Context Navigation

source: branches/samba-3.0/source/smbd/nttrans.c

Visit:

Last change on this file was 159, checked in by Paul Smedley, 17 years ago
Update source to 3.0.33
File size: 90.7 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-1998
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 2 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program; if not, write to the Free Software
19	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20	*/
21
22	#include "includes.h"
23
24	extern int max_send;
25	extern enum protocol_types Protocol;
26	extern int smb_read_error;
27	extern struct current_user current_user;
28
29	static const char *known_nt_pipes[] = {
30	"\\LANMAN",
31	"\\srvsvc",
32	"\\samr",
33	"\\wkssvc",
34	"\\NETLOGON",
35	"\\ntlsa",
36	"\\ntsvcs",
37	"\\lsass",
38	"\\lsarpc",
39	"\\winreg",
40	"\\initshutdown",
41	"\\spoolss",
42	"\\netdfs",
43	"\\rpcecho",
44	"\\svcctl",
45	"\\eventlog",
46	"\\unixinfo",
47	NULL
48	};
49
50	static char nttrans_realloc(char *ptr, size_t size)
51	{
52	if (ptr==NULL) {
53	smb_panic("nttrans_realloc() called with NULL ptr\n");
54	}
55
56	ptr = (char )SMB_REALLOC(*ptr, size);
57	if(*ptr == NULL) {
58	return NULL;
59	}
60	memset(*ptr,'\0',size);
61	return *ptr;
62	}
63
64	/****************************************************************************
65	Send the required number of replies back.
66	We assume all fields other than the data fields are
67	set correctly for the type of call.
68	HACK ! Always assumes smb_setup field is zero.
69	****************************************************************************/
70
71	int send_nt_replies(char *outbuf, int bufsize, NTSTATUS nt_error,
72	char params, int paramsize, char pdata, int datasize)
73	{
74	int data_to_send = datasize;
75	int params_to_send = paramsize;
76	int useable_space;
77	char *pp = params;
78	char *pd = pdata;
79	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80	int alignment_offset = 3;
81	int data_alignment_offset = 0;
82
83	/*
84	* Initially set the wcnt area to be 18 - this is true for all
85	* transNT replies.
86	*/
87
88	set_message(outbuf,18,0,True);
89
90	if (NT_STATUS_V(nt_error)) {
91	ERROR_NT(nt_error);
92	}
93
94	/*
95	* If there genuinely are no parameters or data to send just send
96	* the empty packet.
97	*/
98
99	if(params_to_send == 0 && data_to_send == 0) {
100	show_msg(outbuf);
101	if (!send_smb(smbd_server_fd(),outbuf)) {
102	exit_server_cleanly("send_nt_replies: send_smb failed.");
103	}
104	return 0;
105	}
106
107	/*
108	* When sending params and data ensure that both are nicely aligned.
109	* Only do this alignment when there is also data to send - else
110	* can cause NT redirector problems.
111	*/
112
113	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
114	data_alignment_offset = 4 - (params_to_send % 4);
115	}
116
117	/*
118	* Space is bufsize minus Netbios over TCP header minus SMB header.
119	* The alignment_offset is to align the param bytes on a four byte
120	* boundary (2 bytes for data len, one byte pad).
121	* NT needs this to work correctly.
122	*/
123
124	useable_space = bufsize - ((smb_buf(outbuf)+
125	alignment_offset+data_alignment_offset) -
126	outbuf);
127
128	/*
129	* useable_space can never be more than max_send minus the
130	* alignment offset.
131	*/
132
133	useable_space = MIN(useable_space,
134	max_send - (alignment_offset+data_alignment_offset));
135
136
137	while (params_to_send \|\| data_to_send) {
138
139	/*
140	* Calculate whether we will totally or partially fill this packet.
141	*/
142
143	total_sent_thistime = params_to_send + data_to_send +
144	alignment_offset + data_alignment_offset;
145
146	/*
147	* We can never send more than useable_space.
148	*/
149
150	total_sent_thistime = MIN(total_sent_thistime, useable_space);
151
152	set_message(outbuf, 18, total_sent_thistime, True);
153
154	/*
155	* Set total params and data to be sent.
156	*/
157
158	SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
159	SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
160
161	/*
162	* Calculate how many parameters and data we can fit into
163	* this packet. Parameters get precedence.
164	*/
165
166	params_sent_thistime = MIN(params_to_send,useable_space);
167	data_sent_thistime = useable_space - params_sent_thistime;
168	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
169
170	SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
171
172	if(params_sent_thistime == 0) {
173	SIVAL(outbuf,smb_ntr_ParameterOffset,0);
174	SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
175	} else {
176	/*
177	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
178	* parameter bytes, however the first 4 bytes of outbuf are
179	* the Netbios over TCP header. Thus use smb_base() to subtract
180	* them from the calculation.
181	*/
182
183	SIVAL(outbuf,smb_ntr_ParameterOffset,
184	((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
185	/*
186	* Absolute displacement of param bytes sent in this packet.
187	*/
188
189	SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
190	}
191
192	/*
193	* Deal with the data portion.
194	*/
195
196	SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
197
198	if(data_sent_thistime == 0) {
199	SIVAL(outbuf,smb_ntr_DataOffset,0);
200	SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
201	} else {
202	/*
203	* The offset of the data bytes is the offset of the
204	* parameter bytes plus the number of parameters being sent this time.
205	*/
206
207	SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
208	smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
209	SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
210	}
211
212	/*
213	* Copy the param bytes into the packet.
214	*/
215
216	if(params_sent_thistime) {
217	memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
218	}
219
220	/*
221	* Copy in the data bytes
222	*/
223
224	if(data_sent_thistime) {
225	memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
226	data_alignment_offset,pd,data_sent_thistime);
227	}
228
229	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
230	params_sent_thistime, data_sent_thistime, useable_space));
231	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
232	params_to_send, data_to_send, paramsize, datasize));
233
234	/* Send the packet */
235	show_msg(outbuf);
236	if (!send_smb(smbd_server_fd(),outbuf)) {
237	exit_server_cleanly("send_nt_replies: send_smb failed.");
238	}
239
240	pp += params_sent_thistime;
241	pd += data_sent_thistime;
242
243	params_to_send -= params_sent_thistime;
244	data_to_send -= data_sent_thistime;
245
246	/*
247	* Sanity check
248	*/
249
250	if(params_to_send < 0 \|\| data_to_send < 0) {
251	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
252	params_to_send, data_to_send));
253	return -1;
254	}
255	}
256
257	return 0;
258	}
259
260	/****************************************************************************
261	Is it an NTFS stream name ?
262	****************************************************************************/
263
264	BOOL is_ntfs_stream_name(const char *fname)
265	{
266	if (lp_posix_pathnames()) {
267	return False;
268	}
269	return (strchr_m(fname, ':') != NULL) ? True : False;
270	}
271
272	/****************************************************************************
273	Save case statics.
274	****************************************************************************/
275
276	static BOOL saved_case_sensitive;
277	static BOOL saved_case_preserve;
278	static BOOL saved_short_case_preserve;
279
280	/****************************************************************************
281	Save case semantics.
282	****************************************************************************/
283
284	static uint32 set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
285	{
286	if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
287	return file_attributes;
288	}
289
290	saved_case_sensitive = conn->case_sensitive;
291	saved_case_preserve = conn->case_preserve;
292	saved_short_case_preserve = conn->short_case_preserve;
293
294	/* Set to POSIX. */
295	conn->case_sensitive = True;
296	conn->case_preserve = True;
297	conn->short_case_preserve = True;
298
299	return (file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
300	}
301
302	/****************************************************************************
303	Restore case semantics.
304	****************************************************************************/
305
306	static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
307	{
308	if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
309	return;
310	}
311
312	conn->case_sensitive = saved_case_sensitive;
313	conn->case_preserve = saved_case_preserve;
314	conn->short_case_preserve = saved_short_case_preserve;
315	}
316
317	/****************************************************************************
318	Reply to an NT create and X call on a pipe.
319	****************************************************************************/
320
321	static int nt_open_pipe(char fname, connection_struct conn,
322	char inbuf, char outbuf, int *ppnum)
323	{
324	smb_np_struct *p = NULL;
325	uint16 vuid = SVAL(inbuf, smb_uid);
326	int i;
327
328	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
329
330	/* See if it is one we want to handle. */
331
332	if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
333	return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
334	}
335
336	for( i = 0; known_nt_pipes[i]; i++ ) {
337	if( strequal(fname,known_nt_pipes[i])) {
338	break;
339	}
340	}
341
342	if ( known_nt_pipes[i] == NULL ) {
343	return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
344	}
345
346	/* Strip \\ off the name. */
347	fname++;
348
349	DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
350
351	p = open_rpc_pipe_p(fname, conn, vuid);
352	if (!p) {
353	return(ERROR_DOS(ERRSRV,ERRnofids));
354	}
355
356	/* Add pipe to db */
357
358	if ( !store_pipe_opendb( p ) ) {
359	DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
360	}
361
362	*ppnum = p->pnum;
363	return 0;
364	}
365
366	/****************************************************************************
367	Reply to an NT create and X call for pipes.
368	****************************************************************************/
369
370	static int do_ntcreate_pipe_open(connection_struct *conn,
371	char inbuf,char outbuf,int length,int bufsize)
372	{
373	pstring fname;
374	int ret;
375	int pnum = -1;
376	char *p = NULL;
377	uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
378
379	srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
380
381	if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
382	return ret;
383	}
384
385	/*
386	* Deal with pipe return.
387	*/
388
389	if (flags & EXTENDED_RESPONSE_REQUIRED) {
390	/* This is very strange. We
391	* return 50 words, but only set
392	* the wcnt to 42 ? It's definately
393	* what happens on the wire....
394	*/
395	set_message(outbuf,50,0,True);
396	SCVAL(outbuf,smb_wct,42);
397	} else {
398	set_message(outbuf,34,0,True);
399	}
400
401	p = outbuf + smb_vwv2;
402	p++;
403	SSVAL(p,0,pnum);
404	p += 2;
405	SIVAL(p,0,FILE_WAS_OPENED);
406	p += 4;
407	p += 32;
408	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
409	p += 20;
410	/* File type. */
411	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
412	/* Device state. */
413	SSVAL(p,2, 0x5FF); /* ? */
414	p += 4;
415
416	if (flags & EXTENDED_RESPONSE_REQUIRED) {
417	p += 25;
418	SIVAL(p,0,FILE_GENERIC_ALL);
419	/*
420	* For pipes W2K3 seems to return
421	* 0x12019B next.
