?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Lift the smbd_messaging_context from nt_printer_publish_ads
[Samba/wip.git] / source3 / smbd / reply.c
blobba4c90d55299dce791712866a87c508706659f96
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "printing.h"
29 #include "smbd/globals.h"
30 #include "../librpc/gen_ndr/cli_spoolss.h"
31 #include "rpc_client/cli_spoolss.h"
32 #include "rpc_client/init_spoolss.h"
33
34 /****************************************************************************
35 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
36 path or anything including wildcards.
37 We're assuming here that '/' is not the second byte in any multibyte char
38 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
39 set.
40 ****************************************************************************/
41
42 /* Custom version for processing POSIX paths. */
43 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
44
45 static NTSTATUS check_path_syntax_internal(char *path,
46 bool posix_path,
47 bool *p_last_component_contains_wcard)
48 {
49 char *d = path;
50 const char *s = path;
51 NTSTATUS ret = NT_STATUS_OK;
52 bool start_of_name_component = True;
53 bool stream_started = false;
54
55 *p_last_component_contains_wcard = False;
56
57 while (*s) {
58 if (stream_started) {
59 switch (*s) {
60 case '/':
61 case '\\':
62 return NT_STATUS_OBJECT_NAME_INVALID;
63 case ':':
64 if (s[1] == '\0') {
65 return NT_STATUS_OBJECT_NAME_INVALID;
66 }
67 if (strchr_m(&s[1], ':')) {
68 return NT_STATUS_OBJECT_NAME_INVALID;
69 }
70 break;
71 }
72 }
73
74 if ((*s == ':') && !posix_path && !stream_started) {
75 if (*p_last_component_contains_wcard) {
76 return NT_STATUS_OBJECT_NAME_INVALID;
77 }
78 /* Stream names allow more characters than file names.
79 We're overloading posix_path here to allow a wider
80 range of characters. If stream_started is true this
81 is still a Windows path even if posix_path is true.
82 JRA.
83 */
84 stream_started = true;
85 start_of_name_component = false;
86 posix_path = true;
87
88 if (s[1] == '\0') {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 }
92
93 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
94 /*
95 * Safe to assume is not the second part of a mb char
96 * as this is handled below.
97 */
98 /* Eat multiple '/' or '\\' */
99 while (IS_PATH_SEP(*s,posix_path)) {
100 s++;
101 }
102 if ((d != path) && (*s != '\0')) {
103 /* We only care about non-leading or trailing '/' or '\\' */
104 *d++ = '/';
105 }
106
107 start_of_name_component = True;
108 /* New component. */
109 *p_last_component_contains_wcard = False;
110 continue;
111 }
112
113 if (start_of_name_component) {
114 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
115 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
116
117 /*
118 * No mb char starts with '.' so we're safe checking the directory separator here.
119 */
120
121 /* If we just added a '/' - delete it */
122 if ((d > path) && (*(d-1) == '/')) {
123 *(d-1) = '\0';
124 d--;
125 }
126
127 /* Are we at the start ? Can't go back further if so. */
128 if (d <= path) {
129 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
130 break;
131 }
132 /* Go back one level... */
133 /* We know this is safe as '/' cannot be part of a mb sequence. */
134 /* NOTE - if this assumption is invalid we are not in good shape... */
135 /* Decrement d first as d points to the *next* char to write into. */
136 for (d--; d > path; d--) {
137 if (*d == '/')
138 break;
139 }
140 s += 2; /* Else go past the .. */
141 /* We're still at the start of a name component, just the previous one. */
142 continue;
143
144 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
145 if (posix_path) {
146 /* Eat the '.' */
147 s++;
148 continue;
149 }
150 }
151
152 }
153
154 if (!(*s & 0x80)) {
155 if (!posix_path) {
156 if (*s <= 0x1f || *s == '|') {
157 return NT_STATUS_OBJECT_NAME_INVALID;
158 }
159 switch (*s) {
160 case '*':
161 case '?':
162 case '<':
163 case '>':
164 case '"':
165 *p_last_component_contains_wcard = True;
166 break;
167 default:
168 break;
169 }
170 }
171 *d++ = *s++;
172 } else {
173 size_t siz;
174 /* Get the size of the next MB character. */
175 next_codepoint(s,&siz);
176 switch(siz) {
177 case 5:
178 *d++ = *s++;
179 /*fall through*/
180 case 4:
181 *d++ = *s++;
182 /*fall through*/
183 case 3:
184 *d++ = *s++;
185 /*fall through*/
186 case 2:
187 *d++ = *s++;
188 /*fall through*/
189 case 1:
190 *d++ = *s++;
191 break;
192 default:
193 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
194 *d = '\0';
195 return NT_STATUS_INVALID_PARAMETER;
196 }
197 }
198 start_of_name_component = False;
199 }
200
201 *d = '\0';
202
203 return ret;
204 }
205
206 /****************************************************************************
207 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
208 No wildcards allowed.
209 ****************************************************************************/
210
211 NTSTATUS check_path_syntax(char *path)
212 {
213 bool ignore;
214 return check_path_syntax_internal(path, False, &ignore);
215 }
216
217 /****************************************************************************
218 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
219 Wildcards allowed - p_contains_wcard returns true if the last component contained
220 a wildcard.
221 ****************************************************************************/
222
223 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
224 {
225 return check_path_syntax_internal(path, False, p_contains_wcard);
226 }
227
228 /****************************************************************************
229 Check the path for a POSIX client.
230 We're assuming here that '/' is not the second byte in any multibyte char
231 set (a safe assumption).
232 ****************************************************************************/
233
234 NTSTATUS check_path_syntax_posix(char *path)
235 {
236 bool ignore;
237 return check_path_syntax_internal(path, True, &ignore);
238 }
239
240 /****************************************************************************
241 Pull a string and check the path allowing a wilcard - provide for error return.
242 ****************************************************************************/
243
244 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
245 const char *base_ptr,
246 uint16 smb_flags2,
247 char **pp_dest,
248 const char *src,
249 size_t src_len,
250 int flags,
251 NTSTATUS *err,
252 bool *contains_wcard)
253 {
254 size_t ret;
255
256 *pp_dest = NULL;
257
258 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
259 src_len, flags);
260
261 if (!*pp_dest) {
262 *err = NT_STATUS_INVALID_PARAMETER;
263 return ret;
264 }
265
266 *contains_wcard = False;
267
268 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
269 /*
270 * For a DFS path the function parse_dfs_path()
271 * will do the path processing, just make a copy.
272 */
273 *err = NT_STATUS_OK;
274 return ret;
275 }
276
277 if (lp_posix_pathnames()) {
278 *err = check_path_syntax_posix(*pp_dest);
279 } else {
280 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
281 }
282
283 return ret;
284 }
285
286 /****************************************************************************
287 Pull a string and check the path - provide for error return.
288 ****************************************************************************/
289
290 size_t srvstr_get_path(TALLOC_CTX *ctx,
291 const char *base_ptr,
292 uint16 smb_flags2,
293 char **pp_dest,
294 const char *src,
295 size_t src_len,
296 int flags,
297 NTSTATUS *err)
298 {
299 bool ignore;
300 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
301 src_len, flags, err, &ignore);
302 }
303
304 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
305 char **pp_dest, const char *src, int flags,
306 NTSTATUS *err, bool *contains_wcard)
307 {
308 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
309 pp_dest, src, smbreq_bufrem(req, src),
310 flags, err, contains_wcard);
311 }
312
313 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
314 char **pp_dest, const char *src, int flags,
315 NTSTATUS *err)
316 {
317 bool ignore;
318 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
319 flags, err, &ignore);
320 }
321
322 /****************************************************************************
323 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
324 ****************************************************************************/
325
326 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
327 files_struct *fsp)
328 {
329 if ((fsp == NULL) || (conn == NULL)) {
330 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
331 return False;
332 }
333 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
334 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
335 return False;
336 }
337 return True;
338 }
339
340 /****************************************************************************
341 Check if we have a correct fsp pointing to a file.
342 ****************************************************************************/
343
344 bool check_fsp(connection_struct *conn, struct smb_request *req,
345 files_struct *fsp)
346 {
347 if (!check_fsp_open(conn, req, fsp)) {
348 return False;
349 }
350 if (fsp->is_directory) {
351 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
352 return False;
353 }
354 if (fsp->fh->fd == -1) {
355 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
356 return False;
357 }
358 fsp->num_smb_operations++;
359 return True;
360 }
361
362 /****************************************************************************
363 Check if we have a correct fsp pointing to a quota fake file. Replacement for
364 the CHECK_NTQUOTA_HANDLE_OK macro.
365 ****************************************************************************/
366
367 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
368 files_struct *fsp)
369 {
370 if (!check_fsp_open(conn, req, fsp)) {
371 return false;
372 }
373
374 if (fsp->is_directory) {
375 return false;
376 }
377
378 if (fsp->fake_file_handle == NULL) {
379 return false;
380 }
381
382 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
383 return false;
384 }
385
386 if (fsp->fake_file_handle->private_data == NULL) {
387 return false;
388 }
389
390 return true;
391 }
392
393 static bool netbios_session_retarget(const char *name, int name_type)
394 {
395 char *trim_name;
396 char *trim_name_type;
397 const char *retarget_parm;
398 char *retarget;
399 char *p;
400 int retarget_type = 0x20;
401 int retarget_port = 139;
402 struct sockaddr_storage retarget_addr;
403 struct sockaddr_in *in_addr;
404 bool ret = false;
405 uint8_t outbuf[10];
406
407 if (get_socket_port(smbd_server_fd()) != 139) {
408 return false;
409 }
410
411 trim_name = talloc_strdup(talloc_tos(), name);
412 if (trim_name == NULL) {
413 goto fail;
414 }
415 trim_char(trim_name, ' ', ' ');
416
417 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
418 name_type);
419 if (trim_name_type == NULL) {
420 goto fail;
421 }
422
423 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
424 trim_name_type, NULL);
425 if (retarget_parm == NULL) {
426 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
427 trim_name, NULL);
428 }
429 if (retarget_parm == NULL) {
430 goto fail;
431 }
432
433 retarget = talloc_strdup(trim_name, retarget_parm);
434 if (retarget == NULL) {
435 goto fail;
436 }
437
438 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
439
440 p = strchr(retarget, ':');
441 if (p != NULL) {
442 *p++ = '\0';
443 retarget_port = atoi(p);
444 }
445
446 p = strchr_m(retarget, '#');
447 if (p != NULL) {
448 *p++ = '\0';
449 sscanf(p, "%x", &retarget_type);
450 }
451
452 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
453 if (!ret) {
454 DEBUG(10, ("could not resolve %s\n", retarget));
455 goto fail;
456 }
457
458 if (retarget_addr.ss_family != AF_INET) {
459 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
460 goto fail;
461 }
462
463 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
464
465 _smb_setlen(outbuf, 6);
466 SCVAL(outbuf, 0, 0x84);
467 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
468 *(uint16_t *)(outbuf+8) = htons(retarget_port);
469
470 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
471 NULL)) {
472 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
473 "failed.");
474 }
475
476 ret = true;
477 fail:
478 TALLOC_FREE(trim_name);
479 return ret;
480 }
481
482 /****************************************************************************
483 Reply to a (netbios-level) special message.
484 ****************************************************************************/
485
486 void reply_special(struct smbd_server_connection *sconn, char *inbuf)
487 {
488 int msg_type = CVAL(inbuf,0);
489 int msg_flags = CVAL(inbuf,1);
490 fstring name1,name2;
491 char name_type1, name_type2;
492
493 /*
494 * We only really use 4 bytes of the outbuf, but for the smb_setlen
495 * calculation & friends (srv_send_smb uses that) we need the full smb
496 * header.
497 */
498 char outbuf[smb_size];
499
500 *name1 = *name2 = 0;
501
502 memset(outbuf, '\0', sizeof(outbuf));
503
504 smb_setlen(outbuf,0);
505
506 switch (msg_type) {
507 case 0x81: /* session request */
508
509 if (sconn->nbt.got_session) {
510 exit_server_cleanly("multiple session request not permitted");
511 }
512
513 SCVAL(outbuf,0,0x82);
514 SCVAL(outbuf,3,0);
515 if (name_len(inbuf+4) > 50 ||
516 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
517 DEBUG(0,("Invalid name length in session request\n"));
518 return;
519 }
520 name_type1 = name_extract(inbuf,4,name1);
521 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
522 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
523 name1, name_type1, name2, name_type2));
524
525 if (netbios_session_retarget(name1, name_type1)) {
526 exit_server_cleanly("retargeted client");
527 }
528
529 set_local_machine_name(name1, True);
530 set_remote_machine_name(name2, True);
531
532 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
533 get_local_machine_name(), get_remote_machine_name(),
534 name_type2));
535
536 if (name_type2 == 'R') {
537 /* We are being asked for a pathworks session ---
538 no thanks! */
539 SCVAL(outbuf, 0,0x83);
540 break;
541 }
542
543 /* only add the client's machine name to the list
544 of possibly valid usernames if we are operating
545 in share mode security */
546 if (lp_security() == SEC_SHARE) {
547 add_session_user(sconn, get_remote_machine_name());
548 }
549
550 reload_services(True);
551 reopen_logs();
552
553 sconn->nbt.got_session = true;
554 break;
555
556 case 0x89: /* session keepalive request
557 (some old clients produce this?) */
558 SCVAL(outbuf,0,SMBkeepalive);
559 SCVAL(outbuf,3,0);
560 break;
561
562 case 0x82: /* positive session response */
563 case 0x83: /* negative session response */
564 case 0x84: /* retarget session response */
565 DEBUG(0,("Unexpected session response\n"));
566 break;
567
568 case SMBkeepalive: /* session keepalive */
569 default:
570 return;
571 }
572
573 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
574 msg_type, msg_flags));
575
576 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
577 return;
578 }
579
580 /****************************************************************************
581 Reply to a tcon.
582 conn POINTER CAN BE NULL HERE !
583 ****************************************************************************/
584
585 void reply_tcon(struct smb_request *req)
586 {
587 connection_struct *conn = req->conn;
588 const char *service;
589 char *service_buf = NULL;
590 char *password = NULL;
591 char *dev = NULL;
592 int pwlen=0;
593 NTSTATUS nt_status;
594 const char *p;
595 DATA_BLOB password_blob;
596 TALLOC_CTX *ctx = talloc_tos();
597 struct smbd_server_connection *sconn = req->sconn;
598
599 START_PROFILE(SMBtcon);
600
601 if (req->buflen < 4) {
602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
603 END_PROFILE(SMBtcon);
604 return;
605 }
606
607 p = (const char *)req->buf + 1;
608 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
609 p += 1;
610 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
611 p += pwlen+1;
612 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
613 p += 1;
614
615 if (service_buf == NULL || password == NULL || dev == NULL) {
616 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
617 END_PROFILE(SMBtcon);
618 return;
619 }
620 p = strrchr_m(service_buf,'\\');
621 if (p) {
622 service = p+1;
623 } else {
624 service = service_buf;
625 }
626
627 password_blob = data_blob(password, pwlen+1);
628
629 conn = make_connection(sconn,service,password_blob,dev,
630 req->vuid,&nt_status);
631 req->conn = conn;
632
633 data_blob_clear_free(&password_blob);
634
635 if (!conn) {
636 reply_nterror(req, nt_status);
637 END_PROFILE(SMBtcon);
638 return;
639 }
640
641 reply_outbuf(req, 2, 0);
642 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
643 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
644 SSVAL(req->outbuf,smb_tid,conn->cnum);
645
646 DEBUG(3,("tcon service=%s cnum=%d\n",
647 service, conn->cnum));
648
649 END_PROFILE(SMBtcon);
650 return;
651 }
652
653 /****************************************************************************
654 Reply to a tcon and X.
655 conn POINTER CAN BE NULL HERE !
656 ****************************************************************************/
657
658 void reply_tcon_and_X(struct smb_request *req)
659 {
660 connection_struct *conn = req->conn;
661 const char *service = NULL;
662 DATA_BLOB password;
663 TALLOC_CTX *ctx = talloc_tos();
664 /* what the cleint thinks the device is */
665 char *client_devicetype = NULL;
666 /* what the server tells the client the share represents */
667 const char *server_devicetype;
668 NTSTATUS nt_status;
669 int passlen;
670 char *path = NULL;
671 const char *p, *q;
672 uint16 tcon_flags;
673 struct smbd_server_connection *sconn = req->sconn;
674
675 START_PROFILE(SMBtconX);
676
677 if (req->wct < 4) {
678 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
679 END_PROFILE(SMBtconX);
680 return;
681 }
682
683 passlen = SVAL(req->vwv+3, 0);
684 tcon_flags = SVAL(req->vwv+2, 0);
685
686 /* we might have to close an old one */
687 if ((tcon_flags & 0x1) && conn) {
688 close_cnum(conn,req->vuid);
689 req->conn = NULL;
690 conn = NULL;
691 }
692
693 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
694 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
695 END_PROFILE(SMBtconX);
696 return;
697 }
698
699 if (sconn->smb1.negprot.encrypted_passwords) {
700 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
701 if (lp_security() == SEC_SHARE) {
702 /*
703 * Security = share always has a pad byte
704 * after the password.
705 */
706 p = (const char *)req->buf + passlen + 1;
707 } else {
708 p = (const char *)req->buf + passlen;
709 }
710 } else {
711 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
712 /* Ensure correct termination */
713 password.data[passlen]=0;
714 p = (const char *)req->buf + passlen + 1;
715 }
716
717 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
718
719 if (path == NULL) {
720 data_blob_clear_free(&password);
721 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
722 END_PROFILE(SMBtconX);
723 return;
724 }
725
726 /*
727 * the service name can be either: \\server\share
728 * or share directly like on the DELL PowerVault 705
729 */
730 if (*path=='\\') {
731 q = strchr_m(path+2,'\\');
732 if (!q) {
733 data_blob_clear_free(&password);
734 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
735 END_PROFILE(SMBtconX);
736 return;
737 }
738 service = q+1;
739 } else {
740 service = path;
741 }
742
743 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
744 &client_devicetype, p,
745 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
746
747 if (client_devicetype == NULL) {
748 data_blob_clear_free(&password);
749 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
750 END_PROFILE(SMBtconX);
751 return;
752 }
753
754 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
755
756 conn = make_connection(sconn, service, password, client_devicetype,
757 req->vuid, &nt_status);
758 req->conn =conn;
759
760 data_blob_clear_free(&password);
761
762 if (!conn) {
763 reply_nterror(req, nt_status);
764 END_PROFILE(SMBtconX);
765 return;
766 }
767
768 if ( IS_IPC(conn) )
769 server_devicetype = "IPC";
770 else if ( IS_PRINT(conn) )
771 server_devicetype = "LPT1:";
772 else
773 server_devicetype = "A:";
774
775 if (get_Protocol() < PROTOCOL_NT1) {
776 reply_outbuf(req, 2, 0);
777 if (message_push_string(&req->outbuf, server_devicetype,
778 STR_TERMINATE|STR_ASCII) == -1) {
779 reply_nterror(req, NT_STATUS_NO_MEMORY);
780 END_PROFILE(SMBtconX);
781 return;
782 }
783 } else {
784 /* NT sets the fstype of IPC$ to the null string */
785 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
786
787 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
788 /* Return permissions. */
789 uint32 perm1 = 0;
790 uint32 perm2 = 0;
791
792 reply_outbuf(req, 7, 0);
793
794 if (IS_IPC(conn)) {
795 perm1 = FILE_ALL_ACCESS;
796 perm2 = FILE_ALL_ACCESS;
797 } else {
798 perm1 = CAN_WRITE(conn) ?
799 SHARE_ALL_ACCESS :
800 SHARE_READ_ONLY;
801 }
802
803 SIVAL(req->outbuf, smb_vwv3, perm1);
804 SIVAL(req->outbuf, smb_vwv5, perm2);
805 } else {
806 reply_outbuf(req, 3, 0);
807 }
808
809 if ((message_push_string(&req->outbuf, server_devicetype,
810 STR_TERMINATE|STR_ASCII) == -1)
811 || (message_push_string(&req->outbuf, fstype,
812 STR_TERMINATE) == -1)) {
813 reply_nterror(req, NT_STATUS_NO_MEMORY);
814 END_PROFILE(SMBtconX);
815 return;
816 }
817
818 /* what does setting this bit do? It is set by NT4 and
819 may affect the ability to autorun mounted cdroms */
820 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
821 (lp_csc_policy(SNUM(conn)) << 2));
822
823 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
824 DEBUG(2,("Serving %s as a Dfs root\n",
825 lp_servicename(SNUM(conn)) ));
826 SSVAL(req->outbuf, smb_vwv2,
827 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
828 }
829 }
830
831
832 DEBUG(3,("tconX service=%s \n",
833 service));
834
835 /* set the incoming and outgoing tid to the just created one */
836 SSVAL(req->inbuf,smb_tid,conn->cnum);
837 SSVAL(req->outbuf,smb_tid,conn->cnum);
838
839 END_PROFILE(SMBtconX);
840
841 req->tid = conn->cnum;
842 chain_reply(req);
843 return;
844 }
845
846 /****************************************************************************
847 Reply to an unknown type.
848 ****************************************************************************/
849
850 void reply_unknown_new(struct smb_request *req, uint8 type)
851 {
852 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
853 smb_fn_name(type), type, type));
854 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
855 return;
856 }
857
858 /****************************************************************************
859 Reply to an ioctl.
860 conn POINTER CAN BE NULL HERE !
861 ****************************************************************************/
862
863 void reply_ioctl(struct smb_request *req)
864 {
865 connection_struct *conn = req->conn;
866 uint16 device;
867 uint16 function;
868 uint32 ioctl_code;
869 int replysize;
870 char *p;
871
872 START_PROFILE(SMBioctl);
873
874 if (req->wct < 3) {
875 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
876 END_PROFILE(SMBioctl);
877 return;
878 }
879
880 device = SVAL(req->vwv+1, 0);
881 function = SVAL(req->vwv+2, 0);
882 ioctl_code = (device << 16) + function;
883
884 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
885
886 switch (ioctl_code) {
887 case IOCTL_QUERY_JOB_INFO:
888 replysize = 32;
889 break;
890 default:
891 reply_force_doserror(req, ERRSRV, ERRnosupport);
892 END_PROFILE(SMBioctl);
893 return;
894 }
895
896 reply_outbuf(req, 8, replysize+1);
897 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
898 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
899 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
900 p = smb_buf(req->outbuf);
901 memset(p, '\0', replysize+1); /* valgrind-safe. */
902 p += 1; /* Allow for alignment */
903
904 switch (ioctl_code) {
905 case IOCTL_QUERY_JOB_INFO:
906 {
907 files_struct *fsp = file_fsp(
908 req, SVAL(req->vwv+0, 0));
909 if (!fsp) {
910 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
911 END_PROFILE(SMBioctl);
912 return;
913 }
914 /* Job number */
915 if (fsp->print_file) {
916 SSVAL(p, 0, fsp->print_file->rap_jobid);
917 } else {
918 SSVAL(p, 0, 0);
919 }
920 srvstr_push((char *)req->outbuf, req->flags2, p+2,
921 global_myname(), 15,
922 STR_TERMINATE|STR_ASCII);
923 if (conn) {
924 srvstr_push((char *)req->outbuf, req->flags2,
925 p+18, lp_servicename(SNUM(conn)),
926 13, STR_TERMINATE|STR_ASCII);
927 } else {
928 memset(p+18, 0, 13);
929 }
930 break;
931 }
932 }
933
934 END_PROFILE(SMBioctl);
935 return;
936 }
937
938 /****************************************************************************
939 Strange checkpath NTSTATUS mapping.
940 ****************************************************************************/
941
942 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
943 {
944 /* Strange DOS error code semantics only for checkpath... */
945 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
946 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
947 /* We need to map to ERRbadpath */
948 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
949 }
950 }
951 return status;
952 }
953
954 /****************************************************************************
955 Reply to a checkpath.
956 ****************************************************************************/
957
958 void reply_checkpath(struct smb_request *req)
959 {
960 connection_struct *conn = req->conn;
961 struct smb_filename *smb_fname = NULL;
962 char *name = NULL;
963 NTSTATUS status;
964 TALLOC_CTX *ctx = talloc_tos();
965
966 START_PROFILE(SMBcheckpath);
967
968 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
969 STR_TERMINATE, &status);
970
971 if (!NT_STATUS_IS_OK(status)) {
972 status = map_checkpath_error(req->flags2, status);
973 reply_nterror(req, status);
974 END_PROFILE(SMBcheckpath);
975 return;
976 }
977
978 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
979
980 status = filename_convert(ctx,
981 conn,
982 req->flags2 & FLAGS2_DFS_PATHNAMES,
983 name,
984 0,
985 NULL,
986 &smb_fname);
987
988 if (!NT_STATUS_IS_OK(status)) {
989 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
990 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
991 ERRSRV, ERRbadpath);
992 END_PROFILE(SMBcheckpath);
993 return;
994 }
995 goto path_err;
996 }
997
998 if (!VALID_STAT(smb_fname->st) &&
999 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1000 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1001 smb_fname_str_dbg(smb_fname), strerror(errno)));
1002 status = map_nt_error_from_unix(errno);
1003 goto path_err;
1004 }
1005
1006 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1007 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1008 ERRDOS, ERRbadpath);
1009 goto out;
1010 }
1011
1012 reply_outbuf(req, 0, 0);
1013
1014 path_err:
1015 /* We special case this - as when a Windows machine
1016 is parsing a path is steps through the components
1017 one at a time - if a component fails it expects
1018 ERRbadpath, not ERRbadfile.
1019 */
1020 status = map_checkpath_error(req->flags2, status);
1021 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1022 /*
1023 * Windows returns different error codes if
1024 * the parent directory is valid but not the
1025 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1026 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1027 * if the path is invalid.
