Context Navigation

source: branches/samba-3.3.x/source/smbd/nttrans.c@ 432

Visit:

Last change on this file since 432 was 370, checked in by Herwig Bauernfeind, 16 years ago
Update Samba 3.3 to 3.3.10 (source)
File size: 75.9 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-2007
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 3 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program. If not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22
23	extern int max_send;
24	extern enum protocol_types Protocol;
25	extern const struct generic_mapping file_generic_mapping;
26
27	static char nttrans_realloc(char *ptr, size_t size)
28	{
29	if (ptr==NULL) {
30	smb_panic("nttrans_realloc() called with NULL ptr");
31	}
32
33	ptr = (char )SMB_REALLOC(*ptr, size);
34	if(*ptr == NULL) {
35	return NULL;
36	}
37	memset(*ptr,'\0',size);
38	return *ptr;
39	}
40
41	/****************************************************************************
42	Send the required number of replies back.
43	We assume all fields other than the data fields are
44	set correctly for the type of call.
45	HACK ! Always assumes smb_setup field is zero.
46	****************************************************************************/
47
48	void send_nt_replies(connection_struct *conn,
49	struct smb_request *req, NTSTATUS nt_error,
50	char *params, int paramsize,
51	char *pdata, int datasize)
52	{
53	int data_to_send = datasize;
54	int params_to_send = paramsize;
55	int useable_space;
56	char *pp = params;
57	char *pd = pdata;
58	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59	int alignment_offset = 3;
60	int data_alignment_offset = 0;
61
62	/*
63	* If there genuinely are no parameters or data to send just send
64	* the empty packet.
65	*/
66
67	if(params_to_send == 0 && data_to_send == 0) {
68	reply_outbuf(req, 18, 0);
69	show_msg((char *)req->outbuf);
70	return;
71	}
72
73	/*
74	* When sending params and data ensure that both are nicely aligned.
75	* Only do this alignment when there is also data to send - else
76	* can cause NT redirector problems.
77	*/
78
79	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
80	data_alignment_offset = 4 - (params_to_send % 4);
81	}
82
83	/*
84	* Space is bufsize minus Netbios over TCP header minus SMB header.
85	* The alignment_offset is to align the param bytes on a four byte
86	* boundary (2 bytes for data len, one byte pad).
87	* NT needs this to work correctly.
88	*/
89
90	useable_space = max_send - (smb_size
91	+ 2 * 18 /* wct */
92	+ alignment_offset
93	+ data_alignment_offset);
94
95	if (useable_space < 0) {
96	DEBUG(0, ("send_nt_replies failed sanity useable_space "
97	"= %d!!!", useable_space));
98	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
99	}
100
101	while (params_to_send \|\| data_to_send) {
102
103	/*
104	* Calculate whether we will totally or partially fill this packet.
105	*/
106
107	total_sent_thistime = params_to_send + data_to_send;
108
109	/*
110	* We can never send more than useable_space.
111	*/
112
113	total_sent_thistime = MIN(total_sent_thistime, useable_space);
114
115	reply_outbuf(req, 18,
116	total_sent_thistime + alignment_offset
117	+ data_alignment_offset);
118
119	/*
120	* Set total params and data to be sent.
121	*/
122
123	SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
124	SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
125
126	/*
127	* Calculate how many parameters and data we can fit into
128	* this packet. Parameters get precedence.
129	*/
130
131	params_sent_thistime = MIN(params_to_send,useable_space);
132	data_sent_thistime = useable_space - params_sent_thistime;
133	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
134
135	SIVAL(req->outbuf, smb_ntr_ParameterCount,
136	params_sent_thistime);
137
138	if(params_sent_thistime == 0) {
139	SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
140	SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
141	} else {
142	/*
143	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
144	* parameter bytes, however the first 4 bytes of outbuf are
145	* the Netbios over TCP header. Thus use smb_base() to subtract
146	* them from the calculation.
147	*/
148
149	SIVAL(req->outbuf,smb_ntr_ParameterOffset,
150	((smb_buf(req->outbuf)+alignment_offset)
151	- smb_base(req->outbuf)));
152	/*
153	* Absolute displacement of param bytes sent in this packet.
154	*/
155
156	SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
157	pp - params);
158	}
159
160	/*
161	* Deal with the data portion.
162	*/
163
164	SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
165
166	if(data_sent_thistime == 0) {
167	SIVAL(req->outbuf,smb_ntr_DataOffset,0);
168	SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
169	} else {
170	/*
171	* The offset of the data bytes is the offset of the
172	* parameter bytes plus the number of parameters being sent this time.
173	*/
174
175	SIVAL(req->outbuf, smb_ntr_DataOffset,
176	((smb_buf(req->outbuf)+alignment_offset) -
177	smb_base(req->outbuf))
178	+ params_sent_thistime + data_alignment_offset);
179	SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
180	}
181
182	/*
183	* Copy the param bytes into the packet.
184	*/
185
186	if(params_sent_thistime) {
187	if (alignment_offset != 0) {
188	memset(smb_buf(req->outbuf), 0,
189	alignment_offset);
190	}
191	memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
192	params_sent_thistime);
193	}
194
195	/*
196	* Copy in the data bytes
197	*/
198
199	if(data_sent_thistime) {
200	if (data_alignment_offset != 0) {
201	memset((smb_buf(req->outbuf)+alignment_offset+
202	params_sent_thistime), 0,
203	data_alignment_offset);
204	}
205	memcpy(smb_buf(req->outbuf)+alignment_offset
206	+params_sent_thistime+data_alignment_offset,
207	pd,data_sent_thistime);
208	}
209
210	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
211	params_sent_thistime, data_sent_thistime, useable_space));
212	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
213	params_to_send, data_to_send, paramsize, datasize));
214
215	if (NT_STATUS_V(nt_error)) {
216	error_packet_set((char *)req->outbuf,
217	0, 0, nt_error,
218	__LINE__,__FILE__);
219	}
220
221	/* Send the packet */
222	show_msg((char *)req->outbuf);
223	if (!srv_send_smb(smbd_server_fd(),
224	(char *)req->outbuf,
225	IS_CONN_ENCRYPTED(conn))) {
226	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
227	}
228
229	TALLOC_FREE(req->outbuf);
230
231	pp += params_sent_thistime;
232	pd += data_sent_thistime;
233
234	params_to_send -= params_sent_thistime;
235	data_to_send -= data_sent_thistime;
236
237	/*
238	* Sanity check
239	*/
240
241	if(params_to_send < 0 \|\| data_to_send < 0) {
242	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
243	params_to_send, data_to_send));
244	exit_server_cleanly("send_nt_replies: internal error");
245	}
246	}
247	}
248
249	/****************************************************************************
250	Is it an NTFS stream name ?
251	An NTFS file name is <path>.<extention>:<stream name>:<stream type>
252	$DATA can be used as both a stream name and a stream type. A missing stream
253	name or type implies $DATA.
254	****************************************************************************/
255
256	bool is_ntfs_stream_name(const char *fname)
257	{
258	if (lp_posix_pathnames()) {
259	return False;
260	}
261	return (strchr_m(fname, ':') != NULL) ? True : False;
262	}
263
264	/****************************************************************************
265	Reply to an NT create and X call on a pipe
266	****************************************************************************/
267
268	static void nt_open_pipe(char fname, connection_struct conn,
269	struct smb_request req, int ppnum)
270	{
271	smb_np_struct *p = NULL;
272
273	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
274
275	/* See if it is one we want to handle. */
276
277	if (!is_known_pipename(fname)) {
278	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
279	ERRDOS, ERRbadpipe);
280	return;
281	}
282
283	/* Strip \\ off the name. */
284	fname++;
285
286	DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
287
288	p = open_rpc_pipe_p(fname, conn, req->vuid);
289	if (!p) {
290	reply_doserror(req, ERRSRV, ERRnofids);
291	return;
292	}
293
294	/* TODO: Add pipe to db */
295
296	if ( !store_pipe_opendb( p ) ) {
297	DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
298	}
299
300	*ppnum = p->pnum;
301	return;
302	}
303
304	/****************************************************************************
305	Reply to an NT create and X call for pipes.
306	****************************************************************************/
307
308	static void do_ntcreate_pipe_open(connection_struct *conn,
309	struct smb_request *req)
310	{
311	char *fname = NULL;
312	int pnum = -1;
313	char *p = NULL;
314	uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
315	TALLOC_CTX *ctx = talloc_tos();
316
317	srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
318	smb_buf(req->inbuf), STR_TERMINATE);
319
320	if (!fname) {
321	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
322	ERRDOS, ERRbadpipe);
323	return;
324	}
325	nt_open_pipe(fname, conn, req, &pnum);
326
327	if (req->outbuf) {
328	/* error reply */
329	return;
330	}
331
332	/*
333	* Deal with pipe return.
334	*/
335
336	if (flags & EXTENDED_RESPONSE_REQUIRED) {
337	/* This is very strange. We
338	* return 50 words, but only set
339	* the wcnt to 42 ? It's definately
340	* what happens on the wire....
341	*/
342	reply_outbuf(req, 50, 0);
343	SCVAL(req->outbuf,smb_wct,42);
344	} else {
345	reply_outbuf(req, 34, 0);
346	}
347
348	p = (char *)req->outbuf + smb_vwv2;
349	p++;
350	SSVAL(p,0,pnum);
351	p += 2;
352	SIVAL(p,0,FILE_WAS_OPENED);
353	p += 4;
354	p += 32;
355	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
356	p += 20;
357	/* File type. */
358	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
359	/* Device state. */
360	SSVAL(p,2, 0x5FF); /* ? */
361	p += 4;
362
363	if (flags & EXTENDED_RESPONSE_REQUIRED) {
364	p += 25;
365	SIVAL(p,0,FILE_GENERIC_ALL);
366	/*
367	* For pipes W2K3 seems to return
368	* 0x12019B next.