422	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
423	*/
424	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
425	}
426
427	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
428
429	return chain_reply(inbuf,outbuf,length,bufsize);
430	}
431
432	/****************************************************************************
433	Reply to an NT create and X call for a quota file.
434	****************************************************************************/
435
436	int reply_ntcreate_and_X_quota(connection_struct *conn,
437	char *inbuf,
438	char *outbuf,
439	int length,
440	int bufsize,
441	enum FAKE_FILE_TYPE fake_file_type,
442	const char *fname)
443	{
444	int result;
445	char *p;
446	uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
447	files_struct *fsp;
448	NTSTATUS status;
449
450	status = open_fake_file(conn, fake_file_type, fname, desired_access,
451	&fsp);
452
453	if (!NT_STATUS_IS_OK(status)) {
454	return ERROR_NT(status);
455	}
456
457	set_message(outbuf,34,0,True);
458
459	p = outbuf + smb_vwv2;
460
461	/* SCVAL(p,0,NO_OPLOCK_RETURN); */
462	p++;
463	SSVAL(p,0,fsp->fnum);
464
465	DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
466
467	result = chain_reply(inbuf,outbuf,length,bufsize);
468	return result;
469	}
470
471	/****************************************************************************
472	Reply to an NT create and X call.
473	****************************************************************************/
474
475	int reply_ntcreate_and_X(connection_struct *conn,
476	char inbuf,char outbuf,int length,int bufsize)
477	{
478	int result;
479	pstring fname;
480	uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
481	uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
482	uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
483	uint32 new_file_attributes;
484	uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
485	uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
486	uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
487	uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
488	/* Breakout the oplock request bits so we can set the
489	reply bits separately. */
490	int oplock_request = 0;
491	uint32 fattr=0;
492	SMB_OFF_T file_len = 0;
493	SMB_STRUCT_STAT sbuf;
494	int info = 0;
495	files_struct *fsp = NULL;
496	char *p = NULL;
497	struct timespec c_timespec;
498	struct timespec a_timespec;
499	struct timespec m_timespec;
500	BOOL extended_oplock_granted = False;
501	NTSTATUS status;
502
503	START_PROFILE(SMBntcreateX);
504
505	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
506	"file_attributes = 0x%x, share_access = 0x%x, "
507	"create_disposition = 0x%x create_options = 0x%x "
508	"root_dir_fid = 0x%x\n",
509	(unsigned int)flags,
510	(unsigned int)access_mask,
511	(unsigned int)file_attributes,
512	(unsigned int)share_access,
513	(unsigned int)create_disposition,
514	(unsigned int)create_options,
515	(unsigned int)root_dir_fid ));
516
517	/*
518	* If it's an IPC, use the pipe handler.
519	*/
520
521	if (IS_IPC(conn)) {
522	if (lp_nt_pipe_support()) {
523	END_PROFILE(SMBntcreateX);
524	return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
525	} else {
526	END_PROFILE(SMBntcreateX);
527	return(ERROR_DOS(ERRDOS,ERRnoaccess));
528	}
529	}
530
531	if (create_options & FILE_OPEN_BY_FILE_ID) {
532	END_PROFILE(SMBntcreateX);
533	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
534	}
535
536	/*
537	* Get the file name.
538	*/
539
540	if(root_dir_fid != 0) {
541	/*
542	* This filename is relative to a directory fid.
543	*/
544	pstring rel_fname;
545	files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
546
547	if(!dir_fsp) {
548	END_PROFILE(SMBntcreateX);
549	return ERROR_DOS(ERRDOS,ERRbadfid);
550	}
551
552	if(!dir_fsp->is_directory) {
553
554	srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
555	if (!NT_STATUS_IS_OK(status)) {
556	END_PROFILE(SMBntcreateX);
557	return ERROR_NT(status);
558	}
559
560	/*
561	* Check to see if this is a mac fork of some kind.
562	*/
563
564	if( is_ntfs_stream_name(fname)) {
565	END_PROFILE(SMBntcreateX);
566	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
567	}
568
569	/*
570	we need to handle the case when we get a
571	relative open relative to a file and the
572	pathname is blank - this is a reopen!
573	(hint from demyn plantenberg)
574	*/
575
576	END_PROFILE(SMBntcreateX);
577	return(ERROR_DOS(ERRDOS,ERRbadfid));
578	}
579
580	/*
581	* Copy in the base directory name.
582	*/
583
584	pstrcpy( fname, dir_fsp->fsp_name );
585
586	if (ISDOT(fname)) {
587	fname[0] = '\0';
588	} else {
589	size_t dir_name_len = strlen(fname);
590	/*
591	* Ensure it ends in a '\'.
592	*/
593
594	if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
595	pstrcat(fname, "/");
596	}
597	}
598
599	srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
600	if (!NT_STATUS_IS_OK(status)) {
601	END_PROFILE(SMBntcreateX);
602	return ERROR_NT(status);
603	}
604	pstrcat(fname, rel_fname);
605	} else {
606	srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
607	if (!NT_STATUS_IS_OK(status)) {
608	END_PROFILE(SMBntcreateX);
609	return ERROR_NT(status);
610	}
611
612	/*
613	* Check to see if this is a mac fork of some kind.
614	*/
615
616	if( is_ntfs_stream_name(fname)) {
617	enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
618	if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
619	/*
620	* Here we go! support for changing the disk quotas --metze
621	*
622	* We need to fake up to open this MAGIC QUOTA file
623	* and return a valid FID.
624	*
625	* w2k close this file directly after openening
626	* xp also tries a QUERY_FILE_INFO on the file and then close it
627	*/
628	result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
629	fake_file_type, fname);
630	END_PROFILE(SMBntcreateX);
631	return result;
632	} else {
633	END_PROFILE(SMBntcreateX);
634	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
635	}
636	}
637	}
638
639	/*
640	* Now contruct the smb_open_mode value from the filename,
641	* desired access and the share access.
642	*/
643	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
644	if (!NT_STATUS_IS_OK(status)) {
645	END_PROFILE(SMBntcreateX);
646	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
647	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
648	}
649	return ERROR_NT(status);
650	}
651
652	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
653	if (oplock_request) {
654	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
655	}
656
657	/*
658	* Ordinary file or directory.
659	*/
660
661	/*
662	* Check if POSIX semantics are wanted.
663	*/
664
665	new_file_attributes = set_posix_case_semantics(conn, file_attributes);
666
667	status = unix_convert(conn, fname, False, NULL, &sbuf);
668	if (!NT_STATUS_IS_OK(status)) {
669	restore_case_semantics(conn, file_attributes);
670	END_PROFILE(SMBntcreateX);
671	return ERROR_NT(status);
672	}
673	/* All file access must go through check_name() */
674	status = check_name(conn, fname);
675	if (!NT_STATUS_IS_OK(status)) {
676	restore_case_semantics(conn, file_attributes);
677	END_PROFILE(SMBntcreateX);
678	return ERROR_NT(status);
679	}
680
681	/* This is the correct thing to do (check every time) but can_delete is
682	expensive (it may have to read the parent directory permissions). So
683	for now we're not doing it unless we have a strong hint the client
684	is really going to delete this file. If the client is forcing FILE_CREATE
685	let the filesystem take care of the permissions. */
686
687	/* Setting FILE_SHARE_DELETE is the hint. */
688
689	if (lp_acl_check_permissions(SNUM(conn))
690	&& (create_disposition != FILE_CREATE)
691	&& (share_access & FILE_SHARE_DELETE)
692	&& (access_mask & DELETE_ACCESS)) {
693	if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) \|\|
694	!can_delete_file_in_directory(conn, fname)) {
695	restore_case_semantics(conn, file_attributes);
696	END_PROFILE(SMBntcreateX);
697	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
698	}
699	}
700
701	/*
702	* If it's a request for a directory open, deal with it separately.
703	*/
704
705	if(create_options & FILE_DIRECTORY_FILE) {
706
707	/* Can't open a temp directory. IFS kit test. */
708	if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
709	END_PROFILE(SMBntcreateX);
710	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
711	}
712
713	oplock_request = 0;
714	status = open_directory(conn, fname, &sbuf,
715	access_mask,
716	share_access,
717	create_disposition,
718	create_options,
719	new_file_attributes,
720	&info, &fsp);
721	} else {
722
723	/*
724	* Ordinary file case.
725	*/
726
727	/* NB. We have a potential bug here. If we
728	* cause an oplock break to ourselves, then we
729	* could end up processing filename related
730	* SMB requests whilst we await the oplock
731	* break response. As we may have changed the
732	* filename case semantics to be POSIX-like,
733	* this could mean a filename request could
734	* fail when it should succeed. This is a rare
735	* condition, but eventually we must arrange
736	* to restore the correct case semantics
737	* before issuing an oplock break request to
738	* our client. JRA. */
739
740	status = open_file_ntcreate(conn,fname,&sbuf,
741	access_mask,
742	share_access,
743	create_disposition,
744	create_options,
745	new_file_attributes,
746	oplock_request,
747	&info, &fsp);
748
749	if (!NT_STATUS_IS_OK(status)) {
750	/* We cheat here. There are two cases we
751	* care about. One is a directory rename,
752	* where the NT client will attempt to
753	* open the source directory for
754	* DELETE access. Note that when the
755	* NT client does this it does not
756	* set the directory bit in the
757	* request packet. This is translated
758	* into a read/write open
759	* request. POSIX states that any open
760	* for write request on a directory
761	* will generate an EISDIR error, so
762	* we can catch this here and open a
763	* pseudo handle that is flagged as a
764	* directory. The second is an open
765	* for a permissions read only, which
766	* we handle in the open_file_stat case. JRA.
767	*/
768
769	if (NT_STATUS_EQUAL(status,
770	NT_STATUS_FILE_IS_A_DIRECTORY)) {
771
772	/*
773	* Fail the open if it was explicitly a non-directory file.
774	*/
775
776	if (create_options & FILE_NON_DIRECTORY_FILE) {
777	restore_case_semantics(conn, file_attributes);
778	END_PROFILE(SMBntcreateX);
779	return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
780	}
781
782	oplock_request = 0;
783	status = open_directory(conn, fname, &sbuf,
784	access_mask,
785	share_access,
786	create_disposition,
787	create_options,
788	new_file_attributes,
789	&info, &fsp);
790
791	}
792	}
793	}
794
795	restore_case_semantics(conn, file_attributes);
796
797	if(!NT_STATUS_IS_OK(status)) {
798	END_PROFILE(SMBntcreateX);
799
800	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
801	/* We have re-scheduled this call. */
802	return -1;
803	}
804
805	return ERROR_OPEN(status);
806	}
807
808	file_len = sbuf.st_size;
809	fattr = dos_mode(conn,fname,&sbuf);
810	if(fattr == 0) {
811	fattr = FILE_ATTRIBUTE_NORMAL;
812	}
813	if (!fsp->is_directory && (fattr & aDIR)) {
814	close_file(fsp,ERROR_CLOSE);
815	END_PROFILE(SMBntcreateX);
816	return ERROR_DOS(ERRDOS,ERRnoaccess);
817	}
818
819	/* Save the requested allocation size. */
820	if ((info == FILE_WAS_CREATED) \|\| (info == FILE_WAS_OVERWRITTEN)) {
821	SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
822	#ifdef LARGE_SMB_OFF_T
823	allocation_size \|= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
824	#endif
825	if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
826	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
827	if (fsp->is_directory) {
828	close_file(fsp,ERROR_CLOSE);
829	END_PROFILE(SMBntcreateX);
830	/* Can't set allocation size on a directory. */
831	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
832	}
833	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
834	close_file(fsp,ERROR_CLOSE);
835	END_PROFILE(SMBntcreateX);
836	return ERROR_NT(NT_STATUS_DISK_FULL);
837	}
838	} else {
839	fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
840	}
841	}
842
843	/*
844	* If the caller set the extended oplock request bit
845	* and we granted one (by whatever means) - set the
846	* correct bit for extended oplock reply.
847	*/
848
849	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
850	extended_oplock_granted = True;
851	}
852
853	if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
854	extended_oplock_granted = True;
855	}
856
857	if (flags & EXTENDED_RESPONSE_REQUIRED) {
858	/* This is very strange. We
859	* return 50 words, but only set
860	* the wcnt to 42 ? It's definately
861	* what happens on the wire....
862	*/
863	set_message(outbuf,50,0,True);
864	SCVAL(outbuf,smb_wct,42);
865	} else {
866	set_message(outbuf,34,0,True);
867	}
868
869	p = outbuf + smb_vwv2;
870
871	/*
872	* Currently as we don't support level II oplocks we just report
873	* exclusive & batch here.