1028 */
1029 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1030 ERRDOS, ERRbadpath);
1031 goto out;
1032 }
1033
1034 reply_nterror(req, status);
1035
1036 out:
1037 TALLOC_FREE(smb_fname);
1038 END_PROFILE(SMBcheckpath);
1039 return;
1040 }
1041
1042 /****************************************************************************
1043 Reply to a getatr.
1044 ****************************************************************************/
1045
1046 void reply_getatr(struct smb_request *req)
1047 {
1048 connection_struct *conn = req->conn;
1049 struct smb_filename *smb_fname = NULL;
1050 char *fname = NULL;
1051 int mode=0;
1052 SMB_OFF_T size=0;
1053 time_t mtime=0;
1054 const char *p;
1055 NTSTATUS status;
1056 TALLOC_CTX *ctx = talloc_tos();
1057 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1058
1059 START_PROFILE(SMBgetatr);
1060
1061 p = (const char *)req->buf + 1;
1062 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1063 if (!NT_STATUS_IS_OK(status)) {
1064 reply_nterror(req, status);
1065 goto out;
1066 }
1067
1068 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1069 under WfWg - weird! */
1070 if (*fname == '\0') {
1071 mode = aHIDDEN | aDIR;
1072 if (!CAN_WRITE(conn)) {
1073 mode |= aRONLY;
1074 }
1075 size = 0;
1076 mtime = 0;
1077 } else {
1078 status = filename_convert(ctx,
1079 conn,
1080 req->flags2 & FLAGS2_DFS_PATHNAMES,
1081 fname,
1082 0,
1083 NULL,
1084 &smb_fname);
1085 if (!NT_STATUS_IS_OK(status)) {
1086 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1087 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1088 ERRSRV, ERRbadpath);
1089 goto out;
1090 }
1091 reply_nterror(req, status);
1092 goto out;
1093 }
1094 if (!VALID_STAT(smb_fname->st) &&
1095 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1096 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1097 smb_fname_str_dbg(smb_fname),
1098 strerror(errno)));
1099 reply_nterror(req, map_nt_error_from_unix(errno));
1100 goto out;
1101 }
1102
1103 mode = dos_mode(conn, smb_fname);
1104 size = smb_fname->st.st_ex_size;
1105
1106 if (ask_sharemode) {
1107 struct timespec write_time_ts;
1108 struct file_id fileid;
1109
1110 ZERO_STRUCT(write_time_ts);
1111 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1112 get_file_infos(fileid, NULL, &write_time_ts);
1113 if (!null_timespec(write_time_ts)) {
1114 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1115 }
1116 }
1117
1118 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1119 if (mode & aDIR) {
1120 size = 0;
1121 }
1122 }
1123
1124 reply_outbuf(req, 10, 0);
1125
1126 SSVAL(req->outbuf,smb_vwv0,mode);
1127 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1128 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1129 } else {
1130 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1131 }
1132 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1133
1134 if (get_Protocol() >= PROTOCOL_NT1) {
1135 SSVAL(req->outbuf, smb_flg2,
1136 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1137 }
1138
1139 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1140 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1141
1142 out:
1143 TALLOC_FREE(smb_fname);
1144 TALLOC_FREE(fname);
1145 END_PROFILE(SMBgetatr);
1146 return;
1147 }
1148
1149 /****************************************************************************
1150 Reply to a setatr.
1151 ****************************************************************************/
1152
1153 void reply_setatr(struct smb_request *req)
1154 {
1155 struct smb_file_time ft;
1156 connection_struct *conn = req->conn;
1157 struct smb_filename *smb_fname = NULL;
1158 char *fname = NULL;
1159 int mode;
1160 time_t mtime;
1161 const char *p;
1162 NTSTATUS status;
1163 TALLOC_CTX *ctx = talloc_tos();
1164
1165 START_PROFILE(SMBsetatr);
1166
1167 ZERO_STRUCT(ft);
1168
1169 if (req->wct < 2) {
1170 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1171 goto out;
1172 }
1173
1174 p = (const char *)req->buf + 1;
1175 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1176 if (!NT_STATUS_IS_OK(status)) {
1177 reply_nterror(req, status);
1178 goto out;
1179 }
1180
1181 status = filename_convert(ctx,
1182 conn,
1183 req->flags2 & FLAGS2_DFS_PATHNAMES,
1184 fname,
1185 0,
1186 NULL,
1187 &smb_fname);
1188 if (!NT_STATUS_IS_OK(status)) {
1189 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1190 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1191 ERRSRV, ERRbadpath);
1192 goto out;
1193 }
1194 reply_nterror(req, status);
1195 goto out;
1196 }
1197
1198 if (smb_fname->base_name[0] == '.' &&
1199 smb_fname->base_name[1] == '\0') {
1200 /*
1201 * Not sure here is the right place to catch this
1202 * condition. Might be moved to somewhere else later -- vl
1203 */
1204 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1205 goto out;
1206 }
1207
1208 mode = SVAL(req->vwv+0, 0);
1209 mtime = srv_make_unix_date3(req->vwv+1);
1210
1211 ft.mtime = convert_time_t_to_timespec(mtime);
1212 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1213 if (!NT_STATUS_IS_OK(status)) {
1214 reply_nterror(req, status);
1215 goto out;
1216 }
1217
1218 if (mode != FILE_ATTRIBUTE_NORMAL) {
1219 if (VALID_STAT_OF_DIR(smb_fname->st))
1220 mode |= aDIR;
1221 else
1222 mode &= ~aDIR;
1223
1224 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1225 false) != 0) {
1226 reply_nterror(req, map_nt_error_from_unix(errno));
1227 goto out;
1228 }
1229 }
1230
1231 reply_outbuf(req, 0, 0);
1232
1233 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1234 mode));
1235 out:
1236 TALLOC_FREE(smb_fname);
1237 END_PROFILE(SMBsetatr);
1238 return;
1239 }
1240
1241 /****************************************************************************
1242 Reply to a dskattr.
1243 ****************************************************************************/
1244
1245 void reply_dskattr(struct smb_request *req)
1246 {
1247 connection_struct *conn = req->conn;
1248 uint64_t dfree,dsize,bsize;
1249 START_PROFILE(SMBdskattr);
1250
1251 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1252 reply_nterror(req, map_nt_error_from_unix(errno));
1253 END_PROFILE(SMBdskattr);
1254 return;
1255 }
1256
1257 reply_outbuf(req, 5, 0);
1258
1259 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1260 double total_space, free_space;
1261 /* we need to scale this to a number that DOS6 can handle. We
1262 use floating point so we can handle large drives on systems
1263 that don't have 64 bit integers
1264
1265 we end up displaying a maximum of 2G to DOS systems
1266 */
1267 total_space = dsize * (double)bsize;
1268 free_space = dfree * (double)bsize;
1269
1270 dsize = (uint64_t)((total_space+63*512) / (64*512));
1271 dfree = (uint64_t)((free_space+63*512) / (64*512));
1272
1273 if (dsize > 0xFFFF) dsize = 0xFFFF;
1274 if (dfree > 0xFFFF) dfree = 0xFFFF;
1275
1276 SSVAL(req->outbuf,smb_vwv0,dsize);
1277 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1278 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1279 SSVAL(req->outbuf,smb_vwv3,dfree);
1280 } else {
1281 SSVAL(req->outbuf,smb_vwv0,dsize);
1282 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1283 SSVAL(req->outbuf,smb_vwv2,512);
1284 SSVAL(req->outbuf,smb_vwv3,dfree);
1285 }
1286
1287 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1288
1289 END_PROFILE(SMBdskattr);
1290 return;
1291 }
1292
1293 /*
1294 * Utility function to split the filename from the directory.
1295 */
1296 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1297 char **fname_dir_out,
1298 char **fname_mask_out)
1299 {
1300 const char *p = NULL;
1301 char *fname_dir = NULL;
1302 char *fname_mask = NULL;
1303
1304 p = strrchr_m(fname_in, '/');
1305 if (!p) {
1306 fname_dir = talloc_strdup(ctx, ".");
1307 fname_mask = talloc_strdup(ctx, fname_in);
1308 } else {
1309 fname_dir = talloc_strndup(ctx, fname_in,
1310 PTR_DIFF(p, fname_in));
1311 fname_mask = talloc_strdup(ctx, p+1);
1312 }
1313
1314 if (!fname_dir || !fname_mask) {
1315 TALLOC_FREE(fname_dir);
1316 TALLOC_FREE(fname_mask);
1317 return NT_STATUS_NO_MEMORY;
1318 }
1319
1320 *fname_dir_out = fname_dir;
1321 *fname_mask_out = fname_mask;
1322 return NT_STATUS_OK;
1323 }
1324
1325 /****************************************************************************
1326 Reply to a search.
1327 Can be called from SMBsearch, SMBffirst or SMBfunique.
1328 ****************************************************************************/
1329
1330 void reply_search(struct smb_request *req)
1331 {
1332 connection_struct *conn = req->conn;
1333 char *path = NULL;
1334 const char *mask = NULL;
1335 char *directory = NULL;
1336 struct smb_filename *smb_fname = NULL;
1337 char *fname = NULL;
1338 SMB_OFF_T size;
1339 uint32 mode;
1340 struct timespec date;
1341 uint32 dirtype;
1342 unsigned int numentries = 0;
1343 unsigned int maxentries = 0;
1344 bool finished = False;
1345 const char *p;
1346 int status_len;
1347 char status[21];
1348 int dptr_num= -1;
1349 bool check_descend = False;
1350 bool expect_close = False;
1351 NTSTATUS nt_status;
1352 bool mask_contains_wcard = False;
1353 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1354 TALLOC_CTX *ctx = talloc_tos();
1355 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1356 struct dptr_struct *dirptr = NULL;
1357 struct smbd_server_connection *sconn = req->sconn;
1358
1359 START_PROFILE(SMBsearch);
1360
1361 if (req->wct < 2) {
1362 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1363 goto out;
1364 }
1365
1366 if (lp_posix_pathnames()) {
1367 reply_unknown_new(req, req->cmd);
1368 goto out;
1369 }
1370
1371 /* If we were called as SMBffirst then we must expect close. */
1372 if(req->cmd == SMBffirst) {
1373 expect_close = True;
1374 }
1375
1376 reply_outbuf(req, 1, 3);
1377 maxentries = SVAL(req->vwv+0, 0);
1378 dirtype = SVAL(req->vwv+1, 0);
1379 p = (const char *)req->buf + 1;
1380 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1381 &nt_status, &mask_contains_wcard);
1382 if (!NT_STATUS_IS_OK(nt_status)) {
1383 reply_nterror(req, nt_status);
1384 goto out;
1385 }
1386
1387 p++;
1388 status_len = SVAL(p, 0);
1389 p += 2;
1390
1391 /* dirtype &= ~aDIR; */
1392
1393 if (status_len == 0) {
1394 nt_status = filename_convert(ctx, conn,
1395 req->flags2 & FLAGS2_DFS_PATHNAMES,
1396 path,
1397 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1398 &mask_contains_wcard,
1399 &smb_fname);
1400 if (!NT_STATUS_IS_OK(nt_status)) {
1401 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1402 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1403 ERRSRV, ERRbadpath);
1404 goto out;
1405 }
1406 reply_nterror(req, nt_status);
1407 goto out;
1408 }
1409
1410 directory = smb_fname->base_name;
1411
1412 p = strrchr_m(directory,'/');
1413 if ((p != NULL) && (*directory != '/')) {
1414 mask = p + 1;
1415 directory = talloc_strndup(ctx, directory,
1416 PTR_DIFF(p, directory));
1417 } else {
1418 mask = directory;
1419 directory = talloc_strdup(ctx,".");
1420 }
1421
1422 if (!directory) {
1423 reply_nterror(req, NT_STATUS_NO_MEMORY);
1424 goto out;
1425 }
1426
1427 memset((char *)status,'\0',21);
1428 SCVAL(status,0,(dirtype & 0x1F));
1429
1430 nt_status = dptr_create(conn,
1431 directory,
1432 True,
1433 expect_close,
1434 req->smbpid,
1435 mask,
1436 mask_contains_wcard,
1437 dirtype,
1438 &dirptr);
1439 if (!NT_STATUS_IS_OK(nt_status)) {
1440 reply_nterror(req, nt_status);
1441 goto out;
1442 }
1443 dptr_num = dptr_dnum(dirptr);
1444 } else {
1445 int status_dirtype;
1446 const char *dirpath;
1447
1448 memcpy(status,p,21);
1449 status_dirtype = CVAL(status,0) & 0x1F;
1450 if (status_dirtype != (dirtype & 0x1F)) {
1451 dirtype = status_dirtype;
1452 }
1453
1454 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1455 if (!dirptr) {
1456 goto SearchEmpty;
1457 }
1458 dirpath = dptr_path(sconn, dptr_num);
1459 directory = talloc_strdup(ctx, dirpath);
1460 if (!directory) {
1461 reply_nterror(req, NT_STATUS_NO_MEMORY);
1462 goto out;
1463 }
1464
1465 mask = dptr_wcard(sconn, dptr_num);
1466 if (!mask) {
1467 goto SearchEmpty;
1468 }
1469 /*
1470 * For a 'continue' search we have no string. So
1471 * check from the initial saved string.
1472 */
1473 mask_contains_wcard = ms_has_wild(mask);
1474 dirtype = dptr_attr(sconn, dptr_num);
1475 }
1476
1477 DEBUG(4,("dptr_num is %d\n",dptr_num));
1478
1479 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1480 dptr_init_search_op(dirptr);
1481
1482 if ((dirtype&0x1F) == aVOLID) {
1483 char buf[DIR_STRUCT_SIZE];
1484 memcpy(buf,status,21);
1485 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1486 0,aVOLID,0,!allow_long_path_components)) {
1487 reply_nterror(req, NT_STATUS_NO_MEMORY);
1488 goto out;
1489 }
1490 dptr_fill(sconn, buf+12,dptr_num);
1491 if (dptr_zero(buf+12) && (status_len==0)) {
1492 numentries = 1;
1493 } else {
1494 numentries = 0;
1495 }
1496 if (message_push_blob(&req->outbuf,
1497 data_blob_const(buf, sizeof(buf)))
1498 == -1) {
1499 reply_nterror(req, NT_STATUS_NO_MEMORY);
1500 goto out;
1501 }
1502 } else {
1503 unsigned int i;
1504 maxentries = MIN(
1505 maxentries,
1506 ((BUFFER_SIZE -
1507 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1508 /DIR_STRUCT_SIZE));
1509
1510 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1511 directory,lp_dontdescend(SNUM(conn))));
1512 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1513 check_descend = True;
1514 }
1515
1516 for (i=numentries;(i<maxentries) && !finished;i++) {
1517 finished = !get_dir_entry(ctx,
1518 dirptr,
1519 mask,
1520 dirtype,
1521 &fname,
1522 &size,
1523 &mode,
1524 &date,
1525 check_descend,
1526 ask_sharemode);
1527 if (!finished) {
1528 char buf[DIR_STRUCT_SIZE];
1529 memcpy(buf,status,21);
1530 if (!make_dir_struct(ctx,
1531 buf,
1532 mask,
1533 fname,
1534 size,
1535 mode,
1536 convert_timespec_to_time_t(date),
1537 !allow_long_path_components)) {
1538 reply_nterror(req, NT_STATUS_NO_MEMORY);
1539 goto out;
1540 }
1541 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1542 break;
1543 }
1544 if (message_push_blob(&req->outbuf,
1545 data_blob_const(buf, sizeof(buf)))
1546 == -1) {
1547 reply_nterror(req, NT_STATUS_NO_MEMORY);
1548 goto out;
1549 }
1550 numentries++;
1551 }
1552 }
1553 }
1554
1555 SearchEmpty:
1556
1557 /* If we were called as SMBffirst with smb_search_id == NULL
1558 and no entries were found then return error and close dirptr
1559 (X/Open spec) */
1560
1561 if (numentries == 0) {
1562 dptr_close(sconn, &dptr_num);
1563 } else if(expect_close && status_len == 0) {
1564 /* Close the dptr - we know it's gone */
1565 dptr_close(sconn, &dptr_num);
1566 }
1567
1568 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1569 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1570 dptr_close(sconn, &dptr_num);
1571 }
1572
1573 if ((numentries == 0) && !mask_contains_wcard) {
1574 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1575 goto out;
1576 }
1577
1578 SSVAL(req->outbuf,smb_vwv0,numentries);
1579 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1580 SCVAL(smb_buf(req->outbuf),0,5);
1581 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1582
1583 /* The replies here are never long name. */
1584 SSVAL(req->outbuf, smb_flg2,
1585 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1586 if (!allow_long_path_components) {
1587 SSVAL(req->outbuf, smb_flg2,
1588 SVAL(req->outbuf, smb_flg2)
1589 & (~FLAGS2_LONG_PATH_COMPONENTS));
1590 }
1591
1592 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1593 SSVAL(req->outbuf, smb_flg2,
1594 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1595
1596 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1597 smb_fn_name(req->cmd),
1598 mask,
1599 directory,
1600 dirtype,
1601 numentries,
1602 maxentries ));
1603 out:
1604 TALLOC_FREE(directory);
1605 TALLOC_FREE(smb_fname);
1606 END_PROFILE(SMBsearch);
1607 return;
1608 }
1609
1610 /****************************************************************************
1611 Reply to a fclose (stop directory search).
1612 ****************************************************************************/
1613
1614 void reply_fclose(struct smb_request *req)
1615 {
1616 int status_len;
1617 char status[21];
1618 int dptr_num= -2;
1619 const char *p;
1620 char *path = NULL;
1621 NTSTATUS err;
1622 bool path_contains_wcard = False;
1623 TALLOC_CTX *ctx = talloc_tos();
1624 struct smbd_server_connection *sconn = req->sconn;
1625
1626 START_PROFILE(SMBfclose);
1627
1628 if (lp_posix_pathnames()) {
1629 reply_unknown_new(req, req->cmd);
1630 END_PROFILE(SMBfclose);
1631 return;
1632 }
1633
1634 p = (const char *)req->buf + 1;
1635 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1636 &err, &path_contains_wcard);
1637 if (!NT_STATUS_IS_OK(err)) {
1638 reply_nterror(req, err);
1639 END_PROFILE(SMBfclose);
1640 return;
1641 }
1642 p++;
1643 status_len = SVAL(p,0);
1644 p += 2;
1645
1646 if (status_len == 0) {
1647 reply_force_doserror(req, ERRSRV, ERRsrverror);
1648 END_PROFILE(SMBfclose);
1649 return;
1650 }
1651
1652 memcpy(status,p,21);
1653
1654 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1655 /* Close the dptr - we know it's gone */
1656 dptr_close(sconn, &dptr_num);
1657 }
1658
1659 reply_outbuf(req, 1, 0);
1660 SSVAL(req->outbuf,smb_vwv0,0);
1661
1662 DEBUG(3,("search close\n"));
1663
1664 END_PROFILE(SMBfclose);
1665 return;
1666 }
1667
1668 /****************************************************************************
1669 Reply to an open.
1670 ****************************************************************************/
1671
1672 void reply_open(struct smb_request *req)
1673 {
1674 connection_struct *conn = req->conn;
1675 struct smb_filename *smb_fname = NULL;
1676 char *fname = NULL;
1677 uint32 fattr=0;
1678 SMB_OFF_T size = 0;
1679 time_t mtime=0;
1680 int info;
1681 files_struct *fsp;
1682 int oplock_request;
1683 int deny_mode;
1684 uint32 dos_attr;
1685 uint32 access_mask;
1686 uint32 share_mode;
1687 uint32 create_disposition;
1688 uint32 create_options = 0;
1689 uint32_t private_flags = 0;
1690 NTSTATUS status;
1691 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1692 TALLOC_CTX *ctx = talloc_tos();
1693
1694 START_PROFILE(SMBopen);
1695
1696 if (req->wct < 2) {
1697 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1698 goto out;
1699 }
1700
1701 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1702 deny_mode = SVAL(req->vwv+0, 0);
1703 dos_attr = SVAL(req->vwv+1, 0);
1704
1705 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1706 STR_TERMINATE, &status);
1707 if (!NT_STATUS_IS_OK(status)) {
1708 reply_nterror(req, status);
1709 goto out;
1710 }
1711
1712 status = filename_convert(ctx,
1713 conn,
1714 req->flags2 & FLAGS2_DFS_PATHNAMES,
1715 fname,
1716 0,
1717 NULL,
1718 &smb_fname);
1719 if (!NT_STATUS_IS_OK(status)) {
1720 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1721 reply_botherror(req,
1722 NT_STATUS_PATH_NOT_COVERED,
1723 ERRSRV, ERRbadpath);
1724 goto out;
1725 }
1726 reply_nterror(req, status);
1727 goto out;
1728 }
1729
1730 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1731 OPENX_FILE_EXISTS_OPEN, &access_mask,
1732 &share_mode, &create_disposition,
1733 &create_options, &private_flags)) {
1734 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1735 goto out;
1736 }
1737
1738 status = SMB_VFS_CREATE_FILE(
1739 conn, /* conn */
1740 req, /* req */
1741 0, /* root_dir_fid */
1742 smb_fname, /* fname */
1743 access_mask, /* access_mask */
1744 share_mode, /* share_access */
1745 create_disposition, /* create_disposition*/
1746 create_options, /* create_options */
1747 dos_attr, /* file_attributes */
1748 oplock_request, /* oplock_request */
1749 0, /* allocation_size */
1750 private_flags,
1751 NULL, /* sd */
1752 NULL, /* ea_list */
1753 &fsp, /* result */
1754 &info); /* pinfo */
1755
1756 if (!NT_STATUS_IS_OK(status)) {
1757 if (open_was_deferred(req->mid)) {
1758 /* We have re-scheduled this call. */
1759 goto out;
1760 }
1761 reply_openerror(req, status);
1762 goto out;
1763 }
1764
1765 size = smb_fname->st.st_ex_size;
1766 fattr = dos_mode(conn, smb_fname);
1767
1768 /* Deal with other possible opens having a modified
1769 write time. JRA. */
1770 if (ask_sharemode) {
1771 struct timespec write_time_ts;
1772
1773 ZERO_STRUCT(write_time_ts);
1774 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1775 if (!null_timespec(write_time_ts)) {
1776 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1777 }
1778 }
1779
1780 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1781
1782 if (fattr & aDIR) {
1783 DEBUG(3,("attempt to open a directory %s\n",
1784 fsp_str_dbg(fsp)));
1785 close_file(req, fsp, ERROR_CLOSE);
1786 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1787 ERRDOS, ERRnoaccess);
1788 goto out;
1789 }
1790
1791 reply_outbuf(req, 7, 0);
1792 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1793 SSVAL(req->outbuf,smb_vwv1,fattr);
1794 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1795 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1796 } else {
1797 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1798 }
1799 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1800 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1801
1802 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1803 SCVAL(req->outbuf,smb_flg,
1804 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1805 }
1806
1807 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1808 SCVAL(req->outbuf,smb_flg,
1809 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1810 }
1811 out:
1812 TALLOC_FREE(smb_fname);
1813 END_PROFILE(SMBopen);
1814 return;
1815 }
1816
1817 /****************************************************************************
1818 Reply to an open and X.
1819 ****************************************************************************/
1820
1821 void reply_open_and_X(struct smb_request *req)
1822 {
1823 connection_struct *conn = req->conn;
1824 struct smb_filename *smb_fname = NULL;
1825 char *fname = NULL;
1826 uint16 open_flags;
1827 int deny_mode;
1828 uint32 smb_attr;
1829 /* Breakout the oplock request bits so we can set the
1830 reply bits separately. */
1831 int ex_oplock_request;
1832 int core_oplock_request;
1833 int oplock_request;
1834 #if 0
1835 int smb_sattr = SVAL(req->vwv+4, 0);
1836 uint32 smb_time = make_unix_date3(req->vwv+6);
1837 #endif
1838 int smb_ofun;
1839 uint32 fattr=0;
1840 int mtime=0;
1841 int smb_action = 0;
1842 files_struct *fsp;
1843 NTSTATUS status;
1844 uint64_t allocation_size;
1845 ssize_t retval = -1;
1846 uint32 access_mask;
1847 uint32 share_mode;
1848 uint32 create_disposition;
1849 uint32 create_options = 0;
1850 uint32_t private_flags = 0;
1851 TALLOC_CTX *ctx = talloc_tos();
1852
1853 START_PROFILE(SMBopenX);
1854
1855 if (req->wct < 15) {
1856 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1857 goto out;
1858 }
1859
1860 open_flags = SVAL(req->vwv+2, 0);
1861 deny_mode = SVAL(req->vwv+3, 0);
1862 smb_attr = SVAL(req->vwv+5, 0);
1863 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1864 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1865 oplock_request = ex_oplock_request | core_oplock_request;
1866 smb_ofun = SVAL(req->vwv+8, 0);
1867 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1868
1869 /* If it's an IPC, pass off the pipe handler. */
1870 if (IS_IPC(conn)) {
1871 if (lp_nt_pipe_support()) {
1872 reply_open_pipe_and_X(conn, req);
1873 } else {
1874 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1875 }
1876 goto out;
1877 }
1878
1879 /* XXXX we need to handle passed times, sattr and flags */
1880 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1881 STR_TERMINATE, &status);
1882 if (!NT_STATUS_IS_OK(status)) {
1883 reply_nterror(req, status);
1884 goto out;
1885 }
1886
1887 status = filename_convert(ctx,
1888 conn,
1889 req->flags2 & FLAGS2_DFS_PATHNAMES,
1890 fname,
1891 0,
1892 NULL,
1893 &smb_fname);
1894 if (!NT_STATUS_IS_OK(status)) {
1895 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1896 reply_botherror(req,
1897 NT_STATUS_PATH_NOT_COVERED,
1898 ERRSRV, ERRbadpath);
1899 goto out;
1900 }
1901 reply_nterror(req, status);
1902 goto out;
1903 }
1904
1905 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1906 &access_mask, &share_mode,
1907 &create_disposition,
1908 &create_options,
1909 &private_flags)) {
1910 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1911 goto out;
1912 }
1913
1914 status = SMB_VFS_CREATE_FILE(
1915 conn, /* conn */
1916 req, /* req */
1917 0, /* root_dir_fid */
1918 smb_fname, /* fname */
1919 access_mask, /* access_mask */
1920 share_mode, /* share_access */
1921 create_disposition, /* create_disposition*/
1922 create_options, /* create_options */
1923 smb_attr, /* file_attributes */
1924 oplock_request, /* oplock_request */
1925 0, /* allocation_size */
1926 private_flags,
1927 NULL, /* sd */
1928 NULL, /* ea_list */
1929 &fsp, /* result */
1930 &smb_action); /* pinfo */
1931
1932 if (!NT_STATUS_IS_OK(status)) {
1933 if (open_was_deferred(req->mid)) {
1934 /* We have re-scheduled this call. */
1935 goto out;
1936 }
1937 reply_openerror(req, status);
1938 goto out;
1939 }
1940
1941 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1942 if the file is truncated or created. */
1943 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1944 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1945 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1946 close_file(req, fsp, ERROR_CLOSE);
1947 reply_nterror(req, NT_STATUS_DISK_FULL);
1948 goto out;
1949 }
1950 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1951 if (retval < 0) {
1952 close_file(req, fsp, ERROR_CLOSE);
1953 reply_nterror(req, NT_STATUS_DISK_FULL);
1954 goto out;
1955 }
1956 smb_fname->st.st_ex_size =
1957 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1958 }
1959
1960 fattr = dos_mode(conn, smb_fname);
1961 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1962 if (fattr & aDIR) {
1963 close_file(req, fsp, ERROR_CLOSE);
1964 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1965 goto out;
1966 }
1967
1968 /* If the caller set the extended oplock request bit
1969 and we granted one (by whatever means) - set the
1970 correct bit for extended oplock reply.
1971 */
1972
1973 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1974 smb_action |= EXTENDED_OPLOCK_GRANTED;
1975 }
1976
1977 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1978 smb_action |= EXTENDED_OPLOCK_GRANTED;
1979 }
1980
1981 /* If the caller set the core oplock request bit
1982 and we granted one (by whatever means) - set the
1983 correct bit for core oplock reply.