369	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
370	*/
371	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
372	}
373
374	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
375
376	chain_reply(req);
377	}
378
379	/****************************************************************************
380	Reply to an NT create and X call.
381	****************************************************************************/
382
383	void reply_ntcreate_and_X(struct smb_request *req)
384	{
385	connection_struct *conn = req->conn;
386	char *fname = NULL;
387	uint32 flags;
388	uint32 access_mask;
389	uint32 file_attributes;
390	uint32 share_access;
391	uint32 create_disposition;
392	uint32 create_options;
393	uint16 root_dir_fid;
394	SMB_BIG_UINT allocation_size;
395	/* Breakout the oplock request bits so we can set the
396	reply bits separately. */
397	uint32 fattr=0;
398	SMB_OFF_T file_len = 0;
399	SMB_STRUCT_STAT sbuf;
400	int info = 0;
401	files_struct *fsp = NULL;
402	char *p = NULL;
403	struct timespec c_timespec;
404	struct timespec a_timespec;
405	struct timespec m_timespec;
406	NTSTATUS status;
407	int oplock_request;
408	uint8_t oplock_granted = NO_OPLOCK_RETURN;
409	TALLOC_CTX *ctx = talloc_tos();
410
411	START_PROFILE(SMBntcreateX);
412
413	if (req->wct < 24) {
414	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
415	return;
416	}
417
418	flags = IVAL(req->inbuf,smb_ntcreate_Flags);
419	access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
420	file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
421	share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
422	create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
423	create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
424	root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
425
426	allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
427	smb_ntcreate_AllocationSize);
428	#ifdef LARGE_SMB_OFF_T
429	allocation_size \|= (((SMB_BIG_UINT)IVAL(
430	req->inbuf,
431	smb_ntcreate_AllocationSize + 4)) << 32);
432	#endif
433
434	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
435	smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
436
437	if (!NT_STATUS_IS_OK(status)) {
438	reply_nterror(req, status);
439	END_PROFILE(SMBntcreateX);
440	return;
441	}
442
443	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
444	"file_attributes = 0x%x, share_access = 0x%x, "
445	"create_disposition = 0x%x create_options = 0x%x "
446	"root_dir_fid = 0x%x, fname = %s\n",
447	(unsigned int)flags,
448	(unsigned int)access_mask,
449	(unsigned int)file_attributes,
450	(unsigned int)share_access,
451	(unsigned int)create_disposition,
452	(unsigned int)create_options,
453	(unsigned int)root_dir_fid,
454	fname));
455
456	/*
457	* we need to remove ignored bits when they come directly from the client
458	* because we reuse some of them for internal stuff
459	*/
460	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
461
462	/*
463	* If it's an IPC, use the pipe handler.
464	*/
465
466	if (IS_IPC(conn)) {
467	if (lp_nt_pipe_support()) {
468	do_ntcreate_pipe_open(conn, req);
469	END_PROFILE(SMBntcreateX);
470	return;
471	}
472	reply_doserror(req, ERRDOS, ERRnoaccess);
473	END_PROFILE(SMBntcreateX);
474	return;
475	}
476
477	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
478	if (oplock_request) {
479	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
480	? BATCH_OPLOCK : 0;
481	}
482
483	status = create_file(conn, req, root_dir_fid, fname,
484	access_mask, share_access, create_disposition,
485	create_options, file_attributes, oplock_request,
486	allocation_size, NULL, NULL, &fsp, &info, &sbuf);
487
488	if (!NT_STATUS_IS_OK(status)) {
489	if (open_was_deferred(req->mid)) {
490	/* We have re-scheduled this call, no error. */
491	END_PROFILE(SMBntcreateX);
492	return;
493	}
494	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
495	reply_botherror(req, status, ERRDOS, ERRfilexists);
496	}
497	else {
498	reply_nterror(req, status);
499	}
500	END_PROFILE(SMBntcreateX);
501	return;
502	}
503
504	/*
505	* If the caller set the extended oplock request bit
506	* and we granted one (by whatever means) - set the
507	* correct bit for extended oplock reply.
508	*/
509
510	if (oplock_request &&
511	(lp_fake_oplocks(SNUM(conn))
512	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
513
514	/*
515	* Exclusive oplock granted
516	*/
517
518	if (flags & REQUEST_BATCH_OPLOCK) {
519	oplock_granted = BATCH_OPLOCK_RETURN;
520	} else {
521	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
522	}
523	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
524	oplock_granted = LEVEL_II_OPLOCK_RETURN;
525	} else {
526	oplock_granted = NO_OPLOCK_RETURN;
527	}
528
529	file_len = sbuf.st_size;
530	fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
531	if (fattr == 0) {
532	fattr = FILE_ATTRIBUTE_NORMAL;
533	}
534
535	if (flags & EXTENDED_RESPONSE_REQUIRED) {
536	/* This is very strange. We
537	* return 50 words, but only set
538	* the wcnt to 42 ? It's definately
539	* what happens on the wire....
540	*/
541	reply_outbuf(req, 50, 0);
542	SCVAL(req->outbuf,smb_wct,42);
543	} else {
544	reply_outbuf(req, 34, 0);
545	}
546
547	p = (char *)req->outbuf + smb_vwv2;
548
549	SCVAL(p, 0, oplock_granted);
550
551	p++;
552	SSVAL(p,0,fsp->fnum);
553	p += 2;
554	if ((create_disposition == FILE_SUPERSEDE)
555	&& (info == FILE_WAS_OVERWRITTEN)) {
556	SIVAL(p,0,FILE_WAS_SUPERSEDED);
557	} else {
558	SIVAL(p,0,info);
559	}
560	p += 4;
561
562	/* Create time. */
563	c_timespec = get_create_timespec(
564	&sbuf,lp_fake_dir_create_times(SNUM(conn)));
565	a_timespec = get_atimespec(&sbuf);
566	m_timespec = get_mtimespec(&sbuf);
567
568	if (lp_dos_filetime_resolution(SNUM(conn))) {
569	dos_filetime_timespec(&c_timespec);
570	dos_filetime_timespec(&a_timespec);
571	dos_filetime_timespec(&m_timespec);
572	}
573
574	put_long_date_timespec(p, c_timespec); /* create time. */
575	p += 8;
576	put_long_date_timespec(p, a_timespec); /* access time */
577	p += 8;
578	put_long_date_timespec(p, m_timespec); /* write time */
579	p += 8;
580	put_long_date_timespec(p, m_timespec); /* change time */
581	p += 8;
582	SIVAL(p,0,fattr); /* File Attributes. */
583	p += 4;
584	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
585	p += 8;
586	SOFF_T(p,0,file_len);
587	p += 8;
588	if (flags & EXTENDED_RESPONSE_REQUIRED) {
589	SSVAL(p,2,0x7);
590	}
591	p += 4;
592	SCVAL(p,0,fsp->is_directory ? 1 : 0);
593
594	if (flags & EXTENDED_RESPONSE_REQUIRED) {
595	uint32 perms = 0;
596	p += 25;
597	if (fsp->is_directory
598	\|\| can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
599	perms = FILE_GENERIC_ALL;
600	} else {
601	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
602	}
603	SIVAL(p,0,perms);
604	}
605
606	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
607	fsp->fnum, fsp->fsp_name));
608
609	chain_reply(req);
610	END_PROFILE(SMBntcreateX);
611	return;
612	}
613
614	/****************************************************************************
615	Reply to a NT_TRANSACT_CREATE call to open a pipe.
616	****************************************************************************/
617
618	static void do_nt_transact_create_pipe(connection_struct *conn,
619	struct smb_request *req,
620	uint16 **ppsetup, uint32 setup_count,
621	char **ppparams, uint32 parameter_count,
622	char **ppdata, uint32 data_count)
623	{
624	char *fname = NULL;
625	char params = ppparams;
626	int pnum = -1;
627	char *p = NULL;
628	NTSTATUS status;
629	size_t param_len;
630	uint32 flags;
631	TALLOC_CTX *ctx = talloc_tos();
632
633	/*
634	* Ensure minimum number of parameters sent.
635	*/
636
637	if(parameter_count < 54) {
638	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
639	reply_doserror(req, ERRDOS, ERRnoaccess);
640	return;
641	}
642
643	flags = IVAL(params,0);
644
645	srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
646	parameter_count-53, STR_TERMINATE,
647	&status);
648	if (!NT_STATUS_IS_OK(status)) {
649	reply_nterror(req, status);
650	return;
651	}
652
653	nt_open_pipe(fname, conn, req, &pnum);
654
655	if (req->outbuf) {
656	/* Error return */
657	return;
658	}
659
660	/* Realloc the size of parameters and data we will return */
661	if (flags & EXTENDED_RESPONSE_REQUIRED) {
662	/* Extended response is 32 more byyes. */
663	param_len = 101;
664	} else {
665	param_len = 69;
666	}
667	params = nttrans_realloc(ppparams, param_len);
668	if(params == NULL) {
669	reply_doserror(req, ERRDOS, ERRnomem);
670	return;
671	}
672
673	p = params;
674	SCVAL(p,0,NO_OPLOCK_RETURN);
675
676	p += 2;
677	SSVAL(p,0,pnum);
678	p += 2;
679	SIVAL(p,0,FILE_WAS_OPENED);
680	p += 8;
681
682	p += 32;
683	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
684	p += 20;
685	/* File type. */
686	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
687	/* Device state. */
688	SSVAL(p,2, 0x5FF); /* ? */
689	p += 4;
690
691	if (flags & EXTENDED_RESPONSE_REQUIRED) {
692	p += 25;
693	SIVAL(p,0,FILE_GENERIC_ALL);
694	/*
695	* For pipes W2K3 seems to return
696	* 0x12019B next.