874	*/
875
876	if (extended_oplock_granted) {
877	if (flags & REQUEST_BATCH_OPLOCK) {
878	SCVAL(p,0, BATCH_OPLOCK_RETURN);
879	} else {
880	SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
881	}
882	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
883	SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
884	} else {
885	SCVAL(p,0,NO_OPLOCK_RETURN);
886	}
887
888	p++;
889	SSVAL(p,0,fsp->fnum);
890	p += 2;
891	if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
892	SIVAL(p,0,FILE_WAS_SUPERSEDED);
893	} else {
894	SIVAL(p,0,info);
895	}
896	p += 4;
897
898	/* Create time. */
899	c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
900	a_timespec = get_atimespec(&sbuf);
901	m_timespec = get_mtimespec(&sbuf);
902
903	if (lp_dos_filetime_resolution(SNUM(conn))) {
904	dos_filetime_timespec(&c_timespec);
905	dos_filetime_timespec(&a_timespec);
906	dos_filetime_timespec(&m_timespec);
907	}
908
909	put_long_date_timespec(p, c_timespec); /* create time. */
910	p += 8;
911	put_long_date_timespec(p, a_timespec); /* access time */
912	p += 8;
913	put_long_date_timespec(p, m_timespec); /* write time */
914	p += 8;
915	put_long_date_timespec(p, m_timespec); /* change time */
916	p += 8;
917	SIVAL(p,0,fattr); /* File Attributes. */
918	p += 4;
919	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
920	p += 8;
921	SOFF_T(p,0,file_len);
922	p += 8;
923	if (flags & EXTENDED_RESPONSE_REQUIRED) {
924	SSVAL(p,2,0x7);
925	}
926	p += 4;
927	SCVAL(p,0,fsp->is_directory ? 1 : 0);
928
929	if (flags & EXTENDED_RESPONSE_REQUIRED) {
930	uint32 perms = 0;
931	p += 25;
932	if (fsp->is_directory \|\| can_write_to_file(conn, fname, &sbuf)) {
933	perms = FILE_GENERIC_ALL;
934	} else {
935	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
936	}
937	SIVAL(p,0,perms);
938	}
939
940	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
941
942	result = chain_reply(inbuf,outbuf,length,bufsize);
943	END_PROFILE(SMBntcreateX);
944	return result;
945	}
946
947	/****************************************************************************
948	Reply to a NT_TRANSACT_CREATE call to open a pipe.
949	****************************************************************************/
950
951	static int do_nt_transact_create_pipe( connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
952	uint16 **ppsetup, uint32 setup_count,
953	char **ppparams, uint32 parameter_count,
954	char **ppdata, uint32 data_count)
955	{
956	pstring fname;
957	char params = ppparams;
958	int ret;
959	int pnum = -1;
960	char *p = NULL;
961	NTSTATUS status;
962	size_t param_len;
963	uint32 flags;
964
965	/*
966	* Ensure minimum number of parameters sent.
967	*/
968
969	if(parameter_count < 54) {
970	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
971	return ERROR_DOS(ERRDOS,ERRnoaccess);
972	}
973
974	flags = IVAL(params,0);
975
976	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
977	if (!NT_STATUS_IS_OK(status)) {
978	return ERROR_NT(status);
979	}
980
981	if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
982	return ret;
983	}
984
985	/* Realloc the size of parameters and data we will return */
986	if (flags & EXTENDED_RESPONSE_REQUIRED) {
987	/* Extended response is 32 more byyes. */
988	param_len = 101;
989	} else {
990	param_len = 69;
991	}
992	params = nttrans_realloc(ppparams, param_len);
993	if(params == NULL) {
994	return ERROR_DOS(ERRDOS,ERRnomem);
995	}
996
997	p = params;
998	SCVAL(p,0,NO_OPLOCK_RETURN);
999
1000	p += 2;
1001	SSVAL(p,0,pnum);
1002	p += 2;
1003	SIVAL(p,0,FILE_WAS_OPENED);
1004	p += 8;
1005
1006	p += 32;
1007	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1008	p += 20;
1009	/* File type. */
1010	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1011	/* Device state. */
1012	SSVAL(p,2, 0x5FF); /* ? */
1013	p += 4;
1014
1015	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1016	p += 25;
1017	SIVAL(p,0,FILE_GENERIC_ALL);
1018	/*
1019	* For pipes W2K3 seems to return
1020	* 0x12019B next.
1021	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
1022	*/
1023	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
1024	}
1025
1026	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1027
1028	/* Send the required number of replies */
1029	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
1030
1031	return -1;
1032	}
1033
1034	/****************************************************************************
1035	Internal fn to set security descriptors.
1036	****************************************************************************/
1037
1038	static NTSTATUS set_sd(files_struct fsp, char data, uint32 sd_len, uint32 security_info_sent)
1039	{
1040	prs_struct pd;
1041	SEC_DESC *psd = NULL;
1042	TALLOC_CTX *mem_ctx;
1043	BOOL ret;
1044
1045	if (sd_len == 0 \|\| !lp_nt_acl_support(SNUM(fsp->conn))) {
1046	return NT_STATUS_OK;
1047	}
1048
1049	/*
1050	* Init the parse struct we will unmarshall from.
1051	*/
1052
1053	if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1054	DEBUG(0,("set_sd: talloc_init failed.\n"));
1055	return NT_STATUS_NO_MEMORY;
1056	}
1057
1058	prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1059
1060	/*
1061	* Setup the prs_struct to point at the memory we just
1062	* allocated.
1063	*/
1064
1065	prs_give_memory( &pd, data, sd_len, False);
1066
1067	/*
1068	* Finally, unmarshall from the data buffer.
1069	*/
1070
1071	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1072	DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1073	/*
1074	* Return access denied for want of a better error message..
1075	*/
1076	talloc_destroy(mem_ctx);
1077	return NT_STATUS_NO_MEMORY;
1078	}
1079
1080	if (psd->owner_sid==0) {
1081	security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1082	}
1083	if (psd->group_sid==0) {
1084	security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1085	}
1086	if (psd->sacl==0) {
1087	security_info_sent &= ~SACL_SECURITY_INFORMATION;
1088	}
1089	if (psd->dacl==0) {
1090	security_info_sent &= ~DACL_SECURITY_INFORMATION;
1091	}
1092
1093	ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1094
1095	if (!ret) {
1096	talloc_destroy(mem_ctx);
1097	return NT_STATUS_ACCESS_DENIED;
1098	}
1099
1100	talloc_destroy(mem_ctx);
1101
1102	return NT_STATUS_OK;
1103	}
1104
1105	/****************************************************************************
1106	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1107	****************************************************************************/
1108
1109	static struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
1110	{
1111	struct ea_list *ea_list_head = NULL;
1112	size_t offset = 0;
1113
1114	if (data_size < 4) {
1115	return NULL;
1116	}
1117
1118	while (offset + 4 <= data_size) {
1119	size_t next_offset = IVAL(pdata,offset);
1120	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1121
1122	if (!eal) {
1123	return NULL;
1124	}
1125
1126	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1127	if (next_offset == 0) {
1128	break;
1129	}
1130	offset += next_offset;
1131	}
1132
1133	return ea_list_head;
1134	}
1135
1136	/****************************************************************************
1137	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1138	****************************************************************************/
1139
1140	static int call_nt_transact_create(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1141	uint16 **ppsetup, uint32 setup_count,
1142	char **ppparams, uint32 parameter_count,
1143	char **ppdata, uint32 data_count, uint32 max_data_count)
1144	{
1145	pstring fname;
1146	char params = ppparams;
1147	char data = ppdata;
1148	/* Breakout the oplock request bits so we can set the reply bits separately. */
1149	int oplock_request = 0;
1150	uint32 fattr=0;
1151	SMB_OFF_T file_len = 0;
1152	SMB_STRUCT_STAT sbuf;
1153	int info = 0;
1154	files_struct *fsp = NULL;
1155	char *p = NULL;
1156	BOOL extended_oplock_granted = False;
1157	uint32 flags;
1158	uint32 access_mask;
1159	uint32 file_attributes;
1160	uint32 new_file_attributes;
1161	uint32 share_access;
1162	uint32 create_disposition;
1163	uint32 create_options;
1164	uint32 sd_len;
1165	uint32 ea_len;
1166	uint16 root_dir_fid;
1167	struct timespec c_timespec;
1168	struct timespec a_timespec;
1169	struct timespec m_timespec;
1170	struct ea_list *ea_list = NULL;
1171	TALLOC_CTX *ctx = NULL;
1172	char *pdata = NULL;
1173	NTSTATUS status;
1174	size_t param_len;
1175
1176	DEBUG(5,("call_nt_transact_create\n"));
1177
1178	/*
1179	* If it's an IPC, use the pipe handler.
1180	*/
1181
1182	if (IS_IPC(conn)) {
1183	if (lp_nt_pipe_support()) {
1184	return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1185	bufsize,
1186	ppsetup, setup_count,
1187	ppparams, parameter_count,
1188	ppdata, data_count);
1189	} else {
1190	return ERROR_DOS(ERRDOS,ERRnoaccess);
1191	}
1192	}
1193
1194	/*
1195	* Ensure minimum number of parameters sent.
1196	*/
1197
1198	if(parameter_count < 54) {
1199	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1200	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1201	}
1202
1203	flags = IVAL(params,0);
1204	access_mask = IVAL(params,8);
1205	file_attributes = IVAL(params,20);
1206	share_access = IVAL(params,24);
1207	create_disposition = IVAL(params,28);
1208	create_options = IVAL(params,32);
1209	sd_len = IVAL(params,36);
1210	ea_len = IVAL(params,40);
1211	root_dir_fid = (uint16)IVAL(params,4);
1212
1213	/* Ensure the data_len is correct for the sd and ea values given. */
1214	if ((ea_len + sd_len > data_count) \|\|
1215	(ea_len > data_count) \|\| (sd_len > data_count) \|\|
1216	(ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
1217	DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1218	(unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1219	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1220	}
1221
1222	if (ea_len) {
1223	if (!lp_ea_support(SNUM(conn))) {
1224	DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1225	(unsigned int)ea_len ));
1226	return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1227	}
1228
1229	if (ea_len < 10) {
1230	DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1231	(unsigned int)ea_len ));
1232	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1233	}
1234	}
1235
1236	if (create_options & FILE_OPEN_BY_FILE_ID) {
1237	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1238	}
1239
1240	/*
1241	* Get the file name.
1242	*/
1243
1244	if(root_dir_fid != 0) {
1245	/*
1246	* This filename is relative to a directory fid.
1247	*/
1248	files_struct *dir_fsp = file_fsp(params,4);
1249
1250	if(!dir_fsp) {
1251	return ERROR_DOS(ERRDOS,ERRbadfid);
1252	}
1253
1254	if(!dir_fsp->is_directory) {
1255	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1256	if (!NT_STATUS_IS_OK(status)) {
1257	return ERROR_NT(status);
1258	}
1259
1260	/*
1261	* Check to see if this is a mac fork of some kind.
1262	*/
1263
1264	if( is_ntfs_stream_name(fname)) {
1265	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1266	}
1267
1268	return ERROR_DOS(ERRDOS,ERRbadfid);
1269	}
1270
1271	/*
1272	* Copy in the base directory name.
1273	*/
1274
1275	pstrcpy( fname, dir_fsp->fsp_name );
1276
1277	if (ISDOT(fname)) {
1278	fname[0] = '\0';
1279	} else {
1280	size_t dir_name_len = strlen(fname);
1281	/*
1282	* Ensure it ends in a '\'.
1283	*/
1284
1285	if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1286	pstrcat(fname, "/");
1287	}
1288	}
1289
1290	{
1291	pstring tmpname;
1292	srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1293	if (!NT_STATUS_IS_OK(status)) {
1294	return ERROR_NT(status);
1295	}
1296	pstrcat(fname, tmpname);
1297	}
1298	} else {
1299	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1300	if (!NT_STATUS_IS_OK(status)) {
1301	return ERROR_NT(status);
1302	}
1303
1304	/*
1305	* Check to see if this is a mac fork of some kind.
1306	*/
1307
1308	if( is_ntfs_stream_name(fname)) {
1309	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1310	}
1311	}
1312
1313	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1314	if (oplock_request) {
1315	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1316	}
1317
1318	/*
1319	* Ordinary file or directory.