1984 */
1985
1986 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1987 reply_outbuf(req, 19, 0);
1988 } else {
1989 reply_outbuf(req, 15, 0);
1990 }
1991
1992 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1993 SCVAL(req->outbuf, smb_flg,
1994 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1995 }
1996
1997 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1998 SCVAL(req->outbuf, smb_flg,
1999 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2000 }
2001
2002 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2003 SSVAL(req->outbuf,smb_vwv3,fattr);
2004 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2005 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2006 } else {
2007 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2008 }
2009 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2010 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2011 SSVAL(req->outbuf,smb_vwv11,smb_action);
2012
2013 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2014 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2015 }
2016
2017 chain_reply(req);
2018 out:
2019 TALLOC_FREE(smb_fname);
2020 END_PROFILE(SMBopenX);
2021 return;
2022 }
2023
2024 /****************************************************************************
2025 Reply to a SMBulogoffX.
2026 ****************************************************************************/
2027
2028 void reply_ulogoffX(struct smb_request *req)
2029 {
2030 struct smbd_server_connection *sconn = req->sconn;
2031 user_struct *vuser;
2032
2033 START_PROFILE(SMBulogoffX);
2034
2035 vuser = get_valid_user_struct(sconn, req->vuid);
2036
2037 if(vuser == NULL) {
2038 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2039 req->vuid));
2040 }
2041
2042 /* in user level security we are supposed to close any files
2043 open by this user */
2044 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2045 file_close_user(req->vuid);
2046 }
2047
2048 invalidate_vuid(sconn, req->vuid);
2049
2050 reply_outbuf(req, 2, 0);
2051
2052 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2053
2054 END_PROFILE(SMBulogoffX);
2055 req->vuid = UID_FIELD_INVALID;
2056 chain_reply(req);
2057 }
2058
2059 /****************************************************************************
2060 Reply to a mknew or a create.
2061 ****************************************************************************/
2062
2063 void reply_mknew(struct smb_request *req)
2064 {
2065 connection_struct *conn = req->conn;
2066 struct smb_filename *smb_fname = NULL;
2067 char *fname = NULL;
2068 uint32 fattr = 0;
2069 struct smb_file_time ft;
2070 files_struct *fsp;
2071 int oplock_request = 0;
2072 NTSTATUS status;
2073 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2074 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2075 uint32 create_disposition;
2076 uint32 create_options = 0;
2077 TALLOC_CTX *ctx = talloc_tos();
2078
2079 START_PROFILE(SMBcreate);
2080 ZERO_STRUCT(ft);
2081
2082 if (req->wct < 3) {
2083 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2084 goto out;
2085 }
2086
2087 fattr = SVAL(req->vwv+0, 0);
2088 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2089
2090 /* mtime. */
2091 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2092
2093 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2094 STR_TERMINATE, &status);
2095 if (!NT_STATUS_IS_OK(status)) {
2096 reply_nterror(req, status);
2097 goto out;
2098 }
2099
2100 status = filename_convert(ctx,
2101 conn,
2102 req->flags2 & FLAGS2_DFS_PATHNAMES,
2103 fname,
2104 0,
2105 NULL,
2106 &smb_fname);
2107 if (!NT_STATUS_IS_OK(status)) {
2108 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2109 reply_botherror(req,
2110 NT_STATUS_PATH_NOT_COVERED,
2111 ERRSRV, ERRbadpath);
2112 goto out;
2113 }
2114 reply_nterror(req, status);
2115 goto out;
2116 }
2117
2118 if (fattr & aVOLID) {
2119 DEBUG(0,("Attempt to create file (%s) with volid set - "
2120 "please report this\n",
2121 smb_fname_str_dbg(smb_fname)));
2122 }
2123
2124 if(req->cmd == SMBmknew) {
2125 /* We should fail if file exists. */
2126 create_disposition = FILE_CREATE;
2127 } else {
2128 /* Create if file doesn't exist, truncate if it does. */
2129 create_disposition = FILE_OVERWRITE_IF;
2130 }
2131
2132 status = SMB_VFS_CREATE_FILE(
2133 conn, /* conn */
2134 req, /* req */
2135 0, /* root_dir_fid */
2136 smb_fname, /* fname */
2137 access_mask, /* access_mask */
2138 share_mode, /* share_access */
2139 create_disposition, /* create_disposition*/
2140 create_options, /* create_options */
2141 fattr, /* file_attributes */
2142 oplock_request, /* oplock_request */
2143 0, /* allocation_size */
2144 0, /* private_flags */
2145 NULL, /* sd */
2146 NULL, /* ea_list */
2147 &fsp, /* result */
2148 NULL); /* pinfo */
2149
2150 if (!NT_STATUS_IS_OK(status)) {
2151 if (open_was_deferred(req->mid)) {
2152 /* We have re-scheduled this call. */
2153 goto out;
2154 }
2155 reply_openerror(req, status);
2156 goto out;
2157 }
2158
2159 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2160 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2161 if (!NT_STATUS_IS_OK(status)) {
2162 END_PROFILE(SMBcreate);
2163 goto out;
2164 }
2165
2166 reply_outbuf(req, 1, 0);
2167 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2168
2169 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2170 SCVAL(req->outbuf,smb_flg,
2171 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2172 }
2173
2174 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2175 SCVAL(req->outbuf,smb_flg,
2176 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2177 }
2178
2179 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2180 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2181 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2182 (unsigned int)fattr));
2183
2184 out:
2185 TALLOC_FREE(smb_fname);
2186 END_PROFILE(SMBcreate);
2187 return;
2188 }
2189
2190 /****************************************************************************
2191 Reply to a create temporary file.
2192 ****************************************************************************/
2193
2194 void reply_ctemp(struct smb_request *req)
2195 {
2196 connection_struct *conn = req->conn;
2197 struct smb_filename *smb_fname = NULL;
2198 char *fname = NULL;
2199 uint32 fattr;
2200 files_struct *fsp;
2201 int oplock_request;
2202 int tmpfd;
2203 char *s;
2204 NTSTATUS status;
2205 TALLOC_CTX *ctx = talloc_tos();
2206
2207 START_PROFILE(SMBctemp);
2208
2209 if (req->wct < 3) {
2210 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2211 goto out;
2212 }
2213
2214 fattr = SVAL(req->vwv+0, 0);
2215 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2216
2217 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2218 STR_TERMINATE, &status);
2219 if (!NT_STATUS_IS_OK(status)) {
2220 reply_nterror(req, status);
2221 goto out;
2222 }
2223 if (*fname) {
2224 fname = talloc_asprintf(ctx,
2225 "%s/TMXXXXXX",
2226 fname);
2227 } else {
2228 fname = talloc_strdup(ctx, "TMXXXXXX");
2229 }
2230
2231 if (!fname) {
2232 reply_nterror(req, NT_STATUS_NO_MEMORY);
2233 goto out;
2234 }
2235
2236 status = filename_convert(ctx, conn,
2237 req->flags2 & FLAGS2_DFS_PATHNAMES,
2238 fname,
2239 0,
2240 NULL,
2241 &smb_fname);
2242 if (!NT_STATUS_IS_OK(status)) {
2243 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2244 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2245 ERRSRV, ERRbadpath);
2246 goto out;
2247 }
2248 reply_nterror(req, status);
2249 goto out;
2250 }
2251
2252 tmpfd = mkstemp(smb_fname->base_name);
2253 if (tmpfd == -1) {
2254 reply_nterror(req, map_nt_error_from_unix(errno));
2255 goto out;
2256 }
2257
2258 SMB_VFS_STAT(conn, smb_fname);
2259
2260 /* We should fail if file does not exist. */
2261 status = SMB_VFS_CREATE_FILE(
2262 conn, /* conn */
2263 req, /* req */
2264 0, /* root_dir_fid */
2265 smb_fname, /* fname */
2266 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2267 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2268 FILE_OPEN, /* create_disposition*/
2269 0, /* create_options */
2270 fattr, /* file_attributes */
2271 oplock_request, /* oplock_request */
2272 0, /* allocation_size */
2273 0, /* private_flags */
2274 NULL, /* sd */
2275 NULL, /* ea_list */
2276 &fsp, /* result */
2277 NULL); /* pinfo */
2278
2279 /* close fd from mkstemp() */
2280 close(tmpfd);
2281
2282 if (!NT_STATUS_IS_OK(status)) {
2283 if (open_was_deferred(req->mid)) {
2284 /* We have re-scheduled this call. */
2285 goto out;
2286 }
2287 reply_openerror(req, status);
2288 goto out;
2289 }
2290
2291 reply_outbuf(req, 1, 0);
2292 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2293
2294 /* the returned filename is relative to the directory */
2295 s = strrchr_m(fsp->fsp_name->base_name, '/');
2296 if (!s) {
2297 s = fsp->fsp_name->base_name;
2298 } else {
2299 s++;
2300 }
2301
2302 #if 0
2303 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2304 thing in the byte section. JRA */
2305 SSVALS(p, 0, -1); /* what is this? not in spec */
2306 #endif
2307 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2308 == -1) {
2309 reply_nterror(req, NT_STATUS_NO_MEMORY);
2310 goto out;
2311 }
2312
2313 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2314 SCVAL(req->outbuf, smb_flg,
2315 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2316 }
2317
2318 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2319 SCVAL(req->outbuf, smb_flg,
2320 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2321 }
2322
2323 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2324 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2325 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2326 out:
2327 TALLOC_FREE(smb_fname);
2328 END_PROFILE(SMBctemp);
2329 return;
2330 }
2331
2332 /*******************************************************************
2333 Check if a user is allowed to rename a file.
2334 ********************************************************************/
2335
2336 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2337 uint16 dirtype)
2338 {
2339 uint32 fmode;
2340
2341 if (!CAN_WRITE(conn)) {
2342 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2343 }
2344
2345 fmode = dos_mode(conn, fsp->fsp_name);
2346 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2347 return NT_STATUS_NO_SUCH_FILE;
2348 }
2349
2350 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2351 if (fsp->posix_open) {
2352 return NT_STATUS_OK;
2353 }
2354
2355 /* If no pathnames are open below this
2356 directory, allow the rename. */
2357
2358 if (file_find_subpath(fsp)) {
2359 return NT_STATUS_ACCESS_DENIED;
2360 }
2361 return NT_STATUS_OK;
2362 }
2363
2364 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2365 return NT_STATUS_OK;
2366 }
2367
2368 return NT_STATUS_ACCESS_DENIED;
2369 }
2370
2371 /*******************************************************************
2372 * unlink a file with all relevant access checks
2373 *******************************************************************/
2374
2375 static NTSTATUS do_unlink(connection_struct *conn,
2376 struct smb_request *req,
2377 struct smb_filename *smb_fname,
2378 uint32 dirtype)
2379 {
2380 uint32 fattr;
2381 files_struct *fsp;
2382 uint32 dirtype_orig = dirtype;
2383 NTSTATUS status;
2384 int ret;
2385 bool posix_paths = lp_posix_pathnames();
2386
2387 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2388 smb_fname_str_dbg(smb_fname),
2389 dirtype));
2390
2391 if (!CAN_WRITE(conn)) {
2392 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2393 }
2394
2395 if (posix_paths) {
2396 ret = SMB_VFS_LSTAT(conn, smb_fname);
2397 } else {
2398 ret = SMB_VFS_STAT(conn, smb_fname);
2399 }
2400 if (ret != 0) {
2401 return map_nt_error_from_unix(errno);
2402 }
2403
2404 fattr = dos_mode(conn, smb_fname);
2405
2406 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2407 dirtype = aDIR|aARCH|aRONLY;
2408 }
2409
2410 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2411 if (!dirtype) {
2412 return NT_STATUS_NO_SUCH_FILE;
2413 }
2414
2415 if (!dir_check_ftype(conn, fattr, dirtype)) {
2416 if (fattr & aDIR) {
2417 return NT_STATUS_FILE_IS_A_DIRECTORY;
2418 }
2419 return NT_STATUS_NO_SUCH_FILE;
2420 }
2421
2422 if (dirtype_orig & 0x8000) {
2423 /* These will never be set for POSIX. */
2424 return NT_STATUS_NO_SUCH_FILE;
2425 }
2426
2427 #if 0
2428 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2429 return NT_STATUS_FILE_IS_A_DIRECTORY;
2430 }
2431
2432 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2433 return NT_STATUS_NO_SUCH_FILE;
2434 }
2435
2436 if (dirtype & 0xFF00) {
2437 /* These will never be set for POSIX. */
2438 return NT_STATUS_NO_SUCH_FILE;
2439 }
2440
2441 dirtype &= 0xFF;
2442 if (!dirtype) {
2443 return NT_STATUS_NO_SUCH_FILE;
2444 }
2445
2446 /* Can't delete a directory. */
2447 if (fattr & aDIR) {
2448 return NT_STATUS_FILE_IS_A_DIRECTORY;
2449 }
2450 #endif
2451
2452 #if 0 /* JRATEST */
2453 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2454 return NT_STATUS_OBJECT_NAME_INVALID;
2455 #endif /* JRATEST */
2456
2457 /* On open checks the open itself will check the share mode, so
2458 don't do it here as we'll get it wrong. */
2459
2460 status = SMB_VFS_CREATE_FILE
2461 (conn, /* conn */
2462 req, /* req */
2463 0, /* root_dir_fid */
2464 smb_fname, /* fname */
2465 DELETE_ACCESS, /* access_mask */
2466 FILE_SHARE_NONE, /* share_access */
2467 FILE_OPEN, /* create_disposition*/
2468 FILE_NON_DIRECTORY_FILE, /* create_options */
2469 /* file_attributes */
2470 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2471 FILE_ATTRIBUTE_NORMAL,
2472 0, /* oplock_request */
2473 0, /* allocation_size */
2474 0, /* private_flags */
2475 NULL, /* sd */
2476 NULL, /* ea_list */
2477 &fsp, /* result */
2478 NULL); /* pinfo */
2479
2480 if (!NT_STATUS_IS_OK(status)) {
2481 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2482 nt_errstr(status)));
2483 return status;
2484 }
2485
2486 status = can_set_delete_on_close(fsp, fattr);
2487 if (!NT_STATUS_IS_OK(status)) {
2488 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2489 "(%s)\n",
2490 smb_fname_str_dbg(smb_fname),
2491 nt_errstr(status)));
2492 close_file(req, fsp, NORMAL_CLOSE);
2493 return status;
2494 }
2495
2496 /* The set is across all open files on this dev/inode pair. */
2497 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2498 close_file(req, fsp, NORMAL_CLOSE);
2499 return NT_STATUS_ACCESS_DENIED;
2500 }
2501
2502 return close_file(req, fsp, NORMAL_CLOSE);
2503 }
2504
2505 /****************************************************************************
2506 The guts of the unlink command, split out so it may be called by the NT SMB
2507 code.
2508 ****************************************************************************/
2509
2510 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2511 uint32 dirtype, struct smb_filename *smb_fname,
2512 bool has_wild)
2513 {
2514 char *fname_dir = NULL;
2515 char *fname_mask = NULL;
2516 int count=0;
2517 NTSTATUS status = NT_STATUS_OK;
2518 TALLOC_CTX *ctx = talloc_tos();
2519
2520 /* Split up the directory from the filename/mask. */
2521 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2522 &fname_dir, &fname_mask);
2523 if (!NT_STATUS_IS_OK(status)) {
2524 goto out;
2525 }
2526
2527 /*
2528 * We should only check the mangled cache
2529 * here if unix_convert failed. This means
2530 * that the path in 'mask' doesn't exist
2531 * on the file system and so we need to look
2532 * for a possible mangle. This patch from
2533 * Tine Smukavec <valentin.smukavec@hermes.si>.
2534 */
2535
2536 if (!VALID_STAT(smb_fname->st) &&
2537 mangle_is_mangled(fname_mask, conn->params)) {
2538 char *new_mask = NULL;
2539 mangle_lookup_name_from_8_3(ctx, fname_mask,
2540 &new_mask, conn->params);
2541 if (new_mask) {
2542 TALLOC_FREE(fname_mask);
2543 fname_mask = new_mask;
2544 }
2545 }
2546
2547 if (!has_wild) {
2548
2549 /*
2550 * Only one file needs to be unlinked. Append the mask back
2551 * onto the directory.
2552 */
2553 TALLOC_FREE(smb_fname->base_name);
2554 smb_fname->base_name = talloc_asprintf(smb_fname,
2555 "%s/%s",
2556 fname_dir,
2557 fname_mask);
2558 if (!smb_fname->base_name) {
2559 status = NT_STATUS_NO_MEMORY;
2560 goto out;
2561 }
2562 if (dirtype == 0) {
2563 dirtype = FILE_ATTRIBUTE_NORMAL;
2564 }
2565
2566 status = check_name(conn, smb_fname->base_name);
2567 if (!NT_STATUS_IS_OK(status)) {
2568 goto out;
2569 }
2570
2571 status = do_unlink(conn, req, smb_fname, dirtype);
2572 if (!NT_STATUS_IS_OK(status)) {
2573 goto out;
2574 }
2575
2576 count++;
2577 } else {
2578 struct smb_Dir *dir_hnd = NULL;
2579 long offset = 0;
2580 const char *dname = NULL;
2581 char *talloced = NULL;
2582
2583 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2584 status = NT_STATUS_OBJECT_NAME_INVALID;
2585 goto out;
2586 }
2587
2588 if (strequal(fname_mask,"????????.???")) {
2589 TALLOC_FREE(fname_mask);
2590 fname_mask = talloc_strdup(ctx, "*");
2591 if (!fname_mask) {
2592 status = NT_STATUS_NO_MEMORY;
2593 goto out;
2594 }
2595 }
2596
2597 status = check_name(conn, fname_dir);
2598 if (!NT_STATUS_IS_OK(status)) {
2599 goto out;
2600 }
2601
2602 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2603 dirtype);
2604 if (dir_hnd == NULL) {
2605 status = map_nt_error_from_unix(errno);
2606 goto out;
2607 }
2608
2609 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2610 the pattern matches against the long name, otherwise the short name
2611 We don't implement this yet XXXX
2612 */
2613
2614 status = NT_STATUS_NO_SUCH_FILE;
2615
2616 while ((dname = ReadDirName(dir_hnd, &offset,
2617 &smb_fname->st, &talloced))) {
2618 TALLOC_CTX *frame = talloc_stackframe();
2619
2620 if (!is_visible_file(conn, fname_dir, dname,
2621 &smb_fname->st, true)) {
2622 TALLOC_FREE(frame);
2623 TALLOC_FREE(talloced);
2624 continue;
2625 }
2626
2627 /* Quick check for "." and ".." */
2628 if (ISDOT(dname) || ISDOTDOT(dname)) {
2629 TALLOC_FREE(frame);
2630 TALLOC_FREE(talloced);
2631 continue;
2632 }
2633
2634 if(!mask_match(dname, fname_mask,
2635 conn->case_sensitive)) {
2636 TALLOC_FREE(frame);
2637 TALLOC_FREE(talloced);
2638 continue;
2639 }
2640
2641 TALLOC_FREE(smb_fname->base_name);
2642 smb_fname->base_name =
2643 talloc_asprintf(smb_fname, "%s/%s",
2644 fname_dir, dname);
2645
2646 if (!smb_fname->base_name) {
2647 TALLOC_FREE(dir_hnd);
2648 status = NT_STATUS_NO_MEMORY;
2649 TALLOC_FREE(frame);
2650 TALLOC_FREE(talloced);
2651 goto out;
2652 }
2653
2654 status = check_name(conn, smb_fname->base_name);
2655 if (!NT_STATUS_IS_OK(status)) {
2656 TALLOC_FREE(dir_hnd);
2657 TALLOC_FREE(frame);
2658 TALLOC_FREE(talloced);
2659 goto out;
2660 }
2661
2662 status = do_unlink(conn, req, smb_fname, dirtype);
2663 if (!NT_STATUS_IS_OK(status)) {
2664 TALLOC_FREE(frame);
2665 TALLOC_FREE(talloced);
2666 continue;
2667 }
2668
2669 count++;
2670 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2671 smb_fname->base_name));
2672
2673 TALLOC_FREE(frame);
2674 TALLOC_FREE(talloced);
2675 }
2676 TALLOC_FREE(dir_hnd);
2677 }
2678
2679 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2680 status = map_nt_error_from_unix(errno);
2681 }
2682
2683 out:
2684 TALLOC_FREE(fname_dir);
2685 TALLOC_FREE(fname_mask);
2686 return status;
2687 }
2688
2689 /****************************************************************************
2690 Reply to a unlink
2691 ****************************************************************************/
2692
2693 void reply_unlink(struct smb_request *req)
2694 {
2695 connection_struct *conn = req->conn;
2696 char *name = NULL;
2697 struct smb_filename *smb_fname = NULL;
2698 uint32 dirtype;
2699 NTSTATUS status;
2700 bool path_contains_wcard = False;
2701 TALLOC_CTX *ctx = talloc_tos();
2702
2703 START_PROFILE(SMBunlink);
2704
2705 if (req->wct < 1) {
2706 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2707 goto out;
2708 }
2709
2710 dirtype = SVAL(req->vwv+0, 0);
2711
2712 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2713 STR_TERMINATE, &status,
2714 &path_contains_wcard);
2715 if (!NT_STATUS_IS_OK(status)) {
2716 reply_nterror(req, status);
2717 goto out;
2718 }
2719
2720 status = filename_convert(ctx, conn,
2721 req->flags2 & FLAGS2_DFS_PATHNAMES,
2722 name,
2723 UCF_COND_ALLOW_WCARD_LCOMP,
2724 &path_contains_wcard,
2725 &smb_fname);
2726 if (!NT_STATUS_IS_OK(status)) {
2727 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2728 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2729 ERRSRV, ERRbadpath);
2730 goto out;
2731 }
2732 reply_nterror(req, status);
2733 goto out;
2734 }
2735
2736 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2737
2738 status = unlink_internals(conn, req, dirtype, smb_fname,
2739 path_contains_wcard);
2740 if (!NT_STATUS_IS_OK(status)) {
2741 if (open_was_deferred(req->mid)) {
2742 /* We have re-scheduled this call. */
2743 goto out;
2744 }
2745 reply_nterror(req, status);
2746 goto out;
2747 }
2748
2749 reply_outbuf(req, 0, 0);
2750 out:
2751 TALLOC_FREE(smb_fname);
2752 END_PROFILE(SMBunlink);
2753 return;
2754 }
2755
2756 /****************************************************************************
2757 Fail for readbraw.
2758 ****************************************************************************/
2759
2760 static void fail_readraw(void)
2761 {
2762 const char *errstr = talloc_asprintf(talloc_tos(),
2763 "FAIL ! reply_readbraw: socket write fail (%s)",
2764 strerror(errno));
2765 if (!errstr) {
2766 errstr = "";
2767 }
2768 exit_server_cleanly(errstr);
2769 }
2770
2771 /****************************************************************************
2772 Fake (read/write) sendfile. Returns -1 on read or write fail.
2773 ****************************************************************************/
2774
2775 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2776 size_t nread)
2777 {
2778 size_t bufsize;
2779 size_t tosend = nread;
2780 char *buf;
2781
2782 if (nread == 0) {
2783 return 0;
2784 }
2785
2786 bufsize = MIN(nread, 65536);
2787
2788 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2789 return -1;
2790 }
2791
2792 while (tosend > 0) {
2793 ssize_t ret;
2794 size_t cur_read;
2795
2796 if (tosend > bufsize) {
2797 cur_read = bufsize;
2798 } else {
2799 cur_read = tosend;
2800 }
2801 ret = read_file(fsp,buf,startpos,cur_read);
2802 if (ret == -1) {
2803 SAFE_FREE(buf);
2804 return -1;
2805 }
2806
2807 /* If we had a short read, fill with zeros. */
2808 if (ret < cur_read) {
2809 memset(buf + ret, '\0', cur_read - ret);
2810 }
2811
2812 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2813 SAFE_FREE(buf);
2814 return -1;
2815 }
2816 tosend -= cur_read;
2817 startpos += cur_read;
2818 }
2819
2820 SAFE_FREE(buf);
2821 return (ssize_t)nread;
2822 }
2823
2824 #if defined(WITH_SENDFILE)
2825 /****************************************************************************
2826 Deal with the case of sendfile reading less bytes from the file than
2827 requested. Fill with zeros (all we can do).
2828 ****************************************************************************/
2829
2830 static void sendfile_short_send(files_struct *fsp,
2831 ssize_t nread,
2832 size_t headersize,
2833 size_t smb_maxcnt)
2834 {
2835 #define SHORT_SEND_BUFSIZE 1024
2836 if (nread < headersize) {
2837 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2838 "header for file %s (%s). Terminating\n",
2839 fsp_str_dbg(fsp), strerror(errno)));
2840 exit_server_cleanly("sendfile_short_send failed");
2841 }
2842
2843 nread -= headersize;
2844
2845 if (nread < smb_maxcnt) {
2846 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2847 if (!buf) {
2848 exit_server_cleanly("sendfile_short_send: "
2849 "malloc failed");
2850 }
2851
2852 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2853 "with zeros !\n", fsp_str_dbg(fsp)));
2854
2855 while (nread < smb_maxcnt) {
2856 /*
2857 * We asked for the real file size and told sendfile
2858 * to not go beyond the end of the file. But it can
2859 * happen that in between our fstat call and the
2860 * sendfile call the file was truncated. This is very
2861 * bad because we have already announced the larger
2862 * number of bytes to the client.
2863 *
2864 * The best we can do now is to send 0-bytes, just as
2865 * a read from a hole in a sparse file would do.
2866 *
2867 * This should happen rarely enough that I don't care
2868 * about efficiency here :-)
2869 */
2870 size_t to_write;
2871
2872 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2873 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2874 exit_server_cleanly("sendfile_short_send: "
2875 "write_data failed");
2876 }
2877 nread += to_write;
2878 }
2879 SAFE_FREE(buf);
2880 }
2881 }
2882 #endif /* defined WITH_SENDFILE */
2883
2884 /****************************************************************************
2885 Return a readbraw error (4 bytes of zero).
2886 ****************************************************************************/
2887
2888 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2889 {
2890 char header[4];
2891
2892 SIVAL(header,0,0);
2893
2894 smbd_lock_socket(sconn);
2895 if (write_data(smbd_server_fd(),header,4) != 4) {
2896 fail_readraw();
2897 }
2898 smbd_unlock_socket(sconn);
2899 }
2900
2901 /****************************************************************************
2902 Use sendfile in readbraw.
2903 ****************************************************************************/
2904
2905 static void send_file_readbraw(connection_struct *conn,
2906 struct smb_request *req,
2907 files_struct *fsp,
2908 SMB_OFF_T startpos,
2909 size_t nread,
2910 ssize_t mincount)
2911 {
2912 struct smbd_server_connection *sconn = req->sconn;
2913 char *outbuf = NULL;
2914 ssize_t ret=0;
2915
2916 #if defined(WITH_SENDFILE)
2917 /*
2918 * We can only use sendfile on a non-chained packet
2919 * but we can use on a non-oplocked file. tridge proved this
2920 * on a train in Germany :-). JRA.
2921 * reply_readbraw has already checked the length.
2922 */
2923
2924 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2925 (fsp->wcp == NULL) &&
2926 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
2927 ssize_t sendfile_read = -1;
2928 char header[4];
2929 DATA_BLOB header_blob;
2930
2931 _smb_setlen(header,nread);
2932 header_blob = data_blob_const(header, 4);
2933
2934 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2935 &header_blob, startpos, nread)) == -1) {
2936 /* Returning ENOSYS means no data at all was sent.
2937 * Do this as a normal read. */
2938 if (errno == ENOSYS) {
2939 goto normal_readbraw;
2940 }
2941
2942 /*
2943 * Special hack for broken Linux with no working sendfile. If we
2944 * return EINTR we sent the header but not the rest of the data.
2945 * Fake this up by doing read/write calls.
2946 */
2947 if (errno == EINTR) {
2948 /* Ensure we don't do this again. */
2949 set_use_sendfile(SNUM(conn), False);
2950 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2951
2952 if (fake_sendfile(fsp, startpos, nread) == -1) {
2953 DEBUG(0,("send_file_readbraw: "
2954 "fake_sendfile failed for "
2955 "file %s (%s).\n",
2956 fsp_str_dbg(fsp),
2957 strerror(errno)));
2958 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2959 }
2960 return;
2961 }
2962
2963 DEBUG(0,("send_file_readbraw: sendfile failed for "
2964 "file %s (%s). Terminating\n",
2965 fsp_str_dbg(fsp), strerror(errno)));
2966 exit_server_cleanly("send_file_readbraw sendfile failed");
2967 } else if (sendfile_read == 0) {
2968 /*
2969 * Some sendfile implementations return 0 to indicate
2970 * that there was a short read, but nothing was
2971 * actually written to the socket. In this case,
2972 * fallback to the normal read path so the header gets
2973 * the correct byte count.
2974 */
2975 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2976 "bytes falling back to the normal read: "
2977 "%s\n", fsp_str_dbg(fsp)));
2978 goto normal_readbraw;
2979 }
2980
2981 /* Deal with possible short send. */
2982 if (sendfile_read != 4+nread) {
2983 sendfile_short_send(fsp, sendfile_read, 4, nread);
2984 }
2985 return;
2986 }
2987
2988 normal_readbraw:
2989 #endif
2990
2991 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2992 if (!outbuf) {
2993 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2994 (unsigned)(nread+4)));
2995 reply_readbraw_error(sconn);
2996 return;
2997 }
2998
2999 if (nread > 0) {
3000 ret = read_file(fsp,outbuf+4,startpos,nread);
3001 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3002 if (ret < mincount)
3003 ret = 0;
3004 #else
3005 if (ret < nread)
3006 ret = 0;
3007 #endif
3008 }
3009
3010 _smb_setlen(outbuf,ret);
3011 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3012 fail_readraw();
3013
3014 TALLOC_FREE(outbuf);
3015 }
3016
3017 /****************************************************************************
3018 Reply to a readbraw (core+ protocol).
3019 ****************************************************************************/
3020
3021 void reply_readbraw(struct smb_request *req)
3022 {
3023 connection_struct *conn = req->conn;
3024 struct smbd_server_connection *sconn = req->sconn;
3025 ssize_t maxcount,mincount;
3026 size_t nread = 0;
3027 SMB_OFF_T startpos;
3028 files_struct *fsp;
3029 struct lock_struct lock;
3030 SMB_OFF_T size = 0;
3031
3032 START_PROFILE(SMBreadbraw);
3033
3034 if (srv_is_signing_active(sconn) ||
3035 is_encrypted_packet(req->inbuf)) {
3036 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3037 "raw reads/writes are disallowed.");
3038 }
3039
3040 if (req->wct < 8) {
3041 reply_readbraw_error(sconn);
3042 END_PROFILE(SMBreadbraw);
3043 return;
3044 }
3045
3046 if (sconn->smb1.echo_handler.trusted_fde) {
3047 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3048 "'async smb echo handler = yes'\n"));
3049 reply_readbraw_error(sconn);
3050 END_PROFILE(SMBreadbraw);
3051 return;
3052 }
3053
3054 /*
3055 * Special check if an oplock break has been issued
3056 * and the readraw request croses on the wire, we must
3057 * return a zero length response here.
3058 */
3059
3060 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3061
3062 /*
3063 * We have to do a check_fsp by hand here, as
3064 * we must always return 4 zero bytes on error,
3065 * not a NTSTATUS.
3066 */
3067
3068 if (!fsp || !conn || conn != fsp->conn ||
3069 req->vuid != fsp->vuid ||
3070 fsp->is_directory || fsp->fh->fd == -1) {
3071 /*
3072 * fsp could be NULL here so use the value from the packet. JRA.
3073 */
3074 DEBUG(3,("reply_readbraw: fnum %d not valid "
3075 "- cache prime?\n",
3076 (int)SVAL(req->vwv+0, 0)));
3077 reply_readbraw_error(sconn);
3078 END_PROFILE(SMBreadbraw);
3079 return;
3080 }
3081
3082 /* Do a "by hand" version of CHECK_READ. */
3083 if (!(fsp->can_read ||
3084 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3085 (fsp->access_mask & FILE_EXECUTE)))) {
3086 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3087 (int)SVAL(req->vwv+0, 0)));
3088 reply_readbraw_error(sconn);
3089 END_PROFILE(SMBreadbraw);
3090 return;
3091 }
3092
3093 flush_write_cache(fsp, READRAW_FLUSH);
3094
3095 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3096 if(req->wct == 10) {
3097 /*
3098 * This is a large offset (64 bit) read.
3099 */
3100 #ifdef LARGE_SMB_OFF_T
3101
3102 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3103
3104 #else /* !LARGE_SMB_OFF_T */
3105
3106 /*
3107 * Ensure we haven't been sent a >32 bit offset.
3108 */
3109
3110 if(IVAL(req->vwv+8, 0) != 0) {
3111 DEBUG(0,("reply_readbraw: large offset "
3112 "(%x << 32) used and we don't support "
3113 "64 bit offsets.\n",
3114 (unsigned int)IVAL(req->vwv+8, 0) ));
3115 reply_readbraw_error();
3116 END_PROFILE(SMBreadbraw);
3117 return;
3118 }
3119
3120 #endif /* LARGE_SMB_OFF_T */
3121
3122 if(startpos < 0) {
3123 DEBUG(0,("reply_readbraw: negative 64 bit "
3124 "readraw offset (%.0f) !\n",
3125 (double)startpos ));
3126 reply_readbraw_error(sconn);
3127 END_PROFILE(SMBreadbraw);
3128 return;
3129 }
3130 }
3131
3132 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3133 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3134
3135 /* ensure we don't overrun the packet size */
3136 maxcount = MIN(65535,maxcount);
3137
3138 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3139 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3140 &lock);
3141
3142 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3143 reply_readbraw_error(sconn);
3144 END_PROFILE(SMBreadbraw);
3145 return;
3146 }
3147
3148 if (fsp_stat(fsp) == 0) {
3149 size = fsp->fsp_name->st.st_ex_size;
3150 }
3151
3152 if (startpos >= size) {
3153 nread = 0;
3154 } else {
3155 nread = MIN(maxcount,(size - startpos));
3156 }
3157
3158 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3159 if (nread < mincount)
3160 nread = 0;
3161 #endif
3162
3163 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3164 "min=%lu nread=%lu\n",
3165 fsp->fnum, (double)startpos,
3166 (unsigned long)maxcount,
3167 (unsigned long)mincount,
3168 (unsigned long)nread ) );
3169
3170 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3171
3172 DEBUG(5,("reply_readbraw finished\n"));
3173
3174 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3175
3176 END_PROFILE(SMBreadbraw);
3177 return;
3178 }
3179
3180 #undef DBGC_CLASS
3181 #define DBGC_CLASS DBGC_LOCKING
3182
3183 /****************************************************************************
3184 Reply to a lockread (core+ protocol).
3185 ****************************************************************************/
3186
3187 void reply_lockread(struct smb_request *req)
3188 {
3189 connection_struct *conn = req->conn;
3190 ssize_t nread = -1;
3191 char *data;
3192 SMB_OFF_T startpos;
3193 size_t numtoread;
3194 NTSTATUS status;
3195 files_struct *fsp;
3196 struct byte_range_lock *br_lck = NULL;
3197 char *p = NULL;
3198 struct smbd_server_connection *sconn = req->sconn;
3199
3200 START_PROFILE(SMBlockread);
3201
3202 if (req->wct < 5) {
3203 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3204 END_PROFILE(SMBlockread);
3205 return;
3206 }
3207
3208 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3209
3210 if (!check_fsp(conn, req, fsp)) {
3211 END_PROFILE(SMBlockread);
3212 return;
3213 }
3214
3215 if (!CHECK_READ(fsp,req)) {
3216 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3217 END_PROFILE(SMBlockread);
3218 return;
3219 }
3220
3221 numtoread = SVAL(req->vwv+1, 0);
3222 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3223
3224 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3225
3226 reply_outbuf(req, 5, numtoread + 3);
3227
3228 data = smb_buf(req->outbuf) + 3;
3229
3230 /*
3231 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3232 * protocol request that predates the read/write lock concept.
3233 * Thus instead of asking for a read lock here we need to ask
3234 * for a write lock. JRA.
3235 * Note that the requested lock size is unaffected by max_recv.
3236 */
3237
3238 br_lck = do_lock(req->sconn->msg_ctx,
3239 fsp,
3240 (uint64_t)req->smbpid,
3241 (uint64_t)numtoread,
3242 (uint64_t)startpos,
3243 WRITE_LOCK,
3244 WINDOWS_LOCK,
3245 False, /* Non-blocking lock. */
3246 &status,
3247 NULL,
3248 NULL);
3249 TALLOC_FREE(br_lck);
3250
3251 if (NT_STATUS_V(status)) {
3252 reply_nterror(req, status);
3253 END_PROFILE(SMBlockread);
3254 return;
3255 }
3256
3257 /*
3258 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3259 */
3260
3261 if (numtoread > sconn->smb1.negprot.max_recv) {
3262 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3263 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3264 (unsigned int)numtoread,
3265 (unsigned int)sconn->smb1.negprot.max_recv));
3266 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3267 }
3268 nread = read_file(fsp,data,startpos,numtoread);
3269
3270 if (nread < 0) {
3271 reply_nterror(req, map_nt_error_from_unix(errno));
3272 END_PROFILE(SMBlockread);
3273 return;
3274 }
3275
3276 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3277
3278 SSVAL(req->outbuf,smb_vwv0,nread);
3279 SSVAL(req->outbuf,smb_vwv5,nread+3);
3280 p = smb_buf(req->outbuf);
3281 SCVAL(p,0,0); /* pad byte. */
3282 SSVAL(p,1,nread);
3283
3284 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3285 fsp->fnum, (int)numtoread, (int)nread));
3286
3287 END_PROFILE(SMBlockread);
3288 return;
3289 }
3290
3291 #undef DBGC_CLASS
3292 #define DBGC_CLASS DBGC_ALL
3293
3294 /****************************************************************************
3295 Reply to a read.
3296 ****************************************************************************/
3297
3298 void reply_read(struct smb_request *req)
3299 {
3300 connection_struct *conn = req->conn;
3301 size_t numtoread;
3302 ssize_t nread = 0;
3303 char *data;
3304 SMB_OFF_T startpos;
3305 int outsize = 0;
3306 files_struct *fsp;
3307 struct lock_struct lock;
3308 struct smbd_server_connection *sconn = req->sconn;
3309
3310 START_PROFILE(SMBread);
3311
3312 if (req->wct < 3) {
3313 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3314 END_PROFILE(SMBread);
3315 return;
3316 }
3317
3318 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3319
3320 if (!check_fsp(conn, req, fsp)) {
3321 END_PROFILE(SMBread);
3322 return;
3323 }
3324
3325 if (!CHECK_READ(fsp,req)) {
3326 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3327 END_PROFILE(SMBread);
3328 return;
3329 }
3330
3331 numtoread = SVAL(req->vwv+1, 0);
3332 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3333
3334 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3335
3336 /*
3337 * The requested read size cannot be greater than max_recv. JRA.
3338 */
3339 if (numtoread > sconn->smb1.negprot.max_recv) {
3340 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3341 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3342 (unsigned int)numtoread,
3343 (unsigned int)sconn->smb1.negprot.max_recv));
3344 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3345 }
3346
3347 reply_outbuf(req, 5, numtoread+3);
3348
3349 data = smb_buf(req->outbuf) + 3;
3350
3351 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3352 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3353 &lock);
3354
3355 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3356 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3357 END_PROFILE(SMBread);
3358 return;
3359 }
3360
3361 if (numtoread > 0)
3362 nread = read_file(fsp,data,startpos,numtoread);
3363
3364 if (nread < 0) {
3365 reply_nterror(req, map_nt_error_from_unix(errno));
3366 goto strict_unlock;
3367 }
3368
3369 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3370
3371 SSVAL(req->outbuf,smb_vwv0,nread);
3372 SSVAL(req->outbuf,smb_vwv5,nread+3);
3373 SCVAL(smb_buf(req->outbuf),0,1);
3374 SSVAL(smb_buf(req->outbuf),1,nread);
3375
3376 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3377 fsp->fnum, (int)numtoread, (int)nread ) );
3378
3379 strict_unlock:
3380 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3381
3382 END_PROFILE(SMBread);
3383 return;
3384 }
3385
3386 /****************************************************************************
3387 Setup readX header.
3388 ****************************************************************************/
3389
3390 static int setup_readX_header(struct smb_request *req, char *outbuf,
3391 size_t smb_maxcnt)
3392 {
3393 int outsize;
3394 char *data;
3395
3396 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3397 data = smb_buf(outbuf);
3398
3399 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3400
3401 SCVAL(outbuf,smb_vwv0,0xFF);
3402 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3403 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3404 SSVAL(outbuf,smb_vwv6,
3405 req_wct_ofs(req)
3406 + 1 /* the wct field */
3407 + 12 * sizeof(uint16_t) /* vwv */
3408 + 2); /* the buflen field */
3409 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3410 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3411 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3412 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3413 return outsize;
3414 }
3415
3416 /****************************************************************************
3417 Reply to a read and X - possibly using sendfile.
3418 ****************************************************************************/
3419
3420 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3421 files_struct *fsp, SMB_OFF_T startpos,
3422 size_t smb_maxcnt)
3423 {
3424 ssize_t nread = -1;
3425 struct lock_struct lock;
3426 int saved_errno = 0;
3427
3428 if(fsp_stat(fsp) == -1) {
3429 reply_nterror(req, map_nt_error_from_unix(errno));
3430 return;
3431 }
3432
3433 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3434 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3435 &lock);
3436
3437 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3438 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3439 return;
3440 }
3441
3442 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3443 (startpos > fsp->fsp_name->st.st_ex_size)
3444 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3445 /*
3446 * We already know that we would do a short read, so don't
3447 * try the sendfile() path.
3448 */
3449 goto nosendfile_read;
3450 }
3451
3452 #if defined(WITH_SENDFILE)
3453 /*
3454 * We can only use sendfile on a non-chained packet
3455 * but we can use on a non-oplocked file. tridge proved this
3456 * on a train in Germany :-). JRA.
3457 */
3458
3459 if (!req_is_in_chain(req) &&
3460 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3461 (fsp->wcp == NULL) &&
3462 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3463 uint8 headerbuf[smb_size + 12 * 2];
3464 DATA_BLOB header;
3465
3466 /*
3467 * Set up the packet header before send. We
3468 * assume here the sendfile will work (get the
3469 * correct amount of data).
3470 */
3471
3472 header = data_blob_const(headerbuf, sizeof(headerbuf));
3473
3474 construct_reply_common_req(req, (char *)headerbuf);
3475 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3476
3477 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3478 /* Returning ENOSYS means no data at all was sent.
3479 Do this as a normal read. */
3480 if (errno == ENOSYS) {
3481 goto normal_read;
3482 }
3483
3484 /*
3485 * Special hack for broken Linux with no working sendfile. If we
3486 * return EINTR we sent the header but not the rest of the data.
3487 * Fake this up by doing read/write calls.
3488 */
3489
3490 if (errno == EINTR) {
3491 /* Ensure we don't do this again. */
3492 set_use_sendfile(SNUM(conn), False);
3493 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3494 nread = fake_sendfile(fsp, startpos,
3495 smb_maxcnt);
3496 if (nread == -1) {
3497 DEBUG(0,("send_file_readX: "
3498 "fake_sendfile failed for "
3499 "file %s (%s).\n",
3500 fsp_str_dbg(fsp),
3501 strerror(errno)));
3502 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3503 }
3504 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3505 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3506 /* No outbuf here means successful sendfile. */
3507 goto strict_unlock;
3508 }
3509
3510 DEBUG(0,("send_file_readX: sendfile failed for file "
3511 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3512 strerror(errno)));
3513 exit_server_cleanly("send_file_readX sendfile failed");
3514 } else if (nread == 0) {
3515 /*
3516 * Some sendfile implementations return 0 to indicate
3517 * that there was a short read, but nothing was
3518 * actually written to the socket. In this case,
3519 * fallback to the normal read path so the header gets
3520 * the correct byte count.
3521 */
3522 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3523 "falling back to the normal read: %s\n",
3524 fsp_str_dbg(fsp)));
3525 goto normal_read;
3526 }
3527
3528 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3529 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3530
3531 /* Deal with possible short send. */
3532 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3533 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3534 }
3535 /* No outbuf here means successful sendfile. */
3536 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3537 SMB_PERFCOUNT_END(&req->pcd);
3538 goto strict_unlock;
3539 }
3540
3541 normal_read:
3542
3543 #endif
3544
3545 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3546 uint8 headerbuf[smb_size + 2*12];
3547
3548 construct_reply_common_req(req, (char *)headerbuf);
3549 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3550
3551 /* Send out the header. */
3552 if (write_data(smbd_server_fd(), (char *)headerbuf,
3553 sizeof(headerbuf)) != sizeof(headerbuf)) {
3554 DEBUG(0,("send_file_readX: write_data failed for file "
3555 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3556 strerror(errno)));
3557 exit_server_cleanly("send_file_readX sendfile failed");
3558 }
3559 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3560 if (nread == -1) {
3561 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3562 "file %s (%s).\n", fsp_str_dbg(fsp),
3563 strerror(errno)));
3564 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3565 }
3566 goto strict_unlock;
3567 }
3568
3569 nosendfile_read:
3570
3571 reply_outbuf(req, 12, smb_maxcnt);
3572
3573 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3574 saved_errno = errno;
3575
3576 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3577
3578 if (nread < 0) {
3579 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3580 return;
3581 }
3582
3583 setup_readX_header(req, (char *)req->outbuf, nread);
3584
3585 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3586 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3587
3588 chain_reply(req);
3589 return;
3590
3591 strict_unlock:
3592 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3593 TALLOC_FREE(req->outbuf);
3594 return;
3595 }
3596
3597 /****************************************************************************
3598 Reply to a read and X.
3599 ****************************************************************************/
3600
3601 void reply_read_and_X(struct smb_request *req)
3602 {
3603 connection_struct *conn = req->conn;
3604 files_struct *fsp;
3605 SMB_OFF_T startpos;
3606 size_t smb_maxcnt;
3607 bool big_readX = False;
3608 #if 0
3609 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3610 #endif
3611
3612 START_PROFILE(SMBreadX);
3613
3614 if ((req->wct != 10) && (req->wct != 12)) {
3615 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3616 return;
3617 }
3618
3619 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3620 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3621 smb_maxcnt = SVAL(req->vwv+5, 0);
3622
3623 /* If it's an IPC, pass off the pipe handler. */
3624 if (IS_IPC(conn)) {
3625 reply_pipe_read_and_X(req);
3626 END_PROFILE(SMBreadX);
3627 return;
3628 }
3629
3630 if (!check_fsp(conn, req, fsp)) {
3631 END_PROFILE(SMBreadX);
3632 return;
3633 }
3634
3635 if (!CHECK_READ(fsp,req)) {
3636 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3637 END_PROFILE(SMBreadX);
3638 return;
3639 }
3640
3641 if (global_client_caps & CAP_LARGE_READX) {
3642 size_t upper_size = SVAL(req->vwv+7, 0);
3643 smb_maxcnt |= (upper_size<<16);
3644 if (upper_size > 1) {
3645 /* Can't do this on a chained packet. */
3646 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3647 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3648 END_PROFILE(SMBreadX);
3649 return;
3650 }
3651 /* We currently don't do this on signed or sealed data. */
3652 if (srv_is_signing_active(req->sconn) ||
3653 is_encrypted_packet(req->inbuf)) {
3654 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3655 END_PROFILE(SMBreadX);
3656 return;
3657 }
3658 /* Is there room in the reply for this data ? */
3659 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3660 reply_nterror(req,
3661 NT_STATUS_INVALID_PARAMETER);
3662 END_PROFILE(SMBreadX);
3663 return;
3664 }
3665 big_readX = True;
3666 }
3667 }
3668
3669 if (req->wct == 12) {
3670 #ifdef LARGE_SMB_OFF_T
3671 /*
3672 * This is a large offset (64 bit) read.
3673 */
3674 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3675
3676 #else /* !LARGE_SMB_OFF_T */
3677
3678 /*
3679 * Ensure we haven't been sent a >32 bit offset.
3680 */
3681
3682 if(IVAL(req->vwv+10, 0) != 0) {
3683 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3684 "used and we don't support 64 bit offsets.\n",
3685 (unsigned int)IVAL(req->vwv+10, 0) ));
3686 END_PROFILE(SMBreadX);
3687 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3688 return;
3689 }
3690
3691 #endif /* LARGE_SMB_OFF_T */
3692
3693 }
3694
3695 if (!big_readX) {
3696 NTSTATUS status = schedule_aio_read_and_X(conn,
3697 req,
3698 fsp,
3699 startpos,
3700 smb_maxcnt);
3701 if (NT_STATUS_IS_OK(status)) {
3702 /* Read scheduled - we're done. */
3703 goto out;
3704 }
3705 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3706 /* Real error - report to client. */
3707 END_PROFILE(SMBreadX);
3708 reply_nterror(req, status);
3709 return;
3710 }
3711 /* NT_STATUS_RETRY - fall back to sync read. */
3712 }
3713
3714 smbd_lock_socket(req->sconn);
3715 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3716 smbd_unlock_socket(req->sconn);
3717
3718 out:
3719 END_PROFILE(SMBreadX);
3720 return;
3721 }
3722
3723 /****************************************************************************
3724 Error replies to writebraw must have smb_wct == 1. Fix this up.
3725 ****************************************************************************/
3726
3727 void error_to_writebrawerr(struct smb_request *req)
3728 {
3729 uint8 *old_outbuf = req->outbuf;
3730
3731 reply_outbuf(req, 1, 0);
3732
3733 memcpy(req->outbuf, old_outbuf, smb_size);
3734 TALLOC_FREE(old_outbuf);
3735 }
3736
3737 /****************************************************************************
3738 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3739 ****************************************************************************/
3740
3741 void reply_writebraw(struct smb_request *req)
3742 {
3743 connection_struct *conn = req->conn;
3744 char *buf = NULL;
3745 ssize_t nwritten=0;
3746 ssize_t total_written=0;
3747 size_t numtowrite=0;
3748 size_t tcount;
3749 SMB_OFF_T startpos;
3750 char *data=NULL;
3751 bool write_through;
3752 files_struct *fsp;
3753 struct lock_struct lock;
3754 NTSTATUS status;
3755
3756 START_PROFILE(SMBwritebraw);
3757
3758 /*
3759 * If we ever reply with an error, it must have the SMB command
3760 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3761 * we're finished.
3762 */
3763 SCVAL(req->inbuf,smb_com,SMBwritec);
3764
3765 if (srv_is_signing_active(req->sconn)) {
3766 END_PROFILE(SMBwritebraw);
3767 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3768 "raw reads/writes are disallowed.");
3769 }
3770
3771 if (req->wct < 12) {
3772 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3773 error_to_writebrawerr(req);
3774 END_PROFILE(SMBwritebraw);
3775 return;
3776 }
3777
3778 if (req->sconn->smb1.echo_handler.trusted_fde) {
3779 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3780 "'async smb echo handler = yes'\n"));
3781 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3782 error_to_writebrawerr(req);
3783 END_PROFILE(SMBwritebraw);
3784 return;
3785 }
3786
3787 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3788 if (!check_fsp(conn, req, fsp)) {
3789 error_to_writebrawerr(req);
3790 END_PROFILE(SMBwritebraw);
3791 return;
3792 }
3793
3794 if (!CHECK_WRITE(fsp)) {
3795 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3796 error_to_writebrawerr(req);
3797 END_PROFILE(SMBwritebraw);
3798 return;
3799 }
3800
3801 tcount = IVAL(req->vwv+1, 0);
3802 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3803 write_through = BITSETW(req->vwv+7,0);
3804
3805 /* We have to deal with slightly different formats depending
3806 on whether we are using the core+ or lanman1.0 protocol */
3807
3808 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3809 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3810 data = smb_buf(req->inbuf);
3811 } else {
3812 numtowrite = SVAL(req->vwv+10, 0);
3813 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3814 }
3815
3816 /* Ensure we don't write bytes past the end of this packet. */
3817 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3818 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3819 error_to_writebrawerr(req);
3820 END_PROFILE(SMBwritebraw);
3821 return;
3822 }
3823
3824 if (!fsp->print_file) {
3825 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3826 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3827 &lock);
3828
3829 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3830 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3831 error_to_writebrawerr(req);
3832 END_PROFILE(SMBwritebraw);
3833 return;
3834 }
3835 }
3836
3837 if (numtowrite>0) {
3838 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3839 }
3840
3841 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3842 "wrote=%d sync=%d\n",
3843 fsp->fnum, (double)startpos, (int)numtowrite,
3844 (int)nwritten, (int)write_through));
3845
3846 if (nwritten < (ssize_t)numtowrite) {
3847 reply_nterror(req, NT_STATUS_DISK_FULL);
3848 error_to_writebrawerr(req);
3849 goto strict_unlock;
3850 }
3851
3852 total_written = nwritten;
3853
3854 /* Allocate a buffer of 64k + length. */
3855 buf = TALLOC_ARRAY(NULL, char, 65540);
3856 if (!buf) {
3857 reply_nterror(req, NT_STATUS_NO_MEMORY);
3858 error_to_writebrawerr(req);
3859 goto strict_unlock;
3860 }
3861
3862 /* Return a SMBwritebraw message to the redirector to tell
3863 * it to send more bytes */
3864
3865 memcpy(buf, req->inbuf, smb_size);
3866 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3867 SCVAL(buf,smb_com,SMBwritebraw);
3868 SSVALS(buf,smb_vwv0,0xFFFF);
3869 show_msg(buf);
3870 if (!srv_send_smb(smbd_server_fd(),
3871 buf,
3872 false, 0, /* no signing */
3873 IS_CONN_ENCRYPTED(conn),
3874 &req->pcd)) {
3875 exit_server_cleanly("reply_writebraw: srv_send_smb "
3876 "failed.");
3877 }
3878
3879 /* Now read the raw data into the buffer and write it */
3880 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3881 &numtowrite);
3882 if (!NT_STATUS_IS_OK(status)) {
3883 exit_server_cleanly("secondary writebraw failed");
3884 }
3885
3886 /* Set up outbuf to return the correct size */
3887 reply_outbuf(req, 1, 0);
3888
3889 if (numtowrite != 0) {
3890
3891 if (numtowrite > 0xFFFF) {
3892 DEBUG(0,("reply_writebraw: Oversize secondary write "
3893 "raw requested (%u). Terminating\n",
3894 (unsigned int)numtowrite ));
3895 exit_server_cleanly("secondary writebraw failed");
3896 }
3897
3898 if (tcount > nwritten+numtowrite) {
3899 DEBUG(3,("reply_writebraw: Client overestimated the "
3900 "write %d %d %d\n",
3901 (int)tcount,(int)nwritten,(int)numtowrite));
3902 }
3903
3904 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3905
3906 if (!NT_STATUS_IS_OK(status)) {
3907 DEBUG(0,("reply_writebraw: Oversize secondary write "
3908 "raw read failed (%s). Terminating\n",
3909 nt_errstr(status)));
3910 exit_server_cleanly("secondary writebraw failed");
3911 }
3912
3913 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3914 if (nwritten == -1) {
3915 TALLOC_FREE(buf);
3916 reply_nterror(req, map_nt_error_from_unix(errno));
3917 error_to_writebrawerr(req);
3918 goto strict_unlock;
3919 }
3920
3921 if (nwritten < (ssize_t)numtowrite) {
3922 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3923 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3924 }
3925
3926 if (nwritten > 0) {
3927 total_written += nwritten;
3928 }
3929 }
3930
3931 TALLOC_FREE(buf);
3932 SSVAL(req->outbuf,smb_vwv0,total_written);
3933
3934 status = sync_file(conn, fsp, write_through);
3935 if (!NT_STATUS_IS_OK(status)) {
3936 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3937 fsp_str_dbg(fsp), nt_errstr(status)));
3938 reply_nterror(req, status);
3939 error_to_writebrawerr(req);
3940 goto strict_unlock;
3941 }
3942
3943 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3944 "wrote=%d\n",
3945 fsp->fnum, (double)startpos, (int)numtowrite,
3946 (int)total_written));
3947
3948 if (!fsp->print_file) {
3949 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3950 }
3951
3952 /* We won't return a status if write through is not selected - this
3953 * follows what WfWg does */
3954 END_PROFILE(SMBwritebraw);
3955
3956 if (!write_through && total_written==tcount) {
3957
3958 #if RABBIT_PELLET_FIX
3959 /*
3960 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3961 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3962 * JRA.
3963 */
3964 if (!send_keepalive(smbd_server_fd())) {
3965 exit_server_cleanly("reply_writebraw: send of "
3966 "keepalive failed");
3967 }
3968 #endif
3969 TALLOC_FREE(req->outbuf);
3970 }
3971 return;
3972
3973 strict_unlock:
3974 if (!fsp->print_file) {
3975 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3976 }
3977
3978 END_PROFILE(SMBwritebraw);
3979 return;
3980 }
3981
3982 #undef DBGC_CLASS
3983 #define DBGC_CLASS DBGC_LOCKING
3984
3985 /****************************************************************************
3986 Reply to a writeunlock (core+).
3987 ****************************************************************************/
3988
3989 void reply_writeunlock(struct smb_request *req)
3990 {
3991 connection_struct *conn = req->conn;
3992 ssize_t nwritten = -1;
3993 size_t numtowrite;
3994 SMB_OFF_T startpos;
3995 const char *data;
3996 NTSTATUS status = NT_STATUS_OK;
3997 files_struct *fsp;
3998 struct lock_struct lock;
3999 int saved_errno = 0;
4000
4001 START_PROFILE(SMBwriteunlock);
4002
4003 if (req->wct < 5) {
4004 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4005 END_PROFILE(SMBwriteunlock);
4006 return;
4007 }
4008
4009 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4010
4011 if (!check_fsp(conn, req, fsp)) {
4012 END_PROFILE(SMBwriteunlock);
4013 return;
4014 }
4015
4016 if (!CHECK_WRITE(fsp)) {
4017 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4018 END_PROFILE(SMBwriteunlock);
4019 return;
4020 }
4021
4022 numtowrite = SVAL(req->vwv+1, 0);
4023 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4024 data = (const char *)req->buf + 3;
4025
4026 if (!fsp->print_file && numtowrite > 0) {
4027 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4028 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4029 &lock);
4030
4031 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4032 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4033 END_PROFILE(SMBwriteunlock);
4034 return;
4035 }
4036 }
4037
4038 /* The special X/Open SMB protocol handling of
4039 zero length writes is *NOT* done for
4040 this call */
4041 if(numtowrite == 0) {
4042 nwritten = 0;
4043 } else {
4044 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4045 saved_errno = errno;
4046 }
4047
4048 status = sync_file(conn, fsp, False /* write through */);
4049 if (!NT_STATUS_IS_OK(status)) {
4050 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4051 fsp_str_dbg(fsp), nt_errstr(status)));
4052 reply_nterror(req, status);
4053 goto strict_unlock;
4054 }
4055
4056 if(nwritten < 0) {
4057 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4058 goto strict_unlock;
4059 }
4060
4061 if((nwritten < numtowrite) && (numtowrite != 0)) {
4062 reply_nterror(req, NT_STATUS_DISK_FULL);
4063 goto strict_unlock;
4064 }
4065
4066 if (numtowrite && !fsp->print_file) {
4067 status = do_unlock(req->sconn->msg_ctx,
4068 fsp,
4069 (uint64_t)req->smbpid,
4070 (uint64_t)numtowrite,
4071 (uint64_t)startpos,
4072 WINDOWS_LOCK);
4073
4074 if (NT_STATUS_V(status)) {
4075 reply_nterror(req, status);
4076 goto strict_unlock;
4077 }
4078 }
4079
4080 reply_outbuf(req, 1, 0);
4081
4082 SSVAL(req->outbuf,smb_vwv0,nwritten);
4083
4084 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4085 fsp->fnum, (int)numtowrite, (int)nwritten));
4086
4087 strict_unlock:
4088 if (numtowrite && !fsp->print_file) {
4089 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4090 }
4091
4092 END_PROFILE(SMBwriteunlock);
4093 return;
4094 }
4095
4096 #undef DBGC_CLASS
4097 #define DBGC_CLASS DBGC_ALL
4098
4099 /****************************************************************************
4100 Reply to a write.
4101 ****************************************************************************/
4102
4103 void reply_write(struct smb_request *req)
4104 {
4105 connection_struct *conn = req->conn;
4106 size_t numtowrite;
4107 ssize_t nwritten = -1;
4108 SMB_OFF_T startpos;
4109 const char *data;
4110 files_struct *fsp;
4111 struct lock_struct lock;
4112 NTSTATUS status;
4113 int saved_errno = 0;
4114
4115 START_PROFILE(SMBwrite);
4116
4117 if (req->wct < 5) {
4118 END_PROFILE(SMBwrite);
4119 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4120 return;
4121 }
4122
4123 /* If it's an IPC, pass off the pipe handler. */
4124 if (IS_IPC(conn)) {
4125 reply_pipe_write(req);
4126 END_PROFILE(SMBwrite);
4127 return;
4128 }
4129
4130 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4131
4132 if (!check_fsp(conn, req, fsp)) {
4133 END_PROFILE(SMBwrite);
4134 return;
4135 }
4136
4137 if (!CHECK_WRITE(fsp)) {
4138 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4139 END_PROFILE(SMBwrite);
4140 return;
4141 }
4142
4143 numtowrite = SVAL(req->vwv+1, 0);
4144 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4145 data = (const char *)req->buf + 3;
4146
4147 if (!fsp->print_file) {
4148 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4149 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4150 &lock);
4151
4152 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4153 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4154 END_PROFILE(SMBwrite);
4155 return;
4156 }
4157 }
4158
4159 /*
4160 * X/Open SMB protocol says that if smb_vwv1 is
4161 * zero then the file size should be extended or
4162 * truncated to the size given in smb_vwv[2-3].
4163 */
4164
4165 if(numtowrite == 0) {
4166 /*
4167 * This is actually an allocate call, and set EOF. JRA.
4168 */
4169 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4170 if (nwritten < 0) {
4171 reply_nterror(req, NT_STATUS_DISK_FULL);
4172 goto strict_unlock;
4173 }
4174 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4175 if (nwritten < 0) {
4176 reply_nterror(req, NT_STATUS_DISK_FULL);
4177 goto strict_unlock;
4178 }
4179 trigger_write_time_update_immediate(fsp);
4180 } else {
4181 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4182 }
4183
4184 status = sync_file(conn, fsp, False);
4185 if (!NT_STATUS_IS_OK(status)) {
4186 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4187 fsp_str_dbg(fsp), nt_errstr(status)));
4188 reply_nterror(req, status);
4189 goto strict_unlock;
4190 }
4191
4192 if(nwritten < 0) {
4193 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4194 goto strict_unlock;
4195 }
4196
4197 if((nwritten == 0) && (numtowrite != 0)) {
4198 reply_nterror(req, NT_STATUS_DISK_FULL);
4199 goto strict_unlock;
4200 }
4201
4202 reply_outbuf(req, 1, 0);
4203
4204 SSVAL(req->outbuf,smb_vwv0,nwritten);
4205
4206 if (nwritten < (ssize_t)numtowrite) {
4207 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4208 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4209 }
4210
4211 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4212
4213 strict_unlock:
4214 if (!fsp->print_file) {
4215 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4216 }
4217
4218 END_PROFILE(SMBwrite);
4219 return;
4220 }
4221
4222 /****************************************************************************
4223 Ensure a buffer is a valid writeX for recvfile purposes.
4224 ****************************************************************************/
4225
4226 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4227 (2*14) + /* word count (including bcc) */ \
4228 1 /* pad byte */)
4229
4230 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4231 const uint8_t *inbuf)
4232 {
4233 size_t numtowrite;
4234 connection_struct *conn = NULL;
4235 unsigned int doff = 0;
4236 size_t len = smb_len_large(inbuf);
4237
4238 if (is_encrypted_packet(inbuf)) {
4239 /* Can't do this on encrypted
4240 * connections. */
4241 return false;
4242 }
4243
4244 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4245 return false;
4246 }
4247
4248 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4249 CVAL(inbuf,smb_wct) != 14) {
4250 DEBUG(10,("is_valid_writeX_buffer: chained or "
4251 "invalid word length.\n"));
4252 return false;
4253 }
4254
4255 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4256 if (conn == NULL) {
4257 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4258 return false;
4259 }
4260 if (IS_IPC(conn)) {
4261 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4262 return false;
4263 }
4264 if (IS_PRINT(conn)) {
4265 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4266 return false;
4267 }
4268 doff = SVAL(inbuf,smb_vwv11);
4269
4270 numtowrite = SVAL(inbuf,smb_vwv10);
4271
4272 if (len > doff && len - doff > 0xFFFF) {
4273 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4274 }
4275
4276 if (numtowrite == 0) {
4277 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4278 return false;
4279 }
4280
4281 /* Ensure the sizes match up. */
4282 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4283 /* no pad byte...old smbclient :-( */
4284 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4285 (unsigned int)doff,
4286 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4287 return false;
4288 }
4289
4290 if (len - doff != numtowrite) {
4291 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4292 "len = %u, doff = %u, numtowrite = %u\n",
4293 (unsigned int)len,
4294 (unsigned int)doff,
4295 (unsigned int)numtowrite ));
4296 return false;
4297 }
4298
4299 DEBUG(10,("is_valid_writeX_buffer: true "
4300 "len = %u, doff = %u, numtowrite = %u\n",
4301 (unsigned int)len,
4302 (unsigned int)doff,
4303 (unsigned int)numtowrite ));
4304
4305 return true;
4306 }
4307
4308 /****************************************************************************
4309 Reply to a write and X.
4310 ****************************************************************************/
4311
4312 void reply_write_and_X(struct smb_request *req)
4313 {
4314 connection_struct *conn = req->conn;
4315 files_struct *fsp;
4316 struct lock_struct lock;
4317 SMB_OFF_T startpos;
4318 size_t numtowrite;
4319 bool write_through;
4320 ssize_t nwritten;
4321 unsigned int smb_doff;
4322 unsigned int smblen;
4323 char *data;
4324 NTSTATUS status;
4325 int saved_errno = 0;
4326
4327 START_PROFILE(SMBwriteX);
4328
4329 if ((req->wct != 12) && (req->wct != 14)) {
4330 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4331 END_PROFILE(SMBwriteX);
4332 return;
4333 }
4334
4335 numtowrite = SVAL(req->vwv+10, 0);
4336 smb_doff = SVAL(req->vwv+11, 0);
4337 smblen = smb_len(req->inbuf);
4338
4339 if (req->unread_bytes > 0xFFFF ||
4340 (smblen > smb_doff &&
4341 smblen - smb_doff > 0xFFFF)) {
4342 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4343 }
4344
4345 if (req->unread_bytes) {
4346 /* Can't do a recvfile write on IPC$ */
4347 if (IS_IPC(conn)) {
4348 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4349 END_PROFILE(SMBwriteX);
4350 return;
4351 }
4352 if (numtowrite != req->unread_bytes) {
4353 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4354 END_PROFILE(SMBwriteX);
4355 return;
4356 }
4357 } else {
4358 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4359 smb_doff + numtowrite > smblen) {
4360 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4361 END_PROFILE(SMBwriteX);
4362 return;
4363 }
4364 }
4365
4366 /* If it's an IPC, pass off the pipe handler. */
4367 if (IS_IPC(conn)) {
4368 if (req->unread_bytes) {
4369 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4370 END_PROFILE(SMBwriteX);
4371 return;
4372 }
4373 reply_pipe_write_and_X(req);
4374 END_PROFILE(SMBwriteX);
4375 return;
4376 }
4377
4378 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4379 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4380 write_through = BITSETW(req->vwv+7,0);
4381
4382 if (!check_fsp(conn, req, fsp)) {
4383 END_PROFILE(SMBwriteX);
4384 return;
4385 }
4386
4387 if (!CHECK_WRITE(fsp)) {
4388 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4389 END_PROFILE(SMBwriteX);
4390 return;
4391 }
4392
4393 data = smb_base(req->inbuf) + smb_doff;
4394
4395 if(req->wct == 14) {
4396 #ifdef LARGE_SMB_OFF_T
4397 /*
4398 * This is a large offset (64 bit) write.
4399 */
4400 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4401
4402 #else /* !LARGE_SMB_OFF_T */
4403
4404 /*
4405 * Ensure we haven't been sent a >32 bit offset.
4406 */
4407
4408 if(IVAL(req->vwv+12, 0) != 0) {
4409 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4410 "used and we don't support 64 bit offsets.\n",
4411 (unsigned int)IVAL(req->vwv+12, 0) ));
4412 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4413 END_PROFILE(SMBwriteX);
4414 return;
4415 }
4416
4417 #endif /* LARGE_SMB_OFF_T */
4418 }
4419
4420 /* X/Open SMB protocol says that, unlike SMBwrite
4421 if the length is zero then NO truncation is
4422 done, just a write of zero. To truncate a file,
4423 use SMBwrite. */
4424
4425 if(numtowrite == 0) {
4426 nwritten = 0;
4427 } else {
4428 if (req->unread_bytes == 0) {
4429 status = schedule_aio_write_and_X(conn,
4430 req,
4431 fsp,
4432 data,
4433 startpos,
4434 numtowrite);
4435
4436 if (NT_STATUS_IS_OK(status)) {
4437 /* write scheduled - we're done. */
4438 goto out;
4439 }
4440 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4441 /* Real error - report to client. */
4442 reply_nterror(req, status);
4443 goto out;
4444 }
4445 /* NT_STATUS_RETRY - fall through to sync write. */
4446 }
4447
4448 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4449 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4450 &lock);
4451
4452 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4453 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4454 goto out;
4455 }
4456
4457 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4458 saved_errno = errno;
4459
4460 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4461 }
4462
4463 if(nwritten < 0) {
4464 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4465 goto out;
4466 }
4467
4468 if((nwritten == 0) && (numtowrite != 0)) {
4469 reply_nterror(req, NT_STATUS_DISK_FULL);
4470 goto out;
4471 }
4472
4473 reply_outbuf(req, 6, 0);
4474 SSVAL(req->outbuf,smb_vwv2,nwritten);
4475 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4476
4477 if (nwritten < (ssize_t)numtowrite) {
4478 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4479 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4480 }
4481
4482 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4483 fsp->fnum, (int)numtowrite, (int)nwritten));
4484
4485 status = sync_file(conn, fsp, write_through);
4486 if (!NT_STATUS_IS_OK(status)) {
4487 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4488 fsp_str_dbg(fsp), nt_errstr(status)));
4489 reply_nterror(req, status);
4490 goto out;
4491 }
4492
4493 END_PROFILE(SMBwriteX);
4494 chain_reply(req);
4495 return;
4496
4497 out:
4498 END_PROFILE(SMBwriteX);
4499 return;
4500 }
4501
4502 /****************************************************************************
4503 Reply to a lseek.
4504 ****************************************************************************/
4505
4506 void reply_lseek(struct smb_request *req)
4507 {
4508 connection_struct *conn = req->conn;
4509 SMB_OFF_T startpos;
4510 SMB_OFF_T res= -1;
4511 int mode,umode;
4512 files_struct *fsp;
4513
4514 START_PROFILE(SMBlseek);
4515
4516 if (req->wct < 4) {
4517 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4518 END_PROFILE(SMBlseek);
4519 return;
4520 }
4521
4522 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4523
4524 if (!check_fsp(conn, req, fsp)) {
4525 return;
4526 }
4527
4528 flush_write_cache(fsp, SEEK_FLUSH);
4529
4530 mode = SVAL(req->vwv+1, 0) & 3;
4531 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4532 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4533
4534 switch (mode) {
4535 case 0:
4536 umode = SEEK_SET;
4537 res = startpos;
4538 break;
4539 case 1:
4540 umode = SEEK_CUR;
4541 res = fsp->fh->pos + startpos;
4542 break;
4543 case 2:
4544 umode = SEEK_END;
4545 break;
4546 default:
4547 umode = SEEK_SET;
4548 res = startpos;
4549 break;
4550 }
4551
4552 if (umode == SEEK_END) {
4553 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4554 if(errno == EINVAL) {
4555 SMB_OFF_T current_pos = startpos;
4556
4557 if(fsp_stat(fsp) == -1) {
4558 reply_nterror(req,
4559 map_nt_error_from_unix(errno));
4560 END_PROFILE(SMBlseek);
4561 return;
4562 }
4563
4564 current_pos += fsp->fsp_name->st.st_ex_size;
4565 if(current_pos < 0)
4566 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4567 }
4568 }
4569
4570 if(res == -1) {
4571 reply_nterror(req, map_nt_error_from_unix(errno));
4572 END_PROFILE(SMBlseek);
4573 return;
4574 }
4575 }
4576
4577 fsp->fh->pos = res;
4578
4579 reply_outbuf(req, 2, 0);
4580 SIVAL(req->outbuf,smb_vwv0,res);
4581
4582 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4583 fsp->fnum, (double)startpos, (double)res, mode));
4584
4585 END_PROFILE(SMBlseek);
4586 return;
4587 }
4588
4589 /****************************************************************************
4590 Reply to a flush.
4591 ****************************************************************************/
4592
4593 void reply_flush(struct smb_request *req)
4594 {
4595 connection_struct *conn = req->conn;
4596 uint16 fnum;
4597 files_struct *fsp;
4598
4599 START_PROFILE(SMBflush);
4600
4601 if (req->wct < 1) {
4602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4603 return;
4604 }
4605
4606 fnum = SVAL(req->vwv+0, 0);
4607 fsp = file_fsp(req, fnum);
4608
4609 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4610 return;
4611 }
4612
4613 if (!fsp) {
4614 file_sync_all(conn);
4615 } else {
4616 NTSTATUS status = sync_file(conn, fsp, True);
4617 if (!NT_STATUS_IS_OK(status)) {
4618 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4619 fsp_str_dbg(fsp), nt_errstr(status)));
4620 reply_nterror(req, status);
4621 END_PROFILE(SMBflush);
4622 return;
4623 }
4624 }
4625
4626 reply_outbuf(req, 0, 0);
4627
4628 DEBUG(3,("flush\n"));
4629 END_PROFILE(SMBflush);
4630 return;
4631 }
4632
4633 /****************************************************************************
4634 Reply to a exit.
4635 conn POINTER CAN BE NULL HERE !
4636 ****************************************************************************/
4637
4638 void reply_exit(struct smb_request *req)
4639 {
4640 START_PROFILE(SMBexit);
4641
4642 file_close_pid(req->smbpid, req->vuid);
4643
4644 reply_outbuf(req, 0, 0);
4645
4646 DEBUG(3,("exit\n"));
4647
4648 END_PROFILE(SMBexit);
4649 return;
4650 }
4651
4652 /****************************************************************************
4653 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4654 ****************************************************************************/
4655
4656 void reply_close(struct smb_request *req)
4657 {
4658 connection_struct *conn = req->conn;
4659 NTSTATUS status = NT_STATUS_OK;
4660 files_struct *fsp = NULL;
4661 START_PROFILE(SMBclose);
4662
4663 if (req->wct < 3) {
4664 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4665 END_PROFILE(SMBclose);
4666 return;
4667 }
4668
4669 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4670
4671 /*
4672 * We can only use check_fsp if we know it's not a directory.
4673 */
4674
4675 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4676 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4677 END_PROFILE(SMBclose);
4678 return;
4679 }
4680
4681 if(fsp->is_directory) {
4682 /*
4683 * Special case - close NT SMB directory handle.
4684 */
4685 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4686 status = close_file(req, fsp, NORMAL_CLOSE);
4687 } else {
4688 time_t t;
4689 /*
4690 * Close ordinary file.
4691 */
4692
4693 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4694 fsp->fh->fd, fsp->fnum,
4695 conn->num_files_open));
4696
4697 /*
4698 * Take care of any time sent in the close.
4699 */
4700
4701 t = srv_make_unix_date3(req->vwv+1);
4702 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4703
4704 /*
4705 * close_file() returns the unix errno if an error
4706 * was detected on close - normally this is due to
4707 * a disk full error. If not then it was probably an I/O error.
4708 */
4709
4710 status = close_file(req, fsp, NORMAL_CLOSE);
4711 }
4712
4713 if (!NT_STATUS_IS_OK(status)) {
4714 reply_nterror(req, status);
4715 END_PROFILE(SMBclose);
4716 return;
4717 }
4718
4719 reply_outbuf(req, 0, 0);
4720 END_PROFILE(SMBclose);
4721 return;
4722 }
4723
4724 /****************************************************************************
4725 Reply to a writeclose (Core+ protocol).
4726 ****************************************************************************/
4727
4728 void reply_writeclose(struct smb_request *req)
4729 {
4730 connection_struct *conn = req->conn;
4731 size_t numtowrite;
4732 ssize_t nwritten = -1;
4733 NTSTATUS close_status = NT_STATUS_OK;
4734 SMB_OFF_T startpos;
4735 const char *data;
4736 struct timespec mtime;
4737 files_struct *fsp;
4738 struct lock_struct lock;
4739
4740 START_PROFILE(SMBwriteclose);
4741
4742 if (req->wct < 6) {
4743 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4744 END_PROFILE(SMBwriteclose);
4745 return;
4746 }
4747
4748 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4749
4750 if (!check_fsp(conn, req, fsp)) {
4751 END_PROFILE(SMBwriteclose);
4752 return;
4753 }
4754 if (!CHECK_WRITE(fsp)) {
4755 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4756 END_PROFILE(SMBwriteclose);
4757 return;
4758 }
4759
4760 numtowrite = SVAL(req->vwv+1, 0);
4761 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4762 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4763 data = (const char *)req->buf + 1;
4764
4765 if (!fsp->print_file) {
4766 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4767 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4768 &lock);
4769
4770 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4771 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4772 END_PROFILE(SMBwriteclose);
4773 return;
4774 }
4775 }
4776
4777 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4778
4779 set_close_write_time(fsp, mtime);
4780
4781 /*
4782 * More insanity. W2K only closes the file if writelen > 0.
4783 * JRA.
4784 */
4785
4786 if (numtowrite) {
4787 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4788 "file %s\n", fsp_str_dbg(fsp)));
4789 close_status = close_file(req, fsp, NORMAL_CLOSE);
4790 }
4791
4792 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4793 fsp->fnum, (int)numtowrite, (int)nwritten,
4794 conn->num_files_open));
4795
4796 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4797 reply_nterror(req, NT_STATUS_DISK_FULL);
4798 goto strict_unlock;
4799 }
4800
4801 if(!NT_STATUS_IS_OK(close_status)) {
4802 reply_nterror(req, close_status);
4803 goto strict_unlock;
4804 }
4805
4806 reply_outbuf(req, 1, 0);
4807
4808 SSVAL(req->outbuf,smb_vwv0,nwritten);
4809
4810 strict_unlock:
4811 if (numtowrite && !fsp->print_file) {
4812 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4813 }
4814
4815 END_PROFILE(SMBwriteclose);
4816 return;
4817 }
4818
4819 #undef DBGC_CLASS
4820 #define DBGC_CLASS DBGC_LOCKING
4821
4822 /****************************************************************************
4823 Reply to a lock.
4824 ****************************************************************************/
4825
4826 void reply_lock(struct smb_request *req)
4827 {
4828 connection_struct *conn = req->conn;
4829 uint64_t count,offset;
4830 NTSTATUS status;
4831 files_struct *fsp;
4832 struct byte_range_lock *br_lck = NULL;
4833
4834 START_PROFILE(SMBlock);
4835
4836 if (req->wct < 5) {
4837 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4838 END_PROFILE(SMBlock);
4839 return;
4840 }
4841
4842 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4843
4844 if (!check_fsp(conn, req, fsp)) {
4845 END_PROFILE(SMBlock);
4846 return;
4847 }
4848
4849 count = (uint64_t)IVAL(req->vwv+1, 0);
4850 offset = (uint64_t)IVAL(req->vwv+3, 0);
4851
4852 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4853 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4854
4855 br_lck = do_lock(req->sconn->msg_ctx,
4856 fsp,
4857 (uint64_t)req->smbpid,
4858 count,
4859 offset,
4860 WRITE_LOCK,
4861 WINDOWS_LOCK,
4862 False, /* Non-blocking lock. */
4863 &status,
4864 NULL,
4865 NULL);
4866
4867 TALLOC_FREE(br_lck);
4868
4869 if (NT_STATUS_V(status)) {
4870 reply_nterror(req, status);
4871 END_PROFILE(SMBlock);
4872 return;
4873 }
4874
4875 reply_outbuf(req, 0, 0);
4876
4877 END_PROFILE(SMBlock);
4878 return;
4879 }
4880
4881 /****************************************************************************
4882 Reply to a unlock.
4883 ****************************************************************************/
4884
4885 void reply_unlock(struct smb_request *req)
4886 {
4887 connection_struct *conn = req->conn;
4888 uint64_t count,offset;
4889 NTSTATUS status;
4890 files_struct *fsp;
4891
4892 START_PROFILE(SMBunlock);
4893
4894 if (req->wct < 5) {
4895 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4896 END_PROFILE(SMBunlock);
4897 return;
4898 }
4899
4900 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4901
4902 if (!check_fsp(conn, req, fsp)) {
4903 END_PROFILE(SMBunlock);
4904 return;
4905 }
4906
4907 count = (uint64_t)IVAL(req->vwv+1, 0);
4908 offset = (uint64_t)IVAL(req->vwv+3, 0);
4909
4910 status = do_unlock(req->sconn->msg_ctx,
4911 fsp,
4912 (uint64_t)req->smbpid,
4913 count,
4914 offset,
4915 WINDOWS_LOCK);
4916
4917 if (NT_STATUS_V(status)) {
4918 reply_nterror(req, status);
4919 END_PROFILE(SMBunlock);
4920 return;
4921 }
4922
4923 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4924 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4925
4926 reply_outbuf(req, 0, 0);
4927
4928 END_PROFILE(SMBunlock);
4929 return;
4930 }
4931
4932 #undef DBGC_CLASS
4933 #define DBGC_CLASS DBGC_ALL
4934
4935 /****************************************************************************
4936 Reply to a tdis.
4937 conn POINTER CAN BE NULL HERE !
4938 ****************************************************************************/
4939
4940 void reply_tdis(struct smb_request *req)
4941 {
4942 connection_struct *conn = req->conn;
4943 START_PROFILE(SMBtdis);
4944
4945 if (!conn) {
4946 DEBUG(4,("Invalid connection in tdis\n"));
4947 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
4948 END_PROFILE(SMBtdis);
4949 return;
4950 }
4951
4952 conn->used = False;
4953
4954 close_cnum(conn,req->vuid);
4955 req->conn = NULL;
4956
4957 reply_outbuf(req, 0, 0);
4958 END_PROFILE(SMBtdis);
4959 return;
4960 }
4961
4962 /****************************************************************************
4963 Reply to a echo.
4964 conn POINTER CAN BE NULL HERE !
4965 ****************************************************************************/
4966
4967 void reply_echo(struct smb_request *req)
4968 {
4969 connection_struct *conn = req->conn;
4970 struct smb_perfcount_data local_pcd;
4971 struct smb_perfcount_data *cur_pcd;
4972 int smb_reverb;
4973 int seq_num;
4974
4975 START_PROFILE(SMBecho);
4976
4977 smb_init_perfcount_data(&local_pcd);
4978
4979 if (req->wct < 1) {
4980 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4981 END_PROFILE(SMBecho);
4982 return;
4983 }
4984
4985 smb_reverb = SVAL(req->vwv+0, 0);
4986
4987 reply_outbuf(req, 1, req->buflen);
4988
4989 /* copy any incoming data back out */
4990 if (req->buflen > 0) {
4991 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4992 }
4993
4994 if (smb_reverb > 100) {
4995 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4996 smb_reverb = 100;
4997 }
4998
4999 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5000
5001 /* this makes sure we catch the request pcd */
5002 if (seq_num == smb_reverb) {
5003 cur_pcd = &req->pcd;
5004 } else {
5005 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5006 cur_pcd = &local_pcd;
5007 }
5008
5009 SSVAL(req->outbuf,smb_vwv0,seq_num);
5010
5011 show_msg((char *)req->outbuf);
5012 if (!srv_send_smb(smbd_server_fd(),
5013 (char *)req->outbuf,
5014 true, req->seqnum+1,
5015 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5016 cur_pcd))
5017 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5018 }
5019
5020 DEBUG(3,("echo %d times\n", smb_reverb));
5021
5022 TALLOC_FREE(req->outbuf);
5023
5024 END_PROFILE(SMBecho);
5025 return;
5026 }
5027
5028 /****************************************************************************
5029 Reply to a printopen.
5030 ****************************************************************************/
5031
5032 void reply_printopen(struct smb_request *req)
5033 {
5034 connection_struct *conn = req->conn;
5035 files_struct *fsp;
5036 NTSTATUS status;
5037
5038 START_PROFILE(SMBsplopen);
5039
5040 if (req->wct < 2) {
5041 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5042 END_PROFILE(SMBsplopen);
5043 return;
5044 }
5045
5046 if (!CAN_PRINT(conn)) {
5047 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5048 END_PROFILE(SMBsplopen);
5049 return;
5050 }
5051
5052 status = file_new(req, conn, &fsp);
5053 if(!NT_STATUS_IS_OK(status)) {
5054 reply_nterror(req, status);
5055 END_PROFILE(SMBsplopen);
5056 return;
5057 }
5058
5059 /* Open for exclusive use, write only. */
5060 status = print_spool_open(fsp, NULL, req->vuid);
5061
5062 if (!NT_STATUS_IS_OK(status)) {
5063 file_free(req, fsp);
5064 reply_nterror(req, status);
5065 END_PROFILE(SMBsplopen);
5066 return;
5067 }
5068
5069 reply_outbuf(req, 1, 0);
5070 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5071
5072 DEBUG(3,("openprint fd=%d fnum=%d\n",
5073 fsp->fh->fd, fsp->fnum));
5074
5075 END_PROFILE(SMBsplopen);
5076 return;
5077 }
5078
5079 /****************************************************************************
5080 Reply to a printclose.
5081 ****************************************************************************/
5082
5083 void reply_printclose(struct smb_request *req)
5084 {
5085 connection_struct *conn = req->conn;
5086 files_struct *fsp;
5087 NTSTATUS status;
5088
5089 START_PROFILE(SMBsplclose);
5090
5091 if (req->wct < 1) {
5092 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5093 END_PROFILE(SMBsplclose);
5094 return;
5095 }
5096
5097 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5098
5099 if (!check_fsp(conn, req, fsp)) {
5100 END_PROFILE(SMBsplclose);
5101 return;
5102 }
5103
5104 if (!CAN_PRINT(conn)) {
5105 reply_force_doserror(req, ERRSRV, ERRerror);
5106 END_PROFILE(SMBsplclose);
5107 return;
5108 }
5109
5110 DEBUG(3,("printclose fd=%d fnum=%d\n",
5111 fsp->fh->fd,fsp->fnum));
5112
5113 status = close_file(req, fsp, NORMAL_CLOSE);
5114
5115 if(!NT_STATUS_IS_OK(status)) {
5116 reply_nterror(req, status);
5117 END_PROFILE(SMBsplclose);
5118 return;
5119 }
5120
5121 reply_outbuf(req, 0, 0);
5122
5123 END_PROFILE(SMBsplclose);
5124 return;
5125 }
5126
5127 /****************************************************************************
5128 Reply to a printqueue.
5129 ****************************************************************************/
5130
5131 void reply_printqueue(struct smb_request *req)
5132 {
5133 connection_struct *conn = req->conn;
5134 int max_count;
5135 int start_index;
5136
5137 START_PROFILE(SMBsplretq);
5138
5139 if (req->wct < 2) {
5140 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5141 END_PROFILE(SMBsplretq);
5142 return;
5143 }
5144
5145 max_count = SVAL(req->vwv+0, 0);
5146 start_index = SVAL(req->vwv+1, 0);
5147
5148 /* we used to allow the client to get the cnum wrong, but that
5149 is really quite gross and only worked when there was only
5150 one printer - I think we should now only accept it if they
5151 get it right (tridge) */
5152 if (!CAN_PRINT(conn)) {
5153 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5154 END_PROFILE(SMBsplretq);
5155 return;
5156 }
5157
5158 reply_outbuf(req, 2, 3);
5159 SSVAL(req->outbuf,smb_vwv0,0);
5160 SSVAL(req->outbuf,smb_vwv1,0);
5161 SCVAL(smb_buf(req->outbuf),0,1);
5162 SSVAL(smb_buf(req->outbuf),1,0);
5163
5164 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5165 start_index, max_count));
5166
5167 {
5168 TALLOC_CTX *mem_ctx = talloc_tos();
5169 NTSTATUS status;
5170 WERROR werr;
5171 const char *sharename = lp_servicename(SNUM(conn));
5172 struct rpc_pipe_client *cli = NULL;
5173 struct policy_handle handle;
5174 struct spoolss_DevmodeContainer devmode_ctr;
5175 union spoolss_JobInfo *info;
5176 uint32_t count;
5177 uint32_t num_to_get;
5178 uint32_t first;
5179 uint32_t i;
5180
5181 ZERO_STRUCT(handle);
5182
5183 status = rpc_connect_spoolss_pipe(conn, &cli);
5184 if (!NT_STATUS_IS_OK(status)) {
5185 DEBUG(0, ("reply_printqueue: "
5186 "could not connect to spoolss: %s\n",
5187 nt_errstr(status)));
5188 reply_nterror(req, status);
5189 goto out;
5190 }
5191
5192 ZERO_STRUCT(devmode_ctr);
5193
5194 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
5195 sharename,
5196 NULL, devmode_ctr,
5197 SEC_FLAG_MAXIMUM_ALLOWED,
5198 &handle,
5199 &werr);
5200 if (!NT_STATUS_IS_OK(status)) {
5201 reply_nterror(req, status);
5202 goto out;
5203 }
5204 if (!W_ERROR_IS_OK(werr)) {
5205 reply_nterror(req, werror_to_ntstatus(werr));
5206 goto out;
5207 }
5208
5209 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5210 &handle,
5211 0, /* firstjob */
5212 0xff, /* numjobs */
5213 2, /* level */
5214 0, /* offered */
5215 &count,
5216 &info);
5217 if (!W_ERROR_IS_OK(werr)) {
5218 reply_nterror(req, werror_to_ntstatus(werr));
5219 goto out;
5220 }
5221
5222 if (max_count > 0) {
5223 first = start_index;
5224 } else {
5225 first = start_index + max_count + 1;
5226 }
5227
5228 if (first >= count) {
5229 num_to_get = first;
5230 } else {
5231 num_to_get = first + MIN(ABS(max_count), count - first);
5232 }
5233
5234 for (i = first; i < num_to_get; i++) {
5235 char blob[28];
5236 char *p = blob;
5237 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5238 int qstatus;
5239 uint16_t qrapjobid = pjobid_to_rap(sharename,
5240 info[i].info2.job_id);
5241
5242 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5243 qstatus = 2;
5244 } else {
5245 qstatus = 3;
5246 }
5247
5248 srv_put_dos_date2(p, 0, qtime);
5249 SCVAL(p, 4, qstatus);
5250 SSVAL(p, 5, qrapjobid);
5251 SIVAL(p, 7, info[i].info2.size);
5252 SCVAL(p, 11, 0);
5253 srvstr_push(blob, req->flags2, p+12,
5254 info[i].info2.notify_name, 16, STR_ASCII);
5255
5256 if (message_push_blob(
5257 &req->outbuf,
5258 data_blob_const(
5259 blob, sizeof(blob))) == -1) {
5260 reply_nterror(req, NT_STATUS_NO_MEMORY);
5261 goto out;
5262 }
5263 }
5264
5265 if (count > 0) {
5266 SSVAL(req->outbuf,smb_vwv0,count);
5267 SSVAL(req->outbuf,smb_vwv1,
5268 (max_count>0?first+count:first-1));
5269 SCVAL(smb_buf(req->outbuf),0,1);
5270 SSVAL(smb_buf(req->outbuf),1,28*count);
5271 }
5272
5273
5274 DEBUG(3, ("%u entries returned in queue\n",
5275 (unsigned)count));
5276
5277 out:
5278 if (cli && is_valid_policy_hnd(&handle)) {
5279 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
5280 }
5281
5282 }
5283
5284 END_PROFILE(SMBsplretq);
5285 return;
5286 }
5287
5288 /****************************************************************************
5289 Reply to a printwrite.
5290 ****************************************************************************/
5291
5292 void reply_printwrite(struct smb_request *req)
5293 {
5294 connection_struct *conn = req->conn;
5295 int numtowrite;
5296 const char *data;
5297 files_struct *fsp;
5298
5299 START_PROFILE(SMBsplwr);
5300
5301 if (req->wct < 1) {
5302 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5303 END_PROFILE(SMBsplwr);
5304 return;
5305 }
5306
5307 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5308
5309 if (!check_fsp(conn, req, fsp)) {
5310 END_PROFILE(SMBsplwr);
5311 return;
5312 }
5313
5314 if (!fsp->print_file) {
5315 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5316 END_PROFILE(SMBsplwr);
5317 return;
5318 }
5319
5320 if (!CHECK_WRITE(fsp)) {
5321 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5322 END_PROFILE(SMBsplwr);
5323 return;
5324 }
5325
5326 numtowrite = SVAL(req->buf, 1);
5327
5328 if (req->buflen < numtowrite + 3) {
5329 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5330 END_PROFILE(SMBsplwr);
5331 return;
5332 }
5333
5334 data = (const char *)req->buf + 3;
5335
5336 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5337 reply_nterror(req, map_nt_error_from_unix(errno));
5338 END_PROFILE(SMBsplwr);
5339 return;
5340 }
5341
5342 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5343
5344 END_PROFILE(SMBsplwr);
5345 return;
5346 }
5347
5348 /****************************************************************************
5349 Reply to a mkdir.
5350 ****************************************************************************/
5351
5352 void reply_mkdir(struct smb_request *req)
5353 {
5354 connection_struct *conn = req->conn;
5355 struct smb_filename *smb_dname = NULL;
5356 char *directory = NULL;
5357 NTSTATUS status;
5358 TALLOC_CTX *ctx = talloc_tos();
5359
5360 START_PROFILE(SMBmkdir);
5361
5362 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5363 STR_TERMINATE, &status);
5364 if (!NT_STATUS_IS_OK(status)) {
5365 reply_nterror(req, status);
5366 goto out;
5367 }
5368
5369 status = filename_convert(ctx, conn,
5370 req->flags2 & FLAGS2_DFS_PATHNAMES,
5371 directory,
5372 0,
5373 NULL,
5374 &smb_dname);
5375 if (!NT_STATUS_IS_OK(status)) {
5376 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5377 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5378 ERRSRV, ERRbadpath);
5379 goto out;
5380 }
5381 reply_nterror(req, status);
5382 goto out;
5383 }
5384
5385 status = create_directory(conn, req, smb_dname);
5386
5387 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5388
5389 if (!NT_STATUS_IS_OK(status)) {
5390
5391 if (!use_nt_status()
5392 && NT_STATUS_EQUAL(status,
5393 NT_STATUS_OBJECT_NAME_COLLISION)) {
5394 /*
5395 * Yes, in the DOS error code case we get a
5396 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5397 * samba4 torture test.
5398 */
5399 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5400 }
5401
5402 reply_nterror(req, status);
5403 goto out;
5404 }
5405
5406 reply_outbuf(req, 0, 0);
5407
5408 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5409 out:
5410 TALLOC_FREE(smb_dname);
5411 END_PROFILE(SMBmkdir);
5412 return;
5413 }
5414
5415 /****************************************************************************
5416 Reply to a rmdir.
5417 ****************************************************************************/
5418
5419 void reply_rmdir(struct smb_request *req)
5420 {
5421 connection_struct *conn = req->conn;
5422 struct smb_filename *smb_dname = NULL;
5423 char *directory = NULL;
5424 NTSTATUS status;
5425 TALLOC_CTX *ctx = talloc_tos();
5426 files_struct *fsp = NULL;
5427 int info = 0;
5428 struct smbd_server_connection *sconn = req->sconn;
5429
5430 START_PROFILE(SMBrmdir);
5431
5432 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5433 STR_TERMINATE, &status);
5434 if (!NT_STATUS_IS_OK(status)) {
5435 reply_nterror(req, status);
5436 goto out;
5437 }
5438
5439 status = filename_convert(ctx, conn,
5440 req->flags2 & FLAGS2_DFS_PATHNAMES,
5441 directory,
5442 0,
5443 NULL,
5444 &smb_dname);
5445 if (!NT_STATUS_IS_OK(status)) {
5446 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5447 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5448 ERRSRV, ERRbadpath);
5449 goto out;
5450 }
5451 reply_nterror(req, status);
5452 goto out;
5453 }
5454
5455 if (is_ntfs_stream_smb_fname(smb_dname)) {
5456 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5457 goto out;
5458 }
5459
5460 status = SMB_VFS_CREATE_FILE(
5461 conn, /* conn */
5462 req, /* req */
5463 0, /* root_dir_fid */
5464 smb_dname, /* fname */
5465 DELETE_ACCESS, /* access_mask */
5466 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5467 FILE_SHARE_DELETE),
5468 FILE_OPEN, /* create_disposition*/
5469 FILE_DIRECTORY_FILE, /* create_options */
5470 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5471 0, /* oplock_request */
5472 0, /* allocation_size */
5473 0, /* private_flags */
5474 NULL, /* sd */
5475 NULL, /* ea_list */
5476 &fsp, /* result */
5477 &info); /* pinfo */
5478
5479 if (!NT_STATUS_IS_OK(status)) {
5480 if (open_was_deferred(req->mid)) {
5481 /* We have re-scheduled this call. */
5482 goto out;
5483 }
5484 reply_nterror(req, status);
5485 goto out;
5486 }
5487
5488 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5489 if (!NT_STATUS_IS_OK(status)) {
5490 close_file(req, fsp, ERROR_CLOSE);
5491 reply_nterror(req, status);
5492 goto out;
5493 }
5494
5495 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5496 close_file(req, fsp, ERROR_CLOSE);
5497 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5498 goto out;
5499 }
5500
5501 status = close_file(req, fsp, NORMAL_CLOSE);
5502 if (!NT_STATUS_IS_OK(status)) {
5503 reply_nterror(req, status);
5504 } else {
5505 reply_outbuf(req, 0, 0);
5506 }
5507
5508 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5509
5510 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5511 out:
5512 TALLOC_FREE(smb_dname);
5513 END_PROFILE(SMBrmdir);
5514 return;
5515 }
5516
5517 /*******************************************************************
5518 Resolve wildcards in a filename rename.
5519 ********************************************************************/
5520
5521 static bool resolve_wildcards(TALLOC_CTX *ctx,
5522 const char *name1,
5523 const char *name2,
5524 char **pp_newname)
5525 {
5526 char *name2_copy = NULL;
5527 char *root1 = NULL;
5528 char *root2 = NULL;
5529 char *ext1 = NULL;
5530 char *ext2 = NULL;
5531 char *p,*p2, *pname1, *pname2;
5532
5533 name2_copy = talloc_strdup(ctx, name2);
5534 if (!name2_copy) {
5535 return False;
5536 }
5537
5538 pname1 = strrchr_m(name1,'/');
5539 pname2 = strrchr_m(name2_copy,'/');
5540
5541 if (!pname1 || !pname2) {
5542 return False;
5543 }
5544
5545 /* Truncate the copy of name2 at the last '/' */
5546 *pname2 = '\0';
5547
5548 /* Now go past the '/' */
5549 pname1++;
5550 pname2++;
5551
5552 root1 = talloc_strdup(ctx, pname1);
5553 root2 = talloc_strdup(ctx, pname2);
5554
5555 if (!root1 || !root2) {
5556 return False;
5557 }
5558
5559 p = strrchr_m(root1,'.');
5560 if (p) {
5561 *p = 0;
5562 ext1 = talloc_strdup(ctx, p+1);
5563 } else {
5564 ext1 = talloc_strdup(ctx, "");
5565 }
5566 p = strrchr_m(root2,'.');
5567 if (p) {
5568 *p = 0;
5569 ext2 = talloc_strdup(ctx, p+1);
5570 } else {
5571 ext2 = talloc_strdup(ctx, "");
5572 }
5573
5574 if (!ext1 || !ext2) {
5575 return False;
5576 }
5577
5578 p = root1;
5579 p2 = root2;
5580 while (*p2) {
5581 if (*p2 == '?') {
5582 /* Hmmm. Should this be mb-aware ? */
5583 *p2 = *p;
5584 p2++;
5585 } else if (*p2 == '*') {
5586 *p2 = '\0';
5587 root2 = talloc_asprintf(ctx, "%s%s",
5588 root2,
5589 p);
5590 if (!root2) {
5591 return False;
5592 }
5593 break;
5594 } else {
5595 p2++;
5596 }
5597 if (*p) {
5598 p++;
5599 }
5600 }
5601
5602 p = ext1;
5603 p2 = ext2;
5604 while (*p2) {
5605 if (*p2 == '?') {
5606 /* Hmmm. Should this be mb-aware ? */
5607 *p2 = *p;
5608 p2++;
5609 } else if (*p2 == '*') {
5610 *p2 = '\0';
5611 ext2 = talloc_asprintf(ctx, "%s%s",
5612 ext2,
5613 p);
5614 if (!ext2) {
5615 return False;
5616 }
5617 break;
5618 } else {
5619 p2++;
5620 }
5621 if (*p) {
5622 p++;
5623 }
5624 }
5625
5626 if (*ext2) {
5627 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5628 name2_copy,
5629 root2,
5630 ext2);
5631 } else {
5632 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5633 name2_copy,
5634 root2);
5635 }
5636
5637 if (!*pp_newname) {
5638 return False;
5639 }
5640
5641 return True;
5642 }
5643
5644 /****************************************************************************
5645 Ensure open files have their names updated. Updated to notify other smbd's
5646 asynchronously.
5647 ****************************************************************************/
5648
5649 static void rename_open_files(connection_struct *conn,
5650 struct share_mode_lock *lck,
5651 const struct smb_filename *smb_fname_dst)
5652 {
5653 files_struct *fsp;
5654 bool did_rename = False;
5655 NTSTATUS status;
5656
5657 for(fsp = file_find_di_first(lck->id); fsp;
5658 fsp = file_find_di_next(fsp)) {
5659 /* fsp_name is a relative path under the fsp. To change this for other
5660 sharepaths we need to manipulate relative paths. */
5661 /* TODO - create the absolute path and manipulate the newname
5662 relative to the sharepath. */
5663 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5664 continue;
5665 }
5666 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5667 "(file_id %s) from %s -> %s\n", fsp->fnum,
5668 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5669 smb_fname_str_dbg(smb_fname_dst)));
5670
5671 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5672 if (NT_STATUS_IS_OK(status)) {
5673 did_rename = True;
5674 }
5675 }
5676
5677 if (!did_rename) {
5678 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5679 "for %s\n", file_id_string_tos(&lck->id),
5680 smb_fname_str_dbg(smb_fname_dst)));
5681 }
5682
5683 /* Send messages to all smbd's (not ourself) that the name has changed. */
5684 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5685 smb_fname_dst);
5686
5687 }
5688
5689 /****************************************************************************
5690 We need to check if the source path is a parent directory of the destination
5691 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5692 refuse the rename with a sharing violation. Under UNIX the above call can
5693 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5694 probably need to check that the client is a Windows one before disallowing
5695 this as a UNIX client (one with UNIX extensions) can know the source is a
5696 symlink and make this decision intelligently. Found by an excellent bug
5697 report from <AndyLiebman@aol.com>.
5698 ****************************************************************************/
5699
5700 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5701 const struct smb_filename *smb_fname_dst)
5702 {
5703 const char *psrc = smb_fname_src->base_name;
5704 const char *pdst = smb_fname_dst->base_name;
5705 size_t slen;
5706
5707 if (psrc[0] == '.' && psrc[1] == '/') {
5708 psrc += 2;
5709 }
5710 if (pdst[0] == '.' && pdst[1] == '/') {
5711 pdst += 2;
5712 }
5713 if ((slen = strlen(psrc)) > strlen(pdst)) {
5714 return False;
5715 }
5716 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5717 }
5718
5719 /*
5720 * Do the notify calls from a rename
5721 */
5722
5723 static void notify_rename(connection_struct *conn, bool is_dir,
5724 const struct smb_filename *smb_fname_src,
5725 const struct smb_filename *smb_fname_dst)
5726 {
5727 char *parent_dir_src = NULL;
5728 char *parent_dir_dst = NULL;
5729 uint32 mask;
5730
5731 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5732 : FILE_NOTIFY_CHANGE_FILE_NAME;
5733
5734 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5735 &parent_dir_src, NULL) ||
5736 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5737 &parent_dir_dst, NULL)) {
5738 goto out;
5739 }
5740
5741 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5742 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5743 smb_fname_src->base_name);
5744 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5745 smb_fname_dst->base_name);
5746 }
5747 else {
5748 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5749 smb_fname_src->base_name);
5750 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5751 smb_fname_dst->base_name);
5752 }
5753
5754 /* this is a strange one. w2k3 gives an additional event for
5755 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5756 files, but not directories */
5757 if (!is_dir) {
5758 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5759 FILE_NOTIFY_CHANGE_ATTRIBUTES
5760 |FILE_NOTIFY_CHANGE_CREATION,
5761 smb_fname_dst->base_name);
5762 }
5763 out:
5764 TALLOC_FREE(parent_dir_src);
5765 TALLOC_FREE(parent_dir_dst);
5766 }
5767
5768 /****************************************************************************
5769 Rename an open file - given an fsp.
5770 ****************************************************************************/
5771
5772 NTSTATUS rename_internals_fsp(connection_struct *conn,
5773 files_struct *fsp,
5774 const struct smb_filename *smb_fname_dst_in,
5775 uint32 attrs,
5776 bool replace_if_exists)
5777 {
5778 TALLOC_CTX *ctx = talloc_tos();
5779 struct smb_filename *smb_fname_dst = NULL;
5780 NTSTATUS status = NT_STATUS_OK;
5781 struct share_mode_lock *lck = NULL;
5782 bool dst_exists, old_is_stream, new_is_stream;
5783
5784 status = check_name(conn, smb_fname_dst_in->base_name);
5785 if (!NT_STATUS_IS_OK(status)) {
5786 return status;
5787 }
5788
5789 /* Make a copy of the dst smb_fname structs */
5790
5791 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5792 if (!NT_STATUS_IS_OK(status)) {
5793 goto out;
5794 }
5795
5796 /* Ensure the dst smb_fname contains a '/' */
5797 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5798 char * tmp;
5799 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5800 smb_fname_dst->base_name);
5801 if (!tmp) {
5802 status = NT_STATUS_NO_MEMORY;
5803 goto out;
5804 }
5805 TALLOC_FREE(smb_fname_dst->base_name);
5806 smb_fname_dst->base_name = tmp;
5807 }
5808
5809 /*
5810 * Check for special case with case preserving and not
5811 * case sensitive. If the old last component differs from the original
5812 * last component only by case, then we should allow
5813 * the rename (user is trying to change the case of the
5814 * filename).
5815 */
5816 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5817 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5818 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5819 char *last_slash;
5820 char *fname_dst_lcomp_base_mod = NULL;
5821 struct smb_filename *smb_fname_orig_lcomp = NULL;
5822
5823 /*
5824 * Get the last component of the destination name. Note that
5825 * we guarantee that destination name contains a '/' character
5826 * above.
5827 */
5828 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5829 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5830 if (!fname_dst_lcomp_base_mod) {
5831 status = NT_STATUS_NO_MEMORY;
5832 goto out;
5833 }
5834
5835 /*
5836 * Create an smb_filename struct using the original last
5837 * component of the destination.
5838 */
5839 status = create_synthetic_smb_fname_split(ctx,
5840 smb_fname_dst->original_lcomp, NULL,
5841 &smb_fname_orig_lcomp);
5842 if (!NT_STATUS_IS_OK(status)) {
5843 TALLOC_FREE(fname_dst_lcomp_base_mod);
5844 goto out;
5845 }
5846
5847 /* If the base names only differ by case, use original. */
5848 if(!strcsequal(fname_dst_lcomp_base_mod,
5849 smb_fname_orig_lcomp->base_name)) {
5850 char *tmp;
5851 /*
5852 * Replace the modified last component with the
5853 * original.
5854 */
5855 *last_slash = '\0'; /* Truncate at the '/' */
5856 tmp = talloc_asprintf(smb_fname_dst,
5857 "%s/%s",
5858 smb_fname_dst->base_name,
5859 smb_fname_orig_lcomp->base_name);
5860 if (tmp == NULL) {
5861 status = NT_STATUS_NO_MEMORY;
5862 TALLOC_FREE(fname_dst_lcomp_base_mod);
5863 TALLOC_FREE(smb_fname_orig_lcomp);
5864 goto out;
5865 }
5866 TALLOC_FREE(smb_fname_dst->base_name);
5867 smb_fname_dst->base_name = tmp;
5868 }
5869
5870 /* If the stream_names only differ by case, use original. */
5871 if(!strcsequal(smb_fname_dst->stream_name,
5872 smb_fname_orig_lcomp->stream_name)) {
5873 char *tmp = NULL;
5874 /* Use the original stream. */
5875 tmp = talloc_strdup(smb_fname_dst,
5876 smb_fname_orig_lcomp->stream_name);
5877 if (tmp == NULL) {
5878 status = NT_STATUS_NO_MEMORY;
5879 TALLOC_FREE(fname_dst_lcomp_base_mod);
5880 TALLOC_FREE(smb_fname_orig_lcomp);
5881 goto out;
5882 }
5883 TALLOC_FREE(smb_fname_dst->stream_name);
5884 smb_fname_dst->stream_name = tmp;
5885 }
5886 TALLOC_FREE(fname_dst_lcomp_base_mod);
5887 TALLOC_FREE(smb_fname_orig_lcomp);
5888 }
5889
5890 /*
5891 * If the src and dest names are identical - including case,
5892 * don't do the rename, just return success.
5893 */
5894
5895 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5896 strcsequal(fsp->fsp_name->stream_name,
5897 smb_fname_dst->stream_name)) {
5898 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5899 "- returning success\n",
5900 smb_fname_str_dbg(smb_fname_dst)));
5901 status = NT_STATUS_OK;
5902 goto out;
5903 }
5904
5905 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
5906 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5907
5908 /* Return the correct error code if both names aren't streams. */
5909 if (!old_is_stream && new_is_stream) {
5910 status = NT_STATUS_OBJECT_NAME_INVALID;
5911 goto out;
5912 }
5913
5914 if (old_is_stream && !new_is_stream) {
5915 status = NT_STATUS_INVALID_PARAMETER;
5916 goto out;
5917 }
5918
5919 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5920
5921 if(!replace_if_exists && dst_exists) {
5922 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5923 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5924 smb_fname_str_dbg(smb_fname_dst)));
5925 status = NT_STATUS_OBJECT_NAME_COLLISION;
5926 goto out;
5927 }
5928
5929 if (dst_exists) {
5930 struct file_id fileid = vfs_file_id_from_sbuf(conn,
5931 &smb_fname_dst->st);
5932 files_struct *dst_fsp = file_find_di_first(fileid);
5933 /* The file can be open when renaming a stream */
5934 if (dst_fsp && !new_is_stream) {
5935 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5936 status = NT_STATUS_ACCESS_DENIED;
5937 goto out;
5938 }
5939 }
5940
5941 /* Ensure we have a valid stat struct for the source. */
5942 status = vfs_stat_fsp(fsp);
5943 if (!NT_STATUS_IS_OK(status)) {
5944 goto out;
5945 }
5946
5947 status = can_rename(conn, fsp, attrs);
5948
5949 if (!NT_STATUS_IS_OK(status)) {
5950 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5951 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5952 smb_fname_str_dbg(smb_fname_dst)));
5953 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5954 status = NT_STATUS_ACCESS_DENIED;
5955 goto out;
5956 }
5957
5958 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
5959 status = NT_STATUS_ACCESS_DENIED;
5960 }
5961
5962 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5963 NULL);
5964
5965 /*
5966 * We have the file open ourselves, so not being able to get the
5967 * corresponding share mode lock is a fatal error.
5968 */
5969
5970 SMB_ASSERT(lck != NULL);
5971
5972 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
5973 uint32 create_options = fsp->fh->private_options;
5974
5975 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
5976 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5977 smb_fname_str_dbg(smb_fname_dst)));
5978
5979 if (lp_map_archive(SNUM(conn)) ||
5980 lp_store_dos_attributes(SNUM(conn))) {
5981 /* We must set the archive bit on the newly
5982 renamed file. */
5983 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
5984 uint32_t old_dosmode = dos_mode(conn,
5985 smb_fname_dst);
5986 file_set_dosmode(conn,
5987 smb_fname_dst,
5988 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
5989 NULL,
5990 true);
5991 }
5992 }
5993
5994 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
5995 smb_fname_dst);
5996
5997 rename_open_files(conn, lck, smb_fname_dst);
5998
5999 /*
6000 * A rename acts as a new file create w.r.t. allowing an initial delete
6001 * on close, probably because in Windows there is a new handle to the
6002 * new file. If initial delete on close was requested but not
6003 * originally set, we need to set it here. This is probably not 100% correct,
6004 * but will work for the CIFSFS client which in non-posix mode
6005 * depends on these semantics. JRA.
6006 */
6007
6008 if (create_options & FILE_DELETE_ON_CLOSE) {
6009 status = can_set_delete_on_close(fsp, 0);
6010
6011 if (NT_STATUS_IS_OK(status)) {
6012 /* Note that here we set the *inital* delete on close flag,
6013 * not the regular one. The magic gets handled in close. */
6014 fsp->initial_delete_on_close = True;
6015 }
6016 }
6017 TALLOC_FREE(lck);
6018 status = NT_STATUS_OK;
6019 goto out;
6020 }
6021
6022 TALLOC_FREE(lck);
6023
6024 if (errno == ENOTDIR || errno == EISDIR) {
6025 status = NT_STATUS_OBJECT_NAME_COLLISION;
6026 } else {
6027 status = map_nt_error_from_unix(errno);
6028 }
6029
6030 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6031 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6032 smb_fname_str_dbg(smb_fname_dst)));
6033
6034 out:
6035 TALLOC_FREE(smb_fname_dst);
6036
6037 return status;
6038 }
6039
6040 /****************************************************************************
6041 The guts of the rename command, split out so it may be called by the NT SMB
6042 code.
6043 ****************************************************************************/
6044
6045 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6046 connection_struct *conn,
6047 struct smb_request *req,
6048 struct smb_filename *smb_fname_src,
6049 struct smb_filename *smb_fname_dst,
6050 uint32 attrs,
6051 bool replace_if_exists,
6052 bool src_has_wild,
6053 bool dest_has_wild,
6054 uint32_t access_mask)
6055 {
6056 char *fname_src_dir = NULL;
6057 char *fname_src_mask = NULL;
6058 int count=0;
6059 NTSTATUS status = NT_STATUS_OK;
6060 struct smb_Dir *dir_hnd = NULL;
6061 const char *dname = NULL;
6062 char *talloced = NULL;
6063 long offset = 0;
6064 int create_options = 0;
6065 bool posix_pathnames = lp_posix_pathnames();
6066
6067 /*
6068 * Split the old name into directory and last component
6069 * strings. Note that unix_convert may have stripped off a
6070 * leading ./ from both name and newname if the rename is
6071 * at the root of the share. We need to make sure either both
6072 * name and newname contain a / character or neither of them do
6073 * as this is checked in resolve_wildcards().
6074 */
6075
6076 /* Split up the directory from the filename/mask. */
6077 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6078 &fname_src_dir, &fname_src_mask);
6079 if (!NT_STATUS_IS_OK(status)) {
6080 status = NT_STATUS_NO_MEMORY;
6081 goto out;
6082 }
6083
6084 /*
6085 * We should only check the mangled cache
6086 * here if unix_convert failed. This means
6087 * that the path in 'mask' doesn't exist
6088 * on the file system and so we need to look
6089 * for a possible mangle. This patch from
6090 * Tine Smukavec <valentin.smukavec@hermes.si>.
6091 */
6092
6093 if (!VALID_STAT(smb_fname_src->st) &&
6094 mangle_is_mangled(fname_src_mask, conn->params)) {
6095 char *new_mask = NULL;
6096 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6097 conn->params);
6098 if (new_mask) {
6099 TALLOC_FREE(fname_src_mask);
6100 fname_src_mask = new_mask;
6101 }
6102 }
6103
6104 if (!src_has_wild) {
6105 files_struct *fsp;
6106
6107 /*
6108 * Only one file needs to be renamed. Append the mask back
6109 * onto the directory.
6110 */
6111 TALLOC_FREE(smb_fname_src->base_name);
6112 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6113 "%s/%s",
6114 fname_src_dir,
6115 fname_src_mask);
6116 if (!smb_fname_src->base_name) {
6117 status = NT_STATUS_NO_MEMORY;
6118 goto out;
6119 }
6120
6121 /* Ensure dst fname contains a '/' also */
6122 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6123 char *tmp;
6124 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6125 smb_fname_dst->base_name);
6126 if (!tmp) {
6127 status = NT_STATUS_NO_MEMORY;
6128 goto out;
6129 }
6130 TALLOC_FREE(smb_fname_dst->base_name);
6131 smb_fname_dst->base_name = tmp;
6132 }
6133
6134 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6135 "case_preserve = %d, short case preserve = %d, "
6136 "directory = %s, newname = %s, "
6137 "last_component_dest = %s\n",
6138 conn->case_sensitive, conn->case_preserve,
6139 conn->short_case_preserve,
6140 smb_fname_str_dbg(smb_fname_src),
6141 smb_fname_str_dbg(smb_fname_dst),
6142 smb_fname_dst->original_lcomp));
6143
6144 /* The dest name still may have wildcards. */
6145 if (dest_has_wild) {
6146 char *fname_dst_mod = NULL;
6147 if (!resolve_wildcards(smb_fname_dst,
6148 smb_fname_src->base_name,
6149 smb_fname_dst->base_name,
6150 &fname_dst_mod)) {
6151 DEBUG(6, ("rename_internals: resolve_wildcards "
6152 "%s %s failed\n",
6153 smb_fname_src->base_name,
6154 smb_fname_dst->base_name));
6155 status = NT_STATUS_NO_MEMORY;
6156 goto out;
6157 }
6158 TALLOC_FREE(smb_fname_dst->base_name);
6159 smb_fname_dst->base_name = fname_dst_mod;
6160 }
6161
6162 ZERO_STRUCT(smb_fname_src->st);
6163 if (posix_pathnames) {
6164 SMB_VFS_LSTAT(conn, smb_fname_src);
6165 } else {
6166 SMB_VFS_STAT(conn, smb_fname_src);
6167 }
6168
6169 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6170 create_options |= FILE_DIRECTORY_FILE;
6171 }
6172
6173 status = SMB_VFS_CREATE_FILE(
6174 conn, /* conn */
6175 req, /* req */
6176 0, /* root_dir_fid */
6177 smb_fname_src, /* fname */
6178 access_mask, /* access_mask */
6179 (FILE_SHARE_READ | /* share_access */
6180 FILE_SHARE_WRITE),
6181 FILE_OPEN, /* create_disposition*/
6182 create_options, /* create_options */
6183 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6184 0, /* oplock_request */
6185 0, /* allocation_size */
6186 0, /* private_flags */
6187 NULL, /* sd */
6188 NULL, /* ea_list */
6189 &fsp, /* result */
6190 NULL); /* pinfo */
6191
6192 if (!NT_STATUS_IS_OK(status)) {
6193 DEBUG(3, ("Could not open rename source %s: %s\n",
6194 smb_fname_str_dbg(smb_fname_src),
6195 nt_errstr(status)));
6196 goto out;
6197 }
6198
6199 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6200 attrs, replace_if_exists);
6201
6202 close_file(req, fsp, NORMAL_CLOSE);
6203
6204 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6205 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6206 smb_fname_str_dbg(smb_fname_dst)));
6207
6208 goto out;
6209 }
6210
6211 /*
6212 * Wildcards - process each file that matches.
6213 */
6214 if (strequal(fname_src_mask, "????????.???")) {
6215 TALLOC_FREE(fname_src_mask);
6216 fname_src_mask = talloc_strdup(ctx, "*");
6217 if (!fname_src_mask) {
6218 status = NT_STATUS_NO_MEMORY;
6219 goto out;
6220 }
6221 }
6222
6223 status = check_name(conn, fname_src_dir);
6224 if (!NT_STATUS_IS_OK(status)) {
6225 goto out;
6226 }
6227
6228 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6229 attrs);
6230 if (dir_hnd == NULL) {
6231 status = map_nt_error_from_unix(errno);
6232 goto out;
6233 }
6234
6235 status = NT_STATUS_NO_SUCH_FILE;
6236 /*
6237 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6238 * - gentest fix. JRA
6239 */
6240
6241 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6242 &talloced))) {
6243 files_struct *fsp = NULL;
6244 char *destname = NULL;
6245 bool sysdir_entry = False;
6246
6247 /* Quick check for "." and ".." */
6248 if (ISDOT(dname) || ISDOTDOT(dname)) {
6249 if (attrs & aDIR) {
6250 sysdir_entry = True;
6251 } else {
6252 TALLOC_FREE(talloced);
6253 continue;
6254 }
6255 }
6256
6257 if (!is_visible_file(conn, fname_src_dir, dname,
6258 &smb_fname_src->st, false)) {
6259 TALLOC_FREE(talloced);
6260 continue;
6261 }
6262
6263 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6264 TALLOC_FREE(talloced);
6265 continue;
6266 }
6267
6268 if (sysdir_entry) {
6269 status = NT_STATUS_OBJECT_NAME_INVALID;
6270 break;
6271 }
6272
6273 TALLOC_FREE(smb_fname_src->base_name);
6274 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6275 "%s/%s",
6276 fname_src_dir,
6277 dname);
6278 if (!smb_fname_src->base_name) {
6279 status = NT_STATUS_NO_MEMORY;
6280 goto out;
6281 }
6282
6283 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6284 smb_fname_dst->base_name,
6285 &destname)) {
6286 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6287 smb_fname_src->base_name, destname));
6288 TALLOC_FREE(talloced);
6289 continue;
6290 }
6291 if (!destname) {
6292 status = NT_STATUS_NO_MEMORY;
6293 goto out;
6294 }
6295
6296 TALLOC_FREE(smb_fname_dst->base_name);
6297 smb_fname_dst->base_name = destname;
6298
6299 ZERO_STRUCT(smb_fname_src->st);
6300 if (posix_pathnames) {
6301 SMB_VFS_LSTAT(conn, smb_fname_src);
6302 } else {
6303 SMB_VFS_STAT(conn, smb_fname_src);
6304 }
6305
6306 create_options = 0;
6307
6308 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6309 create_options |= FILE_DIRECTORY_FILE;
6310 }
6311
6312 status = SMB_VFS_CREATE_FILE(
6313 conn, /* conn */
6314 req, /* req */
6315 0, /* root_dir_fid */
6316 smb_fname_src, /* fname */
6317 access_mask, /* access_mask */
6318 (FILE_SHARE_READ | /* share_access */
6319 FILE_SHARE_WRITE),
6320 FILE_OPEN, /* create_disposition*/
6321 create_options, /* create_options */
6322 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6323 0, /* oplock_request */
6324 0, /* allocation_size */
6325 0, /* private_flags */
6326 NULL, /* sd */
6327 NULL, /* ea_list */
6328 &fsp, /* result */
6329 NULL); /* pinfo */
6330
6331 if (!NT_STATUS_IS_OK(status)) {
6332 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6333 "returned %s rename %s -> %s\n",
6334 nt_errstr(status),
6335 smb_fname_str_dbg(smb_fname_src),
6336 smb_fname_str_dbg(smb_fname_dst)));
6337 break;
6338 }
6339
6340 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6341 dname);
6342 if (!smb_fname_dst->original_lcomp) {
6343 status = NT_STATUS_NO_MEMORY;
6344 goto out;
6345 }
6346
6347 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6348 attrs, replace_if_exists);
6349
6350 close_file(req, fsp, NORMAL_CLOSE);
6351
6352 if (!NT_STATUS_IS_OK(status)) {
6353 DEBUG(3, ("rename_internals_fsp returned %s for "
6354 "rename %s -> %s\n", nt_errstr(status),
6355 smb_fname_str_dbg(smb_fname_src),
6356 smb_fname_str_dbg(smb_fname_dst)));
6357 break;
6358 }
6359
6360 count++;
6361
6362 DEBUG(3,("rename_internals: doing rename on %s -> "
6363 "%s\n", smb_fname_str_dbg(smb_fname_src),
6364 smb_fname_str_dbg(smb_fname_src)));
6365 TALLOC_FREE(talloced);
6366 }
6367 TALLOC_FREE(dir_hnd);
6368
6369 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6370 status = map_nt_error_from_unix(errno);
6371 }
6372
6373 out:
6374 TALLOC_FREE(talloced);
6375 TALLOC_FREE(fname_src_dir);
6376 TALLOC_FREE(fname_src_mask);
6377 return status;
6378 }
6379
6380 /****************************************************************************
6381 Reply to a mv.
6382 ****************************************************************************/
6383
6384 void reply_mv(struct smb_request *req)
6385 {
6386 connection_struct *conn = req->conn;
6387 char *name = NULL;
6388 char *newname = NULL;
6389 const char *p;
6390 uint32 attrs;
6391 NTSTATUS status;
6392 bool src_has_wcard = False;
6393 bool dest_has_wcard = False;
6394 TALLOC_CTX *ctx = talloc_tos();
6395 struct smb_filename *smb_fname_src = NULL;
6396 struct smb_filename *smb_fname_dst = NULL;
6397
6398 START_PROFILE(SMBmv);
6399
6400 if (req->wct < 1) {
6401 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6402 goto out;
6403 }
6404
6405 attrs = SVAL(req->vwv+0, 0);
6406
6407 p = (const char *)req->buf + 1;
6408 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6409 &status, &src_has_wcard);
6410 if (!NT_STATUS_IS_OK(status)) {
6411 reply_nterror(req, status);
6412 goto out;
6413 }
6414 p++;
6415 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6416 &status, &dest_has_wcard);
6417 if (!NT_STATUS_IS_OK(status)) {
6418 reply_nterror(req, status);
6419 goto out;
6420 }
6421
6422 status = filename_convert(ctx,
6423 conn,
6424 req->flags2 & FLAGS2_DFS_PATHNAMES,
6425 name,
6426 UCF_COND_ALLOW_WCARD_LCOMP,
6427 &src_has_wcard,
6428 &smb_fname_src);
6429
6430 if (!NT_STATUS_IS_OK(status)) {
6431 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6432 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6433 ERRSRV, ERRbadpath);
6434 goto out;
6435 }
6436 reply_nterror(req, status);
6437 goto out;
6438 }
6439
6440 status = filename_convert(ctx,
6441 conn,
6442 req->flags2 & FLAGS2_DFS_PATHNAMES,
6443 newname,
6444 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6445 &dest_has_wcard,
6446 &smb_fname_dst);
6447
6448 if (!NT_STATUS_IS_OK(status)) {
6449 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6450 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6451 ERRSRV, ERRbadpath);
6452 goto out;
6453 }
6454 reply_nterror(req, status);
6455 goto out;
6456 }
6457
6458 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6459 smb_fname_str_dbg(smb_fname_dst)));
6460
6461 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6462 attrs, False, src_has_wcard, dest_has_wcard,
6463 DELETE_ACCESS);
6464 if (!NT_STATUS_IS_OK(status)) {
6465 if (open_was_deferred(req->mid)) {
6466 /* We have re-scheduled this call. */
6467 goto out;
6468 }
6469 reply_nterror(req, status);
6470 goto out;
6471 }
6472
6473 reply_outbuf(req, 0, 0);
6474 out:
6475 TALLOC_FREE(smb_fname_src);
6476 TALLOC_FREE(smb_fname_dst);
6477 END_PROFILE(SMBmv);
6478 return;
6479 }
6480
6481 /*******************************************************************
6482 Copy a file as part of a reply_copy.
6483 ******************************************************************/
6484
6485 /*
6486 * TODO: check error codes on all callers
6487 */
6488
6489 NTSTATUS copy_file(TALLOC_CTX *ctx,
6490 connection_struct *conn,
6491 struct smb_filename *smb_fname_src,
6492 struct smb_filename *smb_fname_dst,
6493 int ofun,
6494 int count,
6495 bool target_is_directory)
6496 {
6497 struct smb_filename *smb_fname_dst_tmp = NULL;
6498 SMB_OFF_T ret=-1;
6499 files_struct *fsp1,*fsp2;
6500 uint32 dosattrs;
6501 uint32 new_create_disposition;
6502 NTSTATUS status;
6503
6504
6505 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6506 if (!NT_STATUS_IS_OK(status)) {
6507 return status;
6508 }
6509
6510 /*
6511 * If the target is a directory, extract the last component from the
6512 * src filename and append it to the dst filename
6513 */
6514 if (target_is_directory) {
6515 const char *p;
6516
6517 /* dest/target can't be a stream if it's a directory. */
6518 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6519
6520 p = strrchr_m(smb_fname_src->base_name,'/');
6521 if (p) {
6522 p++;
6523 } else {
6524 p = smb_fname_src->base_name;
6525 }
6526 smb_fname_dst_tmp->base_name =
6527 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6528 p);
6529 if (!smb_fname_dst_tmp->base_name) {
6530 status = NT_STATUS_NO_MEMORY;
6531 goto out;
6532 }
6533 }
6534
6535 status = vfs_file_exist(conn, smb_fname_src);
6536 if (!NT_STATUS_IS_OK(status)) {
6537 goto out;
6538 }
6539
6540 if (!target_is_directory && count) {
6541 new_create_disposition = FILE_OPEN;
6542 } else {
6543 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6544 NULL, NULL,
6545 &new_create_disposition,
6546 NULL,
6547 NULL)) {
6548 status = NT_STATUS_INVALID_PARAMETER;
6549 goto out;
6550 }
6551 }
6552
6553 /* Open the src file for reading. */
6554 status = SMB_VFS_CREATE_FILE(
6555 conn, /* conn */
6556 NULL, /* req */
6557 0, /* root_dir_fid */
6558 smb_fname_src, /* fname */
6559 FILE_GENERIC_READ, /* access_mask */
6560 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6561 FILE_OPEN, /* create_disposition*/
6562 0, /* create_options */
6563 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6564 INTERNAL_OPEN_ONLY, /* oplock_request */
6565 0, /* allocation_size */
6566 0, /* private_flags */
6567 NULL, /* sd */
6568 NULL, /* ea_list */
6569 &fsp1, /* result */
6570 NULL); /* psbuf */
6571
6572 if (!NT_STATUS_IS_OK(status)) {
6573 goto out;
6574 }
6575
6576 dosattrs = dos_mode(conn, smb_fname_src);
6577
6578 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6579 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6580 }
6581
6582 /* Open the dst file for writing. */
6583 status = SMB_VFS_CREATE_FILE(
6584 conn, /* conn */
6585 NULL, /* req */
6586 0, /* root_dir_fid */
6587 smb_fname_dst, /* fname */
6588 FILE_GENERIC_WRITE, /* access_mask */
6589 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6590 new_create_disposition, /* create_disposition*/
6591 0, /* create_options */
6592 dosattrs, /* file_attributes */
6593 INTERNAL_OPEN_ONLY, /* oplock_request */
6594 0, /* allocation_size */
6595 0, /* private_flags */
6596 NULL, /* sd */
6597 NULL, /* ea_list */
6598 &fsp2, /* result */
6599 NULL); /* psbuf */
6600
6601 if (!NT_STATUS_IS_OK(status)) {
6602 close_file(NULL, fsp1, ERROR_CLOSE);
6603 goto out;
6604 }
6605
6606 if ((ofun&3) == 1) {
6607 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6608 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6609 /*
6610 * Stop the copy from occurring.
6611 */
6612 ret = -1;
6613 smb_fname_src->st.st_ex_size = 0;
6614 }
6615 }
6616
6617 /* Do the actual copy. */
6618 if (smb_fname_src->st.st_ex_size) {
6619 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6620 }
6621
6622 close_file(NULL, fsp1, NORMAL_CLOSE);
6623
6624 /* Ensure the modtime is set correctly on the destination file. */
6625 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6626
6627 /*
6628 * As we are opening fsp1 read-only we only expect
6629 * an error on close on fsp2 if we are out of space.
6630 * Thus we don't look at the error return from the
6631 * close of fsp1.
6632 */
6633 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6634
6635 if (!NT_STATUS_IS_OK(status)) {
6636 goto out;
6637 }
6638
6639 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6640 status = NT_STATUS_DISK_FULL;
6641 goto out;
6642 }
6643
6644 status = NT_STATUS_OK;
6645
6646 out:
6647 TALLOC_FREE(smb_fname_dst_tmp);
6648 return status;
6649 }
6650
6651 /****************************************************************************
6652 Reply to a file copy.
6653 ****************************************************************************/
6654
6655 void reply_copy(struct smb_request *req)
6656 {
6657 connection_struct *conn = req->conn;
6658 struct smb_filename *smb_fname_src = NULL;
6659 struct smb_filename *smb_fname_dst = NULL;
6660 char *fname_src = NULL;
6661 char *fname_dst = NULL;
6662 char *fname_src_mask = NULL;
6663 char *fname_src_dir = NULL;
6664 const char *p;
6665 int count=0;
6666 int error = ERRnoaccess;
6667 int tid2;
6668 int ofun;
6669 int flags;
6670 bool target_is_directory=False;
6671 bool source_has_wild = False;
6672 bool dest_has_wild = False;
6673 NTSTATUS status;
6674 TALLOC_CTX *ctx = talloc_tos();
6675
6676 START_PROFILE(SMBcopy);
6677
6678 if (req->wct < 3) {
6679 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6680 goto out;
6681 }
6682
6683 tid2 = SVAL(req->vwv+0, 0);
6684 ofun = SVAL(req->vwv+1, 0);
6685 flags = SVAL(req->vwv+2, 0);
6686
6687 p = (const char *)req->buf;
6688 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6689 &status, &source_has_wild);
6690 if (!NT_STATUS_IS_OK(status)) {
6691 reply_nterror(req, status);
6692 goto out;
6693 }
6694 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6695 &status, &dest_has_wild);
6696 if (!NT_STATUS_IS_OK(status)) {
6697 reply_nterror(req, status);
6698 goto out;
6699 }
6700
6701 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6702
6703 if (tid2 != conn->cnum) {
6704 /* can't currently handle inter share copies XXXX */
6705 DEBUG(3,("Rejecting inter-share copy\n"));
6706 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6707 goto out;
6708 }
6709
6710 status = filename_convert(ctx, conn,
6711 req->flags2 & FLAGS2_DFS_PATHNAMES,
6712 fname_src,
6713 UCF_COND_ALLOW_WCARD_LCOMP,
6714 &source_has_wild,
6715 &smb_fname_src);
6716 if (!NT_STATUS_IS_OK(status)) {
6717 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6718 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6719 ERRSRV, ERRbadpath);
6720 goto out;
6721 }
6722 reply_nterror(req, status);
6723 goto out;
6724 }
6725
6726 status = filename_convert(ctx, conn,
6727 req->flags2 & FLAGS2_DFS_PATHNAMES,
6728 fname_dst,
6729 UCF_COND_ALLOW_WCARD_LCOMP,
6730 &dest_has_wild,
6731 &smb_fname_dst);
6732 if (!NT_STATUS_IS_OK(status)) {
6733 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6734 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6735 ERRSRV, ERRbadpath);
6736 goto out;
6737 }
6738 reply_nterror(req, status);
6739 goto out;
6740 }
6741
6742 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6743
6744 if ((flags&1) && target_is_directory) {
6745 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6746 goto out;
6747 }
6748
6749 if ((flags&2) && !target_is_directory) {
6750 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6751 goto out;
6752 }
6753
6754 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6755 /* wants a tree copy! XXXX */
6756 DEBUG(3,("Rejecting tree copy\n"));
6757 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6758 goto out;
6759 }
6760
6761 /* Split up the directory from the filename/mask. */
6762 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6763 &fname_src_dir, &fname_src_mask);
6764 if (!NT_STATUS_IS_OK(status)) {
6765 reply_nterror(req, NT_STATUS_NO_MEMORY);
6766 goto out;
6767 }
6768
6769 /*
6770 * We should only check the mangled cache
6771 * here if unix_convert failed. This means
6772 * that the path in 'mask' doesn't exist
6773 * on the file system and so we need to look
6774 * for a possible mangle. This patch from
6775 * Tine Smukavec <valentin.smukavec@hermes.si>.
6776 */
6777 if (!VALID_STAT(smb_fname_src->st) &&
6778 mangle_is_mangled(fname_src_mask, conn->params)) {
6779 char *new_mask = NULL;
6780 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6781 &new_mask, conn->params);
6782
6783 /* Use demangled name if one was successfully found. */
6784 if (new_mask) {
6785 TALLOC_FREE(fname_src_mask);
6786 fname_src_mask = new_mask;
6787 }
6788 }
6789
6790 if (!source_has_wild) {
6791
6792 /*
6793 * Only one file needs to be copied. Append the mask back onto
6794 * the directory.
6795 */
6796 TALLOC_FREE(smb_fname_src->base_name);
6797 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6798 "%s/%s",
6799 fname_src_dir,
6800 fname_src_mask);
6801 if (!smb_fname_src->base_name) {
6802 reply_nterror(req, NT_STATUS_NO_MEMORY);
6803 goto out;
6804 }
6805
6806 if (dest_has_wild) {
6807 char *fname_dst_mod = NULL;
6808 if (!resolve_wildcards(smb_fname_dst,
6809 smb_fname_src->base_name,
6810 smb_fname_dst->base_name,
6811 &fname_dst_mod)) {
6812 reply_nterror(req, NT_STATUS_NO_MEMORY);
6813 goto out;
6814 }
6815 TALLOC_FREE(smb_fname_dst->base_name);
6816 smb_fname_dst->base_name = fname_dst_mod;
6817 }
6818
6819 status = check_name(conn, smb_fname_src->base_name);
6820 if (!NT_STATUS_IS_OK(status)) {
6821 reply_nterror(req, status);
6822 goto out;
6823 }
6824
6825 status = check_name(conn, smb_fname_dst->base_name);
6826 if (!NT_STATUS_IS_OK(status)) {
6827 reply_nterror(req, status);
6828 goto out;
6829 }
6830
6831 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6832 ofun, count, target_is_directory);
6833
6834 if(!NT_STATUS_IS_OK(status)) {
6835 reply_nterror(req, status);
6836 goto out;
6837 } else {
6838 count++;
6839 }
6840 } else {
6841 struct smb_Dir *dir_hnd = NULL;
6842 const char *dname = NULL;
6843 char *talloced = NULL;
6844 long offset = 0;
6845
6846 /*
6847 * There is a wildcard that requires us to actually read the
6848 * src dir and copy each file matching the mask to the dst.
6849 * Right now streams won't be copied, but this could
6850 * presumably be added with a nested loop for reach dir entry.
6851 */
6852 SMB_ASSERT(!smb_fname_src->stream_name);
6853 SMB_ASSERT(!smb_fname_dst->stream_name);
6854
6855 smb_fname_src->stream_name = NULL;
6856 smb_fname_dst->stream_name = NULL;
6857
6858 if (strequal(fname_src_mask,"????????.???")) {
6859 TALLOC_FREE(fname_src_mask);
6860 fname_src_mask = talloc_strdup(ctx, "*");
6861 if (!fname_src_mask) {
6862 reply_nterror(req, NT_STATUS_NO_MEMORY);
6863 goto out;
6864 }
6865 }
6866
6867 status = check_name(conn, fname_src_dir);
6868 if (!NT_STATUS_IS_OK(status)) {
6869 reply_nterror(req, status);
6870 goto out;
6871 }
6872
6873 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6874 if (dir_hnd == NULL) {
6875 status = map_nt_error_from_unix(errno);
6876 reply_nterror(req, status);
6877 goto out;
6878 }
6879
6880 error = ERRbadfile;
6881
6882 /* Iterate over the src dir copying each entry to the dst. */
6883 while ((dname = ReadDirName(dir_hnd, &offset,
6884 &smb_fname_src->st, &talloced))) {
6885 char *destname = NULL;
6886
6887 if (ISDOT(dname) || ISDOTDOT(dname)) {
6888 TALLOC_FREE(talloced);
6889 continue;
6890 }
6891
6892 if (!is_visible_file(conn, fname_src_dir, dname,
6893 &smb_fname_src->st, false)) {
6894 TALLOC_FREE(talloced);
6895 continue;
6896 }
6897
6898 if(!mask_match(dname, fname_src_mask,
6899 conn->case_sensitive)) {
6900 TALLOC_FREE(talloced);
6901 continue;
6902 }
6903
6904 error = ERRnoaccess;
6905
6906 /* Get the src smb_fname struct setup. */
6907 TALLOC_FREE(smb_fname_src->base_name);
6908 smb_fname_src->base_name =
6909 talloc_asprintf(smb_fname_src, "%s/%s",
6910 fname_src_dir, dname);
6911
6912 if (!smb_fname_src->base_name) {
6913 TALLOC_FREE(dir_hnd);
6914 TALLOC_FREE(talloced);
6915 reply_nterror(req, NT_STATUS_NO_MEMORY);
6916 goto out;
6917 }
6918
6919 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6920 smb_fname_dst->base_name,
6921 &destname)) {
6922 TALLOC_FREE(talloced);
6923 continue;
6924 }
6925 if (!destname) {
6926 TALLOC_FREE(dir_hnd);
6927 TALLOC_FREE(talloced);
6928 reply_nterror(req, NT_STATUS_NO_MEMORY);
6929 goto out;
6930 }
6931
6932 TALLOC_FREE(smb_fname_dst->base_name);
6933 smb_fname_dst->base_name = destname;
6934
6935 status = check_name(conn, smb_fname_src->base_name);
6936 if (!NT_STATUS_IS_OK(status)) {
6937 TALLOC_FREE(dir_hnd);
6938 TALLOC_FREE(talloced);
6939 reply_nterror(req, status);
6940 goto out;
6941 }
6942
6943 status = check_name(conn, smb_fname_dst->base_name);
6944 if (!NT_STATUS_IS_OK(status)) {
6945 TALLOC_FREE(dir_hnd);
6946 TALLOC_FREE(talloced);
6947 reply_nterror(req, status);
6948 goto out;
6949 }
6950
6951 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
6952 smb_fname_src->base_name,
6953 smb_fname_dst->base_name));
6954
6955 status = copy_file(ctx, conn, smb_fname_src,
6956 smb_fname_dst, ofun, count,
6957 target_is_directory);
6958 if (NT_STATUS_IS_OK(status)) {
6959 count++;
6960 }
6961
6962 TALLOC_FREE(talloced);
6963 }
6964 TALLOC_FREE(dir_hnd);
6965 }
6966
6967 if (count == 0) {
6968 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
6969 goto out;
6970 }
6971
6972 reply_outbuf(req, 1, 0);
6973 SSVAL(req->outbuf,smb_vwv0,count);
6974 out:
6975 TALLOC_FREE(smb_fname_src);
6976 TALLOC_FREE(smb_fname_dst);
6977 TALLOC_FREE(fname_src);
6978 TALLOC_FREE(fname_dst);
6979 TALLOC_FREE(fname_src_mask);
6980 TALLOC_FREE(fname_src_dir);
6981
6982 END_PROFILE(SMBcopy);
6983 return;
6984 }
6985
6986 #undef DBGC_CLASS
6987 #define DBGC_CLASS DBGC_LOCKING
6988
6989 /****************************************************************************
6990 Get a lock pid, dealing with large count requests.
6991 ****************************************************************************/
6992
6993 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
6994 bool large_file_format)
6995 {
6996 if(!large_file_format)
6997 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
6998 else
6999 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7000 }
7001
7002 /****************************************************************************
7003 Get a lock count, dealing with large count requests.
7004 ****************************************************************************/
7005
7006 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7007 bool large_file_format)
7008 {
7009 uint64_t count = 0;
7010
7011 if(!large_file_format) {
7012 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7013 } else {
7014
7015 #if defined(HAVE_LONGLONG)
7016 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7017 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7018 #else /* HAVE_LONGLONG */
7019
7020 /*
7021 * NT4.x seems to be broken in that it sends large file (64 bit)
7022 * lockingX calls even if the CAP_LARGE_FILES was *not*
7023 * negotiated. For boxes without large unsigned ints truncate the
7024 * lock count by dropping the top 32 bits.
7025 */
7026
7027 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7028 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7029 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7030 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7031 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7032 }
7033
7034 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7035 #endif /* HAVE_LONGLONG */
7036 }
7037
7038 return count;
7039 }
7040
7041 #if !defined(HAVE_LONGLONG)
7042 /****************************************************************************
7043 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7044 ****************************************************************************/
7045
7046 static uint32 map_lock_offset(uint32 high, uint32 low)
7047 {
7048 unsigned int i;
7049 uint32 mask = 0;
7050 uint32 highcopy = high;
7051
7052 /*
7053 * Try and find out how many significant bits there are in high.
7054 */
7055
7056 for(i = 0; highcopy; i++)
7057 highcopy >>= 1;
7058
7059 /*
7060 * We use 31 bits not 32 here as POSIX
7061 * lock offsets may not be negative.
7062 */
7063
7064 mask = (~0) << (31 - i);
7065
7066 if(low & mask)
7067 return 0; /* Fail. */
7068
7069 high <<= (31 - i);
7070
7071 return (high|low);
7072 }
7073 #endif /* !defined(HAVE_LONGLONG) */
7074
7075 /****************************************************************************
7076 Get a lock offset, dealing with large offset requests.
7077 ****************************************************************************/
7078
7079 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7080 bool large_file_format, bool *err)
7081 {
7082 uint64_t offset = 0;
7083
7084 *err = False;
7085
7086 if(!large_file_format) {
7087 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7088 } else {
7089
7090 #if defined(HAVE_LONGLONG)
7091 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7092 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7093 #else /* HAVE_LONGLONG */
7094
7095 /*
7096 * NT4.x seems to be broken in that it sends large file (64 bit)
7097 * lockingX calls even if the CAP_LARGE_FILES was *not*
7098 * negotiated. For boxes without large unsigned ints mangle the
7099 * lock offset by mapping the top 32 bits onto the lower 32.
7100 */
7101
7102 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7103 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7104 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7105 uint32 new_low = 0;
7106
7107 if((new_low = map_lock_offset(high, low)) == 0) {
7108 *err = True;
7109 return (uint64_t)-1;
7110 }
7111
7112 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7113 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7114 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7115 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7116 }
7117
7118 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7119 #endif /* HAVE_LONGLONG */
7120 }
7121
7122 return offset;
7123 }
7124
7125 NTSTATUS smbd_do_locking(struct smb_request *req,
7126 files_struct *fsp,
7127 uint8_t type,
7128 int32_t timeout,
7129 uint16_t num_ulocks,
7130 struct smbd_lock_element *ulocks,
7131 uint16_t num_locks,
7132 struct smbd_lock_element *locks,
7133 bool *async)
7134 {
7135 connection_struct *conn = req->conn;
7136 int i;
7137 NTSTATUS status = NT_STATUS_OK;
7138
7139 *async = false;
7140
7141 /* Data now points at the beginning of the list
7142 of smb_unlkrng structs */
7143 for(i = 0; i < (int)num_ulocks; i++) {
7144 struct smbd_lock_element *e = &ulocks[i];
7145
7146 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7147 "pid %u, file %s\n",
7148 (double)e->offset,
7149 (double)e->count,
7150 (unsigned int)e->smblctx,
7151 fsp_str_dbg(fsp)));
7152
7153 if (e->brltype != UNLOCK_LOCK) {
7154 /* this can only happen with SMB2 */
7155 return NT_STATUS_INVALID_PARAMETER;
7156 }
7157
7158 status = do_unlock(req->sconn->msg_ctx,
7159 fsp,
7160 e->smblctx,
7161 e->count,
7162 e->offset,
7163 WINDOWS_LOCK);
7164
7165 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7166 nt_errstr(status)));
7167
7168 if (!NT_STATUS_IS_OK(status)) {
7169 return status;
7170 }
7171 }
7172
7173 /* Setup the timeout in seconds. */
7174
7175 if (!lp_blocking_locks(SNUM(conn))) {
7176 timeout = 0;
7177 }
7178
7179 /* Data now points at the beginning of the list
7180 of smb_lkrng structs */
7181
7182 for(i = 0; i < (int)num_locks; i++) {
7183 struct smbd_lock_element *e = &locks[i];
7184
7185 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7186 "%llu, file %s timeout = %d\n",
7187 (double)e->offset,
7188 (double)e->count,
7189 (unsigned long long)e->smblctx,
7190 fsp_str_dbg(fsp),
7191 (int)timeout));
7192
7193 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7194 struct blocking_lock_record *blr = NULL;
7195
7196 if (num_locks > 1) {
7197 /*
7198 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7199 * if the lock vector contains one entry. When given mutliple cancel
7200 * requests in a single PDU we expect the server to return an
7201 * error. Windows servers seem to accept the request but only
7202 * cancel the first lock.
7203 * JRA - Do what Windows does (tm) :-).
7204 */
7205
7206 #if 0
7207 /* MS-CIFS (2.2.4.32.1) behavior. */
7208 return NT_STATUS_DOS(ERRDOS,
7209 ERRcancelviolation);
7210 #else
7211 /* Windows behavior. */
7212 if (i != 0) {
7213 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7214 "cancel request\n"));
7215 continue;
7216 }
7217 #endif
7218 }
7219
7220 if (lp_blocking_locks(SNUM(conn))) {
7221
7222 /* Schedule a message to ourselves to
7223 remove the blocking lock record and
7224 return the right error. */
7225
7226 blr = blocking_lock_cancel_smb1(fsp,
7227 e->smblctx,
7228 e->offset,
7229 e->count,
7230 WINDOWS_LOCK,
7231 type,
7232 NT_STATUS_FILE_LOCK_CONFLICT);
7233 if (blr == NULL) {
7234 return NT_STATUS_DOS(
7235 ERRDOS,
7236 ERRcancelviolation);
7237 }
7238 }
7239 /* Remove a matching pending lock. */
7240 status = do_lock_cancel(fsp,
7241 e->smblctx,
7242 e->count,
7243 e->offset,
7244 WINDOWS_LOCK,
7245 blr);
7246 } else {
7247 bool blocking_lock = timeout ? true : false;
7248 bool defer_lock = false;
7249 struct byte_range_lock *br_lck;
7250 uint64_t block_smblctx;
7251
7252 br_lck = do_lock(req->sconn->msg_ctx,
7253 fsp,
7254 e->smblctx,
7255 e->count,
7256 e->offset,
7257 e->brltype,
7258 WINDOWS_LOCK,
7259 blocking_lock,
7260 &status,
7261 &block_smblctx,
7262 NULL);
7263
7264 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7265 /* Windows internal resolution for blocking locks seems
7266 to be about 200ms... Don't wait for less than that. JRA. */
7267 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7268 timeout = lp_lock_spin_time();
7269 }
7270 defer_lock = true;
7271 }
7272
7273 /* If a lock sent with timeout of zero would fail, and
7274 * this lock has been requested multiple times,
7275 * according to brl_lock_failed() we convert this
7276 * request to a blocking lock with a timeout of between
7277 * 150 - 300 milliseconds.
7278 *
7279 * If lp_lock_spin_time() has been set to 0, we skip
7280 * this blocking retry and fail immediately.
7281 *
7282 * Replacement for do_lock_spin(). JRA. */
7283
7284 if (!req->sconn->using_smb2 &&
7285 br_lck && lp_blocking_locks(SNUM(conn)) &&
7286 lp_lock_spin_time() && !blocking_lock &&
7287 NT_STATUS_EQUAL((status),
7288 NT_STATUS_FILE_LOCK_CONFLICT))
7289 {
7290 defer_lock = true;
7291 timeout = lp_lock_spin_time();
7292 }
7293
7294 if (br_lck && defer_lock) {
7295 /*
7296 * A blocking lock was requested. Package up
7297 * this smb into a queued request and push it
7298 * onto the blocking lock queue.
7299 */
7300 if(push_blocking_lock_request(br_lck,
7301 req,
7302 fsp,
7303 timeout,
7304 i,
7305 e->smblctx,
7306 e->brltype,
7307 WINDOWS_LOCK,
7308 e->offset,
7309 e->count,
7310 block_smblctx)) {
7311 TALLOC_FREE(br_lck);
7312 *async = true;
7313 return NT_STATUS_OK;
7314 }
7315 }
7316
7317 TALLOC_FREE(br_lck);
7318 }
7319
7320 if (!NT_STATUS_IS_OK(status)) {
7321 break;
7322 }
7323 }
7324
7325 /* If any of the above locks failed, then we must unlock
7326 all of the previous locks (X/Open spec). */
7327
7328 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7329
7330 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7331 i = -1; /* we want to skip the for loop */
7332 }
7333
7334 /*
7335 * Ensure we don't do a remove on the lock that just failed,
7336 * as under POSIX rules, if we have a lock already there, we
7337 * will delete it (and we shouldn't) .....
7338 */
7339 for(i--; i >= 0; i--) {
7340 struct smbd_lock_element *e = &locks[i];
7341
7342 do_unlock(req->sconn->msg_ctx,
7343 fsp,
7344 e->smblctx,
7345 e->count,
7346 e->offset,
7347 WINDOWS_LOCK);
7348 }
7349 return status;
7350 }
7351
7352 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7353 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7354
7355 return NT_STATUS_OK;
7356 }
7357
7358 /****************************************************************************
7359 Reply to a lockingX request.
7360 ****************************************************************************/
7361
7362 void reply_lockingX(struct smb_request *req)
7363 {
7364 connection_struct *conn = req->conn;
7365 files_struct *fsp;
7366 unsigned char locktype;
7367 unsigned char oplocklevel;
7368 uint16 num_ulocks;
7369 uint16 num_locks;
7370 int32 lock_timeout;
7371 int i;
7372 const uint8_t *data;
7373 bool large_file_format;
7374 bool err;
7375 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7376 struct smbd_lock_element *ulocks;
7377 struct smbd_lock_element *locks;
7378 bool async = false;
7379
7380 START_PROFILE(SMBlockingX);
7381
7382 if (req->wct < 8) {
7383 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7384 END_PROFILE(SMBlockingX);
7385 return;
7386 }
7387
7388 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7389 locktype = CVAL(req->vwv+3, 0);
7390 oplocklevel = CVAL(req->vwv+3, 1);
7391 num_ulocks = SVAL(req->vwv+6, 0);
7392 num_locks = SVAL(req->vwv+7, 0);
7393 lock_timeout = IVAL(req->vwv+4, 0);
7394 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7395
7396 if (!check_fsp(conn, req, fsp)) {
7397 END_PROFILE(SMBlockingX);
7398 return;
7399 }
7400
7401 data = req->buf;
7402
7403 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7404 /* we don't support these - and CANCEL_LOCK makes w2k
7405 and XP reboot so I don't really want to be
7406 compatible! (tridge) */
7407 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7408 END_PROFILE(SMBlockingX);
7409 return;
7410 }
7411
7412 /* Check if this is an oplock break on a file
7413 we have granted an oplock on.
7414 */
7415 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7416 /* Client can insist on breaking to none. */
7417 bool break_to_none = (oplocklevel == 0);
7418 bool result;
7419
7420 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7421 "for fnum = %d\n", (unsigned int)oplocklevel,
7422 fsp->fnum ));
7423
7424 /*
7425 * Make sure we have granted an exclusive or batch oplock on
7426 * this file.
7427 */
7428
7429 if (fsp->oplock_type == 0) {
7430
7431 /* The Samba4 nbench simulator doesn't understand
7432 the difference between break to level2 and break
7433 to none from level2 - it sends oplock break
7434 replies in both cases. Don't keep logging an error
7435 message here - just ignore it. JRA. */
7436
7437 DEBUG(5,("reply_lockingX: Error : oplock break from "
7438 "client for fnum = %d (oplock=%d) and no "
7439 "oplock granted on this file (%s).\n",
7440 fsp->fnum, fsp->oplock_type,
7441 fsp_str_dbg(fsp)));
7442
7443 /* if this is a pure oplock break request then don't
7444 * send a reply */
7445 if (num_locks == 0 && num_ulocks == 0) {
7446 END_PROFILE(SMBlockingX);
7447 return;
7448 } else {
7449 END_PROFILE(SMBlockingX);
7450 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7451 return;
7452 }
7453 }
7454
7455 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7456 (break_to_none)) {
7457 result = remove_oplock(fsp);
7458 } else {
7459 result = downgrade_oplock(fsp);
7460 }
7461
7462 if (!result) {
7463 DEBUG(0, ("reply_lockingX: error in removing "
7464 "oplock on file %s\n", fsp_str_dbg(fsp)));
7465 /* Hmmm. Is this panic justified? */
7466 smb_panic("internal tdb error");
7467 }
7468
7469 reply_to_oplock_break_requests(fsp);
7470
7471 /* if this is a pure oplock break request then don't send a
7472 * reply */
7473 if (num_locks == 0 && num_ulocks == 0) {
7474 /* Sanity check - ensure a pure oplock break is not a
7475 chained request. */
7476 if(CVAL(req->vwv+0, 0) != 0xff)
7477 DEBUG(0,("reply_lockingX: Error : pure oplock "
7478 "break is a chained %d request !\n",
7479 (unsigned int)CVAL(req->vwv+0, 0)));
7480 END_PROFILE(SMBlockingX);
7481 return;
7482 }
7483 }
7484
7485 if (req->buflen <
7486 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7487 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7488 END_PROFILE(SMBlockingX);
7489 return;
7490 }
7491
7492 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7493 if (ulocks == NULL) {
7494 reply_nterror(req, NT_STATUS_NO_MEMORY);
7495 END_PROFILE(SMBlockingX);
7496 return;
7497 }
7498
7499 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7500 if (locks == NULL) {
7501 reply_nterror(req, NT_STATUS_NO_MEMORY);
7502 END_PROFILE(SMBlockingX);
7503 return;
7504 }
7505
7506 /* Data now points at the beginning of the list
7507 of smb_unlkrng structs */
7508 for(i = 0; i < (int)num_ulocks; i++) {
7509 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7510 ulocks[i].count = get_lock_count(data, i, large_file_format);
7511 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7512 ulocks[i].brltype = UNLOCK_LOCK;
7513
7514 /*
7515 * There is no error code marked "stupid client bug".... :-).
7516 */
7517 if(err) {
7518 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7519 END_PROFILE(SMBlockingX);
7520 return;
7521 }
7522 }
7523
7524 /* Now do any requested locks */
7525 data += ((large_file_format ? 20 : 10)*num_ulocks);
7526
7527 /* Data now points at the beginning of the list
7528 of smb_lkrng structs */
7529
7530 for(i = 0; i < (int)num_locks; i++) {
7531 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7532 locks[i].count = get_lock_count(data, i, large_file_format);
7533 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7534
7535 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7536 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7537 locks[i].brltype = PENDING_READ_LOCK;
7538 } else {
7539 locks[i].brltype = READ_LOCK;
7540 }
7541 } else {
7542 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7543 locks[i].brltype = PENDING_WRITE_LOCK;
7544 } else {
7545 locks[i].brltype = WRITE_LOCK;
7546 }
7547 }
7548
7549 /*
7550 * There is no error code marked "stupid client bug".... :-).
7551 */
7552 if(err) {
7553 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7554 END_PROFILE(SMBlockingX);
7555 return;
7556 }
7557 }
7558
7559 status = smbd_do_locking(req, fsp,
7560 locktype, lock_timeout,
7561 num_ulocks, ulocks,
7562 num_locks, locks,
7563 &async);
7564 if (!NT_STATUS_IS_OK(status)) {
7565 END_PROFILE(SMBlockingX);
7566 reply_nterror(req, status);
7567 return;
7568 }
7569 if (async) {
7570 END_PROFILE(SMBlockingX);
7571 return;
7572 }
7573
7574 reply_outbuf(req, 2, 0);
7575
7576 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7577 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7578
7579 END_PROFILE(SMBlockingX);
7580 chain_reply(req);
7581 }
7582
7583 #undef DBGC_CLASS
7584 #define DBGC_CLASS DBGC_ALL
7585
7586 /****************************************************************************
7587 Reply to a SMBreadbmpx (read block multiplex) request.
7588 Always reply with an error, if someone has a platform really needs this,
7589 please contact vl@samba.org
7590 ****************************************************************************/
7591
7592 void reply_readbmpx(struct smb_request *req)
7593 {
7594 START_PROFILE(SMBreadBmpx);
7595 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7596 END_PROFILE(SMBreadBmpx);
7597 return;
7598 }
7599
7600 /****************************************************************************
7601 Reply to a SMBreadbs (read block multiplex secondary) request.
7602 Always reply with an error, if someone has a platform really needs this,
7603 please contact vl@samba.org
7604 ****************************************************************************/
7605
7606 void reply_readbs(struct smb_request *req)
7607 {
7608 START_PROFILE(SMBreadBs);
7609 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7610 END_PROFILE(SMBreadBs);
7611 return;
7612 }
7613
7614 /****************************************************************************
7615 Reply to a SMBsetattrE.
7616 ****************************************************************************/
7617
7618 void reply_setattrE(struct smb_request *req)
7619 {
7620 connection_struct *conn = req->conn;
7621 struct smb_file_time ft;
7622 files_struct *fsp;
7623 NTSTATUS status;
7624
7625 START_PROFILE(SMBsetattrE);
7626 ZERO_STRUCT(ft);
7627
7628 if (req->wct < 7) {
7629 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7630 goto out;
7631 }
7632
7633 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7634
7635 if(!fsp || (fsp->conn != conn)) {
7636 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7637 goto out;
7638 }
7639
7640 /*
7641 * Convert the DOS times into unix times.
7642 */
7643
7644 ft.atime = convert_time_t_to_timespec(
7645 srv_make_unix_date2(req->vwv+3));
7646 ft.mtime = convert_time_t_to_timespec(
7647 srv_make_unix_date2(req->vwv+5));
7648 ft.create_time = convert_time_t_to_timespec(
7649 srv_make_unix_date2(req->vwv+1));
7650
7651 reply_outbuf(req, 0, 0);
7652
7653 /*
7654 * Patch from Ray Frush <frush@engr.colostate.edu>
7655 * Sometimes times are sent as zero - ignore them.
7656 */
7657
7658 /* Ensure we have a valid stat struct for the source. */
7659 status = vfs_stat_fsp(fsp);
7660 if (!NT_STATUS_IS_OK(status)) {
7661 reply_nterror(req, status);
7662 goto out;
7663 }
7664
7665 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7666 if (!NT_STATUS_IS_OK(status)) {
7667 reply_nterror(req, status);
7668 goto out;
7669 }
7670
7671 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7672 " createtime=%u\n",
7673 fsp->fnum,
7674 (unsigned int)ft.atime.tv_sec,
7675 (unsigned int)ft.mtime.tv_sec,
7676 (unsigned int)ft.create_time.tv_sec
7677 ));
7678 out:
7679 END_PROFILE(SMBsetattrE);
7680 return;
7681 }
7682
7683
7684 /* Back from the dead for OS/2..... JRA. */
7685
7686 /****************************************************************************
7687 Reply to a SMBwritebmpx (write block multiplex primary) request.
7688 Always reply with an error, if someone has a platform really needs this,
7689 please contact vl@samba.org
7690 ****************************************************************************/
7691
7692 void reply_writebmpx(struct smb_request *req)
7693 {
7694 START_PROFILE(SMBwriteBmpx);
7695 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7696 END_PROFILE(SMBwriteBmpx);
7697 return;
7698 }
7699
7700 /****************************************************************************
7701 Reply to a SMBwritebs (write block multiplex secondary) request.
7702 Always reply with an error, if someone has a platform really needs this,
7703 please contact vl@samba.org
7704 ****************************************************************************/
7705
7706 void reply_writebs(struct smb_request *req)
7707 {
7708 START_PROFILE(SMBwriteBs);
7709 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7710 END_PROFILE(SMBwriteBs);
7711 return;
7712 }
7713
7714 /****************************************************************************
7715 Reply to a SMBgetattrE.
7716 ****************************************************************************/
7717
7718 void reply_getattrE(struct smb_request *req)
7719 {
7720 connection_struct *conn = req->conn;
7721 int mode;
7722 files_struct *fsp;
7723 struct timespec create_ts;
7724
7725 START_PROFILE(SMBgetattrE);
7726
7727 if (req->wct < 1) {
7728 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7729 END_PROFILE(SMBgetattrE);
7730 return;
7731 }
7732
7733 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7734
7735 if(!fsp || (fsp->conn != conn)) {
7736 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7737 END_PROFILE(SMBgetattrE);
7738 return;
7739 }
7740
7741 /* Do an fstat on this file */
7742 if(fsp_stat(fsp)) {
7743 reply_nterror(req, map_nt_error_from_unix(errno));
7744 END_PROFILE(SMBgetattrE);
7745 return;
7746 }
7747
7748 mode = dos_mode(conn, fsp->fsp_name);
7749
7750 /*
7751 * Convert the times into dos times. Set create
7752 * date to be last modify date as UNIX doesn't save
7753 * this.
7754 */
7755
7756 reply_outbuf(req, 11, 0);
7757
7758 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7759 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7760 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7761 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7762 /* Should we check pending modtime here ? JRA */
7763 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7764 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7765
7766 if (mode & aDIR) {
7767 SIVAL(req->outbuf, smb_vwv6, 0);
7768 SIVAL(req->outbuf, smb_vwv8, 0);
7769 } else {
7770 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7771 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7772 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7773 }
7774 SSVAL(req->outbuf,smb_vwv10, mode);
7775
7776 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7777
7778 END_PROFILE(SMBgetattrE);
7779 return;
7780 }
Anubhav's Work In Progress branches