697	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
698	*/
699	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
700	}
701
702	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
703
704	/* Send the required number of replies */
705	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
706
707	return;
708	}
709
710	/****************************************************************************
711	Internal fn to set security descriptors.
712	****************************************************************************/
713
714	static NTSTATUS set_sd(files_struct fsp, uint8 data, uint32 sd_len,
715	uint32 security_info_sent)
716	{
717	SEC_DESC *psd = NULL;
718	NTSTATUS status;
719
720	if (sd_len == 0 \|\| !lp_nt_acl_support(SNUM(fsp->conn))) {
721	return NT_STATUS_OK;
722	}
723
724	status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
725
726	if (!NT_STATUS_IS_OK(status)) {
727	return status;
728	}
729
730	if (psd->owner_sid == NULL) {
731	security_info_sent &= ~OWNER_SECURITY_INFORMATION;
732	}
733	if (psd->group_sid == NULL) {
734	security_info_sent &= ~GROUP_SECURITY_INFORMATION;
735	}
736
737	/* Convert all the generic bits. */
738	security_acl_map_generic(psd->dacl, &file_generic_mapping);
739	security_acl_map_generic(psd->sacl, &file_generic_mapping);
740
741	if (DEBUGLEVEL >= 10) {
742	DEBUG(10,("set_sd for file %s\n", fsp->fsp_name ));
743	NDR_PRINT_DEBUG(security_descriptor, psd);
744	}
745
746	status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
747
748	TALLOC_FREE(psd);
749
750	return status;
751	}
752
753	/****************************************************************************
754	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
755	****************************************************************************/
756
757	static struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
758	{
759	struct ea_list *ea_list_head = NULL;
760	size_t offset = 0;
761
762	if (data_size < 4) {
763	return NULL;
764	}
765
766	while (offset + 4 <= data_size) {
767	size_t next_offset = IVAL(pdata,offset);
768	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
769
770	if (!eal) {
771	return NULL;
772	}
773
774	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
775	if (next_offset == 0) {
776	break;
777	}
778	offset += next_offset;
779	}
780
781	return ea_list_head;
782	}
783
784	/****************************************************************************
785	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
786	****************************************************************************/
787
788	static void call_nt_transact_create(connection_struct *conn,
789	struct smb_request *req,
790	uint16 **ppsetup, uint32 setup_count,
791	char **ppparams, uint32 parameter_count,
792	char **ppdata, uint32 data_count,
793	uint32 max_data_count)
794	{
795	char *fname = NULL;
796	char params = ppparams;
797	char data = ppdata;
798	/* Breakout the oplock request bits so we can set the reply bits separately. */
799	uint32 fattr=0;
800	SMB_OFF_T file_len = 0;
801	SMB_STRUCT_STAT sbuf;
802	int info = 0;
803	files_struct *fsp = NULL;
804	char *p = NULL;
805	uint32 flags;
806	uint32 access_mask;
807	uint32 file_attributes;
808	uint32 share_access;
809	uint32 create_disposition;
810	uint32 create_options;
811	uint32 sd_len;
812	struct security_descriptor *sd = NULL;
813	uint32 ea_len;
814	uint16 root_dir_fid;
815	struct timespec c_timespec;
816	struct timespec a_timespec;
817	struct timespec m_timespec;
818	struct ea_list *ea_list = NULL;
819	NTSTATUS status;
820	size_t param_len;
821	SMB_BIG_UINT allocation_size;
822	int oplock_request;
823	uint8_t oplock_granted;
824	TALLOC_CTX *ctx = talloc_tos();
825
826	DEBUG(5,("call_nt_transact_create\n"));
827
828	/*
829	* If it's an IPC, use the pipe handler.
830	*/
831
832	if (IS_IPC(conn)) {
833	if (lp_nt_pipe_support()) {
834	do_nt_transact_create_pipe(
835	conn, req,
836	ppsetup, setup_count,
837	ppparams, parameter_count,
838	ppdata, data_count);
839	return;
840	}
841	reply_doserror(req, ERRDOS, ERRnoaccess);
842	return;
843	}
844
845	/*
846	* Ensure minimum number of parameters sent.
847	*/
848
849	if(parameter_count < 54) {
850	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
851	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
852	return;
853	}
854
855	flags = IVAL(params,0);
856	access_mask = IVAL(params,8);
857	file_attributes = IVAL(params,20);
858	share_access = IVAL(params,24);
859	create_disposition = IVAL(params,28);
860	create_options = IVAL(params,32);
861	sd_len = IVAL(params,36);
862	ea_len = IVAL(params,40);
863	root_dir_fid = (uint16)IVAL(params,4);
864	allocation_size = (SMB_BIG_UINT)IVAL(params,12);
865	#ifdef LARGE_SMB_OFF_T
866	allocation_size \|= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
867	#endif
868
869	/*
870	* we need to remove ignored bits when they come directly from the client
871	* because we reuse some of them for internal stuff
872	*/
873	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
874
875	/* Ensure the data_len is correct for the sd and ea values given. */
876	if ((ea_len + sd_len > data_count)
877	\|\| (ea_len > data_count) \|\| (sd_len > data_count)
878	\|\| (ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
879	DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
880	"%u, data_count = %u\n", (unsigned int)ea_len,
881	(unsigned int)sd_len, (unsigned int)data_count));
882	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
883	return;
884	}
885
886	if (sd_len) {
887	DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
888	sd_len));
889
890	status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
891	&sd);
892	if (!NT_STATUS_IS_OK(status)) {
893	DEBUG(10, ("call_nt_transact_create: "
894	"unmarshall_sec_desc failed: %s\n",
895	nt_errstr(status)));
896	reply_nterror(req, status);
897	return;
898	}
899	}
900
901	if (ea_len) {
902	if (!lp_ea_support(SNUM(conn))) {
903	DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
904	"EA's not supported.\n",
905	(unsigned int)ea_len));
906	reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
907	return;
908	}
909
910	if (ea_len < 10) {
911	DEBUG(10,("call_nt_transact_create - ea_len = %u - "
912	"too small (should be more than 10)\n",
913	(unsigned int)ea_len ));
914	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
915	return;
916	}
917
918	/* We have already checked that ea_len <= data_count here. */
919	ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
920	ea_len);
921	if (ea_list == NULL) {
922	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
923	return;
924	}
925	}
926
927	srvstr_get_path(ctx, params, req->flags2, &fname,
928	params+53, parameter_count-53,
929	STR_TERMINATE, &status);
930	if (!NT_STATUS_IS_OK(status)) {
931	reply_nterror(req, status);
932	return;
933	}
934
935	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
936	if (oplock_request) {
937	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
938	? BATCH_OPLOCK : 0;
939	}
940
941	status = create_file(conn, req, root_dir_fid, fname,
942	access_mask, share_access, create_disposition,
943	create_options, file_attributes, oplock_request,
944	allocation_size, sd, ea_list, &fsp, &info, &sbuf);
945
946	if(!NT_STATUS_IS_OK(status)) {
947	if (open_was_deferred(req->mid)) {
948	/* We have re-scheduled this call, no error. */
949	return;
950	}
951	reply_openerror(req, status);
952	return;
953	}
954
955	/*
956	* If the caller set the extended oplock request bit
957	* and we granted one (by whatever means) - set the
958	* correct bit for extended oplock reply.
959	*/
960
961	if (oplock_request &&
962	(lp_fake_oplocks(SNUM(conn))
963	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
964
965	/*
966	* Exclusive oplock granted
967	*/
968
969	if (flags & REQUEST_BATCH_OPLOCK) {
970	oplock_granted = BATCH_OPLOCK_RETURN;
971	} else {
972	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
973	}
974	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
975	oplock_granted = LEVEL_II_OPLOCK_RETURN;
976	} else {
977	oplock_granted = NO_OPLOCK_RETURN;
978	}
979
980	file_len = sbuf.st_size;
981	fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
982	if (fattr == 0) {
983	fattr = FILE_ATTRIBUTE_NORMAL;
984	}
985
986	/* Realloc the size of parameters and data we will return */
987	if (flags & EXTENDED_RESPONSE_REQUIRED) {
988	/* Extended response is 32 more byyes. */
989	param_len = 101;
990	} else {
991	param_len = 69;
992	}
993	params = nttrans_realloc(ppparams, param_len);
994	if(params == NULL) {
995	reply_doserror(req, ERRDOS, ERRnomem);
996	return;
997	}
998
999	p = params;
1000	SCVAL(p, 0, oplock_granted);
1001
1002	p += 2;
1003	SSVAL(p,0,fsp->fnum);
1004	p += 2;
1005	if ((create_disposition == FILE_SUPERSEDE)
1006	&& (info == FILE_WAS_OVERWRITTEN)) {
1007	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1008	} else {
1009	SIVAL(p,0,info);
1010	}
1011	p += 8;
1012
1013	/* Create time. */
1014	c_timespec = get_create_timespec(
1015	&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1016	a_timespec = get_atimespec(&sbuf);
1017	m_timespec = get_mtimespec(&sbuf);
1018
1019	if (lp_dos_filetime_resolution(SNUM(conn))) {
1020	dos_filetime_timespec(&c_timespec);
1021	dos_filetime_timespec(&a_timespec);
1022	dos_filetime_timespec(&m_timespec);
1023	}
1024
1025	put_long_date_timespec(p, c_timespec); /* create time. */
1026	p += 8;
1027	put_long_date_timespec(p, a_timespec); /* access time */
1028	p += 8;
1029	put_long_date_timespec(p, m_timespec); /* write time */
1030	p += 8;
1031	put_long_date_timespec(p, m_timespec); /* change time */
1032	p += 8;
1033	SIVAL(p,0,fattr); /* File Attributes. */
1034	p += 4;
1035	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1036	p += 8;
1037	SOFF_T(p,0,file_len);
1038	p += 8;
1039	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1040	SSVAL(p,2,0x7);
1041	}
1042	p += 4;
1043	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1044
1045	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1046	uint32 perms = 0;
1047	p += 25;
1048	if (fsp->is_directory
1049	\|\| can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1050	perms = FILE_GENERIC_ALL;
1051	} else {
1052	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
1053	}
1054	SIVAL(p,0,perms);
1055	}
1056
1057	DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1058
1059	/* Send the required number of replies */
1060	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1061
1062	return;
1063	}
1064
1065	/****************************************************************************
1066	Reply to a NT CANCEL request.
1067	conn POINTER CAN BE NULL HERE !
1068	****************************************************************************/
1069
1070	void reply_ntcancel(struct smb_request *req)
1071	{
1072	/*
1073	* Go through and cancel any pending change notifies.
1074	*/
1075
1076	START_PROFILE(SMBntcancel);
1077	remove_pending_change_notify_requests_by_mid(req->mid);
1078	remove_pending_lock_requests_by_mid(req->mid);
1079	srv_cancel_sign_response(req->mid, true);
1080
1081	DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1082
1083	END_PROFILE(SMBntcancel);
1084	return;
1085	}
1086
1087	/****************************************************************************
1088	Copy a file.
1089	****************************************************************************/
1090
1091	static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1092	connection_struct *conn,
1093	struct smb_request *req,
1094	const char *oldname_in,
1095	const char *newname_in,
1096	uint32 attrs)
1097	{
1098	SMB_STRUCT_STAT sbuf1, sbuf2;
1099	char *oldname = NULL;
1100	char *newname = NULL;
1101	char *last_component_oldname = NULL;
1102	char *last_component_newname = NULL;
1103	files_struct fsp1,fsp2;
1104	uint32 fattr;
1105	int info;
1106	SMB_OFF_T ret=-1;
1107	NTSTATUS status = NT_STATUS_OK;
1108
1109	ZERO_STRUCT(sbuf1);
1110	ZERO_STRUCT(sbuf2);
1111
1112	if (!CAN_WRITE(conn)) {
1113	return NT_STATUS_MEDIA_WRITE_PROTECTED;
1114	}
1115
1116	status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1117	&last_component_oldname, &sbuf1);
1118	if (!NT_STATUS_IS_OK(status)) {
1119	return status;
1120	}
1121
1122	status = check_name(conn, oldname);
1123	if (!NT_STATUS_IS_OK(status)) {
1124	return status;
1125	}
1126
1127	/* Source must already exist. */
1128	if (!VALID_STAT(sbuf1)) {
1129	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1130	}
1131	/* Ensure attributes match. */
1132	fattr = dos_mode(conn,oldname,&sbuf1);
1133	if ((fattr & ~attrs) & (aHIDDEN \| aSYSTEM)) {
1134	return NT_STATUS_NO_SUCH_FILE;
1135	}
1136
1137	status = unix_convert(ctx, conn, newname_in, False, &newname,
1138	&last_component_newname, &sbuf2);
1139	if (!NT_STATUS_IS_OK(status)) {
1140	return status;
1141	}
1142
1143	status = check_name(conn, newname);
1144	if (!NT_STATUS_IS_OK(status)) {
1145	return status;
1146	}
1147
1148	/* Disallow if newname already exists. */
1149	if (VALID_STAT(sbuf2)) {
1150	return NT_STATUS_OBJECT_NAME_COLLISION;
1151	}
1152
1153	/* No links from a directory. */
1154	if (S_ISDIR(sbuf1.st_mode)) {
1155	return NT_STATUS_FILE_IS_A_DIRECTORY;
1156	}
1157
1158	/* Ensure this is within the share. */
1159	status = check_reduced_name(conn, oldname);
1160	if (!NT_STATUS_IS_OK(status)) {
1161	return status;
1162	}
1163
1164	DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1165	oldname, newname));
1166
1167	status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1168	FILE_READ_DATA, /* Read-only. */
1169	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1170	FILE_OPEN,
1171	0, /* No create options. */
1172	FILE_ATTRIBUTE_NORMAL,
1173	NO_OPLOCK,
1174	&info, &fsp1);
1175
1176	if (!NT_STATUS_IS_OK(status)) {
1177	return status;
1178	}
1179
1180	status = open_file_ntcreate(conn, req, newname, &sbuf2,
1181	FILE_WRITE_DATA, /* Read-only. */
1182	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1183	FILE_CREATE,
1184	0, /* No create options. */
1185	fattr,
1186	NO_OPLOCK,
1187	&info, &fsp2);
1188
1189	if (!NT_STATUS_IS_OK(status)) {
1190	close_file(fsp1,ERROR_CLOSE);
1191	return status;
1192	}
1193
1194	if (sbuf1.st_size) {
1195	ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1196	}
1197
1198	/*
1199	* As we are opening fsp1 read-only we only expect
1200	* an error on close on fsp2 if we are out of space.
1201	* Thus we don't look at the error return from the
1202	* close of fsp1.
1203	*/
1204	close_file(fsp1,NORMAL_CLOSE);
1205
1206	/* Ensure the modtime is set correctly on the destination file. */
1207	set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1208
1209	status = close_file(fsp2,NORMAL_CLOSE);
1210
1211	/* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1212	creates the file. This isn't the correct thing to do in the copy
1213	case. JRA */
1214	file_set_dosmode(conn, newname, fattr, &sbuf2,
1215	parent_dirname(newname),false);
1216
1217	if (ret < (SMB_OFF_T)sbuf1.st_size) {
1218	return NT_STATUS_DISK_FULL;
1219	}
1220
1221	if (!NT_STATUS_IS_OK(status)) {
1222	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1223	nt_errstr(status), oldname, newname));
1224	}
1225	return status;
1226	}
1227
1228	/****************************************************************************
1229	Reply to a NT rename request.
1230	****************************************************************************/
1231
1232	void reply_ntrename(struct smb_request *req)
1233	{
1234	connection_struct *conn = req->conn;
1235	char *oldname = NULL;
1236	char *newname = NULL;
1237	char *p;
1238	NTSTATUS status;
1239	bool src_has_wcard = False;
1240	bool dest_has_wcard = False;
1241	uint32 attrs;
1242	uint16 rename_type;
1243	TALLOC_CTX *ctx = talloc_tos();
1244
1245	START_PROFILE(SMBntrename);
1246
1247	if (req->wct < 4) {
1248	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1249	END_PROFILE(SMBntrename);
1250	return;
1251	}
1252
1253	attrs = SVAL(req->inbuf,smb_vwv0);
1254	rename_type = SVAL(req->inbuf,smb_vwv1);
1255
1256	p = smb_buf(req->inbuf) + 1;
1257	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1258	0, STR_TERMINATE, &status,
1259	&src_has_wcard);
1260	if (!NT_STATUS_IS_OK(status)) {
1261	reply_nterror(req, status);
1262	END_PROFILE(SMBntrename);
1263	return;
1264	}
1265
1266	if (ms_has_wild(oldname)) {
1267	reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1268	END_PROFILE(SMBntrename);
1269	return;
1270	}
1271
1272	p++;
1273	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1274	0, STR_TERMINATE, &status,
1275	&dest_has_wcard);
1276	if (!NT_STATUS_IS_OK(status)) {
1277	reply_nterror(req, status);
1278	END_PROFILE(SMBntrename);
1279	return;
1280	}
1281
1282	status = resolve_dfspath(ctx, conn,
1283	req->flags2 & FLAGS2_DFS_PATHNAMES,
1284	oldname,
1285	&oldname);
1286	if (!NT_STATUS_IS_OK(status)) {
1287	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1288	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1289	ERRSRV, ERRbadpath);
1290	END_PROFILE(SMBntrename);
1291	return;
1292	}
1293	reply_nterror(req, status);
1294	END_PROFILE(SMBntrename);
1295	return;
1296	}
1297
1298	status = resolve_dfspath(ctx, conn,
1299	req->flags2 & FLAGS2_DFS_PATHNAMES,
1300	newname,
1301	&newname);
1302	if (!NT_STATUS_IS_OK(status)) {
1303	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1304	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1305	ERRSRV, ERRbadpath);
1306	END_PROFILE(SMBntrename);
1307	return;
1308	}
1309	reply_nterror(req, status);
1310	END_PROFILE(SMBntrename);
1311	return;
1312	}
1313
1314	/* The new name must begin with a ':' if the old name is a stream. */
1315	if (is_ntfs_stream_name(oldname) && (newname[0] != ':')) {
1316	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1317	END_PROFILE(SMBntrename);
1318	return;
1319	}
1320
1321	DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1322
1323	switch(rename_type) {
1324	case RENAME_FLAG_RENAME:
1325	status = rename_internals(ctx, conn, req, oldname,
1326	newname, attrs, False, src_has_wcard,
1327	dest_has_wcard, DELETE_ACCESS);
1328	break;
1329	case RENAME_FLAG_HARD_LINK:
1330	if (src_has_wcard \|\| dest_has_wcard) {
1331	/* No wildcards. */
1332	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1333	} else {
1334	status = hardlink_internals(ctx,
1335	conn,
1336	oldname,
1337	newname);
1338	}
1339	break;
1340	case RENAME_FLAG_COPY:
1341	if (src_has_wcard \|\| dest_has_wcard) {
1342	/* No wildcards. */
1343	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1344	} else {
1345	status = copy_internals(ctx, conn, req, oldname,
1346	newname, attrs);
1347	}
1348	break;
1349	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1350	status = NT_STATUS_INVALID_PARAMETER;
1351	break;
1352	default:
1353	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1354	break;
1355	}
1356
1357	if (!NT_STATUS_IS_OK(status)) {
1358	if (open_was_deferred(req->mid)) {
1359	/* We have re-scheduled this call. */
1360	END_PROFILE(SMBntrename);
1361	return;
1362	}
1363
1364	reply_nterror(req, status);
1365	END_PROFILE(SMBntrename);
1366	return;
1367	}
1368
1369	reply_outbuf(req, 0, 0);
1370
1371	END_PROFILE(SMBntrename);
1372	return;
1373	}
1374
1375	/****************************************************************************
1376	Reply to a notify change - queue the request and
1377	don't allow a directory to be opened.
1378	****************************************************************************/
1379
1380	static void call_nt_transact_notify_change(connection_struct *conn,
1381	struct smb_request *req,
1382	uint16 **ppsetup,
1383	uint32 setup_count,
1384	char **ppparams,
1385	uint32 parameter_count,
1386	char **ppdata, uint32 data_count,
1387	uint32 max_data_count,
1388	uint32 max_param_count)
1389	{
1390	uint16 setup = ppsetup;
1391	files_struct *fsp;
1392	uint32 filter;
1393	NTSTATUS status;
1394	bool recursive;
1395
1396	if(setup_count < 6) {
1397	reply_doserror(req, ERRDOS, ERRbadfunc);
1398	return;
1399	}
1400
1401	fsp = file_fsp(SVAL(setup,4));
1402	filter = IVAL(setup, 0);
1403	recursive = (SVAL(setup, 6) != 0) ? True : False;
1404
1405	DEBUG(3,("call_nt_transact_notify_change\n"));
1406
1407	if(!fsp) {
1408	reply_doserror(req, ERRDOS, ERRbadfid);
1409	return;
1410	}
1411
1412	{
1413	char *filter_string;
1414
1415	if (!(filter_string = notify_filter_string(NULL, filter))) {
1416	reply_nterror(req,NT_STATUS_NO_MEMORY);
1417	return;
1418	}
1419
1420	DEBUG(3,("call_nt_transact_notify_change: notify change "
1421	"called on %s, filter = %s, recursive = %d\n",
1422	fsp->fsp_name, filter_string, recursive));
1423
1424	TALLOC_FREE(filter_string);
1425	}
1426
1427	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1428	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1429	return;
1430	}
1431
1432	if (fsp->notify == NULL) {
1433
1434	status = change_notify_create(fsp, filter, recursive);
1435
1436	if (!NT_STATUS_IS_OK(status)) {
1437	DEBUG(10, ("change_notify_create returned %s\n",
1438	nt_errstr(status)));
1439	reply_nterror(req, status);
1440	return;
1441	}
1442	}
1443
1444	if (fsp->notify->num_changes != 0) {
1445
1446	/*
1447	* We've got changes pending, respond immediately
1448	*/
1449
1450	/*
1451	* TODO: write a torture test to check the filtering behaviour
1452	* here.
1453	*/
1454
1455	change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1456
1457	/*
1458	* change_notify_reply() above has independently sent its
1459	* results
1460	*/
1461	return;
1462	}
1463
1464	/*
1465	* No changes pending, queue the request
1466	*/
1467
1468	status = change_notify_add_request(req,
1469	max_param_count,
1470	filter,
1471	recursive, fsp);
1472	if (!NT_STATUS_IS_OK(status)) {
1473	reply_nterror(req, status);
1474	}
1475	return;
1476	}
1477
1478	/****************************************************************************
1479	Reply to an NT transact rename command.
1480	****************************************************************************/
1481
1482	static void call_nt_transact_rename(connection_struct *conn,
1483	struct smb_request *req,
1484	uint16 **ppsetup, uint32 setup_count,
1485	char **ppparams, uint32 parameter_count,
1486	char **ppdata, uint32 data_count,
1487	uint32 max_data_count)
1488	{
1489	char params = ppparams;
1490	char *new_name = NULL;
1491	files_struct *fsp = NULL;
1492	bool dest_has_wcard = False;
1493	NTSTATUS status;
1494	TALLOC_CTX *ctx = talloc_tos();
1495
1496	if(parameter_count < 5) {
1497	reply_doserror(req, ERRDOS, ERRbadfunc);
1498	return;
1499	}
1500
1501	fsp = file_fsp(SVAL(params, 0));
1502	if (!check_fsp(conn, req, fsp)) {
1503	return;
1504	}
1505	srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1506	parameter_count - 4,
1507	STR_TERMINATE, &status, &dest_has_wcard);
1508	if (!NT_STATUS_IS_OK(status)) {
1509	reply_nterror(req, status);
1510	return;
1511	}
1512
1513	/*
1514	* W2K3 ignores this request as the RAW-RENAME test
1515	* demonstrates, so we do.
1516	*/
1517	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1518
1519	DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1520	fsp->fsp_name, new_name));
1521
1522	return;
1523	}
1524
1525	/******************************************************************************
1526	Fake up a completely empty SD.
1527	*******************************************************************************/
1528
1529	static NTSTATUS get_null_nt_acl(TALLOC_CTX mem_ctx, SEC_DESC *ppsd)
1530	{
1531	size_t sd_size;
1532
1533	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1534	if(!*ppsd) {
1535	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1536	return NT_STATUS_NO_MEMORY;
1537	}
1538
1539	return NT_STATUS_OK;
1540	}
1541
1542	/****************************************************************************
1543	Reply to query a security descriptor.
1544	****************************************************************************/
1545
1546	static void call_nt_transact_query_security_desc(connection_struct *conn,
1547	struct smb_request *req,
1548	uint16 **ppsetup,
1549	uint32 setup_count,
1550	char **ppparams,
1551	uint32 parameter_count,
1552	char **ppdata,
1553	uint32 data_count,
1554	uint32 max_data_count)
1555	{
1556	char params = ppparams;
1557	char data = ppdata;
1558	SEC_DESC *psd = NULL;
1559	size_t sd_size;
1560	uint32 security_info_wanted;
1561	files_struct *fsp = NULL;
1562	NTSTATUS status;
1563	DATA_BLOB blob;
1564
1565	if(parameter_count < 8) {
1566	reply_doserror(req, ERRDOS, ERRbadfunc);
1567	return;
1568	}
1569
1570	fsp = file_fsp(SVAL(params,0));
1571	if(!fsp) {
1572	reply_doserror(req, ERRDOS, ERRbadfid);
1573	return;
1574	}
1575
1576	security_info_wanted = IVAL(params,4);
1577
1578	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1579	(unsigned int)security_info_wanted ));
1580
1581	params = nttrans_realloc(ppparams, 4);
1582	if(params == NULL) {
1583	reply_doserror(req, ERRDOS, ERRnomem);
1584	return;
1585	}
1586
1587	/*
1588	* Get the permissions to return.
1589	*/
1590
1591	if (!lp_nt_acl_support(SNUM(conn))) {
1592	status = get_null_nt_acl(talloc_tos(), &psd);
1593	} else {
1594	status = SMB_VFS_FGET_NT_ACL(
1595	fsp, security_info_wanted, &psd);
1596	}
1597	if (!NT_STATUS_IS_OK(status)) {
1598	reply_nterror(req, status);
1599	return;
1600	}
1601
1602	/* If the SACL/DACL is NULL, but was requested, we mark that it is
1603	* present in the reply to match Windows behavior */
1604	if (psd->sacl == NULL &&
1605	security_info_wanted & SACL_SECURITY_INFORMATION)
1606	psd->type \|= SEC_DESC_SACL_PRESENT;
1607	if (psd->dacl == NULL &&
1608	security_info_wanted & DACL_SECURITY_INFORMATION)
1609	psd->type \|= SEC_DESC_DACL_PRESENT;
1610
1611	sd_size = ndr_size_security_descriptor(psd, 0);
1612
1613	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1614
1615	if (DEBUGLEVEL >= 10) {
1616	DEBUG(10,("call_nt_transact_query_security_desc for file %s\n", fsp->fsp_name ));
1617	NDR_PRINT_DEBUG(security_descriptor, psd);
1618	}
1619
1620	SIVAL(params,0,(uint32)sd_size);
1621
1622	if (max_data_count < sd_size) {
1623	send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1624	params, 4, *ppdata, 0);
1625	return;
1626	}
1627
1628	/*
1629	* Allocate the data we will point this at.
1630	*/
1631
1632	data = nttrans_realloc(ppdata, sd_size);
1633	if(data == NULL) {
1634	reply_doserror(req, ERRDOS, ERRnomem);
1635	return;
1636	}
1637
1638	status = marshall_sec_desc(talloc_tos(), psd,
1639	&blob.data, &blob.length);
1640
1641	if (!NT_STATUS_IS_OK(status)) {
1642	reply_nterror(req, status);
1643	return;
1644	}
1645
1646	SMB_ASSERT(sd_size == blob.length);
1647	memcpy(data, blob.data, sd_size);
1648
1649	send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1650
1651	return;
1652	}
1653
1654	/****************************************************************************
1655	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1656	****************************************************************************/
1657
1658	static void call_nt_transact_set_security_desc(connection_struct *conn,
1659	struct smb_request *req,
1660	uint16 **ppsetup,
1661	uint32 setup_count,
1662	char **ppparams,
1663	uint32 parameter_count,
1664	char **ppdata,
1665	uint32 data_count,
1666	uint32 max_data_count)
1667	{
1668	char params= ppparams;
1669	char data = ppdata;
1670	files_struct *fsp = NULL;
1671	uint32 security_info_sent = 0;
1672	NTSTATUS status;
1673
1674	if(parameter_count < 8) {
1675	reply_doserror(req, ERRDOS, ERRbadfunc);
1676	return;
1677	}
1678
1679	if((fsp = file_fsp(SVAL(params,0))) == NULL) {
1680	reply_doserror(req, ERRDOS, ERRbadfid);
1681	return;
1682	}
1683
1684	if(!lp_nt_acl_support(SNUM(conn))) {
1685	goto done;
1686	}
1687
1688	security_info_sent = IVAL(params,4);
1689
1690	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1691	(unsigned int)security_info_sent ));
1692
1693	if (data_count == 0) {
1694	reply_doserror(req, ERRDOS, ERRnoaccess);
1695	return;
1696	}
1697
1698	status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1699
1700	if (!NT_STATUS_IS_OK(status)) {
1701	reply_nterror(req, status);
1702	return;
1703	}
1704
1705	done:
1706	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1707	return;
1708	}
1709
1710	/****************************************************************************
1711	Reply to NT IOCTL
1712	****************************************************************************/
1713
1714	static void call_nt_transact_ioctl(connection_struct *conn,
1715	struct smb_request *req,
1716	uint16 **ppsetup, uint32 setup_count,
1717	char **ppparams, uint32 parameter_count,
1718	char **ppdata, uint32 data_count,
1719	uint32 max_data_count)
1720	{
1721	uint32 function;
1722	uint16 fidnum;
1723	files_struct *fsp;
1724	uint8 isFSctl;
1725	uint8 compfilter;
1726	static bool logged_message;
1727	char pdata = ppdata;
1728
1729	if (setup_count != 8) {
1730	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1731	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1732	return;
1733	}
1734
1735	function = IVAL(*ppsetup, 0);
1736	fidnum = SVAL(*ppsetup, 4);
1737	isFSctl = CVAL(*ppsetup, 6);
1738	compfilter = CVAL(*ppsetup, 7);
1739
1740	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1741	function, fidnum, isFSctl, compfilter));
1742
1743	fsp=file_fsp(fidnum);
1744	/* this check is done in each implemented function case for now
1745	because I don't want to break anything... --metze
1746	FSP_BELONGS_CONN(fsp,conn);*/
1747
1748	switch (function) {
1749	case FSCTL_SET_SPARSE:
1750	/* pretend this succeeded - tho strictly we should
1751	mark the file sparse (if the local fs supports it)
1752	so we can know if we need to pre-allocate or not */
1753
1754	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1755	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1756	return;
1757
1758	case FSCTL_CREATE_OR_GET_OBJECT_ID:
1759	{
1760	unsigned char objid[16];
1761
1762	/* This should return the object-id on this file.
1763	* I think I'll make this be the inode+dev. JRA.
1764	*/
1765
1766	DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1767
1768	if (!fsp_belongs_conn(conn, req, fsp)) {
1769	return;
1770	}
1771
1772	data_count = 64;
1773	pdata = nttrans_realloc(ppdata, data_count);
1774	if (pdata == NULL) {
1775	reply_nterror(req, NT_STATUS_NO_MEMORY);
1776	return;
1777	}
1778	push_file_id_16(pdata, &fsp->file_id);
1779	memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1780	push_file_id_16(pdata+32, &fsp->file_id);
1781	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1782	pdata, data_count);
1783	return;
1784	}
1785
1786	case FSCTL_GET_REPARSE_POINT:
1787	/* pretend this fail - my winXP does it like this
1788	* --metze
1789	*/
1790
1791	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1792	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1793	return;
1794
1795	case FSCTL_SET_REPARSE_POINT:
1796	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1797	* --metze
1798	*/
1799
1800	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1801	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1802	return;
1803
1804	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1805	{
1806	/*
1807	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1808	* and return their volume names. If max_data_count is 16, then it is just
1809	* asking for the number of volumes and length of the combined names.
1810	*
1811	* pdata is the data allocated by our caller, but that uses
1812	* total_data_count (which is 0 in our case) rather than max_data_count.
1813	* Allocate the correct amount and return the pointer to let
1814	* it be deallocated when we return.
1815	*/
1816	SHADOW_COPY_DATA *shadow_data = NULL;
1817	TALLOC_CTX *shadow_mem_ctx = NULL;
1818	bool labels = False;
1819	uint32 labels_data_count = 0;
1820	uint32 i;
1821	char *cur_pdata;
1822
1823	if (!fsp_belongs_conn(conn, req, fsp)) {
1824	return;
1825	}
1826
1827	if (max_data_count < 16) {
1828	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1829	max_data_count));
1830	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1831	return;
1832	}
1833
1834	if (max_data_count > 16) {
1835	labels = True;
1836	}
1837
1838	shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1839	if (shadow_mem_ctx == NULL) {
1840	DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1841	reply_nterror(req, NT_STATUS_NO_MEMORY);
1842	return;
1843	}
1844
1845	shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1846	if (shadow_data == NULL) {
1847	DEBUG(0,("TALLOC_ZERO() failed!\n"));
1848	talloc_destroy(shadow_mem_ctx);
1849	reply_nterror(req, NT_STATUS_NO_MEMORY);
1850	return;
1851	}
1852
1853	shadow_data->mem_ctx = shadow_mem_ctx;
1854
1855	/*
1856	* Call the VFS routine to actually do the work.
1857	*/
1858	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1859	talloc_destroy(shadow_data->mem_ctx);
1860	if (errno == ENOSYS) {
1861	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1862	conn->connectpath));
1863	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1864	return;
1865	} else {
1866	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1867	conn->connectpath));
1868	reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1869	return;
1870	}
1871	}
1872
1873	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
1874
1875	if (!labels) {
1876	data_count = 16;
1877	} else {
1878	data_count = 12+labels_data_count+4;
1879	}
1880
1881	if (max_data_count<data_count) {
1882	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1883	max_data_count,data_count));
1884	talloc_destroy(shadow_data->mem_ctx);
1885	reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1886	return;
1887	}
1888
1889	pdata = nttrans_realloc(ppdata, data_count);
1890	if (pdata == NULL) {
1891	talloc_destroy(shadow_data->mem_ctx);
1892	reply_nterror(req, NT_STATUS_NO_MEMORY);
1893	return;
1894	}
1895
1896	cur_pdata = pdata;
1897
1898	/* num_volumes 4 bytes */
1899	SIVAL(pdata,0,shadow_data->num_volumes);
1900
1901	if (labels) {
1902	/* num_labels 4 bytes */
1903	SIVAL(pdata,4,shadow_data->num_volumes);
1904	}
1905
1906	/* needed_data_count 4 bytes */
1907	SIVAL(pdata, 8, labels_data_count+4);
1908
1909	cur_pdata+=12;
1910
1911	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1912	shadow_data->num_volumes,fsp->fsp_name));
1913	if (labels && shadow_data->labels) {
1914	for (i=0;i<shadow_data->num_volumes;i++) {
1915	srvstr_push(pdata, req->flags2,
1916	cur_pdata, shadow_data->labels[i],
1917	2*sizeof(SHADOW_COPY_LABEL),
1918	STR_UNICODE\|STR_TERMINATE);
1919	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1920	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1921	}
1922	}
1923
1924	talloc_destroy(shadow_data->mem_ctx);
1925
1926	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1927	pdata, data_count);
1928
1929	return;
1930	}
1931
1932	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1933	{
1934	/* pretend this succeeded -
1935	*
1936	* we have to send back a list with all files owned by this SID
1937	*
1938	* but I have to check that --metze
1939	*/
1940	DOM_SID sid;
1941	uid_t uid;
1942	size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1943
1944	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1945
1946	if (!fsp_belongs_conn(conn, req, fsp)) {
1947	return;
1948	}
1949
1950	/* unknown 4 bytes: this is not the length of the sid :-( */
1951	/unknown = IVAL(pdata,0);/
1952
1953	sid_parse(pdata+4,sid_len,&sid);
1954	DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1955
1956	if (!sid_to_uid(&sid, &uid)) {
1957	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1958	sid_string_dbg(&sid),
1959	(unsigned long)sid_len));
1960	uid = (-1);
1961	}
1962
1963	/* we can take a look at the find source :-)
1964	*
1965	* find ./ -uid $uid -name '*' is what we need here
1966	*
1967	*
1968	* and send 4bytes len and then NULL terminated unicode strings
1969	* for each file
1970	*
1971	* but I don't know how to deal with the paged results
1972	* (maybe we can hang the result anywhere in the fsp struct)
1973	*
1974	* we don't send all files at once
1975	* and at the next we should not start from the beginning,
1976	* so we have to cache the result
1977	*
1978	* --metze
1979	*/
1980
1981	/* this works for now... */
1982	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1983	return;
1984	}
1985	default:
1986	if (!logged_message) {
1987	logged_message = True; /* Only print this once... */
1988	DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
1989	function));
1990	}
1991	}
1992
1993	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1994	}
1995
1996
1997	#ifdef HAVE_SYS_QUOTAS
1998	/****************************************************************************
1999	Reply to get user quota
2000	****************************************************************************/
2001
2002	static void call_nt_transact_get_user_quota(connection_struct *conn,
2003	struct smb_request *req,
2004	uint16 **ppsetup,
2005	uint32 setup_count,
2006	char **ppparams,
2007	uint32 parameter_count,
2008	char **ppdata,
2009	uint32 data_count,
2010	uint32 max_data_count)
2011	{
2012	NTSTATUS nt_status = NT_STATUS_OK;
2013	char params = ppparams;
2014	char pdata = ppdata;
2015	char *entry;
2016	int data_len=0,param_len=0;
2017	int qt_len=0;
2018	int entry_len = 0;
2019	files_struct *fsp = NULL;
2020	uint16 level = 0;
2021	size_t sid_len;
2022	DOM_SID sid;
2023	bool start_enum = True;
2024	SMB_NTQUOTA_STRUCT qt;
2025	SMB_NTQUOTA_LIST *tmp_list;
2026	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2027
2028	ZERO_STRUCT(qt);
2029
2030	/* access check */
2031	if (conn->server_info->utok.uid != 0) {
2032	DEBUG(1,("get_user_quota: access_denied service [%s] user "
2033	"[%s]\n", lp_servicename(SNUM(conn)),
2034	conn->server_info->unix_name));
2035	reply_doserror(req, ERRDOS, ERRnoaccess);
2036	return;
2037	}
2038
2039	/*
2040	* Ensure minimum number of parameters sent.
2041	*/
2042
2043	if (parameter_count < 4) {
2044	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2045	reply_doserror(req, ERRDOS, ERRinvalidparam);
2046	return;
2047	}
2048
2049	/* maybe we can check the quota_fnum */
2050	fsp = file_fsp(SVAL(params,0));
2051	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2052	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2053	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2054	return;
2055	}
2056
2057	/* the NULL pointer checking for fsp->fake_file_handle->pd
2058	* is done by CHECK_NTQUOTA_HANDLE_OK()
2059	*/
2060	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2061
2062	level = SVAL(params,2);
2063
2064	/* unknown 12 bytes leading in params */
2065
2066	switch (level) {
2067	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2068	/* seems that we should continue with the enum here --metze */
2069
2070	if (qt_handle->quota_list!=NULL &&
2071	qt_handle->tmp_list==NULL) {
2072
2073	/* free the list */
2074	free_ntquota_list(&(qt_handle->quota_list));
2075
2076	/* Realloc the size of parameters and data we will return */
2077	param_len = 4;
2078	params = nttrans_realloc(ppparams, param_len);
2079	if(params == NULL) {
2080	reply_doserror(req, ERRDOS, ERRnomem);
2081	return;
2082	}
2083
2084	data_len = 0;
2085	SIVAL(params,0,data_len);
2086
2087	break;
2088	}
2089
2090	start_enum = False;
2091
2092	case TRANSACT_GET_USER_QUOTA_LIST_START:
2093
2094	if (qt_handle->quota_list==NULL &&
2095	qt_handle->tmp_list==NULL) {
2096	start_enum = True;
2097	}
2098
2099	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2100	reply_doserror(req, ERRSRV, ERRerror);
2101	return;
2102	}
2103
2104	/* Realloc the size of parameters and data we will return */
2105	param_len = 4;
2106	params = nttrans_realloc(ppparams, param_len);
2107	if(params == NULL) {
2108	reply_doserror(req, ERRDOS, ERRnomem);
2109	return;
2110	}
2111
2112	/* we should not trust the value in max_data_count*/
2113	max_data_count = MIN(max_data_count,2048);
2114
2115	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2116	if(pdata == NULL) {
2117	reply_doserror(req, ERRDOS, ERRnomem);
2118	return;
2119	}
2120
2121	entry = pdata;
2122
2123	/* set params Size of returned Quota Data 4 bytes*/
2124	/* but set it later when we know it */
2125
2126	/* for each entry push the data */
2127
2128	if (start_enum) {
2129	qt_handle->tmp_list = qt_handle->quota_list;
2130	}
2131
2132	tmp_list = qt_handle->tmp_list;
2133
2134	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2135	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2136
2137	sid_len = ndr_size_dom_sid(
2138	&tmp_list->quotas->sid, 0);
2139	entry_len = 40 + sid_len;
2140
2141	/* nextoffset entry 4 bytes */
2142	SIVAL(entry,0,entry_len);
2143
2144	/* then the len of the SID 4 bytes */
2145	SIVAL(entry,4,sid_len);
2146
2147	/* unknown data 8 bytes SMB_BIG_UINT */
2148	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2149
2150	/* the used disk space 8 bytes SMB_BIG_UINT */
2151	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2152
2153	/* the soft quotas 8 bytes SMB_BIG_UINT */
2154	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2155
2156	/* the hard quotas 8 bytes SMB_BIG_UINT */
2157	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2158
2159	/* and now the SID */
2160	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2161	}
2162
2163	qt_handle->tmp_list = tmp_list;
2164
2165	/* overwrite the offset of the last entry */
2166	SIVAL(entry-entry_len,0,0);
2167
2168	data_len = 4+qt_len;
2169	/* overwrite the params quota_data_len */
2170	SIVAL(params,0,data_len);
2171
2172	break;
2173
2174	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2175
2176	/* unknown 4 bytes IVAL(pdata,0) */
2177
2178	if (data_count < 8) {
2179	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2180	reply_doserror(req, ERRDOS, ERRunknownlevel);
2181	return;
2182	}
2183
2184	sid_len = IVAL(pdata,4);
2185	/* Ensure this is less than 1mb. */
2186	if (sid_len > (1024*1024)) {
2187	reply_doserror(req, ERRDOS, ERRnomem);
2188	return;
2189	}
2190
2191	if (data_count < 8+sid_len) {
2192	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2193	reply_doserror(req, ERRDOS, ERRunknownlevel);
2194	return;
2195	}
2196
2197	data_len = 4+40+sid_len;
2198
2199	if (max_data_count < data_len) {
2200	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2201	max_data_count, data_len));
2202	param_len = 4;
2203	SIVAL(params,0,data_len);
2204	data_len = 0;
2205	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2206	break;
2207	}
2208
2209	sid_parse(pdata+8,sid_len,&sid);
2210
2211	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2212	ZERO_STRUCT(qt);
2213	/*
2214	* we have to return zero's in all fields
2215	* instead of returning an error here
2216	* --metze
2217	*/
2218	}
2219
2220	/* Realloc the size of parameters and data we will return */
2221	param_len = 4;
2222	params = nttrans_realloc(ppparams, param_len);
2223	if(params == NULL) {
2224	reply_doserror(req, ERRDOS, ERRnomem);
2225	return;
2226	}
2227
2228	pdata = nttrans_realloc(ppdata, data_len);
2229	if(pdata == NULL) {
2230	reply_doserror(req, ERRDOS, ERRnomem);
2231	return;
2232	}
2233
2234	entry = pdata;
2235
2236	/* set params Size of returned Quota Data 4 bytes*/
2237	SIVAL(params,0,data_len);
2238
2239	/* nextoffset entry 4 bytes */
2240	SIVAL(entry,0,0);
2241
2242	/* then the len of the SID 4 bytes */
2243	SIVAL(entry,4,sid_len);
2244
2245	/* unknown data 8 bytes SMB_BIG_UINT */
2246	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2247
2248	/* the used disk space 8 bytes SMB_BIG_UINT */
2249	SBIG_UINT(entry,16,qt.usedspace);
2250
2251	/* the soft quotas 8 bytes SMB_BIG_UINT */
2252	SBIG_UINT(entry,24,qt.softlim);
2253
2254	/* the hard quotas 8 bytes SMB_BIG_UINT */
2255	SBIG_UINT(entry,32,qt.hardlim);
2256
2257	/* and now the SID */
2258	sid_linearize(entry+40, sid_len, &sid);
2259
2260	break;
2261
2262	default:
2263	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2264	reply_doserror(req, ERRSRV, ERRerror);
2265	return;
2266	break;
2267	}
2268
2269	send_nt_replies(conn, req, nt_status, params, param_len,
2270	pdata, data_len);
2271	}
2272
2273	/****************************************************************************
2274	Reply to set user quota
2275	****************************************************************************/
2276
2277	static void call_nt_transact_set_user_quota(connection_struct *conn,
2278	struct smb_request *req,
2279	uint16 **ppsetup,
2280	uint32 setup_count,
2281	char **ppparams,
2282	uint32 parameter_count,
2283	char **ppdata,
2284	uint32 data_count,
2285	uint32 max_data_count)
2286	{
2287	char params = ppparams;
2288	char pdata = ppdata;
2289	int data_len=0,param_len=0;
2290	SMB_NTQUOTA_STRUCT qt;
2291	size_t sid_len;
2292	DOM_SID sid;
2293	files_struct *fsp = NULL;
2294
2295	ZERO_STRUCT(qt);
2296
2297	/* access check */
2298	if (conn->server_info->utok.uid != 0) {
2299	DEBUG(1,("set_user_quota: access_denied service [%s] user "
2300	"[%s]\n", lp_servicename(SNUM(conn)),
2301	conn->server_info->unix_name));
2302	reply_doserror(req, ERRDOS, ERRnoaccess);
2303	return;
2304	}
2305
2306	/*
2307	* Ensure minimum number of parameters sent.
2308	*/
2309
2310	if (parameter_count < 2) {
2311	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2312	reply_doserror(req, ERRDOS, ERRinvalidparam);
2313	return;
2314	}
2315
2316	/* maybe we can check the quota_fnum */
2317	fsp = file_fsp(SVAL(params,0));
2318	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2319	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2320	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2321	return;
2322	}
2323
2324	if (data_count < 40) {
2325	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2326	reply_doserror(req, ERRDOS, ERRunknownlevel);
2327	return;
2328	}
2329
2330	/* offset to next quota record.
2331	* 4 bytes IVAL(pdata,0)
2332	* unused here...
2333	*/
2334
2335	/* sid len */
2336	sid_len = IVAL(pdata,4);
2337
2338	if (data_count < 40+sid_len) {
2339	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2340	reply_doserror(req, ERRDOS, ERRunknownlevel);
2341	return;
2342	}
2343
2344	/* unknown 8 bytes in pdata
2345	* maybe its the change time in NTTIME
2346	*/
2347
2348	/* the used space 8 bytes (SMB_BIG_UINT)*/
2349	qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2350	#ifdef LARGE_SMB_OFF_T
2351	qt.usedspace \|= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2352	#else /* LARGE_SMB_OFF_T */
2353	if ((IVAL(pdata,20) != 0)&&
2354	((qt.usedspace != 0xFFFFFFFF)\|\|
2355	(IVAL(pdata,20)!=0xFFFFFFFF))) {
2356	/* more than 32 bits? */
2357	reply_doserror(req, ERRDOS, ERRunknownlevel);
2358	return;
2359	}
2360	#endif /* LARGE_SMB_OFF_T */
2361
2362	/* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2363	qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2364	#ifdef LARGE_SMB_OFF_T
2365	qt.softlim \|= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2366	#else /* LARGE_SMB_OFF_T */
2367	if ((IVAL(pdata,28) != 0)&&
2368	((qt.softlim != 0xFFFFFFFF)\|\|
2369	(IVAL(pdata,28)!=0xFFFFFFFF))) {
2370	/* more than 32 bits? */
2371	reply_doserror(req, ERRDOS, ERRunknownlevel);
2372	return;
2373	}
2374	#endif /* LARGE_SMB_OFF_T */
2375
2376	/* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2377	qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2378	#ifdef LARGE_SMB_OFF_T
2379	qt.hardlim \|= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2380	#else /* LARGE_SMB_OFF_T */
2381	if ((IVAL(pdata,36) != 0)&&
2382	((qt.hardlim != 0xFFFFFFFF)\|\|
2383	(IVAL(pdata,36)!=0xFFFFFFFF))) {
2384	/* more than 32 bits? */
2385	reply_doserror(req, ERRDOS, ERRunknownlevel);
2386	return;
2387	}
2388	#endif /* LARGE_SMB_OFF_T */
2389
2390	sid_parse(pdata+40,sid_len,&sid);
2391	DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2392
2393	/* 44 unknown bytes left... */
2394
2395	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2396	reply_doserror(req, ERRSRV, ERRerror);
2397	return;
2398	}
2399
2400	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2401	pdata, data_len);
2402	}
2403	#endif /* HAVE_SYS_QUOTAS */
2404
2405	static void handle_nttrans(connection_struct *conn,
2406	struct trans_state *state,
2407	struct smb_request *req)
2408	{
2409	if (Protocol >= PROTOCOL_NT1) {
2410	req->flags2 \|= 0x40; /* IS_LONG_NAME */
2411	SSVAL(req->inbuf,smb_flg2,req->flags2);
2412	}
2413
2414	/* Now we must call the relevant NT_TRANS function */
2415	switch(state->call) {
2416	case NT_TRANSACT_CREATE:
2417	{
2418	START_PROFILE(NT_transact_create);
2419	call_nt_transact_create(
2420	conn, req,
2421	&state->setup, state->setup_count,
2422	&state->param, state->total_param,
2423	&state->data, state->total_data,
2424	state->max_data_return);
2425	END_PROFILE(NT_transact_create);
2426	break;
2427	}
2428
2429	case NT_TRANSACT_IOCTL:
2430	{
2431	START_PROFILE(NT_transact_ioctl);
2432	call_nt_transact_ioctl(
2433	conn, req,
2434	&state->setup, state->setup_count,
2435	&state->param, state->total_param,
2436	&state->data, state->total_data,
2437	state->max_data_return);
2438	END_PROFILE(NT_transact_ioctl);
2439	break;
2440	}
2441
2442	case NT_TRANSACT_SET_SECURITY_DESC:
2443	{
2444	START_PROFILE(NT_transact_set_security_desc);
2445	call_nt_transact_set_security_desc(
2446	conn, req,
2447	&state->setup, state->setup_count,
2448	&state->param, state->total_param,
2449	&state->data, state->total_data,
2450	state->max_data_return);
2451	END_PROFILE(NT_transact_set_security_desc);
2452	break;
2453	}
2454
2455	case NT_TRANSACT_NOTIFY_CHANGE:
2456	{
2457	START_PROFILE(NT_transact_notify_change);
2458	call_nt_transact_notify_change(
2459	conn, req,
2460	&state->setup, state->setup_count,
2461	&state->param, state->total_param,
2462	&state->data, state->total_data,
2463	state->max_data_return,
2464	state->max_param_return);
2465	END_PROFILE(NT_transact_notify_change);
2466	break;
2467	}
2468
2469	case NT_TRANSACT_RENAME:
2470	{
2471	START_PROFILE(NT_transact_rename);
2472	call_nt_transact_rename(
2473	conn, req,
2474	&state->setup, state->setup_count,
2475	&state->param, state->total_param,
2476	&state->data, state->total_data,
2477	state->max_data_return);
2478	END_PROFILE(NT_transact_rename);
2479	break;
2480	}
2481
2482	case NT_TRANSACT_QUERY_SECURITY_DESC:
2483	{
2484	START_PROFILE(NT_transact_query_security_desc);
2485	call_nt_transact_query_security_desc(
2486	conn, req,
2487	&state->setup, state->setup_count,
2488	&state->param, state->total_param,
2489	&state->data, state->total_data,
2490	state->max_data_return);
2491	END_PROFILE(NT_transact_query_security_desc);
2492	break;
2493	}
2494
2495	#ifdef HAVE_SYS_QUOTAS
2496	case NT_TRANSACT_GET_USER_QUOTA:
2497	{
2498	START_PROFILE(NT_transact_get_user_quota);
2499	call_nt_transact_get_user_quota(
2500	conn, req,
2501	&state->setup, state->setup_count,
2502	&state->param, state->total_param,
2503	&state->data, state->total_data,
2504	state->max_data_return);
2505	END_PROFILE(NT_transact_get_user_quota);
2506	break;
2507	}
2508
2509	case NT_TRANSACT_SET_USER_QUOTA:
2510	{
2511	START_PROFILE(NT_transact_set_user_quota);
2512	call_nt_transact_set_user_quota(
2513	conn, req,
2514	&state->setup, state->setup_count,
2515	&state->param, state->total_param,
2516	&state->data, state->total_data,
2517	state->max_data_return);
2518	END_PROFILE(NT_transact_set_user_quota);
2519	break;
2520	}
2521	#endif /* HAVE_SYS_QUOTAS */
2522
2523	default:
2524	/* Error in request */
2525	DEBUG(0,("handle_nttrans: Unknown request %d in "
2526	"nttrans call\n", state->call));
2527	reply_doserror(req, ERRSRV, ERRerror);
2528	return;
2529	}
2530	return;
2531	}
2532
2533	/****************************************************************************
2534	Reply to a SMBNTtrans.
2535	****************************************************************************/
2536
2537	void reply_nttrans(struct smb_request *req)
2538	{
2539	connection_struct *conn = req->conn;
2540	uint32_t pscnt;
2541	uint32_t psoff;
2542	uint32_t dscnt;
2543	uint32_t dsoff;
2544	uint16 function_code;
2545	NTSTATUS result;
2546	struct trans_state *state;
2547	uint32_t size;
2548	uint32_t av_size;
2549
2550	START_PROFILE(SMBnttrans);
2551
2552	if (req->wct < 19) {
2553	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2554	END_PROFILE(SMBnttrans);
2555	return;
2556	}
2557
2558	size = smb_len(req->inbuf) + 4;
2559	av_size = smb_len(req->inbuf);
2560	pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2561	psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2562	dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2563	dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2564	function_code = SVAL(req->inbuf, smb_nt_Function);
2565
2566	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2567	reply_doserror(req, ERRSRV, ERRaccess);
2568	END_PROFILE(SMBnttrans);
2569	return;
2570	}
2571
2572	result = allow_new_trans(conn->pending_trans, req->mid);
2573	if (!NT_STATUS_IS_OK(result)) {
2574	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2575	reply_nterror(req, result);
2576	END_PROFILE(SMBnttrans);
2577	return;
2578	}
2579
2580	if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2581	reply_doserror(req, ERRSRV, ERRaccess);
2582	END_PROFILE(SMBnttrans);
2583	return;
2584	}
2585
2586	state->cmd = SMBnttrans;
2587
2588	state->mid = req->mid;
2589	state->vuid = req->vuid;
2590	state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2591	state->data = NULL;
2592	state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2593	state->param = NULL;
2594	state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2595	state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2596
2597	/* setup count is in words */
2598	state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2599	state->setup = NULL;
2600	state->call = function_code;
2601
2602	/*
2603	* All nttrans messages we handle have smb_wct == 19 +
2604	* state->setup_count. Ensure this is so as a sanity check.
2605	*/
2606
2607	if(req->wct != 19 + (state->setup_count/2)) {
2608	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2609	req->wct, 19 + (state->setup_count/2)));
2610	goto bad_param;
2611	}
2612
2613	/* Don't allow more than 128mb for each value. */
2614	if ((state->total_data > (10241024128)) \|\|
2615	(state->total_param > (10241024128))) {
2616	reply_doserror(req, ERRDOS, ERRnomem);
2617	END_PROFILE(SMBnttrans);
2618	return;
2619	}
2620
2621	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
2622	goto bad_param;
2623
2624	if (state->total_data) {
2625	/* Can't use talloc here, the core routines do realloc on the
2626	* params and data. */
2627	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2628	DEBUG(0,("reply_nttrans: data malloc fail for %u "
2629	"bytes !\n", (unsigned int)state->total_data));
2630	TALLOC_FREE(state);
2631	reply_doserror(req, ERRDOS, ERRnomem);
2632	END_PROFILE(SMBnttrans);
2633	return;
2634	}
2635
2636	if (dscnt > state->total_data \|\|
2637	dsoff+dscnt < dsoff) {
2638	goto bad_param;
2639	}
2640
2641	if (dsoff > av_size \|\|
2642	dscnt > av_size \|\|
2643	dsoff+dscnt > av_size) {
2644	goto bad_param;
2645	}
2646
2647	memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2648	}
2649
2650	if (state->total_param) {
2651	/* Can't use talloc here, the core routines do realloc on the
2652	* params and data. */
2653	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2654	DEBUG(0,("reply_nttrans: param malloc fail for %u "
2655	"bytes !\n", (unsigned int)state->total_param));
2656	SAFE_FREE(state->data);
2657	TALLOC_FREE(state);
2658	reply_doserror(req, ERRDOS, ERRnomem);
2659	END_PROFILE(SMBnttrans);
2660	return;
2661	}
2662
2663	if (pscnt > state->total_param \|\|
2664	psoff+pscnt < psoff) {
2665	goto bad_param;
2666	}
2667
2668	if (psoff > av_size \|\|
2669	pscnt > av_size \|\|
2670	psoff+pscnt > av_size) {
2671	goto bad_param;
2672	}
2673
2674	memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2675	}
2676
2677	state->received_data = dscnt;
2678	state->received_param = pscnt;
2679
2680	if(state->setup_count > 0) {
2681	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2682	state->setup_count));
2683	state->setup = (uint16 *)TALLOC(state, state->setup_count);
2684	if (state->setup == NULL) {
2685	DEBUG(0,("reply_nttrans : Out of memory\n"));
2686	SAFE_FREE(state->data);
2687	SAFE_FREE(state->param);
2688	TALLOC_FREE(state);
2689	reply_doserror(req, ERRDOS, ERRnomem);
2690	END_PROFILE(SMBnttrans);
2691	return;
2692	}
2693
2694	if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) \|\|
2695	(smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2696	goto bad_param;
2697	}
2698	if (smb_nt_SetupStart + state->setup_count > size) {
2699	goto bad_param;
2700	}
2701
2702	memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2703	state->setup_count);
2704	dump_data(10, (uint8 *)state->setup, state->setup_count);
2705	}
2706
2707	if ((state->received_data == state->total_data) &&
2708	(state->received_param == state->total_param)) {
2709	handle_nttrans(conn, state, req);
2710	SAFE_FREE(state->param);
2711	SAFE_FREE(state->data);
2712	TALLOC_FREE(state);
2713	END_PROFILE(SMBnttrans);
2714	return;
2715	}
2716
2717	DLIST_ADD(conn->pending_trans, state);
2718
2719	/* We need to send an interim response then receive the rest
2720	of the parameter/data bytes */
2721	reply_outbuf(req, 0, 0);
2722	show_msg((char *)req->outbuf);
2723	END_PROFILE(SMBnttrans);
2724	return;
2725
2726	bad_param:
2727
2728	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2729	SAFE_FREE(state->data);
2730	SAFE_FREE(state->param);
2731	TALLOC_FREE(state);
2732	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2733	END_PROFILE(SMBnttrans);
2734	return;
2735	}
2736
2737	/****************************************************************************
2738	Reply to a SMBnttranss
2739	****************************************************************************/
2740
2741	void reply_nttranss(struct smb_request *req)
2742	{
2743	connection_struct *conn = req->conn;
2744	uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2745	struct trans_state *state;
2746	uint32_t av_size;
2747	uint32_t size;
2748
2749	START_PROFILE(SMBnttranss);
2750
2751	show_msg((char *)req->inbuf);
2752
2753	if (req->wct < 18) {
2754	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2755	END_PROFILE(SMBnttranss);
2756	return;
2757	}
2758
2759	for (state = conn->pending_trans; state != NULL;
2760	state = state->next) {
2761	if (state->mid == req->mid) {
2762	break;
2763	}
2764	}
2765
2766	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
2767	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2768	END_PROFILE(SMBnttranss);
2769	return;
2770	}
2771
2772	/* Revise state->total_param and state->total_data in case they have
2773	changed downwards */
2774	if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2775	< state->total_param) {
2776	state->total_param = IVAL(req->inbuf,
2777	smb_nts_TotalParameterCount);
2778	}
2779	if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2780	state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2781	}
2782
2783	size = smb_len(req->inbuf) + 4;
2784	av_size = smb_len(req->inbuf);
2785
2786	pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2787	poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2788	pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2789
2790	dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2791	ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2792	doff = IVAL(req->inbuf, smb_nts_DataOffset);
2793
2794	state->received_param += pcnt;
2795	state->received_data += dcnt;
2796
2797	if ((state->received_data > state->total_data) \|\|
2798	(state->received_param > state->total_param))
2799	goto bad_param;
2800
2801	if (pcnt) {
2802	if (pdisp > state->total_param \|\|
2803	pcnt > state->total_param \|\|
2804	pdisp+pcnt > state->total_param \|\|
2805	pdisp+pcnt < pdisp) {
2806	goto bad_param;
2807	}
2808
2809	if (poff > av_size \|\|
2810	pcnt > av_size \|\|
2811	poff+pcnt > av_size \|\|
2812	poff+pcnt < poff) {
2813	goto bad_param;
2814	}
2815
2816	memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2817	pcnt);
2818	}
2819
2820	if (dcnt) {
2821	if (ddisp > state->total_data \|\|
2822	dcnt > state->total_data \|\|
2823	ddisp+dcnt > state->total_data \|\|
2824	ddisp+dcnt < ddisp) {
2825	goto bad_param;
2826	}
2827
2828	if (doff > av_size \|\|
2829	dcnt > av_size \|\|
2830	doff+dcnt > av_size \|\|
2831	doff+dcnt < doff) {
2832	goto bad_param;
2833	}
2834
2835	memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2836	dcnt);
2837	}
2838
2839	if ((state->received_param < state->total_param) \|\|
2840	(state->received_data < state->total_data)) {
2841	END_PROFILE(SMBnttranss);
2842	return;
2843	}
2844
2845	/*
2846	* construct_reply_common will copy smb_com from inbuf to
2847	* outbuf. SMBnttranss is wrong here.
2848	*/
2849	SCVAL(req->inbuf,smb_com,SMBnttrans);
2850
2851	handle_nttrans(conn, state, req);
2852
2853	DLIST_REMOVE(conn->pending_trans, state);
2854	SAFE_FREE(state->data);
2855	SAFE_FREE(state->param);
2856	TALLOC_FREE(state);
2857	END_PROFILE(SMBnttranss);
2858	return;
2859
2860	bad_param:
2861
2862	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2863	DLIST_REMOVE(conn->pending_trans, state);
2864	SAFE_FREE(state->data);
2865	SAFE_FREE(state->param);
2866	TALLOC_FREE(state);
2867	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2868	END_PROFILE(SMBnttranss);
2869	return;
2870	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: