here :-)
2970 */
2971 size_t to_write;
2972
2973 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2974 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2975 != to_write) {
2976 char addr[INET6_ADDRSTRLEN];
2977 /*
2978 * Try and give an error message saying what
2979 * client failed.
2980 */
2981 DEBUG(0, ("write_data failed for client %s. "
2982 "Error %s\n",
2983 get_peer_addr(
2984 fsp->conn->sconn->sock, addr,
2985 sizeof(addr)),
2986 strerror(errno)));
2987 exit_server_cleanly("sendfile_short_send: "
2988 "write_data failed");
2989 }
2990 nread += to_write;
2991 }
2992 SAFE_FREE(buf);
2993 }
2994 }
2995
2996 /****************************************************************************
2997 Return a readbraw error (4 bytes of zero).
2998 ****************************************************************************/
2999
3000 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3001 {
3002 char header[4];
3003
3004 SIVAL(header,0,0);
3005
3006 smbd_lock_socket(sconn);
3007 if (write_data(sconn->sock,header,4) != 4) {
3008 char addr[INET6_ADDRSTRLEN];
3009 /*
3010 * Try and give an error message saying what
3011 * client failed.
3012 */
3013 DEBUG(0, ("write_data failed for client %s. "
3014 "Error %s\n",
3015 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3016 strerror(errno)));
3017
3018 fail_readraw();
3019 }
3020 smbd_unlock_socket(sconn);
3021 }
3022
3023 /****************************************************************************
3024 Use sendfile in readbraw.
3025 ****************************************************************************/
3026
3027 static void send_file_readbraw(connection_struct *conn,
3028 struct smb_request *req,
3029 files_struct *fsp,
3030 SMB_OFF_T startpos,
3031 size_t nread,
3032 ssize_t mincount)
3033 {
3034 struct smbd_server_connection *sconn = req->sconn;
3035 char *outbuf = NULL;
3036 ssize_t ret=0;
3037
3038 /*
3039 * We can only use sendfile on a non-chained packet
3040 * but we can use on a non-oplocked file. tridge proved this
3041 * on a train in Germany :-). JRA.
3042 * reply_readbraw has already checked the length.
3043 */
3044
3045 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3046 (fsp->wcp == NULL) &&
3047 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3048 ssize_t sendfile_read = -1;
3049 char header[4];
3050 DATA_BLOB header_blob;
3051
3052 _smb_setlen(header,nread);
3053 header_blob = data_blob_const(header, 4);
3054
3055 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3056 &header_blob, startpos,
3057 nread);
3058 if (sendfile_read == -1) {
3059 /* Returning ENOSYS means no data at all was sent.
3060 * Do this as a normal read. */
3061 if (errno == ENOSYS) {
3062 goto normal_readbraw;
3063 }
3064
3065 /*
3066 * Special hack for broken Linux with no working sendfile. If we
3067 * return EINTR we sent the header but not the rest of the data.
3068 * Fake this up by doing read/write calls.
3069 */
3070 if (errno == EINTR) {
3071 /* Ensure we don't do this again. */
3072 set_use_sendfile(SNUM(conn), False);
3073 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3074
3075 if (fake_sendfile(fsp, startpos, nread) == -1) {
3076 DEBUG(0,("send_file_readbraw: "
3077 "fake_sendfile failed for "
3078 "file %s (%s).\n",
3079 fsp_str_dbg(fsp),
3080 strerror(errno)));
3081 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3082 }
3083 return;
3084 }
3085
3086 DEBUG(0,("send_file_readbraw: sendfile failed for "
3087 "file %s (%s). Terminating\n",
3088 fsp_str_dbg(fsp), strerror(errno)));
3089 exit_server_cleanly("send_file_readbraw sendfile failed");
3090 } else if (sendfile_read == 0) {
3091 /*
3092 * Some sendfile implementations return 0 to indicate
3093 * that there was a short read, but nothing was
3094 * actually written to the socket. In this case,
3095 * fallback to the normal read path so the header gets
3096 * the correct byte count.
3097 */
3098 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3099 "bytes falling back to the normal read: "
3100 "%s\n", fsp_str_dbg(fsp)));
3101 goto normal_readbraw;
3102 }
3103
3104 /* Deal with possible short send. */
3105 if (sendfile_read != 4+nread) {
3106 sendfile_short_send(fsp, sendfile_read, 4, nread);
3107 }
3108 return;
3109 }
3110
3111 normal_readbraw:
3112
3113 outbuf = talloc_array(NULL, char, nread+4);
3114 if (!outbuf) {
3115 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3116 (unsigned)(nread+4)));
3117 reply_readbraw_error(sconn);
3118 return;
3119 }
3120
3121 if (nread > 0) {
3122 ret = read_file(fsp,outbuf+4,startpos,nread);
3123 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3124 if (ret < mincount)
3125 ret = 0;
3126 #else
3127 if (ret < nread)
3128 ret = 0;
3129 #endif
3130 }
3131
3132 _smb_setlen(outbuf,ret);
3133 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3134 char addr[INET6_ADDRSTRLEN];
3135 /*
3136 * Try and give an error message saying what
3137 * client failed.
3138 */
3139 DEBUG(0, ("write_data failed for client %s. "
3140 "Error %s\n",
3141 get_peer_addr(fsp->conn->sconn->sock, addr,
3142 sizeof(addr)),
3143 strerror(errno)));
3144
3145 fail_readraw();
3146 }
3147
3148 TALLOC_FREE(outbuf);
3149 }
3150
3151 /****************************************************************************
3152 Reply to a readbraw (core+ protocol).
3153 ****************************************************************************/
3154
3155 void reply_readbraw(struct smb_request *req)
3156 {
3157 connection_struct *conn = req->conn;
3158 struct smbd_server_connection *sconn = req->sconn;
3159 ssize_t maxcount,mincount;
3160 size_t nread = 0;
3161 SMB_OFF_T startpos;
3162 files_struct *fsp;
3163 struct lock_struct lock;
3164 SMB_OFF_T size = 0;
3165
3166 START_PROFILE(SMBreadbraw);
3167
3168 if (srv_is_signing_active(sconn) ||
3169 is_encrypted_packet(sconn, req->inbuf)) {
3170 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3171 "raw reads/writes are disallowed.");
3172 }
3173
3174 if (req->wct < 8) {
3175 reply_readbraw_error(sconn);
3176 END_PROFILE(SMBreadbraw);
3177 return;
3178 }
3179
3180 if (sconn->smb1.echo_handler.trusted_fde) {
3181 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3182 "'async smb echo handler = yes'\n"));
3183 reply_readbraw_error(sconn);
3184 END_PROFILE(SMBreadbraw);
3185 return;
3186 }
3187
3188 /*
3189 * Special check if an oplock break has been issued
3190 * and the readraw request croses on the wire, we must
3191 * return a zero length response here.
3192 */
3193
3194 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3195
3196 /*
3197 * We have to do a check_fsp by hand here, as
3198 * we must always return 4 zero bytes on error,
3199 * not a NTSTATUS.
3200 */
3201
3202 if (!fsp || !conn || conn != fsp->conn ||
3203 req->vuid != fsp->vuid ||
3204 fsp->is_directory || fsp->fh->fd == -1) {
3205 /*
3206 * fsp could be NULL here so use the value from the packet. JRA.
3207 */
3208 DEBUG(3,("reply_readbraw: fnum %d not valid "
3209 "- cache prime?\n",
3210 (int)SVAL(req->vwv+0, 0)));
3211 reply_readbraw_error(sconn);
3212 END_PROFILE(SMBreadbraw);
3213 return;
3214 }
3215
3216 /* Do a "by hand" version of CHECK_READ. */
3217 if (!(fsp->can_read ||
3218 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3219 (fsp->access_mask & FILE_EXECUTE)))) {
3220 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3221 (int)SVAL(req->vwv+0, 0)));
3222 reply_readbraw_error(sconn);
3223 END_PROFILE(SMBreadbraw);
3224 return;
3225 }
3226
3227 flush_write_cache(fsp, READRAW_FLUSH);
3228
3229 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3230 if(req->wct == 10) {
3231 /*
3232 * This is a large offset (64 bit) read.
3233 */
3234 #ifdef LARGE_SMB_OFF_T
3235
3236 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3237
3238 #else /* !LARGE_SMB_OFF_T */
3239
3240 /*
3241 * Ensure we haven't been sent a >32 bit offset.
3242 */
3243
3244 if(IVAL(req->vwv+8, 0) != 0) {
3245 DEBUG(0,("reply_readbraw: large offset "
3246 "(%x << 32) used and we don't support "
3247 "64 bit offsets.\n",
3248 (unsigned int)IVAL(req->vwv+8, 0) ));
3249 reply_readbraw_error(sconn);
3250 END_PROFILE(SMBreadbraw);
3251 return;
3252 }
3253
3254 #endif /* LARGE_SMB_OFF_T */
3255
3256 if(startpos < 0) {
3257 DEBUG(0,("reply_readbraw: negative 64 bit "
3258 "readraw offset (%.0f) !\n",
3259 (double)startpos ));
3260 reply_readbraw_error(sconn);
3261 END_PROFILE(SMBreadbraw);
3262 return;
3263 }
3264 }
3265
3266 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3267 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3268
3269 /* ensure we don't overrun the packet size */
3270 maxcount = MIN(65535,maxcount);
3271
3272 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3273 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3274 &lock);
3275
3276 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3277 reply_readbraw_error(sconn);
3278 END_PROFILE(SMBreadbraw);
3279 return;
3280 }
3281
3282 if (fsp_stat(fsp) == 0) {
3283 size = fsp->fsp_name->st.st_ex_size;
3284 }
3285
3286 if (startpos >= size) {
3287 nread = 0;
3288 } else {
3289 nread = MIN(maxcount,(size - startpos));
3290 }
3291
3292 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3293 if (nread < mincount)
3294 nread = 0;
3295 #endif
3296
3297 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3298 "min=%lu nread=%lu\n",
3299 fsp->fnum, (double)startpos,
3300 (unsigned long)maxcount,
3301 (unsigned long)mincount,
3302 (unsigned long)nread ) );
3303
3304 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3305
3306 DEBUG(5,("reply_readbraw finished\n"));
3307
3308 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3309
3310 END_PROFILE(SMBreadbraw);
3311 return;
3312 }
3313
3314 #undef DBGC_CLASS
3315 #define DBGC_CLASS DBGC_LOCKING
3316
3317 /****************************************************************************
3318 Reply to a lockread (core+ protocol).
3319 ****************************************************************************/
3320
3321 void reply_lockread(struct smb_request *req)
3322 {
3323 connection_struct *conn = req->conn;
3324 ssize_t nread = -1;
3325 char *data;
3326 SMB_OFF_T startpos;
3327 size_t numtoread;
3328 NTSTATUS status;
3329 files_struct *fsp;
3330 struct byte_range_lock *br_lck = NULL;
3331 char *p = NULL;
3332 struct smbd_server_connection *sconn = req->sconn;
3333
3334 START_PROFILE(SMBlockread);
3335
3336 if (req->wct < 5) {
3337 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3338 END_PROFILE(SMBlockread);
3339 return;
3340 }
3341
3342 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3343
3344 if (!check_fsp(conn, req, fsp)) {
3345 END_PROFILE(SMBlockread);
3346 return;
3347 }
3348
3349 if (!CHECK_READ(fsp,req)) {
3350 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3351 END_PROFILE(SMBlockread);
3352 return;
3353 }
3354
3355 numtoread = SVAL(req->vwv+1, 0);
3356 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3357
3358 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3359
3360 reply_outbuf(req, 5, numtoread + 3);
3361
3362 data = smb_buf(req->outbuf) + 3;
3363
3364 /*
3365 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3366 * protocol request that predates the read/write lock concept.
3367 * Thus instead of asking for a read lock here we need to ask
3368 * for a write lock. JRA.
3369 * Note that the requested lock size is unaffected by max_recv.
3370 */
3371
3372 br_lck = do_lock(req->sconn->msg_ctx,
3373 fsp,
3374 (uint64_t)req->smbpid,
3375 (uint64_t)numtoread,
3376 (uint64_t)startpos,
3377 WRITE_LOCK,
3378 WINDOWS_LOCK,
3379 False, /* Non-blocking lock. */
3380 &status,
3381 NULL,
3382 NULL);
3383 TALLOC_FREE(br_lck);
3384
3385 if (NT_STATUS_V(status)) {
3386 reply_nterror(req, status);
3387 END_PROFILE(SMBlockread);
3388 return;
3389 }
3390
3391 /*
3392 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3393 */
3394
3395 if (numtoread > sconn->smb1.negprot.max_recv) {
3396 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3397 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3398 (unsigned int)numtoread,
3399 (unsigned int)sconn->smb1.negprot.max_recv));
3400 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3401 }
3402 nread = read_file(fsp,data,startpos,numtoread);
3403
3404 if (nread < 0) {
3405 reply_nterror(req, map_nt_error_from_unix(errno));
3406 END_PROFILE(SMBlockread);
3407 return;
3408 }
3409
3410 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3411
3412 SSVAL(req->outbuf,smb_vwv0,nread);
3413 SSVAL(req->outbuf,smb_vwv5,nread+3);
3414 p = smb_buf(req->outbuf);
3415 SCVAL(p,0,0); /* pad byte. */
3416 SSVAL(p,1,nread);
3417
3418 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3419 fsp->fnum, (int)numtoread, (int)nread));
3420
3421 END_PROFILE(SMBlockread);
3422 return;
3423 }
3424
3425 #undef DBGC_CLASS
3426 #define DBGC_CLASS DBGC_ALL
3427
3428 /****************************************************************************
3429 Reply to a read.
3430 ****************************************************************************/
3431
3432 void reply_read(struct smb_request *req)
3433 {
3434 connection_struct *conn = req->conn;
3435 size_t numtoread;
3436 ssize_t nread = 0;
3437 char *data;
3438 SMB_OFF_T startpos;
3439 int outsize = 0;
3440 files_struct *fsp;
3441 struct lock_struct lock;
3442 struct smbd_server_connection *sconn = req->sconn;
3443
3444 START_PROFILE(SMBread);
3445
3446 if (req->wct < 3) {
3447 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3448 END_PROFILE(SMBread);
3449 return;
3450 }
3451
3452 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3453
3454 if (!check_fsp(conn, req, fsp)) {
3455 END_PROFILE(SMBread);
3456 return;
3457 }
3458
3459 if (!CHECK_READ(fsp,req)) {
3460 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3461 END_PROFILE(SMBread);
3462 return;
3463 }
3464
3465 numtoread = SVAL(req->vwv+1, 0);
3466 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3467
3468 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3469
3470 /*
3471 * The requested read size cannot be greater than max_recv. JRA.
3472 */
3473 if (numtoread > sconn->smb1.negprot.max_recv) {
3474 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3475 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3476 (unsigned int)numtoread,
3477 (unsigned int)sconn->smb1.negprot.max_recv));
3478 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3479 }
3480
3481 reply_outbuf(req, 5, numtoread+3);
3482
3483 data = smb_buf(req->outbuf) + 3;
3484
3485 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3486 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3487 &lock);
3488
3489 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3490 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3491 END_PROFILE(SMBread);
3492 return;
3493 }
3494
3495 if (numtoread > 0)
3496 nread = read_file(fsp,data,startpos,numtoread);
3497
3498 if (nread < 0) {
3499 reply_nterror(req, map_nt_error_from_unix(errno));
3500 goto strict_unlock;
3501 }
3502
3503 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3504
3505 SSVAL(req->outbuf,smb_vwv0,nread);
3506 SSVAL(req->outbuf,smb_vwv5,nread+3);
3507 SCVAL(smb_buf(req->outbuf),0,1);
3508 SSVAL(smb_buf(req->outbuf),1,nread);
3509
3510 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3511 fsp->fnum, (int)numtoread, (int)nread ) );
3512
3513 strict_unlock:
3514 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3515
3516 END_PROFILE(SMBread);
3517 return;
3518 }
3519
3520 /****************************************************************************
3521 Setup readX header.
3522 ****************************************************************************/
3523
3524 static int setup_readX_header(struct smb_request *req, char *outbuf,
3525 size_t smb_maxcnt)
3526 {
3527 int outsize;
3528 char *data;
3529
3530 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3531 data = smb_buf(outbuf);
3532
3533 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3534
3535 SCVAL(outbuf,smb_vwv0,0xFF);
3536 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3537 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3538 SSVAL(outbuf,smb_vwv6,
3539 req_wct_ofs(req)
3540 + 1 /* the wct field */
3541 + 12 * sizeof(uint16_t) /* vwv */
3542 + 2); /* the buflen field */
3543 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3544 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3545 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3546 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3547 return outsize;
3548 }
3549
3550 /****************************************************************************
3551 Reply to a read and X - possibly using sendfile.
3552 ****************************************************************************/
3553
3554 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3555 files_struct *fsp, SMB_OFF_T startpos,
3556 size_t smb_maxcnt)
3557 {
3558 ssize_t nread = -1;
3559 struct lock_struct lock;
3560 int saved_errno = 0;
3561
3562 if(fsp_stat(fsp) == -1) {
3563 reply_nterror(req, map_nt_error_from_unix(errno));
3564 return;
3565 }
3566
3567 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3568 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3569 &lock);
3570
3571 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3572 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3573 return;
3574 }
3575
3576 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3577 (startpos > fsp->fsp_name->st.st_ex_size)
3578 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3579 /*
3580 * We already know that we would do a short read, so don't
3581 * try the sendfile() path.
3582 */
3583 goto nosendfile_read;
3584 }
3585
3586 /*
3587 * We can only use sendfile on a non-chained packet
3588 * but we can use on a non-oplocked file. tridge proved this
3589 * on a train in Germany :-). JRA.
3590 */
3591
3592 if (!req_is_in_chain(req) &&
3593 !is_encrypted_packet(req->sconn, req->inbuf) &&
3594 (fsp->base_fsp == NULL) &&
3595 (fsp->wcp == NULL) &&
3596 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3597 uint8 headerbuf[smb_size + 12 * 2];
3598 DATA_BLOB header;
3599
3600 /*
3601 * Set up the packet header before send. We
3602 * assume here the sendfile will work (get the
3603 * correct amount of data).
3604 */
3605
3606 header = data_blob_const(headerbuf, sizeof(headerbuf));
3607
3608 construct_reply_common_req(req, (char *)headerbuf);
3609 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3610
3611 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3612 startpos, smb_maxcnt);
3613 if (nread == -1) {
3614 /* Returning ENOSYS means no data at all was sent.
3615 Do this as a normal read. */
3616 if (errno == ENOSYS) {
3617 goto normal_read;
3618 }
3619
3620 /*
3621 * Special hack for broken Linux with no working sendfile. If we
3622 * return EINTR we sent the header but not the rest of the data.
3623 * Fake this up by doing read/write calls.
3624 */
3625
3626 if (errno == EINTR) {
3627 /* Ensure we don't do this again. */
3628 set_use_sendfile(SNUM(conn), False);
3629 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3630 nread = fake_sendfile(fsp, startpos,
3631 smb_maxcnt);
3632 if (nread == -1) {
3633 DEBUG(0,("send_file_readX: "
3634 "fake_sendfile failed for "
3635 "file %s (%s).\n",
3636 fsp_str_dbg(fsp),
3637 strerror(errno)));
3638 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3639 }
3640 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3641 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3642 /* No outbuf here means successful sendfile. */
3643 goto strict_unlock;
3644 }
3645
3646 DEBUG(0,("send_file_readX: sendfile failed for file "
3647 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3648 strerror(errno)));
3649 exit_server_cleanly("send_file_readX sendfile failed");
3650 } else if (nread == 0) {
3651 /*
3652 * Some sendfile implementations return 0 to indicate
3653 * that there was a short read, but nothing was
3654 * actually written to the socket. In this case,
3655 * fallback to the normal read path so the header gets
3656 * the correct byte count.
3657 */
3658 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3659 "falling back to the normal read: %s\n",
3660 fsp_str_dbg(fsp)));
3661 goto normal_read;
3662 }
3663
3664 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3665 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3666
3667 /* Deal with possible short send. */
3668 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3669 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3670 }
3671 /* No outbuf here means successful sendfile. */
3672 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3673 SMB_PERFCOUNT_END(&req->pcd);
3674 goto strict_unlock;
3675 }
3676
3677 normal_read:
3678
3679 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3680 uint8 headerbuf[smb_size + 2*12];
3681
3682 construct_reply_common_req(req, (char *)headerbuf);
3683 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3684
3685 /* Send out the header. */
3686 if (write_data(req->sconn->sock, (char *)headerbuf,
3687 sizeof(headerbuf)) != sizeof(headerbuf)) {
3688
3689 char addr[INET6_ADDRSTRLEN];
3690 /*
3691 * Try and give an error message saying what
3692 * client failed.
3693 */
3694 DEBUG(0, ("write_data failed for client %s. "
3695 "Error %s\n",
3696 get_peer_addr(req->sconn->sock, addr,
3697 sizeof(addr)),
3698 strerror(errno)));
3699
3700 DEBUG(0,("send_file_readX: write_data failed for file "
3701 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3702 strerror(errno)));
3703 exit_server_cleanly("send_file_readX sendfile failed");
3704 }
3705 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3706 if (nread == -1) {
3707 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3708 "file %s (%s).\n", fsp_str_dbg(fsp),
3709 strerror(errno)));
3710 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3711 }
3712 goto strict_unlock;
3713 }
3714
3715 nosendfile_read:
3716
3717 reply_outbuf(req, 12, smb_maxcnt);
3718
3719 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3720 saved_errno = errno;
3721
3722 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3723
3724 if (nread < 0) {
3725 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3726 return;
3727 }
3728
3729 setup_readX_header(req, (char *)req->outbuf, nread);
3730
3731 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3732 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3733
3734 chain_reply(req);
3735 return;
3736
3737 strict_unlock:
3738 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3739 TALLOC_FREE(req->outbuf);
3740 return;
3741 }
3742
3743 /****************************************************************************
3744 Reply to a read and X.
3745 ****************************************************************************/
3746
3747 void reply_read_and_X(struct smb_request *req)
3748 {
3749 struct smbd_server_connection *sconn = req->sconn;
3750 connection_struct *conn = req->conn;
3751 files_struct *fsp;
3752 SMB_OFF_T startpos;
3753 size_t smb_maxcnt;
3754 bool big_readX = False;
3755 #if 0
3756 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3757 #endif
3758
3759 START_PROFILE(SMBreadX);
3760
3761 if ((req->wct != 10) && (req->wct != 12)) {
3762 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3763 return;
3764 }
3765
3766 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3767 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3768 smb_maxcnt = SVAL(req->vwv+5, 0);
3769
3770 /* If it's an IPC, pass off the pipe handler. */
3771 if (IS_IPC(conn)) {
3772 reply_pipe_read_and_X(req);
3773 END_PROFILE(SMBreadX);
3774 return;
3775 }
3776
3777 if (!check_fsp(conn, req, fsp)) {
3778 END_PROFILE(SMBreadX);
3779 return;
3780 }
3781
3782 if (!CHECK_READ(fsp,req)) {
3783 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3784 END_PROFILE(SMBreadX);
3785 return;
3786 }
3787
3788 if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3789 (get_remote_arch() == RA_SAMBA)) {
3790 /*
3791 * This is Samba only behavior (up to Samba 3.6)!
3792 *
3793 * Windows 2008 R2 ignores the upper_size,
3794 * so we do unless unix extentions are active
3795 * or "smbclient" is talking to us.
3796 */
3797 size_t upper_size = SVAL(req->vwv+7, 0);
3798 smb_maxcnt |= (upper_size<<16);
3799 if (upper_size > 1) {
3800 /* Can't do this on a chained packet. */
3801 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3802 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3803 END_PROFILE(SMBreadX);
3804 return;
3805 }
3806 /* We currently don't do this on signed or sealed data. */
3807 if (srv_is_signing_active(req->sconn) ||
3808 is_encrypted_packet(req->sconn, req->inbuf)) {
3809 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3810 END_PROFILE(SMBreadX);
3811 return;
3812 }
3813 /* Is there room in the reply for this data ? */
3814 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3815 reply_nterror(req,
3816 NT_STATUS_INVALID_PARAMETER);
3817 END_PROFILE(SMBreadX);
3818 return;
3819 }
3820 big_readX = True;
3821 }
3822 }
3823
3824 if (req->wct == 12) {
3825 #ifdef LARGE_SMB_OFF_T
3826 /*
3827 * This is a large offset (64 bit) read.
3828 */
3829 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3830
3831 #else /* !LARGE_SMB_OFF_T */
3832
3833 /*
3834 * Ensure we haven't been sent a >32 bit offset.
3835 */
3836
3837 if(IVAL(req->vwv+10, 0) != 0) {
3838 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3839 "used and we don't support 64 bit offsets.\n",
3840 (unsigned int)IVAL(req->vwv+10, 0) ));
3841 END_PROFILE(SMBreadX);
3842 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3843 return;
3844 }
3845
3846 #endif /* LARGE_SMB_OFF_T */
3847
3848 }
3849
3850 if (!big_readX) {
3851 NTSTATUS status = schedule_aio_read_and_X(conn,
3852 req,
3853 fsp,
3854 startpos,
3855 smb_maxcnt);
3856 if (NT_STATUS_IS_OK(status)) {
3857 /* Read scheduled - we're done. */
3858 goto out;
3859 }
3860 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3861 /* Real error - report to client. */
3862 END_PROFILE(SMBreadX);
3863 reply_nterror(req, status);
3864 return;
3865 }
3866 /* NT_STATUS_RETRY - fall back to sync read. */
3867 }
3868
3869 smbd_lock_socket(req->sconn);
3870 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3871 smbd_unlock_socket(req->sconn);
3872
3873 out:
3874 END_PROFILE(SMBreadX);
3875 return;
3876 }
3877
3878 /****************************************************************************
3879 Error replies to writebraw must have smb_wct == 1. Fix this up.
3880 ****************************************************************************/
3881
3882 void error_to_writebrawerr(struct smb_request *req)
3883 {
3884 uint8 *old_outbuf = req->outbuf;
3885
3886 reply_outbuf(req, 1, 0);
3887
3888 memcpy(req->outbuf, old_outbuf, smb_size);
3889 TALLOC_FREE(old_outbuf);
3890 }
3891
3892 /****************************************************************************
3893 Read 4 bytes of a smb packet and return the smb length of the packet.
3894 Store the result in the buffer. This version of the function will
3895 never return a session keepalive (length of zero).
3896 Timeout is in milliseconds.
3897 ****************************************************************************/
3898
3899 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3900 size_t *len)
3901 {
3902 uint8_t msgtype = NBSSkeepalive;
3903
3904 while (msgtype == NBSSkeepalive) {
3905 NTSTATUS status;
3906
3907 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3908 len);
3909 if (!NT_STATUS_IS_OK(status)) {
3910 char addr[INET6_ADDRSTRLEN];
3911 /* Try and give an error message
3912 * saying what client failed. */
3913 DEBUG(0, ("read_fd_with_timeout failed for "
3914 "client %s read error = %s.\n",
3915 get_peer_addr(fd,addr,sizeof(addr)),
3916 nt_errstr(status)));
3917 return status;
3918 }
3919
3920 msgtype = CVAL(inbuf, 0);
3921 }
3922
3923 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3924 (unsigned long)len));
3925
3926 return NT_STATUS_OK;
3927 }
3928
3929 /****************************************************************************
3930 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3931 ****************************************************************************/
3932
3933 void reply_writebraw(struct smb_request *req)
3934 {
3935 connection_struct *conn = req->conn;
3936 char *buf = NULL;
3937 ssize_t nwritten=0;
3938 ssize_t total_written=0;
3939 size_t numtowrite=0;
3940 size_t tcount;
3941 SMB_OFF_T startpos;
3942 const char *data=NULL;
3943 bool write_through;
3944 files_struct *fsp;
3945 struct lock_struct lock;
3946 NTSTATUS status;
3947
3948 START_PROFILE(SMBwritebraw);
3949
3950 /*
3951 * If we ever reply with an error, it must have the SMB command
3952 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3953 * we're finished.
3954 */
3955 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3956
3957 if (srv_is_signing_active(req->sconn)) {
3958 END_PROFILE(SMBwritebraw);
3959 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3960 "raw reads/writes are disallowed.");
3961 }
3962
3963 if (req->wct < 12) {
3964 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3965 error_to_writebrawerr(req);
3966 END_PROFILE(SMBwritebraw);
3967 return;
3968 }
3969
3970 if (req->sconn->smb1.echo_handler.trusted_fde) {
3971 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3972 "'async smb echo handler = yes'\n"));
3973 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3974 error_to_writebrawerr(req);
3975 END_PROFILE(SMBwritebraw);
3976 return;
3977 }
3978
3979 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3980 if (!check_fsp(conn, req, fsp)) {
3981 error_to_writebrawerr(req);
3982 END_PROFILE(SMBwritebraw);
3983 return;
3984 }
3985
3986 if (!CHECK_WRITE(fsp)) {
3987 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3988 error_to_writebrawerr(req);
3989 END_PROFILE(SMBwritebraw);
3990 return;
3991 }
3992
3993 tcount = IVAL(req->vwv+1, 0);
3994 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3995 write_through = BITSETW(req->vwv+7,0);
3996
3997 /* We have to deal with slightly different formats depending
3998 on whether we are using the core+ or lanman1.0 protocol */
3999
4000 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4001 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4002 data = smb_buf_const(req->inbuf);
4003 } else {
4004 numtowrite = SVAL(req->vwv+10, 0);
4005 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4006 }
4007
4008 /* Ensure we don't write bytes past the end of this packet. */
4009 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4010 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4011 error_to_writebrawerr(req);
4012 END_PROFILE(SMBwritebraw);
4013 return;
4014 }
4015
4016 if (!fsp->print_file) {
4017 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4018 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4019 &lock);
4020
4021 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4022 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4023 error_to_writebrawerr(req);
4024 END_PROFILE(SMBwritebraw);
4025 return;
4026 }
4027 }
4028
4029 if (numtowrite>0) {
4030 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4031 }
4032
4033 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4034 "wrote=%d sync=%d\n",
4035 fsp->fnum, (double)startpos, (int)numtowrite,
4036 (int)nwritten, (int)write_through));
4037
4038 if (nwritten < (ssize_t)numtowrite) {
4039 reply_nterror(req, NT_STATUS_DISK_FULL);
4040 error_to_writebrawerr(req);
4041 goto strict_unlock;
4042 }
4043
4044 total_written = nwritten;
4045
4046 /* Allocate a buffer of 64k + length. */
4047 buf = talloc_array(NULL, char, 65540);
4048 if (!buf) {
4049 reply_nterror(req, NT_STATUS_NO_MEMORY);
4050 error_to_writebrawerr(req);
4051 goto strict_unlock;
4052 }
4053
4054 /* Return a SMBwritebraw message to the redirector to tell
4055 * it to send more bytes */
4056
4057 memcpy(buf, req->inbuf, smb_size);
4058 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4059 SCVAL(buf,smb_com,SMBwritebraw);
4060 SSVALS(buf,smb_vwv0,0xFFFF);
4061 show_msg(buf);
4062 if (!srv_send_smb(req->sconn,
4063 buf,
4064 false, 0, /* no signing */
4065 IS_CONN_ENCRYPTED(conn),
4066 &req->pcd)) {
4067 exit_server_cleanly("reply_writebraw: srv_send_smb "
4068 "failed.");
4069 }
4070
4071 /* Now read the raw data into the buffer and write it */
4072 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4073 &numtowrite);
4074 if (!NT_STATUS_IS_OK(status)) {
4075 exit_server_cleanly("secondary writebraw failed");
4076 }
4077
4078 /* Set up outbuf to return the correct size */
4079 reply_outbuf(req, 1, 0);
4080
4081 if (numtowrite != 0) {
4082
4083 if (numtowrite > 0xFFFF) {
4084 DEBUG(0,("reply_writebraw: Oversize secondary write "
4085 "raw requested (%u). Terminating\n",
4086 (unsigned int)numtowrite ));
4087 exit_server_cleanly("secondary writebraw failed");
4088 }
4089
4090 if (tcount > nwritten+numtowrite) {
4091 DEBUG(3,("reply_writebraw: Client overestimated the "
4092 "write %d %d %d\n",
4093 (int)tcount,(int)nwritten,(int)numtowrite));
4094 }
4095
4096 status = read_data(req->sconn->sock, buf+4, numtowrite);
4097
4098 if (!NT_STATUS_IS_OK(status)) {
4099 char addr[INET6_ADDRSTRLEN];
4100 /* Try and give an error message
4101 * saying what client failed. */
4102 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4103 "raw read failed (%s) for client %s. "
4104 "Terminating\n", nt_errstr(status),
4105 get_peer_addr(req->sconn->sock, addr,
4106 sizeof(addr))));
4107 exit_server_cleanly("secondary writebraw failed");
4108 }
4109
4110 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4111 if (nwritten == -1) {
4112 TALLOC_FREE(buf);
4113 reply_nterror(req, map_nt_error_from_unix(errno));
4114 error_to_writebrawerr(req);
4115 goto strict_unlock;
4116 }
4117
4118 if (nwritten < (ssize_t)numtowrite) {
4119 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4120 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4121 }
4122
4123 if (nwritten > 0) {
4124 total_written += nwritten;
4125 }
4126 }
4127
4128 TALLOC_FREE(buf);
4129 SSVAL(req->outbuf,smb_vwv0,total_written);
4130
4131 status = sync_file(conn, fsp, write_through);
4132 if (!NT_STATUS_IS_OK(status)) {
4133 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4134 fsp_str_dbg(fsp), nt_errstr(status)));
4135 reply_nterror(req, status);
4136 error_to_writebrawerr(req);
4137 goto strict_unlock;
4138 }
4139
4140 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4141 "wrote=%d\n",
4142 fsp->fnum, (double)startpos, (int)numtowrite,
4143 (int)total_written));
4144
4145 if (!fsp->print_file) {
4146 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4147 }
4148
4149 /* We won't return a status if write through is not selected - this
4150 * follows what WfWg does */
4151 END_PROFILE(SMBwritebraw);
4152
4153 if (!write_through && total_written==tcount) {
4154
4155 #if RABBIT_PELLET_FIX
4156 /*
4157 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4158 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4159 * JRA.
4160 */
4161 if (!send_keepalive(req->sconn->sock)) {
4162 exit_server_cleanly("reply_writebraw: send of "
4163 "keepalive failed");
4164 }
4165 #endif
4166 TALLOC_FREE(req->outbuf);
4167 }
4168 return;
4169
4170 strict_unlock:
4171 if (!fsp->print_file) {
4172 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4173 }
4174
4175 END_PROFILE(SMBwritebraw);
4176 return;
4177 }
4178
4179 #undef DBGC_CLASS
4180 #define DBGC_CLASS DBGC_LOCKING
4181
4182 /****************************************************************************
4183 Reply to a writeunlock (core+).
4184 ****************************************************************************/
4185
4186 void reply_writeunlock(struct smb_request *req)
4187 {
4188 connection_struct *conn = req->conn;
4189 ssize_t nwritten = -1;
4190 size_t numtowrite;
4191 SMB_OFF_T startpos;
4192 const char *data;
4193 NTSTATUS status = NT_STATUS_OK;
4194 files_struct *fsp;
4195 struct lock_struct lock;
4196 int saved_errno = 0;
4197
4198 START_PROFILE(SMBwriteunlock);
4199
4200 if (req->wct < 5) {
4201 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4202 END_PROFILE(SMBwriteunlock);
4203 return;
4204 }
4205
4206 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4207
4208 if (!check_fsp(conn, req, fsp)) {
4209 END_PROFILE(SMBwriteunlock);
4210 return;
4211 }
4212
4213 if (!CHECK_WRITE(fsp)) {
4214 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4215 END_PROFILE(SMBwriteunlock);
4216 return;
4217 }
4218
4219 numtowrite = SVAL(req->vwv+1, 0);
4220 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4221 data = (const char *)req->buf + 3;
4222
4223 if (!fsp->print_file && numtowrite > 0) {
4224 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4225 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4226 &lock);
4227
4228 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4229 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4230 END_PROFILE(SMBwriteunlock);
4231 return;
4232 }
4233 }
4234
4235 /* The special X/Open SMB protocol handling of
4236 zero length writes is *NOT* done for
4237 this call */
4238 if(numtowrite == 0) {
4239 nwritten = 0;
4240 } else {
4241 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4242 saved_errno = errno;
4243 }
4244
4245 status = sync_file(conn, fsp, False /* write through */);
4246 if (!NT_STATUS_IS_OK(status)) {
4247 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4248 fsp_str_dbg(fsp), nt_errstr(status)));
4249 reply_nterror(req, status);
4250 goto strict_unlock;
4251 }
4252
4253 if(nwritten < 0) {
4254 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4255 goto strict_unlock;
4256 }
4257
4258 if((nwritten < numtowrite) && (numtowrite != 0)) {
4259 reply_nterror(req, NT_STATUS_DISK_FULL);
4260 goto strict_unlock;
4261 }
4262
4263 if (numtowrite && !fsp->print_file) {
4264 status = do_unlock(req->sconn->msg_ctx,
4265 fsp,
4266 (uint64_t)req->smbpid,
4267 (uint64_t)numtowrite,
4268 (uint64_t)startpos,
4269 WINDOWS_LOCK);
4270
4271 if (NT_STATUS_V(status)) {
4272 reply_nterror(req, status);
4273 goto strict_unlock;
4274 }
4275 }
4276
4277 reply_outbuf(req, 1, 0);
4278
4279 SSVAL(req->outbuf,smb_vwv0,nwritten);
4280
4281 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4282 fsp->fnum, (int)numtowrite, (int)nwritten));
4283
4284 strict_unlock:
4285 if (numtowrite && !fsp->print_file) {
4286 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4287 }
4288
4289 END_PROFILE(SMBwriteunlock);
4290 return;
4291 }
4292
4293 #undef DBGC_CLASS
4294 #define DBGC_CLASS DBGC_ALL
4295
4296 /****************************************************************************
4297 Reply to a write.
4298 ****************************************************************************/
4299
4300 void reply_write(struct smb_request *req)
4301 {
4302 connection_struct *conn = req->conn;
4303 size_t numtowrite;
4304 ssize_t nwritten = -1;
4305 SMB_OFF_T startpos;
4306 const char *data;
4307 files_struct *fsp;
4308 struct lock_struct lock;
4309 NTSTATUS status;
4310 int saved_errno = 0;
4311
4312 START_PROFILE(SMBwrite);
4313
4314 if (req->wct < 5) {
4315 END_PROFILE(SMBwrite);
4316 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4317 return;
4318 }
4319
4320 /* If it's an IPC, pass off the pipe handler. */
4321 if (IS_IPC(conn)) {
4322 reply_pipe_write(req);
4323 END_PROFILE(SMBwrite);
4324 return;
4325 }
4326
4327 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4328
4329 if (!check_fsp(conn, req, fsp)) {
4330 END_PROFILE(SMBwrite);
4331 return;
4332 }
4333
4334 if (!CHECK_WRITE(fsp)) {
4335 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4336 END_PROFILE(SMBwrite);
4337 return;
4338 }
4339
4340 numtowrite = SVAL(req->vwv+1, 0);
4341 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4342 data = (const char *)req->buf + 3;
4343
4344 if (!fsp->print_file) {
4345 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4346 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4347 &lock);
4348
4349 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4350 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4351 END_PROFILE(SMBwrite);
4352 return;
4353 }
4354 }
4355
4356 /*
4357 * X/Open SMB protocol says that if smb_vwv1 is
4358 * zero then the file size should be extended or
4359 * truncated to the size given in smb_vwv[2-3].
4360 */
4361
4362 if(numtowrite == 0) {
4363 /*
4364 * This is actually an allocate call, and set EOF. JRA.
4365 */
4366 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4367 if (nwritten < 0) {
4368 reply_nterror(req, NT_STATUS_DISK_FULL);
4369 goto strict_unlock;
4370 }
4371 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4372 if (nwritten < 0) {
4373 reply_nterror(req, NT_STATUS_DISK_FULL);
4374 goto strict_unlock;
4375 }
4376 trigger_write_time_update_immediate(fsp);
4377 } else {
4378 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4379 }
4380
4381 status = sync_file(conn, fsp, False);
4382 if (!NT_STATUS_IS_OK(status)) {
4383 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4384 fsp_str_dbg(fsp), nt_errstr(status)));
4385 reply_nterror(req, status);
4386 goto strict_unlock;
4387 }
4388
4389 if(nwritten < 0) {
4390 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4391 goto strict_unlock;
4392 }
4393
4394 if((nwritten == 0) && (numtowrite != 0)) {
4395 reply_nterror(req, NT_STATUS_DISK_FULL);
4396 goto strict_unlock;
4397 }
4398
4399 reply_outbuf(req, 1, 0);
4400
4401 SSVAL(req->outbuf,smb_vwv0,nwritten);
4402
4403 if (nwritten < (ssize_t)numtowrite) {
4404 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4405 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4406 }
4407
4408 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4409
4410 strict_unlock:
4411 if (!fsp->print_file) {
4412 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4413 }
4414
4415 END_PROFILE(SMBwrite);
4416 return;
4417 }
4418
4419 /****************************************************************************
4420 Ensure a buffer is a valid writeX for recvfile purposes.
4421 ****************************************************************************/
4422
4423 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4424 (2*14) + /* word count (including bcc) */ \
4425 1 /* pad byte */)
4426
4427 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4428 const uint8_t *inbuf)
4429 {
4430 size_t numtowrite;
4431 connection_struct *conn = NULL;
4432 unsigned int doff = 0;
4433 size_t len = smb_len_large(inbuf);
4434
4435 if (is_encrypted_packet(sconn, inbuf)) {
4436 /* Can't do this on encrypted
4437 * connections. */
4438 return false;
4439 }
4440
4441 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4442 return false;
4443 }
4444
4445 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4446 CVAL(inbuf,smb_wct) != 14) {
4447 DEBUG(10,("is_valid_writeX_buffer: chained or "
4448 "invalid word length.\n"));
4449 return false;
4450 }
4451
4452 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4453 if (conn == NULL) {
4454 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4455 return false;
4456 }
4457 if (IS_IPC(conn)) {
4458 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4459 return false;
4460 }
4461 if (IS_PRINT(conn)) {
4462 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4463 return false;
4464 }
4465 doff = SVAL(inbuf,smb_vwv11);
4466
4467 numtowrite = SVAL(inbuf,smb_vwv10);
4468
4469 if (len > doff && len - doff > 0xFFFF) {
4470 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4471 }
4472
4473 if (numtowrite == 0) {
4474 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4475 return false;
4476 }
4477
4478 /* Ensure the sizes match up. */
4479 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4480 /* no pad byte...old smbclient :-( */
4481 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4482 (unsigned int)doff,
4483 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4484 return false;
4485 }
4486
4487 if (len - doff != numtowrite) {
4488 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4489 "len = %u, doff = %u, numtowrite = %u\n",
4490 (unsigned int)len,
4491 (unsigned int)doff,
4492 (unsigned int)numtowrite ));
4493 return false;
4494 }
4495
4496 DEBUG(10,("is_valid_writeX_buffer: true "
4497 "len = %u, doff = %u, numtowrite = %u\n",
4498 (unsigned int)len,
4499 (unsigned int)doff,
4500 (unsigned int)numtowrite ));
4501
4502 return true;
4503 }
4504
4505 /****************************************************************************
4506 Reply to a write and X.
4507 ****************************************************************************/
4508
4509 void reply_write_and_X(struct smb_request *req)
4510 {
4511 connection_struct *conn = req->conn;
4512 files_struct *fsp;
4513 struct lock_struct lock;
4514 SMB_OFF_T startpos;
4515 size_t numtowrite;
4516 bool write_through;
4517 ssize_t nwritten;
4518 unsigned int smb_doff;
4519 unsigned int smblen;
4520 const char *data;
4521 NTSTATUS status;
4522 int saved_errno = 0;
4523
4524 START_PROFILE(SMBwriteX);
4525
4526 if ((req->wct != 12) && (req->wct != 14)) {
4527 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4528 END_PROFILE(SMBwriteX);
4529 return;
4530 }
4531
4532 numtowrite = SVAL(req->vwv+10, 0);
4533 smb_doff = SVAL(req->vwv+11, 0);
4534 smblen = smb_len(req->inbuf);
4535
4536 if (req->unread_bytes > 0xFFFF ||
4537 (smblen > smb_doff &&
4538 smblen - smb_doff > 0xFFFF)) {
4539 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4540 }
4541
4542 if (req->unread_bytes) {
4543 /* Can't do a recvfile write on IPC$ */
4544 if (IS_IPC(conn)) {
4545 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4546 END_PROFILE(SMBwriteX);
4547 return;
4548 }
4549 if (numtowrite != req->unread_bytes) {
4550 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4551 END_PROFILE(SMBwriteX);
4552 return;
4553 }
4554 } else {
4555 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4556 smb_doff + numtowrite > smblen) {
4557 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4558 END_PROFILE(SMBwriteX);
4559 return;
4560 }
4561 }
4562
4563 /* If it's an IPC, pass off the pipe handler. */
4564 if (IS_IPC(conn)) {
4565 if (req->unread_bytes) {
4566 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4567 END_PROFILE(SMBwriteX);
4568 return;
4569 }
4570 reply_pipe_write_and_X(req);
4571 END_PROFILE(SMBwriteX);
4572 return;
4573 }
4574
4575 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4576 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4577 write_through = BITSETW(req->vwv+7,0);
4578
4579 if (!check_fsp(conn, req, fsp)) {
4580 END_PROFILE(SMBwriteX);
4581 return;
4582 }
4583
4584 if (!CHECK_WRITE(fsp)) {
4585 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4586 END_PROFILE(SMBwriteX);
4587 return;
4588 }
4589
4590 data = smb_base(req->inbuf) + smb_doff;
4591
4592 if(req->wct == 14) {
4593 #ifdef LARGE_SMB_OFF_T
4594 /*
4595 * This is a large offset (64 bit) write.
4596 */
4597 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4598
4599 #else /* !LARGE_SMB_OFF_T */
4600
4601 /*
4602 * Ensure we haven't been sent a >32 bit offset.
4603 */
4604
4605 if(IVAL(req->vwv+12, 0) != 0) {
4606 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4607 "used and we don't support 64 bit offsets.\n",
4608 (unsigned int)IVAL(req->vwv+12, 0) ));
4609 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4610 END_PROFILE(SMBwriteX);
4611 return;
4612 }
4613
4614 #endif /* LARGE_SMB_OFF_T */
4615 }
4616
4617 /* X/Open SMB protocol says that, unlike SMBwrite
4618 if the length is zero then NO truncation is
4619 done, just a write of zero. To truncate a file,
4620 use SMBwrite. */
4621
4622 if(numtowrite == 0) {
4623 nwritten = 0;
4624 } else {
4625 if (req->unread_bytes == 0) {
4626 status = schedule_aio_write_and_X(conn,
4627 req,
4628 fsp,
4629 data,
4630 startpos,
4631 numtowrite);
4632
4633 if (NT_STATUS_IS_OK(status)) {
4634 /* write scheduled - we're done. */
4635 goto out;
4636 }
4637 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4638 /* Real error - report to client. */
4639 reply_nterror(req, status);
4640 goto out;
4641 }
4642 /* NT_STATUS_RETRY - fall through to sync write. */
4643 }
4644
4645 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4646 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4647 &lock);
4648
4649 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4650 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4651 goto out;
4652 }
4653
4654 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4655 saved_errno = errno;
4656
4657 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4658 }
4659
4660 if(nwritten < 0) {
4661 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4662 goto out;
4663 }
4664
4665 if((nwritten == 0) && (numtowrite != 0)) {
4666 reply_nterror(req, NT_STATUS_DISK_FULL);
4667 goto out;
4668 }
4669
4670 reply_outbuf(req, 6, 0);
4671 SSVAL(req->outbuf,smb_vwv2,nwritten);
4672 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4673
4674 if (nwritten < (ssize_t)numtowrite) {
4675 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4676 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4677 }
4678
4679 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4680 fsp->fnum, (int)numtowrite, (int)nwritten));
4681
4682 status = sync_file(conn, fsp, write_through);
4683 if (!NT_STATUS_IS_OK(status)) {
4684 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4685 fsp_str_dbg(fsp), nt_errstr(status)));
4686 reply_nterror(req, status);
4687 goto out;
4688 }
4689
4690 END_PROFILE(SMBwriteX);
4691 chain_reply(req);
4692 return;
4693
4694 out:
4695 END_PROFILE(SMBwriteX);
4696 return;
4697 }
4698
4699 /****************************************************************************
4700 Reply to a lseek.
4701 ****************************************************************************/
4702
4703 void reply_lseek(struct smb_request *req)
4704 {
4705 connection_struct *conn = req->conn;
4706 SMB_OFF_T startpos;
4707 SMB_OFF_T res= -1;
4708 int mode,umode;
4709 files_struct *fsp;
4710
4711 START_PROFILE(SMBlseek);
4712
4713 if (req->wct < 4) {
4714 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4715 END_PROFILE(SMBlseek);
4716 return;
4717 }
4718
4719 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4720
4721 if (!check_fsp(conn, req, fsp)) {
4722 return;
4723 }
4724
4725 flush_write_cache(fsp, SEEK_FLUSH);
4726
4727 mode = SVAL(req->vwv+1, 0) & 3;
4728 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4729 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4730
4731 switch (mode) {
4732 case 0:
4733 umode = SEEK_SET;
4734 res = startpos;
4735 break;
4736 case 1:
4737 umode = SEEK_CUR;
4738 res = fsp->fh->pos + startpos;
4739 break;
4740 case 2:
4741 umode = SEEK_END;
4742 break;
4743 default:
4744 umode = SEEK_SET;
4745 res = startpos;
4746 break;
4747 }
4748
4749 if (umode == SEEK_END) {
4750 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4751 if(errno == EINVAL) {
4752 SMB_OFF_T current_pos = startpos;
4753
4754 if(fsp_stat(fsp) == -1) {
4755 reply_nterror(req,
4756 map_nt_error_from_unix(errno));
4757 END_PROFILE(SMBlseek);
4758 return;
4759 }
4760
4761 current_pos += fsp->fsp_name->st.st_ex_size;
4762 if(current_pos < 0)
4763 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4764 }
4765 }
4766
4767 if(res == -1) {
4768 reply_nterror(req, map_nt_error_from_unix(errno));
4769 END_PROFILE(SMBlseek);
4770 return;
4771 }
4772 }
4773
4774 fsp->fh->pos = res;
4775
4776 reply_outbuf(req, 2, 0);
4777 SIVAL(req->outbuf,smb_vwv0,res);
4778
4779 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4780 fsp->fnum, (double)startpos, (double)res, mode));
4781
4782 END_PROFILE(SMBlseek);
4783 return;
4784 }
4785
4786 /****************************************************************************
4787 Reply to a flush.
4788 ****************************************************************************/
4789
4790 void reply_flush(struct smb_request *req)
4791 {
4792 connection_struct *conn = req->conn;
4793 uint16 fnum;
4794 files_struct *fsp;
4795
4796 START_PROFILE(SMBflush);
4797
4798 if (req->wct < 1) {
4799 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4800 return;
4801 }
4802
4803 fnum = SVAL(req->vwv+0, 0);
4804 fsp = file_fsp(req, fnum);
4805
4806 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4807 return;
4808 }
4809
4810 if (!fsp) {
4811 file_sync_all(conn);
4812 } else {
4813 NTSTATUS status = sync_file(conn, fsp, True);
4814 if (!NT_STATUS_IS_OK(status)) {
4815 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4816 fsp_str_dbg(fsp), nt_errstr(status)));
4817 reply_nterror(req, status);
4818 END_PROFILE(SMBflush);
4819 return;
4820 }
4821 }
4822
4823 reply_outbuf(req, 0, 0);
4824
4825 DEBUG(3,("flush\n"));
4826 END_PROFILE(SMBflush);
4827 return;
4828 }
4829
4830 /****************************************************************************
4831 Reply to a exit.
4832 conn POINTER CAN BE NULL HERE !
4833 ****************************************************************************/
4834
4835 void reply_exit(struct smb_request *req)
4836 {
4837 START_PROFILE(SMBexit);
4838
4839 file_close_pid(req->sconn, req->smbpid, req->vuid);
4840
4841 reply_outbuf(req, 0, 0);
4842
4843 DEBUG(3,("exit\n"));
4844
4845 END_PROFILE(SMBexit);
4846 return;
4847 }
4848
4849 /****************************************************************************
4850 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4851 ****************************************************************************/
4852
4853 void reply_close(struct smb_request *req)
4854 {
4855 connection_struct *conn = req->conn;
4856 NTSTATUS status = NT_STATUS_OK;
4857 files_struct *fsp = NULL;
4858 START_PROFILE(SMBclose);
4859
4860 if (req->wct < 3) {
4861 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4862 END_PROFILE(SMBclose);
4863 return;
4864 }
4865
4866 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4867
4868 /*
4869 * We can only use check_fsp if we know it's not a directory.
4870 */
4871
4872 if (!check_fsp_open(conn, req, fsp)) {
4873 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4874 END_PROFILE(SMBclose);
4875 return;
4876 }
4877
4878 if(fsp->is_directory) {
4879 /*
4880 * Special case - close NT SMB directory handle.
4881 */
4882 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4883 status = close_file(req, fsp, NORMAL_CLOSE);
4884 } else {
4885 time_t t;
4886 /*
4887 * Close ordinary file.
4888 */
4889
4890 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4891 fsp->fh->fd, fsp->fnum,
4892 conn->num_files_open));
4893
4894 /*
4895 * Take care of any time sent in the close.
4896 */
4897
4898 t = srv_make_unix_date3(req->vwv+1);
4899 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4900
4901 /*
4902 * close_file() returns the unix errno if an error
4903 * was detected on close - normally this is due to
4904 * a disk full error. If not then it was probably an I/O error.
4905 */
4906
4907 status = close_file(req, fsp, NORMAL_CLOSE);
4908 }
4909
4910 if (!NT_STATUS_IS_OK(status)) {
4911 reply_nterror(req, status);
4912 END_PROFILE(SMBclose);
4913 return;
4914 }
4915
4916 reply_outbuf(req, 0, 0);
4917 END_PROFILE(SMBclose);
4918 return;
4919 }
4920
4921 /****************************************************************************
4922 Reply to a writeclose (Core+ protocol).
4923 ****************************************************************************/
4924
4925 void reply_writeclose(struct smb_request *req)
4926 {
4927 connection_struct *conn = req->conn;
4928 size_t numtowrite;
4929 ssize_t nwritten = -1;
4930 NTSTATUS close_status = NT_STATUS_OK;
4931 SMB_OFF_T startpos;
4932 const char *data;
4933 struct timespec mtime;
4934 files_struct *fsp;
4935 struct lock_struct lock;
4936
4937 START_PROFILE(SMBwriteclose);
4938
4939 if (req->wct < 6) {
4940 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4941 END_PROFILE(SMBwriteclose);
4942 return;
4943 }
4944
4945 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4946
4947 if (!check_fsp(conn, req, fsp)) {
4948 END_PROFILE(SMBwriteclose);
4949 return;
4950 }
4951 if (!CHECK_WRITE(fsp)) {
4952 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4953 END_PROFILE(SMBwriteclose);
4954 return;
4955 }
4956
4957 numtowrite = SVAL(req->vwv+1, 0);
4958 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4959 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4960 data = (const char *)req->buf + 1;
4961
4962 if (!fsp->print_file) {
4963 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4964 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4965 &lock);
4966
4967 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4968 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4969 END_PROFILE(SMBwriteclose);
4970 return;
4971 }
4972 }
4973
4974 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4975
4976 set_close_write_time(fsp, mtime);
4977
4978 /*
4979 * More insanity. W2K only closes the file if writelen > 0.
4980 * JRA.
4981 */
4982
4983 if (numtowrite) {
4984 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4985 "file %s\n", fsp_str_dbg(fsp)));
4986 close_status = close_file(req, fsp, NORMAL_CLOSE);
4987 }
4988
4989 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4990 fsp->fnum, (int)numtowrite, (int)nwritten,
4991 conn->num_files_open));
4992
4993 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4994 reply_nterror(req, NT_STATUS_DISK_FULL);
4995 goto strict_unlock;
4996 }
4997
4998 if(!NT_STATUS_IS_OK(close_status)) {
4999 reply_nterror(req, close_status);
5000 goto strict_unlock;
5001 }
5002
5003 reply_outbuf(req, 1, 0);
5004
5005 SSVAL(req->outbuf,smb_vwv0,nwritten);
5006
5007 strict_unlock:
5008 if (numtowrite && !fsp->print_file) {
5009 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5010 }
5011
5012 END_PROFILE(SMBwriteclose);
5013 return;
5014 }
5015
5016 #undef DBGC_CLASS
5017 #define DBGC_CLASS DBGC_LOCKING
5018
5019 /****************************************************************************
5020 Reply to a lock.
5021 ****************************************************************************/
5022
5023 void reply_lock(struct smb_request *req)
5024 {
5025 connection_struct *conn = req->conn;
5026 uint64_t count,offset;
5027 NTSTATUS status;
5028 files_struct *fsp;
5029 struct byte_range_lock *br_lck = NULL;
5030
5031 START_PROFILE(SMBlock);
5032
5033 if (req->wct < 5) {
5034 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5035 END_PROFILE(SMBlock);
5036 return;
5037 }
5038
5039 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5040
5041 if (!check_fsp(conn, req, fsp)) {
5042 END_PROFILE(SMBlock);
5043 return;
5044 }
5045
5046 count = (uint64_t)IVAL(req->vwv+1, 0);
5047 offset = (uint64_t)IVAL(req->vwv+3, 0);
5048
5049 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5050 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5051
5052 br_lck = do_lock(req->sconn->msg_ctx,
5053 fsp,
5054 (uint64_t)req->smbpid,
5055 count,
5056 offset,
5057 WRITE_LOCK,
5058 WINDOWS_LOCK,
5059 False, /* Non-blocking lock. */
5060 &status,
5061 NULL,
5062 NULL);
5063
5064 TALLOC_FREE(br_lck);
5065
5066 if (NT_STATUS_V(status)) {
5067 reply_nterror(req, status);
5068 END_PROFILE(SMBlock);
5069 return;
5070 }
5071
5072 reply_outbuf(req, 0, 0);
5073
5074 END_PROFILE(SMBlock);
5075 return;
5076 }
5077
5078 /****************************************************************************
5079 Reply to a unlock.
5080 ****************************************************************************/
5081
5082 void reply_unlock(struct smb_request *req)
5083 {
5084 connection_struct *conn = req->conn;
5085 uint64_t count,offset;
5086 NTSTATUS status;
5087 files_struct *fsp;
5088
5089 START_PROFILE(SMBunlock);
5090
5091 if (req->wct < 5) {
5092 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5093 END_PROFILE(SMBunlock);
5094 return;
5095 }
5096
5097 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5098
5099 if (!check_fsp(conn, req, fsp)) {
5100 END_PROFILE(SMBunlock);
5101 return;
5102 }
5103
5104 count = (uint64_t)IVAL(req->vwv+1, 0);
5105 offset = (uint64_t)IVAL(req->vwv+3, 0);
5106
5107 status = do_unlock(req->sconn->msg_ctx,
5108 fsp,
5109 (uint64_t)req->smbpid,
5110 count,
5111 offset,
5112 WINDOWS_LOCK);
5113
5114 if (NT_STATUS_V(status)) {
5115 reply_nterror(req, status);
5116 END_PROFILE(SMBunlock);
5117 return;
5118 }
5119
5120 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5121 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5122
5123 reply_outbuf(req, 0, 0);
5124
5125 END_PROFILE(SMBunlock);
5126 return;
5127 }
5128
5129 #undef DBGC_CLASS
5130 #define DBGC_CLASS DBGC_ALL
5131
5132 /****************************************************************************
5133 Reply to a tdis.
5134 conn POINTER CAN BE NULL HERE !
5135 ****************************************************************************/
5136
5137 void reply_tdis(struct smb_request *req)
5138 {
5139 connection_struct *conn = req->conn;
5140 START_PROFILE(SMBtdis);
5141
5142 if (!conn) {
5143 DEBUG(4,("Invalid connection in tdis\n"));
5144 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5145 END_PROFILE(SMBtdis);
5146 return;
5147 }
5148
5149 conn->used = False;
5150
5151 close_cnum(conn,req->vuid);
5152 req->conn = NULL;
5153
5154 reply_outbuf(req, 0, 0);
5155 END_PROFILE(SMBtdis);
5156 return;
5157 }
5158
5159 /****************************************************************************
5160 Reply to a echo.
5161 conn POINTER CAN BE NULL HERE !
5162 ****************************************************************************/
5163
5164 void reply_echo(struct smb_request *req)
5165 {
5166 connection_struct *conn = req->conn;
5167 struct smb_perfcount_data local_pcd;
5168 struct smb_perfcount_data *cur_pcd;
5169 int smb_reverb;
5170 int seq_num;
5171
5172 START_PROFILE(SMBecho);
5173
5174 smb_init_perfcount_data(&local_pcd);
5175
5176 if (req->wct < 1) {
5177 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5178 END_PROFILE(SMBecho);
5179 return;
5180 }
5181
5182 smb_reverb = SVAL(req->vwv+0, 0);
5183
5184 reply_outbuf(req, 1, req->buflen);
5185
5186 /* copy any incoming data back out */
5187 if (req->buflen > 0) {
5188 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5189 }
5190
5191 if (smb_reverb > 100) {
5192 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5193 smb_reverb = 100;
5194 }
5195
5196 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5197
5198 /* this makes sure we catch the request pcd */
5199 if (seq_num == smb_reverb) {
5200 cur_pcd = &req->pcd;
5201 } else {
5202 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5203 cur_pcd = &local_pcd;
5204 }
5205
5206 SSVAL(req->outbuf,smb_vwv0,seq_num);
5207
5208 show_msg((char *)req->outbuf);
5209 if (!srv_send_smb(req->sconn,
5210 (char *)req->outbuf,
5211 true, req->seqnum+1,
5212 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5213 cur_pcd))
5214 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5215 }
5216
5217 DEBUG(3,("echo %d times\n", smb_reverb));
5218
5219 TALLOC_FREE(req->outbuf);
5220
5221 END_PROFILE(SMBecho);
5222 return;
5223 }
5224
5225 /****************************************************************************
5226 Reply to a printopen.
5227 ****************************************************************************/
5228
5229 void reply_printopen(struct smb_request *req)
5230 {
5231 connection_struct *conn = req->conn;
5232 files_struct *fsp;
5233 NTSTATUS status;
5234
5235 START_PROFILE(SMBsplopen);
5236
5237 if (req->wct < 2) {
5238 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5239 END_PROFILE(SMBsplopen);
5240 return;
5241 }
5242
5243 if (!CAN_PRINT(conn)) {
5244 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5245 END_PROFILE(SMBsplopen);
5246 return;
5247 }
5248
5249 status = file_new(req, conn, &fsp);
5250 if(!NT_STATUS_IS_OK(status)) {
5251 reply_nterror(req, status);
5252 END_PROFILE(SMBsplopen);
5253 return;
5254 }
5255
5256 /* Open for exclusive use, write only. */
5257 status = print_spool_open(fsp, NULL, req->vuid);
5258
5259 if (!NT_STATUS_IS_OK(status)) {
5260 file_free(req, fsp);
5261 reply_nterror(req, status);
5262 END_PROFILE(SMBsplopen);
5263 return;
5264 }
5265
5266 reply_outbuf(req, 1, 0);
5267 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5268
5269 DEBUG(3,("openprint fd=%d fnum=%d\n",
5270 fsp->fh->fd, fsp->fnum));
5271
5272 END_PROFILE(SMBsplopen);
5273 return;
5274 }
5275
5276 /****************************************************************************
5277 Reply to a printclose.
5278 ****************************************************************************/
5279
5280 void reply_printclose(struct smb_request *req)
5281 {
5282 connection_struct *conn = req->conn;
5283 files_struct *fsp;
5284 NTSTATUS status;
5285
5286 START_PROFILE(SMBsplclose);
5287
5288 if (req->wct < 1) {
5289 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5290 END_PROFILE(SMBsplclose);
5291 return;
5292 }
5293
5294 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5295
5296 if (!check_fsp(conn, req, fsp)) {
5297 END_PROFILE(SMBsplclose);
5298 return;
5299 }
5300
5301 if (!CAN_PRINT(conn)) {
5302 reply_force_doserror(req, ERRSRV, ERRerror);
5303 END_PROFILE(SMBsplclose);
5304 return;
5305 }
5306
5307 DEBUG(3,("printclose fd=%d fnum=%d\n",
5308 fsp->fh->fd,fsp->fnum));
5309
5310 status = close_file(req, fsp, NORMAL_CLOSE);
5311
5312 if(!NT_STATUS_IS_OK(status)) {
5313 reply_nterror(req, status);
5314 END_PROFILE(SMBsplclose);
5315 return;
5316 }
5317
5318 reply_outbuf(req, 0, 0);
5319
5320 END_PROFILE(SMBsplclose);
5321 return;
5322 }
5323
5324 /****************************************************************************
5325 Reply to a printqueue.
5326 ****************************************************************************/
5327
5328 void reply_printqueue(struct smb_request *req)
5329 {
5330 connection_struct *conn = req->conn;
5331 int max_count;
5332 int start_index;
5333
5334 START_PROFILE(SMBsplretq);
5335
5336 if (req->wct < 2) {
5337 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5338 END_PROFILE(SMBsplretq);
5339 return;
5340 }
5341
5342 max_count = SVAL(req->vwv+0, 0);
5343 start_index = SVAL(req->vwv+1, 0);
5344
5345 /* we used to allow the client to get the cnum wrong, but that
5346 is really quite gross and only worked when there was only
5347 one printer - I think we should now only accept it if they
5348 get it right (tridge) */
5349 if (!CAN_PRINT(conn)) {
5350 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5351 END_PROFILE(SMBsplretq);
5352 return;
5353 }
5354
5355 reply_outbuf(req, 2, 3);
5356 SSVAL(req->outbuf,smb_vwv0,0);
5357 SSVAL(req->outbuf,smb_vwv1,0);
5358 SCVAL(smb_buf(req->outbuf),0,1);
5359 SSVAL(smb_buf(req->outbuf),1,0);
5360
5361 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5362 start_index, max_count));
5363
5364 {
5365 TALLOC_CTX *mem_ctx = talloc_tos();
5366 NTSTATUS status;
5367 WERROR werr;
5368 const char *sharename = lp_servicename(SNUM(conn));
5369 struct rpc_pipe_client *cli = NULL;
5370 struct dcerpc_binding_handle *b = NULL;
5371 struct policy_handle handle;
5372 struct spoolss_DevmodeContainer devmode_ctr;
5373 union spoolss_JobInfo *info;
5374 uint32_t count;
5375 uint32_t num_to_get;
5376 uint32_t first;
5377 uint32_t i;
5378
5379 ZERO_STRUCT(handle);
5380
5381 status = rpc_pipe_open_interface(conn,
5382 &ndr_table_spoolss.syntax_id,
5383 conn->session_info,
5384 conn->sconn->remote_address,
5385 conn->sconn->msg_ctx,
5386 &cli);
5387 if (!NT_STATUS_IS_OK(status)) {
5388 DEBUG(0, ("reply_printqueue: "
5389 "could not connect to spoolss: %s\n",
5390 nt_errstr(status)));
5391 reply_nterror(req, status);
5392 goto out;
5393 }
5394 b = cli->binding_handle;
5395
5396 ZERO_STRUCT(devmode_ctr);
5397
5398 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5399 sharename,
5400 NULL, devmode_ctr,
5401 SEC_FLAG_MAXIMUM_ALLOWED,
5402 &handle,
5403 &werr);
5404 if (!NT_STATUS_IS_OK(status)) {
5405 reply_nterror(req, status);
5406 goto out;
5407 }
5408 if (!W_ERROR_IS_OK(werr)) {
5409 reply_nterror(req, werror_to_ntstatus(werr));
5410 goto out;
5411 }
5412
5413 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5414 &handle,
5415 0, /* firstjob */
5416 0xff, /* numjobs */
5417 2, /* level */
5418 0, /* offered */
5419 &count,
5420 &info);
5421 if (!W_ERROR_IS_OK(werr)) {
5422 reply_nterror(req, werror_to_ntstatus(werr));
5423 goto out;
5424 }
5425
5426 if (max_count > 0) {
5427 first = start_index;
5428 } else {
5429 first = start_index + max_count + 1;
5430 }
5431
5432 if (first >= count) {
5433 num_to_get = first;
5434 } else {
5435 num_to_get = first + MIN(ABS(max_count), count - first);
5436 }
5437
5438 for (i = first; i < num_to_get; i++) {
5439 char blob[28];
5440 char *p = blob;
5441 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5442 int qstatus;
5443 uint16_t qrapjobid = pjobid_to_rap(sharename,
5444 info[i].info2.job_id);
5445
5446 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5447 qstatus = 2;
5448 } else {
5449 qstatus = 3;
5450 }
5451
5452 srv_put_dos_date2(p, 0, qtime);
5453 SCVAL(p, 4, qstatus);
5454 SSVAL(p, 5, qrapjobid);
5455 SIVAL(p, 7, info[i].info2.size);
5456 SCVAL(p, 11, 0);
5457 srvstr_push(blob, req->flags2, p+12,
5458 info[i].info2.notify_name, 16, STR_ASCII);
5459
5460 if (message_push_blob(
5461 &req->outbuf,
5462 data_blob_const(
5463 blob, sizeof(blob))) == -1) {
5464 reply_nterror(req, NT_STATUS_NO_MEMORY);
5465 goto out;
5466 }
5467 }
5468
5469 if (count > 0) {
5470 SSVAL(req->outbuf,smb_vwv0,count);
5471 SSVAL(req->outbuf,smb_vwv1,
5472 (max_count>0?first+count:first-1));
5473 SCVAL(smb_buf(req->outbuf),0,1);
5474 SSVAL(smb_buf(req->outbuf),1,28*count);
5475 }
5476
5477
5478 DEBUG(3, ("%u entries returned in queue\n",
5479 (unsigned)count));
5480
5481 out:
5482 if (b && is_valid_policy_hnd(&handle)) {
5483 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5484 }
5485
5486 }
5487
5488 END_PROFILE(SMBsplretq);
5489 return;
5490 }
5491
5492 /****************************************************************************
5493 Reply to a printwrite.
5494 ****************************************************************************/
5495
5496 void reply_printwrite(struct smb_request *req)
5497 {
5498 connection_struct *conn = req->conn;
5499 int numtowrite;
5500 const char *data;
5501 files_struct *fsp;
5502
5503 START_PROFILE(SMBsplwr);
5504
5505 if (req->wct < 1) {
5506 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5507 END_PROFILE(SMBsplwr);
5508 return;
5509 }
5510
5511 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5512
5513 if (!check_fsp(conn, req, fsp)) {
5514 END_PROFILE(SMBsplwr);
5515 return;
5516 }
5517
5518 if (!fsp->print_file) {
5519 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5520 END_PROFILE(SMBsplwr);
5521 return;
5522 }
5523
5524 if (!CHECK_WRITE(fsp)) {
5525 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5526 END_PROFILE(SMBsplwr);
5527 return;
5528 }
5529
5530 numtowrite = SVAL(req->buf, 1);
5531
5532 if (req->buflen < numtowrite + 3) {
5533 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5534 END_PROFILE(SMBsplwr);
5535 return;
5536 }
5537
5538 data = (const char *)req->buf + 3;
5539
5540 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5541 reply_nterror(req, map_nt_error_from_unix(errno));
5542 END_PROFILE(SMBsplwr);
5543 return;
5544 }
5545
5546 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5547
5548 END_PROFILE(SMBsplwr);
5549 return;
5550 }
5551
5552 /****************************************************************************
5553 Reply to a mkdir.
5554 ****************************************************************************/
5555
5556 void reply_mkdir(struct smb_request *req)
5557 {
5558 connection_struct *conn = req->conn;
5559 struct smb_filename *smb_dname = NULL;
5560 char *directory = NULL;
5561 NTSTATUS status;
5562 TALLOC_CTX *ctx = talloc_tos();
5563
5564 START_PROFILE(SMBmkdir);
5565
5566 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5567 STR_TERMINATE, &status);
5568 if (!NT_STATUS_IS_OK(status)) {
5569 reply_nterror(req, status);
5570 goto out;
5571 }
5572
5573 status = filename_convert(ctx, conn,
5574 req->flags2 & FLAGS2_DFS_PATHNAMES,
5575 directory,
5576 0,
5577 NULL,
5578 &smb_dname);
5579 if (!NT_STATUS_IS_OK(status)) {
5580 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5581 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5582 ERRSRV, ERRbadpath);
5583 goto out;
5584 }
5585 reply_nterror(req, status);
5586 goto out;
5587 }
5588
5589 status = create_directory(conn, req, smb_dname);
5590
5591 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5592
5593 if (!NT_STATUS_IS_OK(status)) {
5594
5595 if (!use_nt_status()
5596 && NT_STATUS_EQUAL(status,
5597 NT_STATUS_OBJECT_NAME_COLLISION)) {
5598 /*
5599 * Yes, in the DOS error code case we get a
5600 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5601 * samba4 torture test.
5602 */
5603 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5604 }
5605
5606 reply_nterror(req, status);
5607 goto out;
5608 }
5609
5610 reply_outbuf(req, 0, 0);
5611
5612 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5613 out:
5614 TALLOC_FREE(smb_dname);
5615 END_PROFILE(SMBmkdir);
5616 return;
5617 }
5618
5619 /****************************************************************************
5620 Reply to a rmdir.
5621 ****************************************************************************/
5622
5623 void reply_rmdir(struct smb_request *req)
5624 {
5625 connection_struct *conn = req->conn;
5626 struct smb_filename *smb_dname = NULL;
5627 char *directory = NULL;
5628 NTSTATUS status;
5629 TALLOC_CTX *ctx = talloc_tos();
5630 files_struct *fsp = NULL;
5631 int info = 0;
5632 struct smbd_server_connection *sconn = req->sconn;
5633
5634 START_PROFILE(SMBrmdir);
5635
5636 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5637 STR_TERMINATE, &status);
5638 if (!NT_STATUS_IS_OK(status)) {
5639 reply_nterror(req, status);
5640 goto out;
5641 }
5642
5643 status = filename_convert(ctx, conn,
5644 req->flags2 & FLAGS2_DFS_PATHNAMES,
5645 directory,
5646 0,
5647 NULL,
5648 &smb_dname);
5649 if (!NT_STATUS_IS_OK(status)) {
5650 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5651 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5652 ERRSRV, ERRbadpath);
5653 goto out;
5654 }
5655 reply_nterror(req, status);
5656 goto out;
5657 }
5658
5659 if (is_ntfs_stream_smb_fname(smb_dname)) {
5660 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5661 goto out;
5662 }
5663
5664 status = SMB_VFS_CREATE_FILE(
5665 conn, /* conn */
5666 req, /* req */
5667 0, /* root_dir_fid */
5668 smb_dname, /* fname */
5669 DELETE_ACCESS, /* access_mask */
5670 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5671 FILE_SHARE_DELETE),
5672 FILE_OPEN, /* create_disposition*/
5673 FILE_DIRECTORY_FILE, /* create_options */
5674 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5675 0, /* oplock_request */
5676 0, /* allocation_size */
5677 0, /* private_flags */
5678 NULL, /* sd */
5679 NULL, /* ea_list */
5680 &fsp, /* result */
5681 &info); /* pinfo */
5682
5683 if (!NT_STATUS_IS_OK(status)) {
5684 if (open_was_deferred(req->sconn, req->mid)) {
5685 /* We have re-scheduled this call. */
5686 goto out;
5687 }
5688 reply_nterror(req, status);
5689 goto out;
5690 }
5691
5692 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5693 if (!NT_STATUS_IS_OK(status)) {
5694 close_file(req, fsp, ERROR_CLOSE);
5695 reply_nterror(req, status);
5696 goto out;
5697 }
5698
5699 if (!set_delete_on_close(fsp, true, conn->session_info->unix_token)) {
5700 close_file(req, fsp, ERROR_CLOSE);
5701 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5702 goto out;
5703 }
5704
5705 status = close_file(req, fsp, NORMAL_CLOSE);
5706 if (!NT_STATUS_IS_OK(status)) {
5707 reply_nterror(req, status);
5708 } else {
5709 reply_outbuf(req, 0, 0);
5710 }
5711
5712 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5713
5714 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5715 out:
5716 TALLOC_FREE(smb_dname);
5717 END_PROFILE(SMBrmdir);
5718 return;
5719 }
5720
5721 /*******************************************************************
5722 Resolve wildcards in a filename rename.
5723 ********************************************************************/
5724
5725 static bool resolve_wildcards(TALLOC_CTX *ctx,
5726 const char *name1,
5727 const char *name2,
5728 char **pp_newname)
5729 {
5730 char *name2_copy = NULL;
5731 char *root1 = NULL;
5732 char *root2 = NULL;
5733 char *ext1 = NULL;
5734 char *ext2 = NULL;
5735 char *p,*p2, *pname1, *pname2;
5736
5737 name2_copy = talloc_strdup(ctx, name2);
5738 if (!name2_copy) {
5739 return False;
5740 }
5741
5742 pname1 = strrchr_m(name1,'/');
5743 pname2 = strrchr_m(name2_copy,'/');
5744
5745 if (!pname1 || !pname2) {
5746 return False;
5747 }
5748
5749 /* Truncate the copy of name2 at the last '/' */
5750 *pname2 = '\0';
5751
5752 /* Now go past the '/' */
5753 pname1++;
5754 pname2++;
5755
5756 root1 = talloc_strdup(ctx, pname1);
5757 root2 = talloc_strdup(ctx, pname2);
5758
5759 if (!root1 || !root2) {
5760 return False;
5761 }
5762
5763 p = strrchr_m(root1,'.');
5764 if (p) {
5765 *p = 0;
5766 ext1 = talloc_strdup(ctx, p+1);
5767 } else {
5768 ext1 = talloc_strdup(ctx, "");
5769 }
5770 p = strrchr_m(root2,'.');
5771 if (p) {
5772 *p = 0;
5773 ext2 = talloc_strdup(ctx, p+1);
5774 } else {
5775 ext2 = talloc_strdup(ctx, "");
5776 }
5777
5778 if (!ext1 || !ext2) {
5779 return False;
5780 }
5781
5782 p = root1;
5783 p2 = root2;
5784 while (*p2) {
5785 if (*p2 == '?') {
5786 /* Hmmm. Should this be mb-aware ? */
5787 *p2 = *p;
5788 p2++;
5789 } else if (*p2 == '*') {
5790 *p2 = '\0';
5791 root2 = talloc_asprintf(ctx, "%s%s",
5792 root2,
5793 p);
5794 if (!root2) {
5795 return False;
5796 }
5797 break;
5798 } else {
5799 p2++;
5800 }
5801 if (*p) {
5802 p++;
5803 }
5804 }
5805
5806 p = ext1;
5807 p2 = ext2;
5808 while (*p2) {
5809 if (*p2 == '?') {
5810 /* Hmmm. Should this be mb-aware ? */
5811 *p2 = *p;
5812 p2++;
5813 } else if (*p2 == '*') {
5814 *p2 = '\0';
5815 ext2 = talloc_asprintf(ctx, "%s%s",
5816 ext2,
5817 p);
5818 if (!ext2) {
5819 return False;
5820 }
5821 break;
5822 } else {
5823 p2++;
5824 }
5825 if (*p) {
5826 p++;
5827 }
5828 }
5829
5830 if (*ext2) {
5831 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5832 name2_copy,
5833 root2,
5834 ext2);
5835 } else {
5836 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5837 name2_copy,
5838 root2);
5839 }
5840
5841 if (!*pp_newname) {
5842 return False;
5843 }
5844
5845 return True;
5846 }
5847
5848 /****************************************************************************
5849 Ensure open files have their names updated. Updated to notify other smbd's
5850 asynchronously.
5851 ****************************************************************************/
5852
5853 static void rename_open_files(connection_struct *conn,
5854 struct share_mode_lock *lck,
5855 uint32_t orig_name_hash,
5856 const struct smb_filename *smb_fname_dst)
5857 {
5858 files_struct *fsp;
5859 bool did_rename = False;
5860 NTSTATUS status;
5861 uint32_t new_name_hash = 0;
5862
5863 for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5864 fsp = file_find_di_next(fsp)) {
5865 /* fsp_name is a relative path under the fsp. To change this for other
5866 sharepaths we need to manipulate relative paths. */
5867 /* TODO - create the absolute path and manipulate the newname
5868 relative to the sharepath. */
5869 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5870 continue;
5871 }
5872 if (fsp->name_hash != orig_name_hash) {
5873 continue;
5874 }
5875 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5876 "(file_id %s) from %s -> %s\n", fsp->fnum,
5877 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5878 smb_fname_str_dbg(smb_fname_dst)));
5879
5880 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5881 if (NT_STATUS_IS_OK(status)) {
5882 did_rename = True;
5883 new_name_hash = fsp->name_hash;
5884 }
5885 }
5886
5887 if (!did_rename) {
5888 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5889 "for %s\n", file_id_string_tos(&lck->id),
5890 smb_fname_str_dbg(smb_fname_dst)));
5891 }
5892
5893 /* Send messages to all smbd's (not ourself) that the name has changed. */
5894 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5895 orig_name_hash, new_name_hash,
5896 smb_fname_dst);
5897
5898 }
5899
5900 /****************************************************************************
5901 We need to check if the source path is a parent directory of the destination
5902 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5903 refuse the rename with a sharing violation. Under UNIX the above call can
5904 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5905 probably need to check that the client is a Windows one before disallowing
5906 this as a UNIX client (one with UNIX extensions) can know the source is a
5907 symlink and make this decision intelligently. Found by an excellent bug
5908 report from <AndyLiebman@aol.com>.
5909 ****************************************************************************/
5910
5911 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5912 const struct smb_filename *smb_fname_dst)
5913 {
5914 const char *psrc = smb_fname_src->base_name;
5915 const char *pdst = smb_fname_dst->base_name;
5916 size_t slen;
5917
5918 if (psrc[0] == '.' && psrc[1] == '/') {
5919 psrc += 2;
5920 }
5921 if (pdst[0] == '.' && pdst[1] == '/') {
5922 pdst += 2;
5923 }
5924 if ((slen = strlen(psrc)) > strlen(pdst)) {
5925 return False;
5926 }
5927 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5928 }
5929
5930 /*
5931 * Do the notify calls from a rename
5932 */
5933
5934 static void notify_rename(connection_struct *conn, bool is_dir,
5935 const struct smb_filename *smb_fname_src,
5936 const struct smb_filename *smb_fname_dst)
5937 {
5938 char *parent_dir_src = NULL;
5939 char *parent_dir_dst = NULL;
5940 uint32 mask;
5941
5942 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5943 : FILE_NOTIFY_CHANGE_FILE_NAME;
5944
5945 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5946 &parent_dir_src, NULL) ||
5947 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5948 &parent_dir_dst, NULL)) {
5949 goto out;
5950 }
5951
5952 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5953 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5954 smb_fname_src->base_name);
5955 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5956 smb_fname_dst->base_name);
5957 }
5958 else {
5959 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5960 smb_fname_src->base_name);
5961 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5962 smb_fname_dst->base_name);
5963 }
5964
5965 /* this is a strange one. w2k3 gives an additional event for
5966 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5967 files, but not directories */
5968 if (!is_dir) {
5969 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5970 FILE_NOTIFY_CHANGE_ATTRIBUTES
5971 |FILE_NOTIFY_CHANGE_CREATION,
5972 smb_fname_dst->base_name);
5973 }
5974 out:
5975 TALLOC_FREE(parent_dir_src);
5976 TALLOC_FREE(parent_dir_dst);
5977 }
5978
5979 /****************************************************************************
5980 Returns an error if the parent directory for a filename is open in an
5981 incompatible way.
5982 ****************************************************************************/
5983
5984 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5985 const struct smb_filename *smb_fname_dst_in)
5986 {
5987 char *parent_dir = NULL;
5988 struct smb_filename smb_fname_parent;
5989 struct file_id id;
5990 files_struct *fsp = NULL;
5991 int ret;
5992
5993 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5994 &parent_dir, NULL)) {
5995 return NT_STATUS_NO_MEMORY;
5996 }
5997 ZERO_STRUCT(smb_fname_parent);
5998 smb_fname_parent.base_name = parent_dir;
5999
6000 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6001 if (ret == -1) {
6002 return map_nt_error_from_unix(errno);
6003 }
6004
6005 /*
6006 * We're only checking on this smbd here, mostly good
6007 * enough.. and will pass tests.
6008 */
6009
6010 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6011 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6012 fsp = file_find_di_next(fsp)) {
6013 if (fsp->access_mask & DELETE_ACCESS) {
6014 return NT_STATUS_SHARING_VIOLATION;
6015 }
6016 }
6017 return NT_STATUS_OK;
6018 }
6019
6020 /****************************************************************************
6021 Rename an open file - given an fsp.
6022 ****************************************************************************/
6023
6024 NTSTATUS rename_internals_fsp(connection_struct *conn,
6025 files_struct *fsp,
6026 const struct smb_filename *smb_fname_dst_in,
6027 uint32 attrs,
6028 bool replace_if_exists)
6029 {
6030 TALLOC_CTX *ctx = talloc_tos();
6031 struct smb_filename *smb_fname_dst = NULL;
6032 NTSTATUS status = NT_STATUS_OK;
6033 struct share_mode_lock *lck = NULL;
6034 bool dst_exists, old_is_stream, new_is_stream;
6035
6036 status = check_name(conn, smb_fname_dst_in->base_name);
6037 if (!NT_STATUS_IS_OK(status)) {
6038 return status;
6039 }
6040
6041 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6042 if (!NT_STATUS_IS_OK(status)) {
6043 return status;
6044 }
6045
6046 /* Make a copy of the dst smb_fname structs */
6047
6048 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6049 if (!NT_STATUS_IS_OK(status)) {
6050 goto out;
6051 }
6052
6053 /*
6054 * Check for special case with case preserving and not
6055 * case sensitive. If the old last component differs from the original
6056 * last component only by case, then we should allow
6057 * the rename (user is trying to change the case of the
6058 * filename).
6059 */
6060 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6061 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6062 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6063 char *last_slash;
6064 char *fname_dst_lcomp_base_mod = NULL;
6065 struct smb_filename *smb_fname_orig_lcomp = NULL;
6066
6067 /*
6068 * Get the last component of the destination name.
6069 */
6070 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6071 if (last_slash) {
6072 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6073 } else {
6074 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6075 }
6076 if (!fname_dst_lcomp_base_mod) {
6077 status = NT_STATUS_NO_MEMORY;
6078 goto out;
6079 }
6080
6081 /*
6082 * Create an smb_filename struct using the original last
6083 * component of the destination.
6084 */
6085 status = create_synthetic_smb_fname_split(ctx,
6086 smb_fname_dst->original_lcomp, NULL,
6087 &smb_fname_orig_lcomp);
6088 if (!NT_STATUS_IS_OK(status)) {
6089 TALLOC_FREE(fname_dst_lcomp_base_mod);
6090 goto out;
6091 }
6092
6093 /* If the base names only differ by case, use original. */
6094 if(!strcsequal(fname_dst_lcomp_base_mod,
6095 smb_fname_orig_lcomp->base_name)) {
6096 char *tmp;
6097 /*
6098 * Replace the modified last component with the
6099 * original.
6100 */
6101 if (last_slash) {
6102 *last_slash = '\0'; /* Truncate at the '/' */
6103 tmp = talloc_asprintf(smb_fname_dst,
6104 "%s/%s",
6105 smb_fname_dst->base_name,
6106 smb_fname_orig_lcomp->base_name);
6107 } else {
6108 tmp = talloc_asprintf(smb_fname_dst,
6109 "%s",
6110 smb_fname_orig_lcomp->base_name);
6111 }
6112 if (tmp == NULL) {
6113 status = NT_STATUS_NO_MEMORY;
6114 TALLOC_FREE(fname_dst_lcomp_base_mod);
6115 TALLOC_FREE(smb_fname_orig_lcomp);
6116 goto out;
6117 }
6118 TALLOC_FREE(smb_fname_dst->base_name);
6119 smb_fname_dst->base_name = tmp;
6120 }
6121
6122 /* If the stream_names only differ by case, use original. */
6123 if(!strcsequal(smb_fname_dst->stream_name,
6124 smb_fname_orig_lcomp->stream_name)) {
6125 char *tmp = NULL;
6126 /* Use the original stream. */
6127 tmp = talloc_strdup(smb_fname_dst,
6128 smb_fname_orig_lcomp->stream_name);
6129 if (tmp == NULL) {
6130 status = NT_STATUS_NO_MEMORY;
6131 TALLOC_FREE(fname_dst_lcomp_base_mod);
6132 TALLOC_FREE(smb_fname_orig_lcomp);
6133 goto out;
6134 }
6135 TALLOC_FREE(smb_fname_dst->stream_name);
6136 smb_fname_dst->stream_name = tmp;
6137 }
6138 TALLOC_FREE(fname_dst_lcomp_base_mod);
6139 TALLOC_FREE(smb_fname_orig_lcomp);
6140 }
6141
6142 /*
6143 * If the src and dest names are identical - including case,
6144 * don't do the rename, just return success.
6145 */
6146
6147 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6148 strcsequal(fsp->fsp_name->stream_name,
6149 smb_fname_dst->stream_name)) {
6150 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6151 "- returning success\n",
6152 smb_fname_str_dbg(smb_fname_dst)));
6153 status = NT_STATUS_OK;
6154 goto out;
6155 }
6156
6157 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6158 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6159
6160 /* Return the correct error code if both names aren't streams. */
6161 if (!old_is_stream && new_is_stream) {
6162 status = NT_STATUS_OBJECT_NAME_INVALID;
6163 goto out;
6164 }
6165
6166 if (old_is_stream && !new_is_stream) {
6167 status = NT_STATUS_INVALID_PARAMETER;
6168 goto out;
6169 }
6170
6171 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6172
6173 if(!replace_if_exists && dst_exists) {
6174 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6175 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6176 smb_fname_str_dbg(smb_fname_dst)));
6177 status = NT_STATUS_OBJECT_NAME_COLLISION;
6178 goto out;
6179 }
6180
6181 if (dst_exists) {
6182 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6183 &smb_fname_dst->st);
6184 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6185 fileid);
6186 /* The file can be open when renaming a stream */
6187 if (dst_fsp && !new_is_stream) {
6188 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6189 status = NT_STATUS_ACCESS_DENIED;
6190 goto out;
6191 }
6192 }
6193
6194 /* Ensure we have a valid stat struct for the source. */
6195 status = vfs_stat_fsp(fsp);
6196 if (!NT_STATUS_IS_OK(status)) {
6197 goto out;
6198 }
6199
6200 status = can_rename(conn, fsp, attrs);
6201
6202 if (!NT_STATUS_IS_OK(status)) {
6203 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6204 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6205 smb_fname_str_dbg(smb_fname_dst)));
6206 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6207 status = NT_STATUS_ACCESS_DENIED;
6208 goto out;
6209 }
6210
6211 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6212 status = NT_STATUS_ACCESS_DENIED;
6213 }
6214
6215 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6216 NULL);
6217
6218 /*
6219 * We have the file open ourselves, so not being able to get the
6220 * corresponding share mode lock is a fatal error.
6221 */
6222
6223 SMB_ASSERT(lck != NULL);
6224
6225 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6226 uint32 create_options = fsp->fh->private_options;
6227
6228 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6229 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6230 smb_fname_str_dbg(smb_fname_dst)));
6231
6232 if (!lp_posix_pathnames() &&
6233 (lp_map_archive(SNUM(conn)) ||
6234 lp_store_dos_attributes(SNUM(conn)))) {
6235 /* We must set the archive bit on the newly
6236 renamed file. */
6237 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6238 uint32_t old_dosmode = dos_mode(conn,
6239 smb_fname_dst);
6240 file_set_dosmode(conn,
6241 smb_fname_dst,
6242 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6243 NULL,
6244 true);
6245 }
6246 }
6247
6248 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6249 smb_fname_dst);
6250
6251 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6252
6253 /*
6254 * A rename acts as a new file create w.r.t. allowing an initial delete
6255 * on close, probably because in Windows there is a new handle to the
6256 * new file. If initial delete on close was requested but not
6257 * originally set, we need to set it here. This is probably not 100% correct,
6258 * but will work for the CIFSFS client which in non-posix mode
6259 * depends on these semantics. JRA.
6260 */
6261
6262 if (create_options & FILE_DELETE_ON_CLOSE) {
6263 status = can_set_delete_on_close(fsp, 0);
6264
6265 if (NT_STATUS_IS_OK(status)) {
6266 /* Note that here we set the *inital* delete on close flag,
6267 * not the regular one. The magic gets handled in close. */
6268 fsp->initial_delete_on_close = True;
6269 }
6270 }
6271 TALLOC_FREE(lck);
6272 status = NT_STATUS_OK;
6273 goto out;
6274 }
6275
6276 TALLOC_FREE(lck);
6277
6278 if (errno == ENOTDIR || errno == EISDIR) {
6279 status = NT_STATUS_OBJECT_NAME_COLLISION;
6280 } else {
6281 status = map_nt_error_from_unix(errno);
6282 }
6283
6284 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6285 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6286 smb_fname_str_dbg(smb_fname_dst)));
6287
6288 out:
6289 TALLOC_FREE(smb_fname_dst);
6290
6291 return status;
6292 }
6293
6294 /****************************************************************************
6295 The guts of the rename command, split out so it may be called by the NT SMB
6296 code.
6297 ****************************************************************************/
6298
6299 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6300 connection_struct *conn,
6301 struct smb_request *req,
6302 struct smb_filename *smb_fname_src,
6303 struct smb_filename *smb_fname_dst,
6304 uint32 attrs,
6305 bool replace_if_exists,
6306 bool src_has_wild,
6307 bool dest_has_wild,
6308 uint32_t access_mask)
6309 {
6310 char *fname_src_dir = NULL;
6311 char *fname_src_mask = NULL;
6312 int count=0;
6313 NTSTATUS status = NT_STATUS_OK;
6314 struct smb_Dir *dir_hnd = NULL;
6315 const char *dname = NULL;
6316 char *talloced = NULL;
6317 long offset = 0;
6318 int create_options = 0;
6319 bool posix_pathnames = lp_posix_pathnames();
6320
6321 /*
6322 * Split the old name into directory and last component
6323 * strings. Note that unix_convert may have stripped off a
6324 * leading ./ from both name and newname if the rename is
6325 * at the root of the share. We need to make sure either both
6326 * name and newname contain a / character or neither of them do
6327 * as this is checked in resolve_wildcards().
6328 */
6329
6330 /* Split up the directory from the filename/mask. */
6331 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6332 &fname_src_dir, &fname_src_mask);
6333 if (!NT_STATUS_IS_OK(status)) {
6334 status = NT_STATUS_NO_MEMORY;
6335 goto out;
6336 }
6337
6338 /*
6339 * We should only check the mangled cache
6340 * here if unix_convert failed. This means
6341 * that the path in 'mask' doesn't exist
6342 * on the file system and so we need to look
6343 * for a possible mangle. This patch from
6344 * Tine Smukavec <valentin.smukavec@hermes.si>.
6345 */
6346
6347 if (!VALID_STAT(smb_fname_src->st) &&
6348 mangle_is_mangled(fname_src_mask, conn->params)) {
6349 char *new_mask = NULL;
6350 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6351 conn->params);
6352 if (new_mask) {
6353 TALLOC_FREE(fname_src_mask);
6354 fname_src_mask = new_mask;
6355 }
6356 }
6357
6358 if (!src_has_wild) {
6359 files_struct *fsp;
6360
6361 /*
6362 * Only one file needs to be renamed. Append the mask back
6363 * onto the directory.
6364 */
6365 TALLOC_FREE(smb_fname_src->base_name);
6366 if (ISDOT(fname_src_dir)) {
6367 /* Ensure we use canonical names on open. */
6368 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6369 "%s",
6370 fname_src_mask);
6371 } else {
6372 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6373 "%s/%s",
6374 fname_src_dir,
6375 fname_src_mask);
6376 }
6377 if (!smb_fname_src->base_name) {
6378 status = NT_STATUS_NO_MEMORY;
6379 goto out;
6380 }
6381
6382 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6383 "case_preserve = %d, short case preserve = %d, "
6384 "directory = %s, newname = %s, "
6385 "last_component_dest = %s\n",
6386 conn->case_sensitive, conn->case_preserve,
6387 conn->short_case_preserve,
6388 smb_fname_str_dbg(smb_fname_src),
6389 smb_fname_str_dbg(smb_fname_dst),
6390 smb_fname_dst->original_lcomp));
6391
6392 /* The dest name still may have wildcards. */
6393 if (dest_has_wild) {
6394 char *fname_dst_mod = NULL;
6395 if (!resolve_wildcards(smb_fname_dst,
6396 smb_fname_src->base_name,
6397 smb_fname_dst->base_name,
6398 &fname_dst_mod)) {
6399 DEBUG(6, ("rename_internals: resolve_wildcards "
6400 "%s %s failed\n",
6401 smb_fname_src->base_name,
6402 smb_fname_dst->base_name));
6403 status = NT_STATUS_NO_MEMORY;
6404 goto out;
6405 }
6406 TALLOC_FREE(smb_fname_dst->base_name);
6407 smb_fname_dst->base_name = fname_dst_mod;
6408 }
6409
6410 ZERO_STRUCT(smb_fname_src->st);
6411 if (posix_pathnames) {
6412 SMB_VFS_LSTAT(conn, smb_fname_src);
6413 } else {
6414 SMB_VFS_STAT(conn, smb_fname_src);
6415 }
6416
6417 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6418 create_options |= FILE_DIRECTORY_FILE;
6419 }
6420
6421 status = SMB_VFS_CREATE_FILE(
6422 conn, /* conn */
6423 req, /* req */
6424 0, /* root_dir_fid */
6425 smb_fname_src, /* fname */
6426 access_mask, /* access_mask */
6427 (FILE_SHARE_READ | /* share_access */
6428 FILE_SHARE_WRITE),
6429 FILE_OPEN, /* create_disposition*/
6430 create_options, /* create_options */
6431 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6432 0, /* oplock_request */
6433 0, /* allocation_size */
6434 0, /* private_flags */
6435 NULL, /* sd */
6436 NULL, /* ea_list */
6437 &fsp, /* result */
6438 NULL); /* pinfo */
6439
6440 if (!NT_STATUS_IS_OK(status)) {
6441 DEBUG(3, ("Could not open rename source %s: %s\n",
6442 smb_fname_str_dbg(smb_fname_src),
6443 nt_errstr(status)));
6444 goto out;
6445 }
6446
6447 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6448 attrs, replace_if_exists);
6449
6450 close_file(req, fsp, NORMAL_CLOSE);
6451
6452 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6453 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6454 smb_fname_str_dbg(smb_fname_dst)));
6455
6456 goto out;
6457 }
6458
6459 /*
6460 * Wildcards - process each file that matches.
6461 */
6462 if (strequal(fname_src_mask, "????????.???")) {
6463 TALLOC_FREE(fname_src_mask);
6464 fname_src_mask = talloc_strdup(ctx, "*");
6465 if (!fname_src_mask) {
6466 status = NT_STATUS_NO_MEMORY;
6467 goto out;
6468 }
6469 }
6470
6471 status = check_name(conn, fname_src_dir);
6472 if (!NT_STATUS_IS_OK(status)) {
6473 goto out;
6474 }
6475
6476 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6477 attrs);
6478 if (dir_hnd == NULL) {
6479 status = map_nt_error_from_unix(errno);
6480 goto out;
6481 }
6482
6483 status = NT_STATUS_NO_SUCH_FILE;
6484 /*
6485 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6486 * - gentest fix. JRA
6487 */
6488
6489 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6490 &talloced))) {
6491 files_struct *fsp = NULL;
6492 char *destname = NULL;
6493 bool sysdir_entry = False;
6494
6495 /* Quick check for "." and ".." */
6496 if (ISDOT(dname) || ISDOTDOT(dname)) {
6497 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6498 sysdir_entry = True;
6499 } else {
6500 TALLOC_FREE(talloced);
6501 continue;
6502 }
6503 }
6504
6505 if (!is_visible_file(conn, fname_src_dir, dname,
6506 &smb_fname_src->st, false)) {
6507 TALLOC_FREE(talloced);
6508 continue;
6509 }
6510
6511 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6512 TALLOC_FREE(talloced);
6513 continue;
6514 }
6515
6516 if (sysdir_entry) {
6517 status = NT_STATUS_OBJECT_NAME_INVALID;
6518 break;
6519 }
6520
6521 TALLOC_FREE(smb_fname_src->base_name);
6522 if (ISDOT(fname_src_dir)) {
6523 /* Ensure we use canonical names on open. */
6524 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6525 "%s",
6526 dname);
6527 } else {
6528 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6529 "%s/%s",
6530 fname_src_dir,
6531 dname);
6532 }
6533 if (!smb_fname_src->base_name) {
6534 status = NT_STATUS_NO_MEMORY;
6535 goto out;
6536 }
6537
6538 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6539 smb_fname_dst->base_name,
6540 &destname)) {
6541 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6542 smb_fname_src->base_name, destname));
6543 TALLOC_FREE(talloced);
6544 continue;
6545 }
6546 if (!destname) {
6547 status = NT_STATUS_NO_MEMORY;
6548 goto out;
6549 }
6550
6551 TALLOC_FREE(smb_fname_dst->base_name);
6552 smb_fname_dst->base_name = destname;
6553
6554 ZERO_STRUCT(smb_fname_src->st);
6555 if (posix_pathnames) {
6556 SMB_VFS_LSTAT(conn, smb_fname_src);
6557 } else {
6558 SMB_VFS_STAT(conn, smb_fname_src);
6559 }
6560
6561 create_options = 0;
6562
6563 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6564 create_options |= FILE_DIRECTORY_FILE;
6565 }
6566
6567 status = SMB_VFS_CREATE_FILE(
6568 conn, /* conn */
6569 req, /* req */
6570 0, /* root_dir_fid */
6571 smb_fname_src, /* fname */
6572 access_mask, /* access_mask */
6573 (FILE_SHARE_READ | /* share_access */
6574 FILE_SHARE_WRITE),
6575 FILE_OPEN, /* create_disposition*/
6576 create_options, /* create_options */
6577 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6578 0, /* oplock_request */
6579 0, /* allocation_size */
6580 0, /* private_flags */
6581 NULL, /* sd */
6582 NULL, /* ea_list */
6583 &fsp, /* result */
6584 NULL); /* pinfo */
6585
6586 if (!NT_STATUS_IS_OK(status)) {
6587 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6588 "returned %s rename %s -> %s\n",
6589 nt_errstr(status),
6590 smb_fname_str_dbg(smb_fname_src),
6591 smb_fname_str_dbg(smb_fname_dst)));
6592 break;
6593 }
6594
6595 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6596 dname);
6597 if (!smb_fname_dst->original_lcomp) {
6598 status = NT_STATUS_NO_MEMORY;
6599 goto out;
6600 }
6601
6602 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6603 attrs, replace_if_exists);
6604
6605 close_file(req, fsp, NORMAL_CLOSE);
6606
6607 if (!NT_STATUS_IS_OK(status)) {
6608 DEBUG(3, ("rename_internals_fsp returned %s for "
6609 "rename %s -> %s\n", nt_errstr(status),
6610 smb_fname_str_dbg(smb_fname_src),
6611 smb_fname_str_dbg(smb_fname_dst)));
6612 break;
6613 }
6614
6615 count++;
6616
6617 DEBUG(3,("rename_internals: doing rename on %s -> "
6618 "%s\n", smb_fname_str_dbg(smb_fname_src),
6619 smb_fname_str_dbg(smb_fname_src)));
6620 TALLOC_FREE(talloced);
6621 }
6622 TALLOC_FREE(dir_hnd);
6623
6624 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6625 status = map_nt_error_from_unix(errno);
6626 }
6627
6628 out:
6629 TALLOC_FREE(talloced);
6630 TALLOC_FREE(fname_src_dir);
6631 TALLOC_FREE(fname_src_mask);
6632 return status;
6633 }
6634
6635 /****************************************************************************
6636 Reply to a mv.
6637 ****************************************************************************/
6638
6639 void reply_mv(struct smb_request *req)
6640 {
6641 connection_struct *conn = req->conn;
6642 char *name = NULL;
6643 char *newname = NULL;
6644 const char *p;
6645 uint32 attrs;
6646 NTSTATUS status;
6647 bool src_has_wcard = False;
6648 bool dest_has_wcard = False;
6649 TALLOC_CTX *ctx = talloc_tos();
6650 struct smb_filename *smb_fname_src = NULL;
6651 struct smb_filename *smb_fname_dst = NULL;
6652 bool stream_rename = false;
6653
6654 START_PROFILE(SMBmv);
6655
6656 if (req->wct < 1) {
6657 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6658 goto out;
6659 }
6660
6661 attrs = SVAL(req->vwv+0, 0);
6662
6663 p = (const char *)req->buf + 1;
6664 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6665 &status, &src_has_wcard);
6666 if (!NT_STATUS_IS_OK(status)) {
6667 reply_nterror(req, status);
6668 goto out;
6669 }
6670 p++;
6671 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6672 &status, &dest_has_wcard);
6673 if (!NT_STATUS_IS_OK(status)) {
6674 reply_nterror(req, status);
6675 goto out;
6676 }
6677
6678 if (!lp_posix_pathnames()) {
6679 /* The newname must begin with a ':' if the
6680 name contains a ':'. */
6681 if (strchr_m(name, ':')) {
6682 if (newname[0] != ':') {
6683 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6684 goto out;
6685 }
6686 stream_rename = true;
6687 }
6688 }
6689
6690 status = filename_convert(ctx,
6691 conn,
6692 req->flags2 & FLAGS2_DFS_PATHNAMES,
6693 name,
6694 UCF_COND_ALLOW_WCARD_LCOMP,
6695 &src_has_wcard,
6696 &smb_fname_src);
6697
6698 if (!NT_STATUS_IS_OK(status)) {
6699 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6700 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6701 ERRSRV, ERRbadpath);
6702 goto out;
6703 }
6704 reply_nterror(req, status);
6705 goto out;
6706 }
6707
6708 status = filename_convert(ctx,
6709 conn,
6710 req->flags2 & FLAGS2_DFS_PATHNAMES,
6711 newname,
6712 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6713 &dest_has_wcard,
6714 &smb_fname_dst);
6715
6716 if (!NT_STATUS_IS_OK(status)) {
6717 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6718 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6719 ERRSRV, ERRbadpath);
6720 goto out;
6721 }
6722 reply_nterror(req, status);
6723 goto out;
6724 }
6725
6726 if (stream_rename) {
6727 /* smb_fname_dst->base_name must be the same as
6728 smb_fname_src->base_name. */
6729 TALLOC_FREE(smb_fname_dst->base_name);
6730 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6731 smb_fname_src->base_name);
6732 if (!smb_fname_dst->base_name) {
6733 reply_nterror(req, NT_STATUS_NO_MEMORY);
6734 goto out;
6735 }
6736 }
6737
6738 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6739 smb_fname_str_dbg(smb_fname_dst)));
6740
6741 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6742 attrs, False, src_has_wcard, dest_has_wcard,
6743 DELETE_ACCESS);
6744 if (!NT_STATUS_IS_OK(status)) {
6745 if (open_was_deferred(req->sconn, req->mid)) {
6746 /* We have re-scheduled this call. */
6747 goto out;
6748 }
6749 reply_nterror(req, status);
6750 goto out;
6751 }
6752
6753 reply_outbuf(req, 0, 0);
6754 out:
6755 TALLOC_FREE(smb_fname_src);
6756 TALLOC_FREE(smb_fname_dst);
6757 END_PROFILE(SMBmv);
6758 return;
6759 }
6760
6761 /*******************************************************************
6762 Copy a file as part of a reply_copy.
6763 ******************************************************************/
6764
6765 /*
6766 * TODO: check error codes on all callers
6767 */
6768
6769 NTSTATUS copy_file(TALLOC_CTX *ctx,
6770 connection_struct *conn,
6771 struct smb_filename *smb_fname_src,
6772 struct smb_filename *smb_fname_dst,
6773 int ofun,
6774 int count,
6775 bool target_is_directory)
6776 {
6777 struct smb_filename *smb_fname_dst_tmp = NULL;
6778 SMB_OFF_T ret=-1;
6779 files_struct *fsp1,*fsp2;
6780 uint32 dosattrs;
6781 uint32 new_create_disposition;
6782 NTSTATUS status;
6783
6784
6785 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6786 if (!NT_STATUS_IS_OK(status)) {
6787 return status;
6788 }
6789
6790 /*
6791 * If the target is a directory, extract the last component from the
6792 * src filename and append it to the dst filename
6793 */
6794 if (target_is_directory) {
6795 const char *p;
6796
6797 /* dest/target can't be a stream if it's a directory. */
6798 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6799
6800 p = strrchr_m(smb_fname_src->base_name,'/');
6801 if (p) {
6802 p++;
6803 } else {
6804 p = smb_fname_src->base_name;
6805 }
6806 smb_fname_dst_tmp->base_name =
6807 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6808 p);
6809 if (!smb_fname_dst_tmp->base_name) {
6810 status = NT_STATUS_NO_MEMORY;
6811 goto out;
6812 }
6813 }
6814
6815 status = vfs_file_exist(conn, smb_fname_src);
6816 if (!NT_STATUS_IS_OK(status)) {
6817 goto out;
6818 }
6819
6820 if (!target_is_directory && count) {
6821 new_create_disposition = FILE_OPEN;
6822 } else {
6823 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6824 0, ofun,
6825 NULL, NULL,
6826 &new_create_disposition,
6827 NULL,
6828 NULL)) {
6829 status = NT_STATUS_INVALID_PARAMETER;
6830 goto out;
6831 }
6832 }
6833
6834 /* Open the src file for reading. */
6835 status = SMB_VFS_CREATE_FILE(
6836 conn, /* conn */
6837 NULL, /* req */
6838 0, /* root_dir_fid */
6839 smb_fname_src, /* fname */
6840 FILE_GENERIC_READ, /* access_mask */
6841 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6842 FILE_OPEN, /* create_disposition*/
6843 0, /* create_options */
6844 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6845 INTERNAL_OPEN_ONLY, /* oplock_request */
6846 0, /* allocation_size */
6847 0, /* private_flags */
6848 NULL, /* sd */
6849 NULL, /* ea_list */
6850 &fsp1, /* result */
6851 NULL); /* psbuf */
6852
6853 if (!NT_STATUS_IS_OK(status)) {
6854 goto out;
6855 }
6856
6857 dosattrs = dos_mode(conn, smb_fname_src);
6858
6859 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6860 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6861 }
6862
6863 /* Open the dst file for writing. */
6864 status = SMB_VFS_CREATE_FILE(
6865 conn, /* conn */
6866 NULL, /* req */
6867 0, /* root_dir_fid */
6868 smb_fname_dst, /* fname */
6869 FILE_GENERIC_WRITE, /* access_mask */
6870 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6871 new_create_disposition, /* create_disposition*/
6872 0, /* create_options */
6873 dosattrs, /* file_attributes */
6874 INTERNAL_OPEN_ONLY, /* oplock_request */
6875 0, /* allocation_size */
6876 0, /* private_flags */
6877 NULL, /* sd */
6878 NULL, /* ea_list */
6879 &fsp2, /* result */
6880 NULL); /* psbuf */
6881
6882 if (!NT_STATUS_IS_OK(status)) {
6883 close_file(NULL, fsp1, ERROR_CLOSE);
6884 goto out;
6885 }
6886
6887 if (ofun & OPENX_FILE_EXISTS_OPEN) {
6888 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6889 if (ret == -1) {
6890 DEBUG(0, ("error - vfs lseek returned error %s\n",
6891 strerror(errno)));
6892 status = map_nt_error_from_unix(errno);
6893 close_file(NULL, fsp1, ERROR_CLOSE);
6894 close_file(NULL, fsp2, ERROR_CLOSE);
6895 goto out;
6896 }
6897 }
6898
6899 /* Do the actual copy. */
6900 if (smb_fname_src->st.st_ex_size) {
6901 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6902 } else {
6903 ret = 0;
6904 }
6905
6906 close_file(NULL, fsp1, NORMAL_CLOSE);
6907
6908 /* Ensure the modtime is set correctly on the destination file. */
6909 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6910
6911 /*
6912 * As we are opening fsp1 read-only we only expect
6913 * an error on close on fsp2 if we are out of space.
6914 * Thus we don't look at the error return from the
6915 * close of fsp1.
6916 */
6917 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6918
6919 if (!NT_STATUS_IS_OK(status)) {
6920 goto out;
6921 }
6922
6923 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6924 status = NT_STATUS_DISK_FULL;
6925 goto out;
6926 }
6927
6928 status = NT_STATUS_OK;
6929
6930 out:
6931 TALLOC_FREE(smb_fname_dst_tmp);
6932 return status;
6933 }
6934
6935 /****************************************************************************
6936 Reply to a file copy.
6937 ****************************************************************************/
6938
6939 void reply_copy(struct smb_request *req)
6940 {
6941 connection_struct *conn = req->conn;
6942 struct smb_filename *smb_fname_src = NULL;
6943 struct smb_filename *smb_fname_dst = NULL;
6944 char *fname_src = NULL;
6945 char *fname_dst = NULL;
6946 char *fname_src_mask = NULL;
6947 char *fname_src_dir = NULL;
6948 const char *p;
6949 int count=0;
6950 int error = ERRnoaccess;
6951 int tid2;
6952 int ofun;
6953 int flags;
6954 bool target_is_directory=False;
6955 bool source_has_wild = False;
6956 bool dest_has_wild = False;
6957 NTSTATUS status;
6958 TALLOC_CTX *ctx = talloc_tos();
6959
6960 START_PROFILE(SMBcopy);
6961
6962 if (req->wct < 3) {
6963 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6964 goto out;
6965 }
6966
6967 tid2 = SVAL(req->vwv+0, 0);
6968 ofun = SVAL(req->vwv+1, 0);
6969 flags = SVAL(req->vwv+2, 0);
6970
6971 p = (const char *)req->buf;
6972 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6973 &status, &source_has_wild);
6974 if (!NT_STATUS_IS_OK(status)) {
6975 reply_nterror(req, status);
6976 goto out;
6977 }
6978 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6979 &status, &dest_has_wild);
6980 if (!NT_STATUS_IS_OK(status)) {
6981 reply_nterror(req, status);
6982 goto out;
6983 }
6984
6985 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6986
6987 if (tid2 != conn->cnum) {
6988 /* can't currently handle inter share copies XXXX */
6989 DEBUG(3,("Rejecting inter-share copy\n"));
6990 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6991 goto out;
6992 }
6993
6994 status = filename_convert(ctx, conn,
6995 req->flags2 & FLAGS2_DFS_PATHNAMES,
6996 fname_src,
6997 UCF_COND_ALLOW_WCARD_LCOMP,
6998 &source_has_wild,
6999 &smb_fname_src);
7000 if (!NT_STATUS_IS_OK(status)) {
7001 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7002 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7003 ERRSRV, ERRbadpath);
7004 goto out;
7005 }
7006 reply_nterror(req, status);
7007 goto out;
7008 }
7009
7010 status = filename_convert(ctx, conn,
7011 req->flags2 & FLAGS2_DFS_PATHNAMES,
7012 fname_dst,
7013 UCF_COND_ALLOW_WCARD_LCOMP,
7014 &dest_has_wild,
7015 &smb_fname_dst);
7016 if (!NT_STATUS_IS_OK(status)) {
7017 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7018 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7019 ERRSRV, ERRbadpath);
7020 goto out;
7021 }
7022 reply_nterror(req, status);
7023 goto out;
7024 }
7025
7026 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7027
7028 if ((flags&1) && target_is_directory) {
7029 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7030 goto out;
7031 }
7032
7033 if ((flags&2) && !target_is_directory) {
7034 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7035 goto out;
7036 }
7037
7038 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7039 /* wants a tree copy! XXXX */
7040 DEBUG(3,("Rejecting tree copy\n"));
7041 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7042 goto out;
7043 }
7044
7045 /* Split up the directory from the filename/mask. */
7046 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7047 &fname_src_dir, &fname_src_mask);
7048 if (!NT_STATUS_IS_OK(status)) {
7049 reply_nterror(req, NT_STATUS_NO_MEMORY);
7050 goto out;
7051 }
7052
7053 /*
7054 * We should only check the mangled cache
7055 * here if unix_convert failed. This means
7056 * that the path in 'mask' doesn't exist
7057 * on the file system and so we need to look
7058 * for a possible mangle. This patch from
7059 * Tine Smukavec <valentin.smukavec@hermes.si>.
7060 */
7061 if (!VALID_STAT(smb_fname_src->st) &&
7062 mangle_is_mangled(fname_src_mask, conn->params)) {
7063 char *new_mask = NULL;
7064 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7065 &new_mask, conn->params);
7066
7067 /* Use demangled name if one was successfully found. */
7068 if (new_mask) {
7069 TALLOC_FREE(fname_src_mask);
7070 fname_src_mask = new_mask;
7071 }
7072 }
7073
7074 if (!source_has_wild) {
7075
7076 /*
7077 * Only one file needs to be copied. Append the mask back onto
7078 * the directory.
7079 */
7080 TALLOC_FREE(smb_fname_src->base_name);
7081 if (ISDOT(fname_src_dir)) {
7082 /* Ensure we use canonical names on open. */
7083 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7084 "%s",
7085 fname_src_mask);
7086 } else {
7087 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7088 "%s/%s",
7089 fname_src_dir,
7090 fname_src_mask);
7091 }
7092 if (!smb_fname_src->base_name) {
7093 reply_nterror(req, NT_STATUS_NO_MEMORY);
7094 goto out;
7095 }
7096
7097 if (dest_has_wild) {
7098 char *fname_dst_mod = NULL;
7099 if (!resolve_wildcards(smb_fname_dst,
7100 smb_fname_src->base_name,
7101 smb_fname_dst->base_name,
7102 &fname_dst_mod)) {
7103 reply_nterror(req, NT_STATUS_NO_MEMORY);
7104 goto out;
7105 }
7106 TALLOC_FREE(smb_fname_dst->base_name);
7107 smb_fname_dst->base_name = fname_dst_mod;
7108 }
7109
7110 status = check_name(conn, smb_fname_src->base_name);
7111 if (!NT_STATUS_IS_OK(status)) {
7112 reply_nterror(req, status);
7113 goto out;
7114 }
7115
7116 status = check_name(conn, smb_fname_dst->base_name);
7117 if (!NT_STATUS_IS_OK(status)) {
7118 reply_nterror(req, status);
7119 goto out;
7120 }
7121
7122 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7123 ofun, count, target_is_directory);
7124
7125 if(!NT_STATUS_IS_OK(status)) {
7126 reply_nterror(req, status);
7127 goto out;
7128 } else {
7129 count++;
7130 }
7131 } else {
7132 struct smb_Dir *dir_hnd = NULL;
7133 const char *dname = NULL;
7134 char *talloced = NULL;
7135 long offset = 0;
7136
7137 /*
7138 * There is a wildcard that requires us to actually read the
7139 * src dir and copy each file matching the mask to the dst.
7140 * Right now streams won't be copied, but this could
7141 * presumably be added with a nested loop for reach dir entry.
7142 */
7143 SMB_ASSERT(!smb_fname_src->stream_name);
7144 SMB_ASSERT(!smb_fname_dst->stream_name);
7145
7146 smb_fname_src->stream_name = NULL;
7147 smb_fname_dst->stream_name = NULL;
7148
7149 if (strequal(fname_src_mask,"????????.???")) {
7150 TALLOC_FREE(fname_src_mask);
7151 fname_src_mask = talloc_strdup(ctx, "*");
7152 if (!fname_src_mask) {
7153 reply_nterror(req, NT_STATUS_NO_MEMORY);
7154 goto out;
7155 }
7156 }
7157
7158 status = check_name(conn, fname_src_dir);
7159 if (!NT_STATUS_IS_OK(status)) {
7160 reply_nterror(req, status);
7161 goto out;
7162 }
7163
7164 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7165 if (dir_hnd == NULL) {
7166 status = map_nt_error_from_unix(errno);
7167 reply_nterror(req, status);
7168 goto out;
7169 }
7170
7171 error = ERRbadfile;
7172
7173 /* Iterate over the src dir copying each entry to the dst. */
7174 while ((dname = ReadDirName(dir_hnd, &offset,
7175 &smb_fname_src->st, &talloced))) {
7176 char *destname = NULL;
7177
7178 if (ISDOT(dname) || ISDOTDOT(dname)) {
7179 TALLOC_FREE(talloced);
7180 continue;
7181 }
7182
7183 if (!is_visible_file(conn, fname_src_dir, dname,
7184 &smb_fname_src->st, false)) {
7185 TALLOC_FREE(talloced);
7186 continue;
7187 }
7188
7189 if(!mask_match(dname, fname_src_mask,
7190 conn->case_sensitive)) {
7191 TALLOC_FREE(talloced);
7192 continue;
7193 }
7194
7195 error = ERRnoaccess;
7196
7197 /* Get the src smb_fname struct setup. */
7198 TALLOC_FREE(smb_fname_src->base_name);
7199 if (ISDOT(fname_src_dir)) {
7200 /* Ensure we use canonical names on open. */
7201 smb_fname_src->base_name =
7202 talloc_asprintf(smb_fname_src, "%s",
7203 dname);
7204 } else {
7205 smb_fname_src->base_name =
7206 talloc_asprintf(smb_fname_src, "%s/%s",
7207 fname_src_dir, dname);
7208 }
7209
7210 if (!smb_fname_src->base_name) {
7211 TALLOC_FREE(dir_hnd);
7212 TALLOC_FREE(talloced);
7213 reply_nterror(req, NT_STATUS_NO_MEMORY);
7214 goto out;
7215 }
7216
7217 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7218 smb_fname_dst->base_name,
7219 &destname)) {
7220 TALLOC_FREE(talloced);
7221 continue;
7222 }
7223 if (!destname) {
7224 TALLOC_FREE(dir_hnd);
7225 TALLOC_FREE(talloced);
7226 reply_nterror(req, NT_STATUS_NO_MEMORY);
7227 goto out;
7228 }
7229
7230 TALLOC_FREE(smb_fname_dst->base_name);
7231 smb_fname_dst->base_name = destname;
7232
7233 status = check_name(conn, smb_fname_src->base_name);
7234 if (!NT_STATUS_IS_OK(status)) {
7235 TALLOC_FREE(dir_hnd);
7236 TALLOC_FREE(talloced);
7237 reply_nterror(req, status);
7238 goto out;
7239 }
7240
7241 status = check_name(conn, smb_fname_dst->base_name);
7242 if (!NT_STATUS_IS_OK(status)) {
7243 TALLOC_FREE(dir_hnd);
7244 TALLOC_FREE(talloced);
7245 reply_nterror(req, status);
7246 goto out;
7247 }
7248
7249 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7250 smb_fname_src->base_name,
7251 smb_fname_dst->base_name));
7252
7253 status = copy_file(ctx, conn, smb_fname_src,
7254 smb_fname_dst, ofun, count,
7255 target_is_directory);
7256 if (NT_STATUS_IS_OK(status)) {
7257 count++;
7258 }
7259
7260 TALLOC_FREE(talloced);
7261 }
7262 TALLOC_FREE(dir_hnd);
7263 }
7264
7265 if (count == 0) {
7266 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7267 goto out;
7268 }
7269
7270 reply_outbuf(req, 1, 0);
7271 SSVAL(req->outbuf,smb_vwv0,count);
7272 out:
7273 TALLOC_FREE(smb_fname_src);
7274 TALLOC_FREE(smb_fname_dst);
7275 TALLOC_FREE(fname_src);
7276 TALLOC_FREE(fname_dst);
7277 TALLOC_FREE(fname_src_mask);
7278 TALLOC_FREE(fname_src_dir);
7279
7280 END_PROFILE(SMBcopy);
7281 return;
7282 }
7283
7284 #undef DBGC_CLASS
7285 #define DBGC_CLASS DBGC_LOCKING
7286
7287 /****************************************************************************
7288 Get a lock pid, dealing with large count requests.
7289 ****************************************************************************/
7290
7291 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7292 bool large_file_format)
7293 {
7294 if(!large_file_format)
7295 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7296 else
7297 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7298 }
7299
7300 /****************************************************************************
7301 Get a lock count, dealing with large count requests.
7302 ****************************************************************************/
7303
7304 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7305 bool large_file_format)
7306 {
7307 uint64_t count = 0;
7308
7309 if(!large_file_format) {
7310 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7311 } else {
7312
7313 #if defined(HAVE_LONGLONG)
7314 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7315 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7316 #else /* HAVE_LONGLONG */
7317
7318 /*
7319 * NT4.x seems to be broken in that it sends large file (64 bit)
7320 * lockingX calls even if the CAP_LARGE_FILES was *not*
7321 * negotiated. For boxes without large unsigned ints truncate the
7322 * lock count by dropping the top 32 bits.
7323 */
7324
7325 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7326 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7327 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7328 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7329 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7330 }
7331
7332 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7333 #endif /* HAVE_LONGLONG */
7334 }
7335
7336 return count;
7337 }
7338
7339 #if !defined(HAVE_LONGLONG)
7340 /****************************************************************************
7341 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7342 ****************************************************************************/
7343
7344 static uint32 map_lock_offset(uint32 high, uint32 low)
7345 {
7346 unsigned int i;
7347 uint32 mask = 0;
7348 uint32 highcopy = high;
7349
7350 /*
7351 * Try and find out how many significant bits there are in high.
7352 */
7353
7354 for(i = 0; highcopy; i++)
7355 highcopy >>= 1;
7356
7357 /*
7358 * We use 31 bits not 32 here as POSIX
7359 * lock offsets may not be negative.
7360 */
7361
7362 mask = (~0) << (31 - i);
7363
7364 if(low & mask)
7365 return 0; /* Fail. */
7366
7367 high <<= (31 - i);
7368
7369 return (high|low);
7370 }
7371 #endif /* !defined(HAVE_LONGLONG) */
7372
7373 /****************************************************************************
7374 Get a lock offset, dealing with large offset requests.
7375 ****************************************************************************/
7376
7377 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7378 bool large_file_format, bool *err)
7379 {
7380 uint64_t offset = 0;
7381
7382 *err = False;
7383
7384 if(!large_file_format) {
7385 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7386 } else {
7387
7388 #if defined(HAVE_LONGLONG)
7389 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7390 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7391 #else /* HAVE_LONGLONG */
7392
7393 /*
7394 * NT4.x seems to be broken in that it sends large file (64 bit)
7395 * lockingX calls even if the CAP_LARGE_FILES was *not*
7396 * negotiated. For boxes without large unsigned ints mangle the
7397 * lock offset by mapping the top 32 bits onto the lower 32.
7398 */
7399
7400 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7401 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7402 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7403 uint32 new_low = 0;
7404
7405 if((new_low = map_lock_offset(high, low)) == 0) {
7406 *err = True;
7407 return (uint64_t)-1;
7408 }
7409
7410 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7411 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7412 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7413 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7414 }
7415
7416 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7417 #endif /* HAVE_LONGLONG */
7418 }
7419
7420 return offset;
7421 }
7422
7423 NTSTATUS smbd_do_locking(struct smb_request *req,
7424 files_struct *fsp,
7425 uint8_t type,
7426 int32_t timeout,
7427 uint16_t num_ulocks,
7428 struct smbd_lock_element *ulocks,
7429 uint16_t num_locks,
7430 struct smbd_lock_element *locks,
7431 bool *async)
7432 {
7433 connection_struct *conn = req->conn;
7434 int i;
7435 NTSTATUS status = NT_STATUS_OK;
7436
7437 *async = false;
7438
7439 /* Data now points at the beginning of the list
7440 of smb_unlkrng structs */
7441 for(i = 0; i < (int)num_ulocks; i++) {
7442 struct smbd_lock_element *e = &ulocks[i];
7443
7444 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7445 "pid %u, file %s\n",
7446 (double)e->offset,
7447 (double)e->count,
7448 (unsigned int)e->smblctx,
7449 fsp_str_dbg(fsp)));
7450
7451 if (e->brltype != UNLOCK_LOCK) {
7452 /* this can only happen with SMB2 */
7453 return NT_STATUS_INVALID_PARAMETER;
7454 }
7455
7456 status = do_unlock(req->sconn->msg_ctx,
7457 fsp,
7458 e->smblctx,
7459 e->count,
7460 e->offset,
7461 WINDOWS_LOCK);
7462
7463 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7464 nt_errstr(status)));
7465
7466 if (!NT_STATUS_IS_OK(status)) {
7467 return status;
7468 }
7469 }
7470
7471 /* Setup the timeout in seconds. */
7472
7473 if (!lp_blocking_locks(SNUM(conn))) {
7474 timeout = 0;
7475 }
7476
7477 /* Data now points at the beginning of the list
7478 of smb_lkrng structs */
7479
7480 for(i = 0; i < (int)num_locks; i++) {
7481 struct smbd_lock_element *e = &locks[i];
7482
7483 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7484 "%llu, file %s timeout = %d\n",
7485 (double)e->offset,
7486 (double)e->count,
7487 (unsigned long long)e->smblctx,
7488 fsp_str_dbg(fsp),
7489 (int)timeout));
7490
7491 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7492 struct blocking_lock_record *blr = NULL;
7493
7494 if (num_locks > 1) {
7495 /*
7496 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7497 * if the lock vector contains one entry. When given mutliple cancel
7498 * requests in a single PDU we expect the server to return an
7499 * error. Windows servers seem to accept the request but only
7500 * cancel the first lock.
7501 * JRA - Do what Windows does (tm) :-).
7502 */
7503
7504 #if 0
7505 /* MS-CIFS (2.2.4.32.1) behavior. */
7506 return NT_STATUS_DOS(ERRDOS,
7507 ERRcancelviolation);
7508 #else
7509 /* Windows behavior. */
7510 if (i != 0) {
7511 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7512 "cancel request\n"));
7513 continue;
7514 }
7515 #endif
7516 }
7517
7518 if (lp_blocking_locks(SNUM(conn))) {
7519
7520 /* Schedule a message to ourselves to
7521 remove the blocking lock record and
7522 return the right error. */
7523
7524 blr = blocking_lock_cancel_smb1(fsp,
7525 e->smblctx,
7526 e->offset,
7527 e->count,
7528 WINDOWS_LOCK,
7529 type,
7530 NT_STATUS_FILE_LOCK_CONFLICT);
7531 if (blr == NULL) {
7532 return NT_STATUS_DOS(
7533 ERRDOS,
7534 ERRcancelviolation);
7535 }
7536 }
7537 /* Remove a matching pending lock. */
7538 status = do_lock_cancel(fsp,
7539 e->smblctx,
7540 e->count,
7541 e->offset,
7542 WINDOWS_LOCK,
7543 blr);
7544 } else {
7545 bool blocking_lock = timeout ? true : false;
7546 bool defer_lock = false;
7547 struct byte_range_lock *br_lck;
7548 uint64_t block_smblctx;
7549
7550 br_lck = do_lock(req->sconn->msg_ctx,
7551 fsp,
7552 e->smblctx,
7553 e->count,
7554 e->offset,
7555 e->brltype,
7556 WINDOWS_LOCK,
7557 blocking_lock,
7558 &status,
7559 &block_smblctx,
7560 NULL);
7561
7562 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7563 /* Windows internal resolution for blocking locks seems
7564 to be about 200ms... Don't wait for less than that. JRA. */
7565 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7566 timeout = lp_lock_spin_time();
7567 }
7568 defer_lock = true;
7569 }
7570
7571 /* If a lock sent with timeout of zero would fail, and
7572 * this lock has been requested multiple times,
7573 * according to brl_lock_failed() we convert this
7574 * request to a blocking lock with a timeout of between
7575 * 150 - 300 milliseconds.
7576 *
7577 * If lp_lock_spin_time() has been set to 0, we skip
7578 * this blocking retry and fail immediately.
7579 *
7580 * Replacement for do_lock_spin(). JRA. */
7581
7582 if (!req->sconn->using_smb2 &&
7583 br_lck && lp_blocking_locks(SNUM(conn)) &&
7584 lp_lock_spin_time() && !blocking_lock &&
7585 NT_STATUS_EQUAL((status),
7586 NT_STATUS_FILE_LOCK_CONFLICT))
7587 {
7588 defer_lock = true;
7589 timeout = lp_lock_spin_time();
7590 }
7591
7592 if (br_lck && defer_lock) {
7593 /*
7594 * A blocking lock was requested. Package up
7595 * this smb into a queued request and push it
7596 * onto the blocking lock queue.
7597 */
7598 if(push_blocking_lock_request(br_lck,
7599 req,
7600 fsp,
7601 timeout,
7602 i,
7603 e->smblctx,
7604 e->brltype,
7605 WINDOWS_LOCK,
7606 e->offset,
7607 e->count,
7608 block_smblctx)) {
7609 TALLOC_FREE(br_lck);
7610 *async = true;
7611 return NT_STATUS_OK;
7612 }
7613 }
7614
7615 TALLOC_FREE(br_lck);
7616 }
7617
7618 if (!NT_STATUS_IS_OK(status)) {
7619 break;
7620 }
7621 }
7622
7623 /* If any of the above locks failed, then we must unlock
7624 all of the previous locks (X/Open spec). */
7625
7626 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7627
7628 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7629 i = -1; /* we want to skip the for loop */
7630 }
7631
7632 /*
7633 * Ensure we don't do a remove on the lock that just failed,
7634 * as under POSIX rules, if we have a lock already there, we
7635 * will delete it (and we shouldn't) .....
7636 */
7637 for(i--; i >= 0; i--) {
7638 struct smbd_lock_element *e = &locks[i];
7639
7640 do_unlock(req->sconn->msg_ctx,
7641 fsp,
7642 e->smblctx,
7643 e->count,
7644 e->offset,
7645 WINDOWS_LOCK);
7646 }
7647 return status;
7648 }
7649
7650 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7651 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7652
7653 return NT_STATUS_OK;
7654 }
7655
7656 /****************************************************************************
7657 Reply to a lockingX request.
7658 ****************************************************************************/
7659
7660 void reply_lockingX(struct smb_request *req)
7661 {
7662 connection_struct *conn = req->conn;
7663 files_struct *fsp;
7664 unsigned char locktype;
7665 unsigned char oplocklevel;
7666 uint16 num_ulocks;
7667 uint16 num_locks;
7668 int32 lock_timeout;
7669 int i;
7670 const uint8_t *data;
7671 bool large_file_format;
7672 bool err;
7673 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7674 struct smbd_lock_element *ulocks;
7675 struct smbd_lock_element *locks;
7676 bool async = false;
7677
7678 START_PROFILE(SMBlockingX);
7679
7680 if (req->wct < 8) {
7681 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7682 END_PROFILE(SMBlockingX);
7683 return;
7684 }
7685
7686 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7687 locktype = CVAL(req->vwv+3, 0);
7688 oplocklevel = CVAL(req->vwv+3, 1);
7689 num_ulocks = SVAL(req->vwv+6, 0);
7690 num_locks = SVAL(req->vwv+7, 0);
7691 lock_timeout = IVAL(req->vwv+4, 0);
7692 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7693
7694 if (!check_fsp(conn, req, fsp)) {
7695 END_PROFILE(SMBlockingX);
7696 return;
7697 }
7698
7699 data = req->buf;
7700
7701 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7702 /* we don't support these - and CANCEL_LOCK makes w2k
7703 and XP reboot so I don't really want to be
7704 compatible! (tridge) */
7705 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7706 END_PROFILE(SMBlockingX);
7707 return;
7708 }
7709
7710 /* Check if this is an oplock break on a file
7711 we have granted an oplock on.
7712 */
7713 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7714 /* Client can insist on breaking to none. */
7715 bool break_to_none = (oplocklevel == 0);
7716 bool result;
7717
7718 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7719 "for fnum = %d\n", (unsigned int)oplocklevel,
7720 fsp->fnum ));
7721
7722 /*
7723 * Make sure we have granted an exclusive or batch oplock on
7724 * this file.
7725 */
7726
7727 if (fsp->oplock_type == 0) {
7728
7729 /* The Samba4 nbench simulator doesn't understand
7730 the difference between break to level2 and break
7731 to none from level2 - it sends oplock break
7732 replies in both cases. Don't keep logging an error
7733 message here - just ignore it. JRA. */
7734
7735 DEBUG(5,("reply_lockingX: Error : oplock break from "
7736 "client for fnum = %d (oplock=%d) and no "
7737 "oplock granted on this file (%s).\n",
7738 fsp->fnum, fsp->oplock_type,
7739 fsp_str_dbg(fsp)));
7740
7741 /* if this is a pure oplock break request then don't
7742 * send a reply */
7743 if (num_locks == 0 && num_ulocks == 0) {
7744 END_PROFILE(SMBlockingX);
7745 return;
7746 } else {
7747 END_PROFILE(SMBlockingX);
7748 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7749 return;
7750 }
7751 }
7752
7753 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7754 (break_to_none)) {
7755 result = remove_oplock(fsp);
7756 } else {
7757 result = downgrade_oplock(fsp);
7758 }
7759
7760 if (!result) {
7761 DEBUG(0, ("reply_lockingX: error in removing "
7762 "oplock on file %s\n", fsp_str_dbg(fsp)));
7763 /* Hmmm. Is this panic justified? */
7764 smb_panic("internal tdb error");
7765 }
7766
7767 reply_to_oplock_break_requests(fsp);
7768
7769 /* if this is a pure oplock break request then don't send a
7770 * reply */
7771 if (num_locks == 0 && num_ulocks == 0) {
7772 /* Sanity check - ensure a pure oplock break is not a
7773 chained request. */
7774 if(CVAL(req->vwv+0, 0) != 0xff)
7775 DEBUG(0,("reply_lockingX: Error : pure oplock "
7776 "break is a chained %d request !\n",
7777 (unsigned int)CVAL(req->vwv+0, 0)));
7778 END_PROFILE(SMBlockingX);
7779 return;
7780 }
7781 }
7782
7783 if (req->buflen <
7784 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7785 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7786 END_PROFILE(SMBlockingX);
7787 return;
7788 }
7789
7790 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7791 if (ulocks == NULL) {
7792 reply_nterror(req, NT_STATUS_NO_MEMORY);
7793 END_PROFILE(SMBlockingX);
7794 return;
7795 }
7796
7797 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7798 if (locks == NULL) {
7799 reply_nterror(req, NT_STATUS_NO_MEMORY);
7800 END_PROFILE(SMBlockingX);
7801 return;
7802 }
7803
7804 /* Data now points at the beginning of the list
7805 of smb_unlkrng structs */
7806 for(i = 0; i < (int)num_ulocks; i++) {
7807 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7808 ulocks[i].count = get_lock_count(data, i, large_file_format);
7809 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7810 ulocks[i].brltype = UNLOCK_LOCK;
7811
7812 /*
7813 * There is no error code marked "stupid client bug".... :-).
7814 */
7815 if(err) {
7816 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7817 END_PROFILE(SMBlockingX);
7818 return;
7819 }
7820 }
7821
7822 /* Now do any requested locks */
7823 data += ((large_file_format ? 20 : 10)*num_ulocks);
7824
7825 /* Data now points at the beginning of the list
7826 of smb_lkrng structs */
7827
7828 for(i = 0; i < (int)num_locks; i++) {
7829 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7830 locks[i].count = get_lock_count(data, i, large_file_format);
7831 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7832
7833 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7834 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7835 locks[i].brltype = PENDING_READ_LOCK;
7836 } else {
7837 locks[i].brltype = READ_LOCK;
7838 }
7839 } else {
7840 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7841 locks[i].brltype = PENDING_WRITE_LOCK;
7842 } else {
7843 locks[i].brltype = WRITE_LOCK;
7844 }
7845 }
7846
7847 /*
7848 * There is no error code marked "stupid client bug".... :-).
7849 */
7850 if(err) {
7851 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7852 END_PROFILE(SMBlockingX);
7853 return;
7854 }
7855 }
7856
7857 status = smbd_do_locking(req, fsp,
7858 locktype, lock_timeout,
7859 num_ulocks, ulocks,
7860 num_locks, locks,
7861 &async);
7862 if (!NT_STATUS_IS_OK(status)) {
7863 END_PROFILE(SMBlockingX);
7864 reply_nterror(req, status);
7865 return;
7866 }
7867 if (async) {
7868 END_PROFILE(SMBlockingX);
7869 return;
7870 }
7871
7872 reply_outbuf(req, 2, 0);
7873
7874 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7875 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7876
7877 END_PROFILE(SMBlockingX);
7878 chain_reply(req);
7879 }
7880
7881 #undef DBGC_CLASS
7882 #define DBGC_CLASS DBGC_ALL
7883
7884 /****************************************************************************
7885 Reply to a SMBreadbmpx (read block multiplex) request.
7886 Always reply with an error, if someone has a platform really needs this,
7887 please contact vl@samba.org
7888 ****************************************************************************/
7889
7890 void reply_readbmpx(struct smb_request *req)
7891 {
7892 START_PROFILE(SMBreadBmpx);
7893 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7894 END_PROFILE(SMBreadBmpx);
7895 return;
7896 }
7897
7898 /****************************************************************************
7899 Reply to a SMBreadbs (read block multiplex secondary) request.
7900 Always reply with an error, if someone has a platform really needs this,
7901 please contact vl@samba.org
7902 ****************************************************************************/
7903
7904 void reply_readbs(struct smb_request *req)
7905 {
7906 START_PROFILE(SMBreadBs);
7907 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7908 END_PROFILE(SMBreadBs);
7909 return;
7910 }
7911
7912 /****************************************************************************
7913 Reply to a SMBsetattrE.
7914 ****************************************************************************/
7915
7916 void reply_setattrE(struct smb_request *req)
7917 {
7918 connection_struct *conn = req->conn;
7919 struct smb_file_time ft;
7920 files_struct *fsp;
7921 NTSTATUS status;
7922
7923 START_PROFILE(SMBsetattrE);
7924 ZERO_STRUCT(ft);
7925
7926 if (req->wct < 7) {
7927 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7928 goto out;
7929 }
7930
7931 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7932
7933 if(!fsp || (fsp->conn != conn)) {
7934 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7935 goto out;
7936 }
7937
7938 /*
7939 * Convert the DOS times into unix times.
7940 */
7941
7942 ft.atime = convert_time_t_to_timespec(
7943 srv_make_unix_date2(req->vwv+3));
7944 ft.mtime = convert_time_t_to_timespec(
7945 srv_make_unix_date2(req->vwv+5));
7946 ft.create_time = convert_time_t_to_timespec(
7947 srv_make_unix_date2(req->vwv+1));
7948
7949 reply_outbuf(req, 0, 0);
7950
7951 /*
7952 * Patch from Ray Frush <frush@engr.colostate.edu>
7953 * Sometimes times are sent as zero - ignore them.
7954 */
7955
7956 /* Ensure we have a valid stat struct for the source. */
7957 status = vfs_stat_fsp(fsp);
7958 if (!NT_STATUS_IS_OK(status)) {
7959 reply_nterror(req, status);
7960 goto out;
7961 }
7962
7963 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
7964 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7965 goto out;
7966 }
7967
7968 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7969 if (!NT_STATUS_IS_OK(status)) {
7970 reply_nterror(req, status);
7971 goto out;
7972 }
7973
7974 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7975 " createtime=%u\n",
7976 fsp->fnum,
7977 (unsigned int)ft.atime.tv_sec,
7978 (unsigned int)ft.mtime.tv_sec,
7979 (unsigned int)ft.create_time.tv_sec
7980 ));
7981 out:
7982 END_PROFILE(SMBsetattrE);
7983 return;
7984 }
7985
7986
7987 /* Back from the dead for OS/2..... JRA. */
7988
7989 /****************************************************************************
7990 Reply to a SMBwritebmpx (write block multiplex primary) request.
7991 Always reply with an error, if someone has a platform really needs this,
7992 please contact vl@samba.org
7993 ****************************************************************************/
7994
7995 void reply_writebmpx(struct smb_request *req)
7996 {
7997 START_PROFILE(SMBwriteBmpx);
7998 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7999 END_PROFILE(SMBwriteBmpx);
8000 return;
8001 }
8002
8003 /****************************************************************************
8004 Reply to a SMBwritebs (write block multiplex secondary) request.
8005 Always reply with an error, if someone has a platform really needs this,
8006 please contact vl@samba.org
8007 ****************************************************************************/
8008
8009 void reply_writebs(struct smb_request *req)
8010 {
8011 START_PROFILE(SMBwriteBs);
8012 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8013 END_PROFILE(SMBwriteBs);
8014 return;
8015 }
8016
8017 /****************************************************************************
8018 Reply to a SMBgetattrE.
8019 ****************************************************************************/
8020
8021 void reply_getattrE(struct smb_request *req)
8022 {
8023 connection_struct *conn = req->conn;
8024 int mode;
8025 files_struct *fsp;
8026 struct timespec create_ts;
8027
8028 START_PROFILE(SMBgetattrE);
8029
8030 if (req->wct < 1) {
8031 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8032 END_PROFILE(SMBgetattrE);
8033 return;
8034 }
8035
8036 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8037
8038 if(!fsp || (fsp->conn != conn)) {
8039 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8040 END_PROFILE(SMBgetattrE);
8041 return;
8042 }
8043
8044 /* Do an fstat on this file */
8045 if(fsp_stat(fsp)) {
8046 reply_nterror(req, map_nt_error_from_unix(errno));
8047 END_PROFILE(SMBgetattrE);
8048 return;
8049 }
8050
8051 mode = dos_mode(conn, fsp->fsp_name);
8052
8053 /*
8054 * Convert the times into dos times. Set create
8055 * date to be last modify date as UNIX doesn't save
8056 * this.
8057 */
8058
8059 reply_outbuf(req, 11, 0);
8060
8061 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8062 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8063 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8064 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8065 /* Should we check pending modtime here ? JRA */
8066 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8067 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8068
8069 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8070 SIVAL(req->outbuf, smb_vwv6, 0);
8071 SIVAL(req->outbuf, smb_vwv8, 0);
8072 } else {
8073 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8074 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8075 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8076 }
8077 SSVAL(req->outbuf,smb_vwv10, mode);
8078
8079 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8080
8081 END_PROFILE(SMBgetattrE);
8082 return;
8083 }