1320	*/
1321
1322	/*
1323	* Check if POSIX semantics are wanted.
1324	*/
1325
1326	new_file_attributes = set_posix_case_semantics(conn, file_attributes);
1327
1328	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1329	if (!NT_STATUS_IS_OK(status)) {
1330	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1331	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1332	}
1333	return ERROR_NT(status);
1334	}
1335
1336	status = unix_convert(conn, fname, False, NULL, &sbuf);
1337	if (!NT_STATUS_IS_OK(status)) {
1338	restore_case_semantics(conn, file_attributes);
1339	return ERROR_NT(status);
1340	}
1341	/* All file access must go through check_name() */
1342	status = check_name(conn, fname);
1343	if (!NT_STATUS_IS_OK(status)) {
1344	restore_case_semantics(conn, file_attributes);
1345	return ERROR_NT(status);
1346	}
1347
1348	/* This is the correct thing to do (check every time) but can_delete is
1349	expensive (it may have to read the parent directory permissions). So
1350	for now we're not doing it unless we have a strong hint the client
1351	is really going to delete this file. If the client is forcing FILE_CREATE
1352	let the filesystem take care of the permissions. */
1353
1354	/* Setting FILE_SHARE_DELETE is the hint. */
1355
1356	if (lp_acl_check_permissions(SNUM(conn))
1357	&& (create_disposition != FILE_CREATE)
1358	&& (share_access & FILE_SHARE_DELETE)
1359	&& (access_mask & DELETE_ACCESS)) {
1360	if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) \|\|
1361	!can_delete_file_in_directory(conn, fname)) {
1362	restore_case_semantics(conn, file_attributes);
1363	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1364	}
1365	}
1366
1367	if (ea_len) {
1368	pdata = data + sd_len;
1369
1370	/* We have already checked that ea_len <= data_count here. */
1371	ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
1372	ea_len);
1373	if (!ea_list ) {
1374	restore_case_semantics(conn, file_attributes);
1375	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1376	}
1377	}
1378
1379	/*
1380	* If it's a request for a directory open, deal with it separately.
1381	*/
1382
1383	if(create_options & FILE_DIRECTORY_FILE) {
1384
1385	/* Can't open a temp directory. IFS kit test. */
1386	if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1387	restore_case_semantics(conn, file_attributes);
1388	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1389	}
1390
1391	/*
1392	* We will get a create directory here if the Win32
1393	* app specified a security descriptor in the
1394	* CreateDirectory() call.
1395	*/
1396
1397	oplock_request = 0;
1398	status = open_directory(conn, fname, &sbuf,
1399	access_mask,
1400	share_access,
1401	create_disposition,
1402	create_options,
1403	new_file_attributes,
1404	&info, &fsp);
1405	} else {
1406
1407	/*
1408	* Ordinary file case.
1409	*/
1410
1411	status = open_file_ntcreate(conn,fname,&sbuf,
1412	access_mask,
1413	share_access,
1414	create_disposition,
1415	create_options,
1416	new_file_attributes,
1417	oplock_request,
1418	&info, &fsp);
1419
1420	if (!NT_STATUS_IS_OK(status)) {
1421	if (NT_STATUS_EQUAL(status,
1422	NT_STATUS_FILE_IS_A_DIRECTORY)) {
1423
1424	/*
1425	* Fail the open if it was explicitly a non-directory file.
1426	*/
1427
1428	if (create_options & FILE_NON_DIRECTORY_FILE) {
1429	restore_case_semantics(conn, file_attributes);
1430	return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1431	}
1432
1433	oplock_request = 0;
1434	status = open_directory(conn, fname, &sbuf,
1435	access_mask,
1436	share_access,
1437	create_disposition,
1438	create_options,
1439	new_file_attributes,
1440	&info, &fsp);
1441	}
1442	}
1443	}
1444
1445	restore_case_semantics(conn, file_attributes);
1446	if(!NT_STATUS_IS_OK(status)) {
1447
1448	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1449	/* We have re-scheduled this call. */
1450	return -1;
1451	}
1452
1453	return ERROR_OPEN(status);
1454	}
1455
1456	/*
1457	* According to the MS documentation, the only time the security
1458	* descriptor is applied to the opened file is iff we created the
1459	* file; an existing file stays the same.
1460	*
1461	* Also, it seems (from observation) that you can open the file with
1462	* any access mask but you can still write the sd. We need to override
1463	* the granted access before we call set_sd
1464	* Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1465	*/
1466
1467	if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1468	uint32 saved_access_mask = fsp->access_mask;
1469
1470	/* We have already checked that sd_len <= data_count here. */
1471
1472	fsp->access_mask = FILE_GENERIC_ALL;
1473
1474	status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1475	if (!NT_STATUS_IS_OK(status)) {
1476	talloc_destroy(ctx);
1477	close_file(fsp,ERROR_CLOSE);
1478	restore_case_semantics(conn, file_attributes);
1479	return ERROR_NT(status);
1480	}
1481	fsp->access_mask = saved_access_mask;
1482	}
1483
1484	if (ea_len && (info == FILE_WAS_CREATED)) {
1485	status = set_ea(conn, fsp, fname, ea_list);
1486	if (!NT_STATUS_IS_OK(status)) {
1487	close_file(fsp,ERROR_CLOSE);
1488	restore_case_semantics(conn, file_attributes);
1489	return ERROR_NT(status);
1490	}
1491	}
1492
1493	restore_case_semantics(conn, file_attributes);
1494
1495	file_len = sbuf.st_size;
1496	fattr = dos_mode(conn,fname,&sbuf);
1497	if(fattr == 0) {
1498	fattr = FILE_ATTRIBUTE_NORMAL;
1499	}
1500	if (!fsp->is_directory && (fattr & aDIR)) {
1501	close_file(fsp,ERROR_CLOSE);
1502	return ERROR_DOS(ERRDOS,ERRnoaccess);
1503	}
1504
1505	/* Save the requested allocation size. */
1506	if ((info == FILE_WAS_CREATED) \|\| (info == FILE_WAS_OVERWRITTEN)) {
1507	SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1508	#ifdef LARGE_SMB_OFF_T
1509	allocation_size \|= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1510	#endif
1511	if (allocation_size && (allocation_size > file_len)) {
1512	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1513	if (fsp->is_directory) {
1514	close_file(fsp,ERROR_CLOSE);
1515	/* Can't set allocation size on a directory. */
1516	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1517	}
1518	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1519	close_file(fsp,ERROR_CLOSE);
1520	return ERROR_NT(NT_STATUS_DISK_FULL);
1521	}
1522	} else {
1523	fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1524	}
1525	}
1526
1527	/*
1528	* If the caller set the extended oplock request bit
1529	* and we granted one (by whatever means) - set the
1530	* correct bit for extended oplock reply.
1531	*/
1532
1533	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1534	extended_oplock_granted = True;
1535	}
1536
1537	if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1538	extended_oplock_granted = True;
1539	}
1540
1541	/* Realloc the size of parameters and data we will return */
1542	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1543	/* Extended response is 32 more byyes. */
1544	param_len = 101;
1545	} else {
1546	param_len = 69;
1547	}
1548	params = nttrans_realloc(ppparams, param_len);
1549	if(params == NULL) {
1550	return ERROR_DOS(ERRDOS,ERRnomem);
1551	}
1552
1553	p = params;
1554	if (extended_oplock_granted) {
1555	if (flags & REQUEST_BATCH_OPLOCK) {
1556	SCVAL(p,0, BATCH_OPLOCK_RETURN);
1557	} else {
1558	SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1559	}
1560	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1561	SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1562	} else {
1563	SCVAL(p,0,NO_OPLOCK_RETURN);
1564	}
1565
1566	p += 2;
1567	SSVAL(p,0,fsp->fnum);
1568	p += 2;
1569	if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1570	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1571	} else {
1572	SIVAL(p,0,info);
1573	}
1574	p += 8;
1575
1576	/* Create time. */
1577	c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1578	a_timespec = get_atimespec(&sbuf);
1579	m_timespec = get_mtimespec(&sbuf);
1580
1581	if (lp_dos_filetime_resolution(SNUM(conn))) {
1582	dos_filetime_timespec(&c_timespec);
1583	dos_filetime_timespec(&a_timespec);
1584	dos_filetime_timespec(&m_timespec);
1585	}
1586
1587	put_long_date_timespec(p, c_timespec); /* create time. */
1588	p += 8;
1589	put_long_date_timespec(p, a_timespec); /* access time */
1590	p += 8;
1591	put_long_date_timespec(p, m_timespec); /* write time */
1592	p += 8;
1593	put_long_date_timespec(p, m_timespec); /* change time */
1594	p += 8;
1595	SIVAL(p,0,fattr); /* File Attributes. */
1596	p += 4;
1597	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1598	p += 8;
1599	SOFF_T(p,0,file_len);
1600	p += 8;
1601	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1602	SSVAL(p,2,0x7);
1603	}
1604	p += 4;
1605	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1606
1607	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1608	uint32 perms = 0;
1609	p += 25;
1610	if (fsp->is_directory \|\| can_write_to_file(conn, fname, &sbuf)) {
1611	perms = FILE_GENERIC_ALL;
1612	} else {
1613	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
1614	}
1615	SIVAL(p,0,perms);
1616	}
1617
1618	DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1619
1620	/* Send the required number of replies */
1621	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
1622
1623	return -1;
1624	}
1625
1626	/****************************************************************************
1627	Reply to a NT CANCEL request.
1628	conn POINTER CAN BE NULL HERE !
1629	****************************************************************************/
1630
1631	int reply_ntcancel(connection_struct *conn,
1632	char inbuf,char outbuf,int length,int bufsize)
1633	{
1634	/*
1635	* Go through and cancel any pending change notifies.
1636	*/
1637
1638	int mid = SVAL(inbuf,smb_mid);
1639	START_PROFILE(SMBntcancel);
1640	remove_pending_change_notify_requests_by_mid(mid);
1641	remove_pending_lock_requests_by_mid(mid);
1642	srv_cancel_sign_response(mid);
1643
1644	DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1645
1646	END_PROFILE(SMBntcancel);
1647	return(-1);
1648	}
1649
1650	/****************************************************************************
1651	Copy a file.
1652	****************************************************************************/
1653
1654	static NTSTATUS copy_internals(connection_struct conn, char oldname, char *newname, uint32 attrs)
1655	{
1656	SMB_STRUCT_STAT sbuf1, sbuf2;
1657	pstring last_component_oldname;
1658	pstring last_component_newname;
1659	files_struct fsp1,fsp2;
1660	uint32 fattr;
1661	int info;
1662	SMB_OFF_T ret=-1;
1663	NTSTATUS status = NT_STATUS_OK;
1664
1665	ZERO_STRUCT(sbuf1);
1666	ZERO_STRUCT(sbuf2);
1667
1668	if (!CAN_WRITE(conn)) {
1669	return NT_STATUS_MEDIA_WRITE_PROTECTED;
1670	}
1671
1672	status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
1673	if (!NT_STATUS_IS_OK(status)) {
1674	return status;
1675	}
1676
1677	status = check_name(conn, oldname);
1678	if (!NT_STATUS_IS_OK(status)) {
1679	return status;
1680	}
1681
1682	/* Source must already exist. */
1683	if (!VALID_STAT(sbuf1)) {
1684	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1685	}
1686	/* Ensure attributes match. */
1687	fattr = dos_mode(conn,oldname,&sbuf1);
1688	if ((fattr & ~attrs) & (aHIDDEN \| aSYSTEM)) {
1689	return NT_STATUS_NO_SUCH_FILE;
1690	}
1691
1692	status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
1693	if (!NT_STATUS_IS_OK(status)) {
1694	return status;
1695	}
1696
1697	status = check_name(conn, newname);
1698	if (!NT_STATUS_IS_OK(status)) {
1699	return status;
1700	}
1701
1702	/* Disallow if newname already exists. */
1703	if (VALID_STAT(sbuf2)) {
1704	return NT_STATUS_OBJECT_NAME_COLLISION;
1705	}
1706
1707	/* No links from a directory. */
1708	if (S_ISDIR(sbuf1.st_mode)) {
1709	return NT_STATUS_FILE_IS_A_DIRECTORY;
1710	}
1711
1712	/* Ensure this is within the share. */
1713	status = reduce_name(conn, oldname);
1714	if (!NT_STATUS_IS_OK(status)) {
1715	return status;
1716	}
1717
1718	DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1719
1720	status = open_file_ntcreate(conn,oldname,&sbuf1,
1721	FILE_READ_DATA, /* Read-only. */
1722	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1723	FILE_OPEN,
1724	0, /* No create options. */
1725	FILE_ATTRIBUTE_NORMAL,
1726	NO_OPLOCK,
1727	&info, &fsp1);
1728
1729	if (!NT_STATUS_IS_OK(status)) {
1730	return status;
1731	}
1732
1733	status = open_file_ntcreate(conn,newname,&sbuf2,
1734	FILE_WRITE_DATA, /* Read-only. */
1735	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1736	FILE_CREATE,
1737	0, /* No create options. */
1738	fattr,
1739	NO_OPLOCK,
1740	&info, &fsp2);
1741
1742	if (!NT_STATUS_IS_OK(status)) {
1743	close_file(fsp1,ERROR_CLOSE);
1744	return status;
1745	}
1746
1747	if (sbuf1.st_size) {
1748	ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1749	}
1750
1751	/*
1752	* As we are opening fsp1 read-only we only expect
1753	* an error on close on fsp2 if we are out of space.
1754	* Thus we don't look at the error return from the
1755	* close of fsp1.
1756	*/
1757	close_file(fsp1,NORMAL_CLOSE);
1758
1759	/* Ensure the modtime is set correctly on the destination file. */
1760	fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1));
1761
1762	status = close_file(fsp2,NORMAL_CLOSE);
1763
1764	/* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1765	creates the file. This isn't the correct thing to do in the copy
1766	case. JRA */
1767	file_set_dosmode(conn, newname, fattr, &sbuf2,
1768	parent_dirname(newname));
1769
1770	if (ret < (SMB_OFF_T)sbuf1.st_size) {
1771	return NT_STATUS_DISK_FULL;
1772	}
1773
1774	if (!NT_STATUS_IS_OK(status)) {
1775	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1776	nt_errstr(status), oldname, newname));
1777	}
1778	return status;
1779	}
1780
1781	/****************************************************************************
1782	Reply to a NT rename request.
1783	****************************************************************************/
1784
1785	int reply_ntrename(connection_struct *conn,
1786	char inbuf,char outbuf,int length,int bufsize)
1787	{
1788	int outsize = 0;
1789	pstring oldname;
1790	pstring newname;
1791	char *p;
1792	NTSTATUS status;
1793	BOOL src_has_wcard = False;
1794	BOOL dest_has_wcard = False;
1795	uint32 attrs = SVAL(inbuf,smb_vwv0);
1796	uint16 rename_type = SVAL(inbuf,smb_vwv1);
1797
1798	START_PROFILE(SMBntrename);
1799
1800	p = smb_buf(inbuf) + 1;
1801	p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &src_has_wcard);
1802	if (!NT_STATUS_IS_OK(status)) {
1803	END_PROFILE(SMBntrename);
1804	return ERROR_NT(status);
1805	}
1806
1807	if( is_ntfs_stream_name(oldname)) {
1808	/* Can't rename a stream. */
1809	END_PROFILE(SMBntrename);
1810	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1811	}
1812
1813	if (ms_has_wild(oldname)) {
1814	END_PROFILE(SMBntrename);
1815	return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1816	}
1817
1818	p++;
1819	p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &dest_has_wcard);
1820	if (!NT_STATUS_IS_OK(status)) {
1821	END_PROFILE(SMBntrename);
1822	return ERROR_NT(status);
1823	}
1824
1825	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, oldname);
1826	if (!NT_STATUS_IS_OK(status)) {
1827	END_PROFILE(SMBntrename);
1828	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1829	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1830	}
1831	return ERROR_NT(status);
1832	}
1833
1834	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname);
1835	if (!NT_STATUS_IS_OK(status)) {
1836	END_PROFILE(SMBntrename);
1837	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1838	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1839	}
1840	return ERROR_NT(status);
1841	}
1842
1843	DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1844
1845	switch(rename_type) {
1846	case RENAME_FLAG_RENAME:
1847	status = rename_internals(conn, oldname, newname, attrs, False, src_has_wcard, dest_has_wcard);
1848	break;
1849	case RENAME_FLAG_HARD_LINK:
1850	if (src_has_wcard \|\| dest_has_wcard) {
1851	/* No wildcards. */
1852	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1853	} else {
1854	status = hardlink_internals(conn, oldname, newname);
1855	}
1856	break;
1857	case RENAME_FLAG_COPY:
1858	if (src_has_wcard \|\| dest_has_wcard) {
1859	/* No wildcards. */
1860	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1861	} else {
1862	status = copy_internals(conn, oldname, newname, attrs);
1863	}
1864	break;
1865	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1866	status = NT_STATUS_INVALID_PARAMETER;
1867	break;
1868	default:
1869	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1870	break;
1871	}
1872
1873	if (!NT_STATUS_IS_OK(status)) {
1874	END_PROFILE(SMBntrename);
1875	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1876	/* We have re-scheduled this call. */
1877	return -1;
1878	}
1879	return ERROR_NT(status);
1880	}
1881
1882	outsize = set_message(outbuf,0,0,False);
1883
1884	END_PROFILE(SMBntrename);
1885	return(outsize);
1886	}
1887
1888	/****************************************************************************
1889	Reply to a notify change - queue the request and
1890	don't allow a directory to be opened.
1891	****************************************************************************/
1892
1893	static int call_nt_transact_notify_change(connection_struct conn, char inbuf,
1894	char *outbuf, int length,
1895	int bufsize,
1896	uint16 **ppsetup, uint32 setup_count,
1897	char **ppparams,
1898	uint32 parameter_count,
1899	char **ppdata, uint32 data_count,
1900	uint32 max_data_count,
1901	uint32 max_param_count)
1902	{
1903	uint16 setup = ppsetup;
1904	files_struct *fsp;
1905	uint32 filter;
1906	NTSTATUS status;
1907	BOOL recursive;
1908
1909	if(setup_count < 6) {
1910	return ERROR_DOS(ERRDOS,ERRbadfunc);
1911	}
1912
1913	fsp = file_fsp((char *)setup,4);
1914	filter = IVAL(setup, 0);
1915	recursive = (SVAL(setup, 6) != 0) ? True : False;
1916
1917	DEBUG(3,("call_nt_transact_notify_change\n"));
1918
1919	if(!fsp) {
1920	return ERROR_DOS(ERRDOS,ERRbadfid);
1921	}
1922
1923	{
1924	char *filter_string;
1925
1926	if (!(filter_string = notify_filter_string(NULL, filter))) {
1927	return ERROR_NT(NT_STATUS_NO_MEMORY);
1928	}
1929
1930	DEBUG(3,("call_nt_transact_notify_change: notify change "
1931	"called on %s, filter = %s, recursive = %d\n",
1932	fsp->fsp_name, filter_string, recursive));
1933
1934	TALLOC_FREE(filter_string);
1935	}
1936
1937	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1938	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1939	}
1940
1941	if (fsp->notify == NULL) {
1942
1943	status = change_notify_create(fsp, filter, recursive);
1944
1945	if (!NT_STATUS_IS_OK(status)) {
1946	DEBUG(10, ("change_notify_create returned %s\n",
1947	nt_errstr(status)));
1948	return ERROR_NT(status);
1949	}
1950	}
1951
1952	if (fsp->notify->num_changes != 0) {
1953
1954	/*
1955	* We've got changes pending, respond immediately
1956	*/
1957
1958	/*
1959	* TODO: write a torture test to check the filtering behaviour
1960	* here.
1961	*/
1962
1963	change_notify_reply(inbuf, max_param_count, fsp->notify);
1964
1965	/*
1966	* change_notify_reply() above has independently sent its
1967	* results
1968	*/
1969	return -1;
1970	}
1971
1972	/*
1973	* No changes pending, queue the request
1974	*/
1975
1976	status = change_notify_add_request(inbuf, max_param_count, filter,
1977	recursive, fsp);
1978	if (!NT_STATUS_IS_OK(status)) {
1979	return ERROR_NT(status);
1980	}
1981
1982	return -1;
1983	}
1984
1985	/****************************************************************************
1986	Reply to an NT transact rename command.
1987	****************************************************************************/
1988
1989	static int call_nt_transact_rename(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1990	uint16 **ppsetup, uint32 setup_count,
1991	char **ppparams, uint32 parameter_count,
1992	char **ppdata, uint32 data_count, uint32 max_data_count)
1993	{
1994	char params = ppparams;
1995	pstring new_name;
1996	files_struct *fsp = NULL;
1997	BOOL replace_if_exists = False;
1998	BOOL dest_has_wcard = False;
1999	NTSTATUS status;
2000
2001	if(parameter_count < 5) {
2002	return ERROR_DOS(ERRDOS,ERRbadfunc);
2003	}
2004
2005	fsp = file_fsp(params, 0);
2006	replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
2007	CHECK_FSP(fsp, conn);
2008	srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), parameter_count - 4,
2009	STR_TERMINATE, &status, &dest_has_wcard);
2010	if (!NT_STATUS_IS_OK(status)) {
2011	return ERROR_NT(status);
2012	}
2013
2014	status = rename_internals(conn, fsp->fsp_name,
2015	new_name, 0, replace_if_exists, False, dest_has_wcard);
2016
2017	if (!NT_STATUS_IS_OK(status)) {
2018	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
2019	/* We have re-scheduled this call. */
2020	return -1;
2021	}
2022	return ERROR_NT(status);
2023	}
2024
2025	/*
2026	* Rename was successful.
2027	*/
2028	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2029
2030	DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
2031	fsp->fsp_name, new_name));
2032
2033	return -1;
2034	}
2035
2036	/******************************************************************************
2037	Fake up a completely empty SD.
2038	*******************************************************************************/
2039
2040	static size_t get_null_nt_acl(TALLOC_CTX mem_ctx, SEC_DESC *ppsd)
2041	{
2042	size_t sd_size;
2043
2044	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2045	if(!*ppsd) {
2046	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2047	sd_size = 0;
2048	}
2049
2050	return sd_size;
2051	}
2052
2053	/****************************************************************************
2054	Reply to query a security descriptor.
2055	****************************************************************************/
2056
2057	static int call_nt_transact_query_security_desc(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2058	uint16 **ppsetup, uint32 setup_count,
2059	char **ppparams, uint32 parameter_count,
2060	char **ppdata, uint32 data_count, uint32 max_data_count)
2061	{
2062	char params = ppparams;
2063	char data = ppdata;
2064	prs_struct pd;
2065	SEC_DESC *psd = NULL;
2066	size_t sd_size;
2067	uint32 security_info_wanted;
2068	TALLOC_CTX *mem_ctx;
2069	files_struct *fsp = NULL;
2070
2071	if(parameter_count < 8) {
2072	return ERROR_DOS(ERRDOS,ERRbadfunc);
2073	}
2074
2075	fsp = file_fsp(params,0);
2076	if(!fsp) {
2077	return ERROR_DOS(ERRDOS,ERRbadfid);
2078	}
2079
2080	security_info_wanted = IVAL(params,4);
2081
2082	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2083	(unsigned int)security_info_wanted ));
2084
2085	params = nttrans_realloc(ppparams, 4);
2086	if(params == NULL) {
2087	return ERROR_DOS(ERRDOS,ERRnomem);
2088	}
2089
2090	if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2091	DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2092	return ERROR_DOS(ERRDOS,ERRnomem);
2093	}
2094
2095	/*
2096	* Get the permissions to return.
2097	*/
2098
2099	if (!lp_nt_acl_support(SNUM(conn))) {
2100	sd_size = get_null_nt_acl(mem_ctx, &psd);
2101	} else {
2102	sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
2103	}
2104
2105	if (sd_size == 0) {
2106	talloc_destroy(mem_ctx);
2107	return(UNIXERROR(ERRDOS,ERRnoaccess));
2108	}
2109
2110	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2111
2112	SIVAL(params,0,(uint32)sd_size);
2113
2114	if(max_data_count < sd_size) {
2115
2116	send_nt_replies(outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2117	params, 4, *ppdata, 0);
2118	talloc_destroy(mem_ctx);
2119	return -1;
2120	}
2121
2122	/*
2123	* Allocate the data we will point this at.
2124	*/
2125
2126	data = nttrans_realloc(ppdata, sd_size);
2127	if(data == NULL) {
2128	talloc_destroy(mem_ctx);
2129	return ERROR_DOS(ERRDOS,ERRnomem);
2130	}
2131
2132	/*
2133	* Init the parse struct we will marshall into.
2134	*/
2135
2136	prs_init(&pd, 0, mem_ctx, MARSHALL);
2137
2138	/*
2139	* Setup the prs_struct to point at the memory we just
2140	* allocated.
2141	*/
2142
2143	prs_give_memory( &pd, data, (uint32)sd_size, False);
2144
2145	/*
2146	* Finally, linearize into the outgoing buffer.
2147	*/
2148
2149	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2150	DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2151	security descriptor.\n"));
2152	/*
2153	* Return access denied for want of a better error message..
2154	*/
2155	talloc_destroy(mem_ctx);
2156	return(UNIXERROR(ERRDOS,ERRnoaccess));
2157	}
2158
2159	/*
2160	* Now we can delete the security descriptor.
2161	*/
2162
2163	talloc_destroy(mem_ctx);
2164
2165	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 4, data,
2166	(int)sd_size);
2167	return -1;
2168	}
2169
2170	/****************************************************************************
2171	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2172	****************************************************************************/
2173
2174	static int call_nt_transact_set_security_desc(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2175	uint16 **ppsetup, uint32 setup_count,
2176	char **ppparams, uint32 parameter_count,
2177	char **ppdata, uint32 data_count, uint32 max_data_count)
2178	{
2179	char params= ppparams;
2180	char data = ppdata;
2181	files_struct *fsp = NULL;
2182	uint32 security_info_sent = 0;
2183	NTSTATUS nt_status;
2184
2185	if(parameter_count < 8) {
2186	return ERROR_DOS(ERRDOS,ERRbadfunc);
2187	}
2188
2189	if((fsp = file_fsp(params,0)) == NULL) {
2190	return ERROR_DOS(ERRDOS,ERRbadfid);
2191	}
2192
2193	if(!lp_nt_acl_support(SNUM(conn))) {
2194	goto done;
2195	}
2196
2197	security_info_sent = IVAL(params,4);
2198
2199	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2200	(unsigned int)security_info_sent ));
2201
2202	if (data_count == 0) {
2203	return ERROR_DOS(ERRDOS, ERRnoaccess);
2204	}
2205
2206	if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2207	return ERROR_NT(nt_status);
2208	}
2209
2210	done:
2211
2212	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2213	return -1;
2214	}
2215
2216	/****************************************************************************
2217	Reply to NT IOCTL
2218	****************************************************************************/
2219
2220	static int call_nt_transact_ioctl(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2221	uint16 **ppsetup, uint32 setup_count,
2222	char **ppparams, uint32 parameter_count,
2223	char **ppdata, uint32 data_count, uint32 max_data_count)
2224	{
2225	uint32 function;
2226	uint16 fidnum;
2227	files_struct *fsp;
2228	uint8 isFSctl;
2229	uint8 compfilter;
2230	static BOOL logged_message;
2231	char pdata = ppdata;
2232
2233	if (setup_count != 8) {
2234	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2235	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2236	}
2237
2238	function = IVAL(*ppsetup, 0);
2239	fidnum = SVAL(*ppsetup, 4);
2240	isFSctl = CVAL(*ppsetup, 6);
2241	compfilter = CVAL(*ppsetup, 7);
2242
2243	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2244	function, fidnum, isFSctl, compfilter));
2245
2246	fsp=file_fsp((char )ppsetup, 4);
2247	/* this check is done in each implemented function case for now
2248	because I don't want to break anything... --metze
2249	FSP_BELONGS_CONN(fsp,conn);*/
2250
2251	switch (function) {
2252	case FSCTL_SET_SPARSE:
2253	/* pretend this succeeded - tho strictly we should
2254	mark the file sparse (if the local fs supports it)
2255	so we can know if we need to pre-allocate or not */
2256
2257	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2258	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2259	0);
2260	return -1;
2261
2262	case FSCTL_0x000900C0:
2263	/* pretend this succeeded - don't know what this really is
2264	but works ok like this --metze
2265	*/
2266
2267	DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2268	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2269	0);
2270	return -1;
2271
2272	case FSCTL_GET_REPARSE_POINT:
2273	/* pretend this fail - my winXP does it like this
2274	* --metze
2275	*/
2276
2277	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2278	send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2279	NULL, 0, NULL, 0);
2280	return -1;
2281
2282	case FSCTL_SET_REPARSE_POINT:
2283	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2284	* --metze
2285	*/
2286
2287	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2288	send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2289	NULL, 0, NULL, 0);
2290	return -1;
2291
2292	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2293	{
2294	/*
2295	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2296	* and return their volume names. If max_data_count is 16, then it is just
2297	* asking for the number of volumes and length of the combined names.
2298	*
2299	* pdata is the data allocated by our caller, but that uses
2300	* total_data_count (which is 0 in our case) rather than max_data_count.
2301	* Allocate the correct amount and return the pointer to let
2302	* it be deallocated when we return.
2303	*/
2304	SHADOW_COPY_DATA *shadow_data = NULL;
2305	TALLOC_CTX *shadow_mem_ctx = NULL;
2306	BOOL labels = False;
2307	uint32 labels_data_count = 0;
2308	uint32 i;
2309	char *cur_pdata;
2310
2311	FSP_BELONGS_CONN(fsp,conn);
2312
2313	if (max_data_count < 16) {
2314	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2315	max_data_count));
2316	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2317	}
2318
2319	if (max_data_count > 16) {
2320	labels = True;
2321	}
2322
2323	shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2324	if (shadow_mem_ctx == NULL) {
2325	DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2326	return ERROR_NT(NT_STATUS_NO_MEMORY);
2327	}
2328
2329	shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2330	if (shadow_data == NULL) {
2331	DEBUG(0,("TALLOC_ZERO() failed!\n"));
2332	talloc_destroy(shadow_mem_ctx);
2333	return ERROR_NT(NT_STATUS_NO_MEMORY);
2334	}
2335
2336	shadow_data->mem_ctx = shadow_mem_ctx;
2337
2338	/*
2339	* Call the VFS routine to actually do the work.
2340	*/
2341	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2342	talloc_destroy(shadow_data->mem_ctx);
2343	if (errno == ENOSYS) {
2344	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2345	conn->connectpath));
2346	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2347	} else {
2348	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2349	conn->connectpath));
2350	return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2351	}
2352	}
2353
2354	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
2355
2356	if (!labels) {
2357	data_count = 16;
2358	} else {
2359	data_count = 12+labels_data_count+4;
2360	}
2361
2362	if (max_data_count<data_count) {
2363	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2364	max_data_count,data_count));
2365	talloc_destroy(shadow_data->mem_ctx);
2366	return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2367	}
2368
2369	pdata = nttrans_realloc(ppdata, data_count);
2370	if (pdata == NULL) {
2371	talloc_destroy(shadow_data->mem_ctx);
2372	return ERROR_NT(NT_STATUS_NO_MEMORY);
2373	}
2374
2375	cur_pdata = pdata;
2376
2377	/* num_volumes 4 bytes */
2378	SIVAL(pdata,0,shadow_data->num_volumes);
2379
2380	if (labels) {
2381	/* num_labels 4 bytes */
2382	SIVAL(pdata,4,shadow_data->num_volumes);
2383	}
2384
2385	/* needed_data_count 4 bytes */
2386	SIVAL(pdata,8,labels_data_count);
2387
2388	cur_pdata+=12;
2389
2390	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2391	shadow_data->num_volumes,fsp->fsp_name));
2392	if (labels && shadow_data->labels) {
2393	for (i=0;i<shadow_data->num_volumes;i++) {
2394	srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE\|STR_TERMINATE);
2395	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2396	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2397	}
2398	}
2399
2400	talloc_destroy(shadow_data->mem_ctx);
2401
2402	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2403	pdata, data_count);
2404
2405	return -1;
2406	}
2407
2408	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2409	{
2410	/* pretend this succeeded -
2411	*
2412	* we have to send back a list with all files owned by this SID
2413	*
2414	* but I have to check that --metze
2415	*/
2416	DOM_SID sid;
2417	uid_t uid;
2418	size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2419
2420	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2421
2422	FSP_BELONGS_CONN(fsp,conn);
2423
2424	/* unknown 4 bytes: this is not the length of the sid :-( */
2425	/unknown = IVAL(pdata,0);/
2426
2427	sid_parse(pdata+4,sid_len,&sid);
2428	DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2429
2430	if (!sid_to_uid(&sid, &uid)) {
2431	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2432	sid_string_static(&sid),(unsigned long)sid_len));
2433	uid = (-1);
2434	}
2435
2436	/* we can take a look at the find source :-)
2437	*
2438	* find ./ -uid $uid -name '*' is what we need here
2439	*
2440	*
2441	* and send 4bytes len and then NULL terminated unicode strings
2442	* for each file
2443	*
2444	* but I don't know how to deal with the paged results
2445	* (maybe we can hang the result anywhere in the fsp struct)
2446	*
2447	* we don't send all files at once
2448	* and at the next we should not start from the beginning,
2449	* so we have to cache the result
2450	*
2451	* --metze
2452	*/
2453
2454	/* this works for now... */
2455	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2456	NULL, 0);
2457	return -1;
2458	}
2459	default:
2460	if (!logged_message) {
2461	logged_message = True; /* Only print this once... */
2462	DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2463	function));
2464	}
2465	}
2466
2467	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2468	}
2469
2470
2471	#ifdef HAVE_SYS_QUOTAS
2472	/****************************************************************************
2473	Reply to get user quota
2474	****************************************************************************/
2475
2476	static int call_nt_transact_get_user_quota(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2477	uint16 **ppsetup, uint32 setup_count,
2478	char **ppparams, uint32 parameter_count,
2479	char **ppdata, uint32 data_count, uint32 max_data_count)
2480	{
2481	NTSTATUS nt_status = NT_STATUS_OK;
2482	char params = ppparams;
2483	char pdata = ppdata;
2484	char *entry;
2485	int data_len=0,param_len=0;
2486	int qt_len=0;
2487	int entry_len = 0;
2488	files_struct *fsp = NULL;
2489	uint16 level = 0;
2490	size_t sid_len;
2491	DOM_SID sid;
2492	BOOL start_enum = True;
2493	SMB_NTQUOTA_STRUCT qt;
2494	SMB_NTQUOTA_LIST *tmp_list;
2495	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2496
2497	ZERO_STRUCT(qt);
2498
2499	/* access check */
2500	if (current_user.ut.uid != 0) {
2501	DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2502	lp_servicename(SNUM(conn)),conn->user));
2503	return ERROR_DOS(ERRDOS,ERRnoaccess);
2504	}
2505
2506	/*
2507	* Ensure minimum number of parameters sent.
2508	*/
2509
2510	if (parameter_count < 4) {
2511	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2512	return ERROR_DOS(ERRDOS,ERRinvalidparam);
2513	}
2514
2515	/* maybe we can check the quota_fnum */
2516	fsp = file_fsp(params,0);
2517	if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2518	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2519	return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2520	}
2521
2522	/* the NULL pointer checking for fsp->fake_file_handle->pd
2523	* is done by CHECK_NTQUOTA_HANDLE_OK()
2524	*/
2525	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2526
2527	level = SVAL(params,2);
2528
2529	/* unknown 12 bytes leading in params */
2530
2531	switch (level) {
2532	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2533	/* seems that we should continue with the enum here --metze */
2534
2535	if (qt_handle->quota_list!=NULL &&
2536	qt_handle->tmp_list==NULL) {
2537
2538	/* free the list */
2539	free_ntquota_list(&(qt_handle->quota_list));
2540
2541	/* Realloc the size of parameters and data we will return */
2542	param_len = 4;
2543	params = nttrans_realloc(ppparams, param_len);
2544	if(params == NULL) {
2545	return ERROR_DOS(ERRDOS,ERRnomem);
2546	}
2547
2548	data_len = 0;
2549	SIVAL(params,0,data_len);
2550
2551	break;
2552	}
2553
2554	start_enum = False;
2555
2556	case TRANSACT_GET_USER_QUOTA_LIST_START:
2557
2558	if (qt_handle->quota_list==NULL &&
2559	qt_handle->tmp_list==NULL) {
2560	start_enum = True;
2561	}
2562
2563	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2564	return ERROR_DOS(ERRSRV,ERRerror);
2565
2566	/* Realloc the size of parameters and data we will return */
2567	param_len = 4;
2568	params = nttrans_realloc(ppparams, param_len);
2569	if(params == NULL) {
2570	return ERROR_DOS(ERRDOS,ERRnomem);
2571	}
2572
2573	/* we should not trust the value in max_data_count*/
2574	max_data_count = MIN(max_data_count,2048);
2575
2576	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2577	if(pdata == NULL) {
2578	return ERROR_DOS(ERRDOS,ERRnomem);
2579	}
2580
2581	entry = pdata;
2582
2583	/* set params Size of returned Quota Data 4 bytes*/
2584	/* but set it later when we know it */
2585
2586	/* for each entry push the data */
2587
2588	if (start_enum) {
2589	qt_handle->tmp_list = qt_handle->quota_list;
2590	}
2591
2592	tmp_list = qt_handle->tmp_list;
2593
2594	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2595	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2596
2597	sid_len = sid_size(&tmp_list->quotas->sid);
2598	entry_len = 40 + sid_len;
2599
2600	/* nextoffset entry 4 bytes */
2601	SIVAL(entry,0,entry_len);
2602
2603	/* then the len of the SID 4 bytes */
2604	SIVAL(entry,4,sid_len);
2605
2606	/* unknown data 8 bytes SMB_BIG_UINT */
2607	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2608
2609	/* the used disk space 8 bytes SMB_BIG_UINT */
2610	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2611
2612	/* the soft quotas 8 bytes SMB_BIG_UINT */
2613	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2614
2615	/* the hard quotas 8 bytes SMB_BIG_UINT */
2616	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2617
2618	/* and now the SID */
2619	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2620	}
2621
2622	qt_handle->tmp_list = tmp_list;
2623
2624	/* overwrite the offset of the last entry */
2625	SIVAL(entry-entry_len,0,0);
2626
2627	data_len = 4+qt_len;
2628	/* overwrite the params quota_data_len */
2629	SIVAL(params,0,data_len);
2630
2631	break;
2632
2633	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2634
2635	/* unknown 4 bytes IVAL(pdata,0) */
2636
2637	if (data_count < 8) {
2638	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2639	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2640	}
2641
2642	sid_len = IVAL(pdata,4);
2643	/* Ensure this is less than 1mb. */
2644	if (sid_len > (1024*1024)) {
2645	return ERROR_DOS(ERRDOS,ERRnomem);
2646	}
2647
2648	if (data_count < 8+sid_len) {
2649	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2650	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2651	}
2652
2653	data_len = 4+40+sid_len;
2654
2655	if (max_data_count < data_len) {
2656	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2657	max_data_count, data_len));
2658	param_len = 4;
2659	SIVAL(params,0,data_len);
2660	data_len = 0;
2661	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2662	break;
2663	}
2664
2665	sid_parse(pdata+8,sid_len,&sid);
2666
2667	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2668	ZERO_STRUCT(qt);
2669	/*
2670	* we have to return zero's in all fields
2671	* instead of returning an error here
2672	* --metze
2673	*/
2674	}
2675
2676	/* Realloc the size of parameters and data we will return */
2677	param_len = 4;
2678	params = nttrans_realloc(ppparams, param_len);
2679	if(params == NULL) {
2680	return ERROR_DOS(ERRDOS,ERRnomem);
2681	}
2682
2683	pdata = nttrans_realloc(ppdata, data_len);
2684	if(pdata == NULL) {
2685	return ERROR_DOS(ERRDOS,ERRnomem);
2686	}
2687
2688	entry = pdata;
2689
2690	/* set params Size of returned Quota Data 4 bytes*/
2691	SIVAL(params,0,data_len);
2692
2693	/* nextoffset entry 4 bytes */
2694	SIVAL(entry,0,0);
2695
2696	/* then the len of the SID 4 bytes */
2697	SIVAL(entry,4,sid_len);
2698
2699	/* unknown data 8 bytes SMB_BIG_UINT */
2700	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2701
2702	/* the used disk space 8 bytes SMB_BIG_UINT */
2703	SBIG_UINT(entry,16,qt.usedspace);
2704
2705	/* the soft quotas 8 bytes SMB_BIG_UINT */
2706	SBIG_UINT(entry,24,qt.softlim);
2707
2708	/* the hard quotas 8 bytes SMB_BIG_UINT */
2709	SBIG_UINT(entry,32,qt.hardlim);
2710
2711	/* and now the SID */
2712	sid_linearize(entry+40, sid_len, &sid);
2713
2714	break;
2715
2716	default:
2717	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2718	return ERROR_DOS(ERRSRV,ERRerror);
2719	break;
2720	}
2721
2722	send_nt_replies(outbuf, bufsize, nt_status, params, param_len,
2723	pdata, data_len);
2724
2725	return -1;
2726	}
2727
2728	/****************************************************************************
2729	Reply to set user quota
2730	****************************************************************************/
2731
2732	static int call_nt_transact_set_user_quota(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2733	uint16 **ppsetup, uint32 setup_count,
2734	char **ppparams, uint32 parameter_count,
2735	char **ppdata, uint32 data_count, uint32 max_data_count)
2736	{
2737	char params = ppparams;
2738	char pdata = ppdata;
2739	int data_len=0,param_len=0;
2740	SMB_NTQUOTA_STRUCT qt;
2741	size_t sid_len;
2742	DOM_SID sid;
2743	files_struct *fsp = NULL;
2744
2745	ZERO_STRUCT(qt);
2746
2747	/* access check */
2748	if (current_user.ut.uid != 0) {
2749	DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2750	lp_servicename(SNUM(conn)),conn->user));
2751	return ERROR_DOS(ERRDOS,ERRnoaccess);
2752	}
2753
2754	/*
2755	* Ensure minimum number of parameters sent.
2756	*/
2757
2758	if (parameter_count < 2) {
2759	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2760	return ERROR_DOS(ERRDOS,ERRinvalidparam);
2761	}
2762
2763	/* maybe we can check the quota_fnum */
2764	fsp = file_fsp(params,0);
2765	if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2766	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2767	return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2768	}
2769
2770	if (data_count < 40) {
2771	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2772	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2773	}
2774
2775	/* offset to next quota record.
2776	* 4 bytes IVAL(pdata,0)
2777	* unused here...
2778	*/
2779
2780	/* sid len */
2781	sid_len = IVAL(pdata,4);
2782
2783	if (data_count < 40+sid_len) {
2784	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2785	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2786	}
2787
2788	/* unknown 8 bytes in pdata
2789	* maybe its the change time in NTTIME
2790	*/
2791
2792	/* the used space 8 bytes (SMB_BIG_UINT)*/
2793	qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2794	#ifdef LARGE_SMB_OFF_T
2795	qt.usedspace \|= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2796	#else /* LARGE_SMB_OFF_T */
2797	if ((IVAL(pdata,20) != 0)&&
2798	((qt.usedspace != 0xFFFFFFFF)\|\|
2799	(IVAL(pdata,20)!=0xFFFFFFFF))) {
2800	/* more than 32 bits? */
2801	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2802	}
2803	#endif /* LARGE_SMB_OFF_T */
2804
2805	/* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2806	qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2807	#ifdef LARGE_SMB_OFF_T
2808	qt.softlim \|= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2809	#else /* LARGE_SMB_OFF_T */
2810	if ((IVAL(pdata,28) != 0)&&
2811	((qt.softlim != 0xFFFFFFFF)\|\|
2812	(IVAL(pdata,28)!=0xFFFFFFFF))) {
2813	/* more than 32 bits? */
2814	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2815	}
2816	#endif /* LARGE_SMB_OFF_T */
2817
2818	/* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2819	qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2820	#ifdef LARGE_SMB_OFF_T
2821	qt.hardlim \|= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2822	#else /* LARGE_SMB_OFF_T */
2823	if ((IVAL(pdata,36) != 0)&&
2824	((qt.hardlim != 0xFFFFFFFF)\|\|
2825	(IVAL(pdata,36)!=0xFFFFFFFF))) {
2826	/* more than 32 bits? */
2827	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2828	}
2829	#endif /* LARGE_SMB_OFF_T */
2830
2831	sid_parse(pdata+40,sid_len,&sid);
2832	DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2833
2834	/* 44 unknown bytes left... */
2835
2836	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2837	return ERROR_DOS(ERRSRV,ERRerror);
2838	}
2839
2840	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len,
2841	pdata, data_len);
2842
2843	return -1;
2844	}
2845	#endif /* HAVE_SYS_QUOTAS */
2846
2847	static int handle_nttrans(connection_struct *conn,
2848	struct trans_state *state,
2849	char inbuf, char outbuf, int size, int bufsize)
2850	{
2851	int outsize;
2852
2853	if (Protocol >= PROTOCOL_NT1) {
2854	SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) \| 0x40); /* IS_LONG_NAME */
2855	}
2856
2857	/* Now we must call the relevant NT_TRANS function */
2858	switch(state->call) {
2859	case NT_TRANSACT_CREATE:
2860	{
2861	START_PROFILE(NT_transact_create);
2862	outsize = call_nt_transact_create(conn, inbuf, outbuf,
2863	size, bufsize,
2864	&state->setup, state->setup_count,
2865	&state->param, state->total_param,
2866	&state->data, state->total_data,
2867	state->max_data_return);
2868	END_PROFILE(NT_transact_create);
2869	break;
2870	}
2871
2872	case NT_TRANSACT_IOCTL:
2873	{
2874	START_PROFILE(NT_transact_ioctl);
2875	outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2876	size, bufsize,
2877	&state->setup, state->setup_count,
2878	&state->param, state->total_param,
2879	&state->data, state->total_data, state->max_data_return);
2880	END_PROFILE(NT_transact_ioctl);
2881	break;
2882	}
2883
2884	case NT_TRANSACT_SET_SECURITY_DESC:
2885	{
2886	START_PROFILE(NT_transact_set_security_desc);
2887	outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2888	size, bufsize,
2889	&state->setup, state->setup_count,
2890	&state->param, state->total_param,
2891	&state->data, state->total_data, state->max_data_return);
2892	END_PROFILE(NT_transact_set_security_desc);
2893	break;
2894	}
2895
2896	case NT_TRANSACT_NOTIFY_CHANGE:
2897	{
2898	START_PROFILE(NT_transact_notify_change);
2899	outsize = call_nt_transact_notify_change(
2900	conn, inbuf, outbuf, size, bufsize,
2901	&state->setup, state->setup_count,
2902	&state->param, state->total_param,
2903	&state->data, state->total_data,
2904	state->max_data_return,
2905	state->max_param_return);
2906	END_PROFILE(NT_transact_notify_change);
2907	break;
2908	}
2909
2910	case NT_TRANSACT_RENAME:
2911	{
2912	START_PROFILE(NT_transact_rename);
2913	outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2914	size, bufsize,
2915	&state->setup, state->setup_count,
2916	&state->param, state->total_param,
2917	&state->data, state->total_data, state->max_data_return);
2918	END_PROFILE(NT_transact_rename);
2919	break;
2920	}
2921
2922	case NT_TRANSACT_QUERY_SECURITY_DESC:
2923	{
2924	START_PROFILE(NT_transact_query_security_desc);
2925	outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2926	size, bufsize,
2927	&state->setup, state->setup_count,
2928	&state->param, state->total_param,
2929	&state->data, state->total_data, state->max_data_return);
2930	END_PROFILE(NT_transact_query_security_desc);
2931	break;
2932	}
2933
2934	#ifdef HAVE_SYS_QUOTAS
2935	case NT_TRANSACT_GET_USER_QUOTA:
2936	{
2937	START_PROFILE(NT_transact_get_user_quota);
2938	outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2939	size, bufsize,
2940	&state->setup, state->setup_count,
2941	&state->param, state->total_param,
2942	&state->data, state->total_data, state->max_data_return);
2943	END_PROFILE(NT_transact_get_user_quota);
2944	break;
2945	}
2946
2947	case NT_TRANSACT_SET_USER_QUOTA:
2948	{
2949	START_PROFILE(NT_transact_set_user_quota);
2950	outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2951	size, bufsize,
2952	&state->setup, state->setup_count,
2953	&state->param, state->total_param,
2954	&state->data, state->total_data, state->max_data_return);
2955	END_PROFILE(NT_transact_set_user_quota);
2956	break;
2957	}
2958	#endif /* HAVE_SYS_QUOTAS */
2959
2960	default:
2961	/* Error in request */
2962	DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2963	state->call));
2964	return ERROR_DOS(ERRSRV,ERRerror);
2965	}
2966	return outsize;
2967	}
2968
2969	/****************************************************************************
2970	Reply to a SMBNTtrans.
2971	****************************************************************************/
2972
2973	int reply_nttrans(connection_struct *conn,
2974	char inbuf,char outbuf,int size,int bufsize)
2975	{
2976	int outsize = 0;
2977	uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2978	uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2979	uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2980	uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2981	uint32 av_size = size-4;
2982
2983	uint16 function_code = SVAL( inbuf, smb_nt_Function);
2984	NTSTATUS result;
2985	struct trans_state *state;
2986
2987	START_PROFILE(SMBnttrans);
2988
2989	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2990	END_PROFILE(SMBnttrans);
2991	return ERROR_DOS(ERRSRV,ERRaccess);
2992	}
2993
2994	result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2995	if (!NT_STATUS_IS_OK(result)) {
2996	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2997	END_PROFILE(SMBnttrans);
2998	return ERROR_NT(result);
2999	}
3000
3001	if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
3002	END_PROFILE(SMBnttrans);
3003	return ERROR_DOS(ERRSRV,ERRaccess);
3004	}
3005
3006	state->cmd = SMBnttrans;
3007
3008	state->mid = SVAL(inbuf,smb_mid);
3009	state->vuid = SVAL(inbuf,smb_uid);
3010	state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
3011	state->data = NULL;
3012	state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
3013	state->param = NULL;
3014	state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
3015	state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
3016
3017	/* setup count is in words */
3018	state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
3019	state->setup = NULL;
3020	state->call = function_code;
3021
3022	/*
3023	* All nttrans messages we handle have smb_wct == 19 +
3024	* state->setup_count. Ensure this is so as a sanity check.
3025	*/
3026
3027	if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
3028	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3029	CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
3030	goto bad_param;
3031	}
3032
3033	/* Don't allow more than 128mb for each value. */
3034	if ((state->total_data > (10241024128)) \|\|
3035	(state->total_param > (10241024128))) {
3036	END_PROFILE(SMBnttrans);
3037	return ERROR_DOS(ERRDOS,ERRnomem);
3038	}
3039
3040	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
3041	goto bad_param;
3042
3043	if (state->total_data) {
3044	/* Can't use talloc here, the core routines do realloc on the
3045	* params and data. */
3046	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3047	DEBUG(0,("reply_nttrans: data malloc fail for %u "
3048	"bytes !\n", (unsigned int)state->total_data));
3049	TALLOC_FREE(state);
3050	END_PROFILE(SMBnttrans);
3051	return(ERROR_DOS(ERRDOS,ERRnomem));
3052	}
3053
3054	if (dscnt > state->total_data \|\|
3055	dsoff+dscnt < dsoff) {
3056	goto bad_param;
3057	}
3058
3059	if (dsoff > av_size \|\|
3060	dscnt > av_size \|\|
3061	dsoff+dscnt > av_size) {
3062	goto bad_param;
3063	}
3064
3065	memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
3066	}
3067
3068	if (state->total_param) {
3069	/* Can't use talloc here, the core routines do realloc on the
3070	* params and data. */
3071	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3072	DEBUG(0,("reply_nttrans: param malloc fail for %u "
3073	"bytes !\n", (unsigned int)state->total_param));
3074	SAFE_FREE(state->data);
3075	TALLOC_FREE(state);
3076	END_PROFILE(SMBnttrans);
3077	return(ERROR_DOS(ERRDOS,ERRnomem));
3078	}
3079
3080	if (pscnt > state->total_param \|\|
3081	psoff+pscnt < psoff) {
3082	goto bad_param;
3083	}
3084
3085	if (psoff > av_size \|\|
3086	pscnt > av_size \|\|
3087	psoff+pscnt > av_size) {
3088	goto bad_param;
3089	}
3090
3091	memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
3092	}
3093
3094	state->received_data = dscnt;
3095	state->received_param = pscnt;
3096
3097	if(state->setup_count > 0) {
3098	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3099	state->setup_count));
3100	state->setup = (uint16 *)TALLOC(state, state->setup_count);
3101	if (state->setup == NULL) {
3102	DEBUG(0,("reply_nttrans : Out of memory\n"));
3103	SAFE_FREE(state->data);
3104	SAFE_FREE(state->param);
3105	TALLOC_FREE(state);
3106	END_PROFILE(SMBnttrans);
3107	return ERROR_DOS(ERRDOS,ERRnomem);
3108	}
3109
3110	if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) \|\|
3111	(smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3112	goto bad_param;
3113	}
3114	if (smb_nt_SetupStart + state->setup_count > size) {
3115	goto bad_param;
3116	}
3117
3118	memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
3119	dump_data(10, (char *)state->setup, state->setup_count);
3120	}
3121
3122	if ((state->received_data == state->total_data) &&
3123	(state->received_param == state->total_param)) {
3124	outsize = handle_nttrans(conn, state, inbuf, outbuf,
3125	size, bufsize);
3126	SAFE_FREE(state->param);
3127	SAFE_FREE(state->data);
3128	TALLOC_FREE(state);
3129	END_PROFILE(SMBnttrans);
3130	return outsize;
3131	}
3132
3133	DLIST_ADD(conn->pending_trans, state);
3134
3135	/* We need to send an interim response then receive the rest
3136	of the parameter/data bytes */
3137	outsize = set_message(outbuf,0,0,False);
3138	show_msg(outbuf);
3139	END_PROFILE(SMBnttrans);
3140	return outsize;
3141
3142	bad_param:
3143
3144	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3145	SAFE_FREE(state->data);
3146	SAFE_FREE(state->param);
3147	TALLOC_FREE(state);
3148	END_PROFILE(SMBnttrans);
3149	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3150	}
3151
3152	/****************************************************************************
3153	Reply to a SMBnttranss
3154	****************************************************************************/
3155
3156	int reply_nttranss(connection_struct conn, char inbuf,char *outbuf,
3157	int size,int bufsize)
3158	{
3159	int outsize = 0;
3160	uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
3161	uint32_t av_size = size-4;
3162	struct trans_state *state;
3163
3164	START_PROFILE(SMBnttranss);
3165
3166	show_msg(inbuf);
3167
3168	for (state = conn->pending_trans; state != NULL;
3169	state = state->next) {
3170	if (state->mid == SVAL(inbuf,smb_mid)) {
3171	break;
3172	}
3173	}
3174
3175	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
3176	END_PROFILE(SMBnttranss);
3177	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3178	}
3179
3180	/* Revise state->total_param and state->total_data in case they have
3181	changed downwards */
3182	if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3183	state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3184	}
3185	if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3186	state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3187	}
3188
3189	pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3190	poff = IVAL(inbuf, smb_nts_ParameterOffset);
3191	pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3192
3193	dcnt = IVAL(inbuf, smb_nts_DataCount);
3194	ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3195	doff = IVAL(inbuf, smb_nts_DataOffset);
3196
3197	state->received_param += pcnt;
3198	state->received_data += dcnt;
3199
3200	if ((state->received_data > state->total_data) \|\|
3201	(state->received_param > state->total_param))
3202	goto bad_param;
3203
3204	if (pcnt) {
3205	if (pdisp > state->total_param \|\|
3206	pcnt > state->total_param \|\|
3207	pdisp+pcnt > state->total_param \|\|
3208	pdisp+pcnt < pdisp) {
3209	goto bad_param;
3210	}
3211
3212	if (poff > av_size \|\|
3213	pcnt > av_size \|\|
3214	poff+pcnt > av_size \|\|
3215	poff+pcnt < poff) {
3216	goto bad_param;
3217	}
3218
3219	memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3220	pcnt);
3221	}
3222
3223	if (dcnt) {
3224	if (ddisp > state->total_data \|\|
3225	dcnt > state->total_data \|\|
3226	ddisp+dcnt > state->total_data \|\|
3227	ddisp+dcnt < ddisp) {
3228	goto bad_param;
3229	}
3230
3231	if (doff > av_size \|\|
3232	dcnt > av_size \|\|
3233	doff+dcnt > av_size \|\|
3234	doff+dcnt < doff) {
3235	goto bad_param;
3236	}
3237
3238	memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3239	dcnt);
3240	}
3241
3242	if ((state->received_param < state->total_param) \|\|
3243	(state->received_data < state->total_data)) {
3244	END_PROFILE(SMBnttranss);
3245	return -1;
3246	}
3247
3248	/* construct_reply_common has done us the favor to pre-fill the
3249	* command field with SMBnttranss which is wrong :-)
3250	*/
3251	SCVAL(outbuf,smb_com,SMBnttrans);
3252
3253	outsize = handle_nttrans(conn, state, inbuf, outbuf,
3254	size, bufsize);
3255
3256	DLIST_REMOVE(conn->pending_trans, state);
3257	SAFE_FREE(state->data);
3258	SAFE_FREE(state->param);
3259	TALLOC_FREE(state);
3260
3261	if (outsize == 0) {
3262	END_PROFILE(SMBnttranss);
3263	return(ERROR_DOS(ERRSRV,ERRnosupport));
3264	}
3265
3266	END_PROFILE(SMBnttranss);
3267	return(outsize);
3268
3269	bad_param:
3270
3271	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3272	DLIST_REMOVE(conn->pending_trans, state);
3273	SAFE_FREE(state->data);
3274	SAFE_FREE(state->param);
3275	TALLOC_FREE(state);
3276	END_PROFILE(SMBnttranss);
3277	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3278	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: