Context Navigation

source: branches/samba-3.3.x/source/smbd/nttrans.c@ 578

Visit:

Last change on this file since 578 was 491, checked in by Herwig Bauernfeind, 15 years ago
Update Samba 3.3 to 3.3.14 (security update)
File size: 76.1 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-2007
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 3 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program. If not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22
23	extern int max_send;
24	extern enum protocol_types Protocol;
25	extern const struct generic_mapping file_generic_mapping;
26
27	static char nttrans_realloc(char *ptr, size_t size)
28	{
29	if (ptr==NULL) {
30	smb_panic("nttrans_realloc() called with NULL ptr");
31	}
32
33	ptr = (char )SMB_REALLOC(*ptr, size);
34	if(*ptr == NULL) {
35	return NULL;
36	}
37	memset(*ptr,'\0',size);
38	return *ptr;
39	}
40
41	/****************************************************************************
42	Send the required number of replies back.
43	We assume all fields other than the data fields are
44	set correctly for the type of call.
45	HACK ! Always assumes smb_setup field is zero.
46	****************************************************************************/
47
48	void send_nt_replies(connection_struct *conn,
49	struct smb_request *req, NTSTATUS nt_error,
50	char *params, int paramsize,
51	char *pdata, int datasize)
52	{
53	int data_to_send = datasize;
54	int params_to_send = paramsize;
55	int useable_space;
56	char *pp = params;
57	char *pd = pdata;
58	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59	int alignment_offset = 3;
60	int data_alignment_offset = 0;
61
62	/*
63	* If there genuinely are no parameters or data to send just send
64	* the empty packet.
65	*/
66
67	if(params_to_send == 0 && data_to_send == 0) {
68	reply_outbuf(req, 18, 0);
69	show_msg((char *)req->outbuf);
70	return;
71	}
72
73	/*
74	* When sending params and data ensure that both are nicely aligned.
75	* Only do this alignment when there is also data to send - else
76	* can cause NT redirector problems.
77	*/
78
79	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
80	data_alignment_offset = 4 - (params_to_send % 4);
81	}
82
83	/*
84	* Space is bufsize minus Netbios over TCP header minus SMB header.
85	* The alignment_offset is to align the param bytes on a four byte
86	* boundary (2 bytes for data len, one byte pad).
87	* NT needs this to work correctly.
88	*/
89
90	useable_space = max_send - (smb_size
91	+ 2 * 18 /* wct */
92	+ alignment_offset
93	+ data_alignment_offset);
94
95	if (useable_space < 0) {
96	DEBUG(0, ("send_nt_replies failed sanity useable_space "
97	"= %d!!!", useable_space));
98	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
99	}
100
101	while (params_to_send \|\| data_to_send) {
102
103	/*
104	* Calculate whether we will totally or partially fill this packet.
105	*/
106
107	total_sent_thistime = params_to_send + data_to_send;
108
109	/*
110	* We can never send more than useable_space.
111	*/
112
113	total_sent_thistime = MIN(total_sent_thistime, useable_space);
114
115	reply_outbuf(req, 18,
116	total_sent_thistime + alignment_offset
117	+ data_alignment_offset);
118
119	/*
120	* Set total params and data to be sent.
121	*/
122
123	SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
124	SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
125
126	/*
127	* Calculate how many parameters and data we can fit into
128	* this packet. Parameters get precedence.
129	*/
130
131	params_sent_thistime = MIN(params_to_send,useable_space);
132	data_sent_thistime = useable_space - params_sent_thistime;
133	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
134
135	SIVAL(req->outbuf, smb_ntr_ParameterCount,
136	params_sent_thistime);
137
138	if(params_sent_thistime == 0) {
139	SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
140	SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
141	} else {
142	/*
143	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
144	* parameter bytes, however the first 4 bytes of outbuf are
145	* the Netbios over TCP header. Thus use smb_base() to subtract
146	* them from the calculation.
147	*/
148
149	SIVAL(req->outbuf,smb_ntr_ParameterOffset,
150	((smb_buf(req->outbuf)+alignment_offset)
151	- smb_base(req->outbuf)));
152	/*
153	* Absolute displacement of param bytes sent in this packet.
154	*/
155
156	SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
157	pp - params);
158	}
159
160	/*
161	* Deal with the data portion.
162	*/
163
164	SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
165
166	if(data_sent_thistime == 0) {
167	SIVAL(req->outbuf,smb_ntr_DataOffset,0);
168	SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
169	} else {
170	/*
171	* The offset of the data bytes is the offset of the
172	* parameter bytes plus the number of parameters being sent this time.
173	*/
174
175	SIVAL(req->outbuf, smb_ntr_DataOffset,
176	((smb_buf(req->outbuf)+alignment_offset) -
177	smb_base(req->outbuf))
178	+ params_sent_thistime + data_alignment_offset);
179	SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
180	}
181
182	/*
183	* Copy the param bytes into the packet.
184	*/
185
186	if(params_sent_thistime) {
187	if (alignment_offset != 0) {
188	memset(smb_buf(req->outbuf), 0,
189	alignment_offset);
190	}
191	memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
192	params_sent_thistime);
193	}
194
195	/*
196	* Copy in the data bytes
197	*/
198
199	if(data_sent_thistime) {
200	if (data_alignment_offset != 0) {
201	memset((smb_buf(req->outbuf)+alignment_offset+
202	params_sent_thistime), 0,
203	data_alignment_offset);
204	}
205	memcpy(smb_buf(req->outbuf)+alignment_offset
206	+params_sent_thistime+data_alignment_offset,
207	pd,data_sent_thistime);
208	}
209
210	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
211	params_sent_thistime, data_sent_thistime, useable_space));
212	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
213	params_to_send, data_to_send, paramsize, datasize));
214
215	if (NT_STATUS_V(nt_error)) {
216	error_packet_set((char *)req->outbuf,
217	0, 0, nt_error,
218	__LINE__,__FILE__);
219	}
220
221	/* Send the packet */
222	show_msg((char *)req->outbuf);
223	if (!srv_send_smb(smbd_server_fd(),
224	(char *)req->outbuf,
225	IS_CONN_ENCRYPTED(conn))) {
226	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
227	}
228
229	TALLOC_FREE(req->outbuf);
230
231	pp += params_sent_thistime;
232	pd += data_sent_thistime;
233
234	params_to_send -= params_sent_thistime;
235	data_to_send -= data_sent_thistime;
236
237	/*
238	* Sanity check
239	*/
240
241	if(params_to_send < 0 \|\| data_to_send < 0) {
242	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
243	params_to_send, data_to_send));
244	exit_server_cleanly("send_nt_replies: internal error");
245	}
246	}
247	}
248
249	/****************************************************************************
250	Is it an NTFS stream name ?
251	An NTFS file name is <path>.<extention>:<stream name>:<stream type>
252	$DATA can be used as both a stream name and a stream type. A missing stream
253	name or type implies $DATA.
254	****************************************************************************/
255
256	bool is_ntfs_stream_name(const char *fname)
257	{
258	if (lp_posix_pathnames()) {
259	return False;
260	}
261	return (strchr_m(fname, ':') != NULL) ? True : False;
262	}
263
264	/****************************************************************************
265	Reply to an NT create and X call on a pipe
266	****************************************************************************/
267
268	static void nt_open_pipe(char fname, connection_struct conn,
269	struct smb_request req, int ppnum)
270	{
271	smb_np_struct *p = NULL;
272
273	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
274
275	/* See if it is one we want to handle. */
276
277	if (!is_known_pipename(fname)) {
278	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
279	ERRDOS, ERRbadpipe);
280	return;
281	}
282
283	/* Strip \\ off the name. */
284	fname++;
285
286	DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
287
288	p = open_rpc_pipe_p(fname, conn, req->vuid);
289	if (!p) {
290	reply_doserror(req, ERRSRV, ERRnofids);
291	return;
292	}
293
294	/* TODO: Add pipe to db */
295
296	if ( !store_pipe_opendb( p ) ) {
297	DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
298	}
299
300	*ppnum = p->pnum;
301	return;
302	}
303
304	/****************************************************************************
305	Reply to an NT create and X call for pipes.
306	****************************************************************************/
307
308	static void do_ntcreate_pipe_open(connection_struct *conn,
309	struct smb_request *req)
310	{
311	char *fname = NULL;
312	int pnum = -1;
313	char *p = NULL;
314	uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
315	TALLOC_CTX *ctx = talloc_tos();
316
317	srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
318	smb_buf(req->inbuf), STR_TERMINATE);
319
320	if (!fname) {
321	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
322	ERRDOS, ERRbadpipe);
323	return;
324	}
325	nt_open_pipe(fname, conn, req, &pnum);
326
327	if (req->outbuf) {
328	/* error reply */
329	return;
330	}
331
332	/*
333	* Deal with pipe return.
334	*/
335
336	if (flags & EXTENDED_RESPONSE_REQUIRED) {
337	/* This is very strange. We
338	* return 50 words, but only set
339	* the wcnt to 42 ? It's definately
340	* what happens on the wire....
341	*/
342	reply_outbuf(req, 50, 0);
343	SCVAL(req->outbuf,smb_wct,42);
344	} else {
345	reply_outbuf(req, 34, 0);
346	}
347
348	p = (char *)req->outbuf + smb_vwv2;
349	p++;
350	SSVAL(p,0,pnum);
351	p += 2;
352	SIVAL(p,0,FILE_WAS_OPENED);
353	p += 4;
354	p += 32;
355	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
356	p += 20;
357	/* File type. */
358	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
359	/* Device state. */
360	SSVAL(p,2, 0x5FF); /* ? */
361	p += 4;
362
363	if (flags & EXTENDED_RESPONSE_REQUIRED) {
364	p += 25;
365	SIVAL(p,0,FILE_GENERIC_ALL);
366	/*
367	* For pipes W2K3 seems to return
368	* 0x12019B next.
369	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
370	*/
371	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
372	}
373
374	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
375
376	chain_reply(req);
377	}
378
379	/****************************************************************************
380	Reply to an NT create and X call.
381	****************************************************************************/
382
383	void reply_ntcreate_and_X(struct smb_request *req)
384	{
385	connection_struct *conn = req->conn;
386	char *fname = NULL;
387	uint32 flags;
388	uint32 access_mask;
389	uint32 file_attributes;
390	uint32 share_access;
391	uint32 create_disposition;
392	uint32 create_options;
393	uint16 root_dir_fid;
394	SMB_BIG_UINT allocation_size;
395	/* Breakout the oplock request bits so we can set the
396	reply bits separately. */
397	uint32 fattr=0;
398	SMB_OFF_T file_len = 0;
399	SMB_STRUCT_STAT sbuf;
400	int info = 0;
401	files_struct *fsp = NULL;
402	char *p = NULL;
403	struct timespec c_timespec;
404	struct timespec a_timespec;
405	struct timespec m_timespec;
406	NTSTATUS status;
407	int oplock_request;
408	uint8_t oplock_granted = NO_OPLOCK_RETURN;
409	TALLOC_CTX *ctx = talloc_tos();
410
411	START_PROFILE(SMBntcreateX);
412
413	if (req->wct < 24) {
414	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
415	return;
416	}
417
418	flags = IVAL(req->inbuf,smb_ntcreate_Flags);
419	access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
420	file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
421	share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
422	create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
423	create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
424	root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
425
426	allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
427	smb_ntcreate_AllocationSize);
428	#ifdef LARGE_SMB_OFF_T
429	allocation_size \|= (((SMB_BIG_UINT)IVAL(
430	req->inbuf,
431	smb_ntcreate_AllocationSize + 4)) << 32);
432	#endif
433
434	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
435	smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
436
437	if (!NT_STATUS_IS_OK(status)) {
438	reply_nterror(req, status);
439	END_PROFILE(SMBntcreateX);
440	return;
441	}
442
443	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
444	"file_attributes = 0x%x, share_access = 0x%x, "
445	"create_disposition = 0x%x create_options = 0x%x "
446	"root_dir_fid = 0x%x, fname = %s\n",
447	(unsigned int)flags,
448	(unsigned int)access_mask,
449	(unsigned int)file_attributes,
450	(unsigned int)share_access,
451	(unsigned int)create_disposition,
452	(unsigned int)create_options,
453	(unsigned int)root_dir_fid,
454	fname));
455
456	/*
457	* we need to remove ignored bits when they come directly from the client
458	* because we reuse some of them for internal stuff
459	*/
460	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
461
462	/*
463	* If it's an IPC, use the pipe handler.
464	*/
465
466	if (IS_IPC(conn)) {
467	if (lp_nt_pipe_support()) {
468	do_ntcreate_pipe_open(conn, req);
469	END_PROFILE(SMBntcreateX);
470	return;
471	}
472	reply_doserror(req, ERRDOS, ERRnoaccess);
473	END_PROFILE(SMBntcreateX);
474	return;
475	}
476
477	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
478	if (oplock_request) {
479	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
480	? BATCH_OPLOCK : 0;
481	}
482
483	status = create_file(conn, req, root_dir_fid, fname,
484	access_mask, share_access, create_disposition,
485	create_options, file_attributes, oplock_request,
486	allocation_size, NULL, NULL, &fsp, &info, &sbuf);
487
488	if (!NT_STATUS_IS_OK(status)) {
489	if (open_was_deferred(req->mid)) {
490	/* We have re-scheduled this call, no error. */
491	END_PROFILE(SMBntcreateX);
492	return;
493	}
494	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
495	reply_botherror(req, status, ERRDOS, ERRfilexists);
496	}
497	else {
498	reply_nterror(req, status);
499	}
500	END_PROFILE(SMBntcreateX);
501	return;
502	}
503
504	/*
505	* If the caller set the extended oplock request bit
506	* and we granted one (by whatever means) - set the
507	* correct bit for extended oplock reply.
508	*/
509
510	if (oplock_request &&
511	(lp_fake_oplocks(SNUM(conn))
512	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
513
514	/*
515	* Exclusive oplock granted
516	*/
517
518	if (flags & REQUEST_BATCH_OPLOCK) {
519	oplock_granted = BATCH_OPLOCK_RETURN;
520	} else {
521	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
522	}
523	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
524	oplock_granted = LEVEL_II_OPLOCK_RETURN;
525	} else {
526	oplock_granted = NO_OPLOCK_RETURN;
527	}
528
529	file_len = sbuf.st_size;
530	fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
531	if (fattr == 0) {
532	fattr = FILE_ATTRIBUTE_NORMAL;
533	}
534
535	if (flags & EXTENDED_RESPONSE_REQUIRED) {
536	/* This is very strange. We
537	* return 50 words, but only set
538	* the wcnt to 42 ? It's definately
539	* what happens on the wire....
540	*/
541	reply_outbuf(req, 50, 0);
542	SCVAL(req->outbuf,smb_wct,42);
543	} else {
544	reply_outbuf(req, 34, 0);
545	}
546
547	p = (char *)req->outbuf + smb_vwv2;
548
549	SCVAL(p, 0, oplock_granted);
550
551	p++;
552	SSVAL(p,0,fsp->fnum);
553	p += 2;
554	if ((create_disposition == FILE_SUPERSEDE)
555	&& (info == FILE_WAS_OVERWRITTEN)) {
556	SIVAL(p,0,FILE_WAS_SUPERSEDED);
557	} else {
558	SIVAL(p,0,info);
559	}
560	p += 4;
561
562	/* Create time. */
563	c_timespec = get_create_timespec(
564	&sbuf,lp_fake_dir_create_times(SNUM(conn)));
565	a_timespec = get_atimespec(&sbuf);
566	m_timespec = get_mtimespec(&sbuf);
567
568	if (lp_dos_filetime_resolution(SNUM(conn))) {
569	dos_filetime_timespec(&c_timespec);
570	dos_filetime_timespec(&a_timespec);
571	dos_filetime_timespec(&m_timespec);
572	}
573
574	put_long_date_timespec(p, c_timespec); /* create time. */
575	p += 8;
576	put_long_date_timespec(p, a_timespec); /* access time */
577	p += 8;
578	put_long_date_timespec(p, m_timespec); /* write time */
579	p += 8;
580	put_long_date_timespec(p, m_timespec); /* change time */
581	p += 8;
582	SIVAL(p,0,fattr); /* File Attributes. */
583	p += 4;
584	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
585	p += 8;
586	SOFF_T(p,0,file_len);
587	p += 8;
588	if (flags & EXTENDED_RESPONSE_REQUIRED) {
589	SSVAL(p,2,0x7);
590	}
591	p += 4;
592	SCVAL(p,0,fsp->is_directory ? 1 : 0);
593
594	if (flags & EXTENDED_RESPONSE_REQUIRED) {
595	uint32 perms = 0;
596	p += 25;
597	if (fsp->is_directory
598	\|\| can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
599	perms = FILE_GENERIC_ALL;
600	} else {
601	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
602	}
603	SIVAL(p,0,perms);
604	}
605
606	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
607	fsp->fnum, fsp->fsp_name));
608
609	chain_reply(req);
610	END_PROFILE(SMBntcreateX);
611	return;
612	}
613
614	/****************************************************************************
615	Reply to a NT_TRANSACT_CREATE call to open a pipe.
616	****************************************************************************/
617
618	static void do_nt_transact_create_pipe(connection_struct *conn,
619	struct smb_request *req,
620	uint16 **ppsetup, uint32 setup_count,
621	char **ppparams, uint32 parameter_count,
622	char **ppdata, uint32 data_count)
623	{
624	char *fname = NULL;
625	char params = ppparams;
626	int pnum = -1;
627	char *p = NULL;
628	NTSTATUS status;
629	size_t param_len;
630	uint32 flags;
631	TALLOC_CTX *ctx = talloc_tos();
632
633	/*
634	* Ensure minimum number of parameters sent.
635	*/
636
637	if(parameter_count < 54) {
638	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
639	reply_doserror(req, ERRDOS, ERRnoaccess);
640	return;
641	}
642
643	flags = IVAL(params,0);
644
645	srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
646	parameter_count-53, STR_TERMINATE,
647	&status);
648	if (!NT_STATUS_IS_OK(status)) {
649	reply_nterror(req, status);
650	return;
651	}
652
653	nt_open_pipe(fname, conn, req, &pnum);
654
655	if (req->outbuf) {
656	/* Error return */
657	return;
658	}
659
660	/* Realloc the size of parameters and data we will return */
661	if (flags & EXTENDED_RESPONSE_REQUIRED) {
662	/* Extended response is 32 more byyes. */
663	param_len = 101;
664	} else {
665	param_len = 69;
666	}
667	params = nttrans_realloc(ppparams, param_len);
668	if(params == NULL) {
669	reply_doserror(req, ERRDOS, ERRnomem);
670	return;
671	}
672
673	p = params;
674	SCVAL(p,0,NO_OPLOCK_RETURN);
675
676	p += 2;
677	SSVAL(p,0,pnum);
678	p += 2;
679	SIVAL(p,0,FILE_WAS_OPENED);
680	p += 8;
681
682	p += 32;
683	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
684	p += 20;
685	/* File type. */
686	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
687	/* Device state. */
688	SSVAL(p,2, 0x5FF); /* ? */
689	p += 4;
690
691	if (flags & EXTENDED_RESPONSE_REQUIRED) {
692	p += 25;
693	SIVAL(p,0,FILE_GENERIC_ALL);
694	/*
695	* For pipes W2K3 seems to return
696	* 0x12019B next.
697	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
698	*/
699	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
700	}
701
702	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
703
704	/* Send the required number of replies */
705	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
706
707	return;
708	}
709
710	/****************************************************************************
711	Internal fn to set security descriptors.
712	****************************************************************************/
713
714	static NTSTATUS set_sd(files_struct fsp, uint8 data, uint32 sd_len,
715	uint32 security_info_sent)
716	{
717	SEC_DESC *psd = NULL;
718	NTSTATUS status;
719
720	if (sd_len == 0 \|\| !lp_nt_acl_support(SNUM(fsp->conn))) {
721	return NT_STATUS_OK;
722	}
723
724	status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
725
726	if (!NT_STATUS_IS_OK(status)) {
727	return status;
728	}
729
730	if (psd->owner_sid == NULL) {
731	security_info_sent &= ~OWNER_SECURITY_INFORMATION;
732	}
733	if (psd->group_sid == NULL) {
734	security_info_sent &= ~GROUP_SECURITY_INFORMATION;
735	}
736
737	/* Convert all the generic bits. */
738	security_acl_map_generic(psd->dacl, &file_generic_mapping);
739	security_acl_map_generic(psd->sacl, &file_generic_mapping);
740
741	if (DEBUGLEVEL >= 10) {
742	DEBUG(10,("set_sd for file %s\n", fsp->fsp_name ));
743	NDR_PRINT_DEBUG(security_descriptor, psd);
744	}
745
746	status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
747
748	TALLOC_FREE(psd);
749
750	return status;
751	}
752
753	/****************************************************************************
754	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
755	****************************************************************************/
756
757	static struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
758	{
759	struct ea_list *ea_list_head = NULL;
760	size_t offset = 0;
761
762	if (data_size < 4) {
763	return NULL;
764	}
765
766	while (offset + 4 <= data_size) {
767	size_t next_offset = IVAL(pdata,offset);
768	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
769
770	if (!eal) {
771	return NULL;
772	}
773
774	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
775	if (next_offset == 0) {
776	break;
777	}
778	offset += next_offset;
779	}
780
781	return ea_list_head;
782	}
783
784	/****************************************************************************
785	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
786	****************************************************************************/
787
788	static void call_nt_transact_create(connection_struct *conn,
789	struct smb_request *req,
790	uint16 **ppsetup, uint32 setup_count,
791	char **ppparams, uint32 parameter_count,
792	char **ppdata, uint32 data_count,
793	uint32 max_data_count)
794	{
795	char *fname = NULL;
796	char params = ppparams;
797	char data = ppdata;
798	/* Breakout the oplock request bits so we can set the reply bits separately. */
799	uint32 fattr=0;
800	SMB_OFF_T file_len = 0;
801	SMB_STRUCT_STAT sbuf;
802	int info = 0;
803	files_struct *fsp = NULL;
804	char *p = NULL;
805	uint32 flags;
806	uint32 access_mask;
807	uint32 file_attributes;
808	uint32 share_access;
809	uint32 create_disposition;
810	uint32 create_options;
811	uint32 sd_len;
812	struct security_descriptor *sd = NULL;
813	uint32 ea_len;
814	uint16 root_dir_fid;
815	struct timespec c_timespec;
816	struct timespec a_timespec;
817	struct timespec m_timespec;
818	struct ea_list *ea_list = NULL;
819	NTSTATUS status;
820	size_t param_len;
821	SMB_BIG_UINT allocation_size;
822	int oplock_request;
823	uint8_t oplock_granted;
824	TALLOC_CTX *ctx = talloc_tos();
825
826	DEBUG(5,("call_nt_transact_create\n"));
827
828	/*
829	* If it's an IPC, use the pipe handler.
830	*/
831
832	if (IS_IPC(conn)) {
833	if (lp_nt_pipe_support()) {
834	do_nt_transact_create_pipe(
835	conn, req,
836	ppsetup, setup_count,
837	ppparams, parameter_count,
838	ppdata, data_count);
839	return;
840	}
841	reply_doserror(req, ERRDOS, ERRnoaccess);
842	return;
843	}
844
845	/*
846	* Ensure minimum number of parameters sent.
847	*/
848
849	if(parameter_count < 54) {
850	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
851	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
852	return;
853	}
854
855	flags = IVAL(params,0);
856	access_mask = IVAL(params,8);
857	file_attributes = IVAL(params,20);
858	share_access = IVAL(params,24);
859	create_disposition = IVAL(params,28);
860	create_options = IVAL(params,32);
861	sd_len = IVAL(params,36);
862	ea_len = IVAL(params,40);
863	root_dir_fid = (uint16)IVAL(params,4);
864	allocation_size = (SMB_BIG_UINT)IVAL(params,12);
865	#ifdef LARGE_SMB_OFF_T
866	allocation_size \|= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
867	#endif
868
869	/*
870	* we need to remove ignored bits when they come directly from the client
871	* because we reuse some of them for internal stuff
872	*/
873	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
874
875	/* Ensure the data_len is correct for the sd and ea values given. */
876	if ((ea_len + sd_len > data_count)
877	\|\| (ea_len > data_count) \|\| (sd_len > data_count)
878	\|\| (ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
879	DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
880	"%u, data_count = %u\n", (unsigned int)ea_len,
881	(unsigned int)sd_len, (unsigned int)data_count));
882	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
883	return;
884	}
885
886	if (sd_len) {
887	DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
888	sd_len));
889
890	status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
891	&sd);
892	if (!NT_STATUS_IS_OK(status)) {
893	DEBUG(10, ("call_nt_transact_create: "
894	"unmarshall_sec_desc failed: %s\n",
895	nt_errstr(status)));
896	reply_nterror(req, status);
897	return;
898	}
899	}
900
901	if (ea_len) {
902	if (!lp_ea_support(SNUM(conn))) {
903	DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
904	"EA's not supported.\n",
905	(unsigned int)ea_len));
906	reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
907	return;
908	}
909
910	if (ea_len < 10) {
911	DEBUG(10,("call_nt_transact_create - ea_len = %u - "
912	"too small (should be more than 10)\n",
913	(unsigned int)ea_len ));
914	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
915	return;
916	}
917
918	/* We have already checked that ea_len <= data_count here. */
919	ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
920	ea_len);
921	if (ea_list == NULL) {
922	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
923	return;
924	}
925	}
926
927	srvstr_get_path(ctx, params, req->flags2, &fname,
928	params+53, parameter_count-53,
929	STR_TERMINATE, &status);
930	if (!NT_STATUS_IS_OK(status)) {
931	reply_nterror(req, status);
932	return;
933	}
934
935	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
936	if (oplock_request) {
937	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
938	? BATCH_OPLOCK : 0;
939	}
940
941	status = create_file(conn, req, root_dir_fid, fname,
942	access_mask, share_access, create_disposition,
943	create_options, file_attributes, oplock_request,
944	allocation_size, sd, ea_list, &fsp, &info, &sbuf);
945
946	if(!NT_STATUS_IS_OK(status)) {
947	if (open_was_deferred(req->mid)) {
948	/* We have re-scheduled this call, no error. */
949	return;
950	}
951	reply_openerror(req, status);
952	return;
953	}
954
955	/*
956	* If the caller set the extended oplock request bit
957	* and we granted one (by whatever means) - set the
958	* correct bit for extended oplock reply.
959	*/
960
961	if (oplock_request &&
962	(lp_fake_oplocks(SNUM(conn))
963	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
964
965	/*
966	* Exclusive oplock granted
967	*/
968
969	if (flags & REQUEST_BATCH_OPLOCK) {
970	oplock_granted = BATCH_OPLOCK_RETURN;
971	} else {
972	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
973	}
974	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
975	oplock_granted = LEVEL_II_OPLOCK_RETURN;
976	} else {
977	oplock_granted = NO_OPLOCK_RETURN;
978	}
979
980	file_len = sbuf.st_size;
981	fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
982	if (fattr == 0) {
983	fattr = FILE_ATTRIBUTE_NORMAL;
984	}
985
986	/* Realloc the size of parameters and data we will return */
987	if (flags & EXTENDED_RESPONSE_REQUIRED) {
988	/* Extended response is 32 more byyes. */
989	param_len = 101;
990	} else {
991	param_len = 69;
992	}
993	params = nttrans_realloc(ppparams, param_len);
994	if(params == NULL) {
995	reply_doserror(req, ERRDOS, ERRnomem);
996	return;
997	}
998
999	p = params;
1000	SCVAL(p, 0, oplock_granted);
1001
1002	p += 2;
1003	SSVAL(p,0,fsp->fnum);
1004	p += 2;
1005	if ((create_disposition == FILE_SUPERSEDE)
1006	&& (info == FILE_WAS_OVERWRITTEN)) {
1007	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1008	} else {
1009	SIVAL(p,0,info);
1010	}
1011	p += 8;
1012
1013	/* Create time. */
1014	c_timespec = get_create_timespec(
1015	&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1016	a_timespec = get_atimespec(&sbuf);
1017	m_timespec = get_mtimespec(&sbuf);
1018
1019	if (lp_dos_filetime_resolution(SNUM(conn))) {
1020	dos_filetime_timespec(&c_timespec);
1021	dos_filetime_timespec(&a_timespec);
1022	dos_filetime_timespec(&m_timespec);
1023	}
1024
1025	put_long_date_timespec(p, c_timespec); /* create time. */
1026	p += 8;
1027	put_long_date_timespec(p, a_timespec); /* access time */
1028	p += 8;
1029	put_long_date_timespec(p, m_timespec); /* write time */
1030	p += 8;
1031	put_long_date_timespec(p, m_timespec); /* change time */
1032	p += 8;
1033	SIVAL(p,0,fattr); /* File Attributes. */
1034	p += 4;
1035	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1036	p += 8;
1037	SOFF_T(p,0,file_len);
1038	p += 8;
1039	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1040	SSVAL(p,2,0x7);
1041	}
1042	p += 4;
1043	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1044
1045	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1046	uint32 perms = 0;
1047	p += 25;
1048	if (fsp->is_directory
1049	\|\| can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1050	perms = FILE_GENERIC_ALL;
1051	} else {
1052	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
1053	}
1054	SIVAL(p,0,perms);
1055	}
1056
1057	DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1058
1059	/* Send the required number of replies */
1060	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1061
1062	return;
1063	}
1064
1065	/****************************************************************************
1066	Reply to a NT CANCEL request.
1067	conn POINTER CAN BE NULL HERE !
1068	****************************************************************************/
1069
1070	void reply_ntcancel(struct smb_request *req)
1071	{
1072	/*
1073	* Go through and cancel any pending change notifies.
1074	*/
1075
1076	START_PROFILE(SMBntcancel);
1077	remove_pending_change_notify_requests_by_mid(req->mid);
1078	remove_pending_lock_requests_by_mid(req->mid);
1079	srv_cancel_sign_response(req->mid, true);
1080
1081	DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1082
1083	END_PROFILE(SMBntcancel);
1084	return;
1085	}
1086
1087	/****************************************************************************
1088	Copy a file.
1089	****************************************************************************/
1090
1091	static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1092	connection_struct *conn,
1093	struct smb_request *req,
1094	const char *oldname_in,
1095	const char *newname_in,
1096	uint32 attrs)
1097	{
1098	SMB_STRUCT_STAT sbuf1, sbuf2;
1099	char *oldname = NULL;
1100	char *newname = NULL;
1101	char *last_component_oldname = NULL;
1102	char *last_component_newname = NULL;
1103	files_struct fsp1,fsp2;
1104	uint32 fattr;
1105	int info;
1106	SMB_OFF_T ret=-1;
1107	NTSTATUS status = NT_STATUS_OK;
1108
1109	ZERO_STRUCT(sbuf1);
1110	ZERO_STRUCT(sbuf2);
1111
1112	if (!CAN_WRITE(conn)) {
1113	return NT_STATUS_MEDIA_WRITE_PROTECTED;
1114	}
1115
1116	status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1117	&last_component_oldname, &sbuf1);
1118	if (!NT_STATUS_IS_OK(status)) {
1119	return status;
1120	}
1121
1122	status = check_name(conn, oldname);
1123	if (!NT_STATUS_IS_OK(status)) {
1124	return status;
1125	}
1126
1127	/* Source must already exist. */
1128	if (!VALID_STAT(sbuf1)) {
1129	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1130	}
1131	/* Ensure attributes match. */
1132	fattr = dos_mode(conn,oldname,&sbuf1);
1133	if ((fattr & ~attrs) & (aHIDDEN \| aSYSTEM)) {
1134	return NT_STATUS_NO_SUCH_FILE;
1135	}
1136
1137	status = unix_convert(ctx, conn, newname_in, False, &newname,
1138	&last_component_newname, &sbuf2);
1139	if (!NT_STATUS_IS_OK(status)) {
1140	return status;
1141	}
1142
1143	status = check_name(conn, newname);
1144	if (!NT_STATUS_IS_OK(status)) {
1145	return status;
1146	}
1147
1148	/* Disallow if newname already exists. */
1149	if (VALID_STAT(sbuf2)) {
1150	return NT_STATUS_OBJECT_NAME_COLLISION;
1151	}
1152
1153	/* No links from a directory. */
1154	if (S_ISDIR(sbuf1.st_mode)) {
1155	return NT_STATUS_FILE_IS_A_DIRECTORY;
1156	}
1157
1158	/* Ensure this is within the share. */
1159	status = check_reduced_name(conn, oldname);
1160	if (!NT_STATUS_IS_OK(status)) {
1161	return status;
1162	}
1163
1164	DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1165	oldname, newname));
1166
1167	status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1168	FILE_READ_DATA, /* Read-only. */
1169	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1170	FILE_OPEN,
1171	0, /* No create options. */
1172	FILE_ATTRIBUTE_NORMAL,
1173	NO_OPLOCK,
1174	&info, &fsp1);
1175
1176	if (!NT_STATUS_IS_OK(status)) {
1177	return status;
1178	}
1179
1180	status = open_file_ntcreate(conn, req, newname, &sbuf2,
1181	FILE_WRITE_DATA, /* Read-only. */
1182	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1183	FILE_CREATE,
1184	0, /* No create options. */
1185	fattr,
1186	NO_OPLOCK,
1187	&info, &fsp2);
1188
1189	if (!NT_STATUS_IS_OK(status)) {
1190	close_file(fsp1,ERROR_CLOSE);
1191	return status;
1192	}
1193
1194	if (sbuf1.st_size) {
1195	ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1196	}
1197
1198	/*
1199	* As we are opening fsp1 read-only we only expect
1200	* an error on close on fsp2 if we are out of space.
1201	* Thus we don't look at the error return from the
1202	* close of fsp1.
1203	*/
1204	close_file(fsp1,NORMAL_CLOSE);
1205
1206	/* Ensure the modtime is set correctly on the destination file. */
1207	set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1208
1209	status = close_file(fsp2,NORMAL_CLOSE);
1210
1211	/* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1212	creates the file. This isn't the correct thing to do in the copy
1213	case. JRA */
1214	file_set_dosmode(conn, newname, fattr, &sbuf2,
1215	parent_dirname(newname),false);
1216
1217	if (ret < (SMB_OFF_T)sbuf1.st_size) {
1218	return NT_STATUS_DISK_FULL;
1219	}
1220
1221	if (!NT_STATUS_IS_OK(status)) {
1222	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1223	nt_errstr(status), oldname, newname));
1224	}
1225	return status;
1226	}
1227
1228	/****************************************************************************
1229	Reply to a NT rename request.
1230	****************************************************************************/
1231
1232	void reply_ntrename(struct smb_request *req)
1233	{
1234	connection_struct *conn = req->conn;
1235	char *oldname = NULL;
1236	char *newname = NULL;
1237	char *p;
1238	NTSTATUS status;
1239	bool src_has_wcard = False;
1240	bool dest_has_wcard = False;
1241	uint32 attrs;
1242	uint16 rename_type;
1243	TALLOC_CTX *ctx = talloc_tos();
1244
1245	START_PROFILE(SMBntrename);
1246
1247	if (req->wct < 4) {
1248	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1249	END_PROFILE(SMBntrename);
1250	return;
1251	}
1252
1253	attrs = SVAL(req->inbuf,smb_vwv0);
1254	rename_type = SVAL(req->inbuf,smb_vwv1);
1255
1256	p = smb_buf(req->inbuf) + 1;
1257	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1258	0, STR_TERMINATE, &status,
1259	&src_has_wcard);
1260	if (!NT_STATUS_IS_OK(status)) {
1261	reply_nterror(req, status);
1262	END_PROFILE(SMBntrename);
1263	return;
1264	}
1265
1266	if (ms_has_wild(oldname)) {
1267	reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1268	END_PROFILE(SMBntrename);
1269	return;
1270	}
1271
1272	p++;
1273	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1274	0, STR_TERMINATE, &status,
1275	&dest_has_wcard);
1276	if (!NT_STATUS_IS_OK(status)) {
1277	reply_nterror(req, status);
1278	END_PROFILE(SMBntrename);
1279	return;
1280	}
1281
1282	status = resolve_dfspath(ctx, conn,
1283	req->flags2 & FLAGS2_DFS_PATHNAMES,
1284	oldname,
1285	&oldname);
1286	if (!NT_STATUS_IS_OK(status)) {
1287	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1288	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1289	ERRSRV, ERRbadpath);
1290	END_PROFILE(SMBntrename);
1291	return;
1292	}
1293	reply_nterror(req, status);
1294	END_PROFILE(SMBntrename);
1295	return;
1296	}
1297
1298	status = resolve_dfspath(ctx, conn,
1299	req->flags2 & FLAGS2_DFS_PATHNAMES,
1300	newname,
1301	&newname);
1302	if (!NT_STATUS_IS_OK(status)) {
1303	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1304	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1305	ERRSRV, ERRbadpath);
1306	END_PROFILE(SMBntrename);
1307	return;
1308	}
1309	reply_nterror(req, status);
1310	END_PROFILE(SMBntrename);
1311	return;
1312	}
1313
1314	/* The new name must begin with a ':' if the old name is a stream. */
1315	if (is_ntfs_stream_name(oldname) && (newname[0] != ':')) {
1316	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1317	END_PROFILE(SMBntrename);
1318	return;
1319	}
1320
1321	DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1322
1323	switch(rename_type) {
1324	case RENAME_FLAG_RENAME:
1325	status = rename_internals(ctx, conn, req, oldname,
1326	newname, attrs, False, src_has_wcard,
1327	dest_has_wcard, DELETE_ACCESS);
1328	break;
1329	case RENAME_FLAG_HARD_LINK:
1330	if (src_has_wcard \|\| dest_has_wcard) {
1331	/* No wildcards. */
1332	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1333	} else {
1334	status = hardlink_internals(ctx,
1335	conn,
1336	oldname,
1337	newname);
1338	}
1339	break;
1340	case RENAME_FLAG_COPY:
1341	if (src_has_wcard \|\| dest_has_wcard) {
1342	/* No wildcards. */
1343	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1344	} else {
1345	status = copy_internals(ctx, conn, req, oldname,
1346	newname, attrs);
1347	}
1348	break;
1349	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1350	status = NT_STATUS_INVALID_PARAMETER;
1351	break;
1352	default:
1353	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1354	break;
1355	}
1356
1357	if (!NT_STATUS_IS_OK(status)) {
1358	if (open_was_deferred(req->mid)) {
1359	/* We have re-scheduled this call. */
1360	END_PROFILE(SMBntrename);
1361	return;
1362	}
1363
1364	reply_nterror(req, status);
1365	END_PROFILE(SMBntrename);
1366	return;
1367	}
1368
1369	reply_outbuf(req, 0, 0);
1370
1371	END_PROFILE(SMBntrename);
1372	return;
1373	}
1374
1375	/****************************************************************************
1376	Reply to a notify change - queue the request and
1377	don't allow a directory to be opened.
1378	****************************************************************************/
1379
1380	static void call_nt_transact_notify_change(connection_struct *conn,
1381	struct smb_request *req,
1382	uint16 **ppsetup,
1383	uint32 setup_count,
1384	char **ppparams,
1385	uint32 parameter_count,
1386	char **ppdata, uint32 data_count,
1387	uint32 max_data_count,
1388	uint32 max_param_count)
1389	{
1390	uint16 setup = ppsetup;
1391	files_struct *fsp;
1392	uint32 filter;
1393	NTSTATUS status;
1394	bool recursive;
1395
1396	if(setup_count < 6) {
1397	reply_doserror(req, ERRDOS, ERRbadfunc);
1398	return;
1399	}
1400
1401	fsp = file_fsp(SVAL(setup,4));
1402	filter = IVAL(setup, 0);
1403	recursive = (SVAL(setup, 6) != 0) ? True : False;
1404
1405	DEBUG(3,("call_nt_transact_notify_change\n"));
1406
1407	if(!fsp) {
1408	reply_doserror(req, ERRDOS, ERRbadfid);
1409	return;
1410	}
1411
1412	{
1413	char *filter_string;
1414
1415	if (!(filter_string = notify_filter_string(NULL, filter))) {
1416	reply_nterror(req,NT_STATUS_NO_MEMORY);
1417	return;
1418	}
1419
1420	DEBUG(3,("call_nt_transact_notify_change: notify change "
1421	"called on %s, filter = %s, recursive = %d\n",
1422	fsp->fsp_name, filter_string, recursive));
1423
1424	TALLOC_FREE(filter_string);
1425	}
1426
1427	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1428	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1429	return;
1430	}
1431
1432	if (fsp->notify == NULL) {
1433
1434	status = change_notify_create(fsp, filter, recursive);
1435
1436	if (!NT_STATUS_IS_OK(status)) {
1437	DEBUG(10, ("change_notify_create returned %s\n",
1438	nt_errstr(status)));
1439	reply_nterror(req, status);
1440	return;
1441	}
1442	}
1443
1444	if (fsp->notify->num_changes != 0) {
1445
1446	/*
1447	* We've got changes pending, respond immediately
1448	*/
1449
1450	/*
1451	* TODO: write a torture test to check the filtering behaviour
1452	* here.
1453	*/
1454
1455	change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1456
1457	/*
1458	* change_notify_reply() above has independently sent its
1459	* results
1460	*/
1461	return;
1462	}
1463
1464	/*
1465	* No changes pending, queue the request
1466	*/
1467
1468	status = change_notify_add_request(req,
1469	max_param_count,
1470	filter,
1471	recursive, fsp);
1472	if (!NT_STATUS_IS_OK(status)) {
1473	reply_nterror(req, status);
1474	}
1475	return;
1476	}
1477
1478	/****************************************************************************
1479	Reply to an NT transact rename command.
1480	****************************************************************************/
1481
1482	static void call_nt_transact_rename(connection_struct *conn,
1483	struct smb_request *req,
1484	uint16 **ppsetup, uint32 setup_count,
1485	char **ppparams, uint32 parameter_count,
1486	char **ppdata, uint32 data_count,
1487	uint32 max_data_count)
1488	{
1489	char params = ppparams;
1490	char *new_name = NULL;
1491	files_struct *fsp = NULL;
1492	bool dest_has_wcard = False;
1493	NTSTATUS status;
1494	TALLOC_CTX *ctx = talloc_tos();
1495
1496	if(parameter_count < 5) {
1497	reply_doserror(req, ERRDOS, ERRbadfunc);
1498	return;
1499	}
1500
1501	fsp = file_fsp(SVAL(params, 0));
1502	if (!check_fsp(conn, req, fsp)) {
1503	return;
1504	}
1505	srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1506	parameter_count - 4,
1507	STR_TERMINATE, &status, &dest_has_wcard);
1508	if (!NT_STATUS_IS_OK(status)) {
1509	reply_nterror(req, status);
1510	return;
1511	}
1512
1513	/*
1514	* W2K3 ignores this request as the RAW-RENAME test
1515	* demonstrates, so we do.
1516	*/
1517	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1518
1519	DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1520	fsp->fsp_name, new_name));
1521
1522	return;
1523	}
1524
1525	/******************************************************************************
1526	Fake up a completely empty SD.
1527	*******************************************************************************/
1528
1529	static NTSTATUS get_null_nt_acl(TALLOC_CTX mem_ctx, SEC_DESC *ppsd)
1530	{
1531	size_t sd_size;
1532
1533	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1534	if(!*ppsd) {
1535	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1536	return NT_STATUS_NO_MEMORY;
1537	}
1538
1539	return NT_STATUS_OK;
1540	}
1541
1542	/****************************************************************************
1543	Reply to query a security descriptor.
1544	****************************************************************************/
1545
1546	static void call_nt_transact_query_security_desc(connection_struct *conn,
1547	struct smb_request *req,
1548	uint16 **ppsetup,
1549	uint32 setup_count,
1550	char **ppparams,
1551	uint32 parameter_count,
1552	char **ppdata,
1553	uint32 data_count,
1554	uint32 max_data_count)
1555	{
1556	char params = ppparams;
1557	char data = ppdata;
1558	SEC_DESC *psd = NULL;
1559	size_t sd_size;
1560	uint32 security_info_wanted;
1561	files_struct *fsp = NULL;
1562	NTSTATUS status;
1563	DATA_BLOB blob;
1564
1565	if(parameter_count < 8) {
1566	reply_doserror(req, ERRDOS, ERRbadfunc);
1567	return;
1568	}
1569
1570	fsp = file_fsp(SVAL(params,0));
1571	if(!fsp) {
1572	reply_doserror(req, ERRDOS, ERRbadfid);
1573	return;
1574	}
1575
1576	security_info_wanted = IVAL(params,4);
1577
1578	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1579	(unsigned int)security_info_wanted ));
1580
1581	params = nttrans_realloc(ppparams, 4);
1582	if(params == NULL) {
1583	reply_doserror(req, ERRDOS, ERRnomem);
1584	return;
1585	}
1586
1587	/*
1588	* Get the permissions to return.
1589	*/
1590
1591	if (!lp_nt_acl_support(SNUM(conn))) {
1592	status = get_null_nt_acl(talloc_tos(), &psd);
1593	} else {
1594	status = SMB_VFS_FGET_NT_ACL(
1595	fsp, security_info_wanted, &psd);
1596	}
1597	if (!NT_STATUS_IS_OK(status)) {
1598	reply_nterror(req, status);
1599	return;
1600	}
1601
1602	/* If the SACL/DACL is NULL, but was requested, we mark that it is
1603	* present in the reply to match Windows behavior */
1604	if (psd->sacl == NULL &&
1605	security_info_wanted & SACL_SECURITY_INFORMATION)
1606	psd->type \|= SEC_DESC_SACL_PRESENT;
1607	if (psd->dacl == NULL &&
1608	security_info_wanted & DACL_SECURITY_INFORMATION)
1609	psd->type \|= SEC_DESC_DACL_PRESENT;
1610
1611	sd_size = ndr_size_security_descriptor(psd, 0);
1612
1613	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1614
1615	if (DEBUGLEVEL >= 10) {
1616	DEBUG(10,("call_nt_transact_query_security_desc for file %s\n", fsp->fsp_name ));
1617	NDR_PRINT_DEBUG(security_descriptor, psd);
1618	}
1619
1620	SIVAL(params,0,(uint32)sd_size);
1621
1622	if (max_data_count < sd_size) {
1623	send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1624	params, 4, *ppdata, 0);
1625	return;
1626	}
1627
1628	/*
1629	* Allocate the data we will point this at.
1630	*/
1631
1632	data = nttrans_realloc(ppdata, sd_size);
1633	if(data == NULL) {
1634	reply_doserror(req, ERRDOS, ERRnomem);
1635	return;
1636	}
1637
1638	status = marshall_sec_desc(talloc_tos(), psd,
1639	&blob.data, &blob.length);
1640
1641	if (!NT_STATUS_IS_OK(status)) {
1642	reply_nterror(req, status);
1643	return;
1644	}
1645
1646	SMB_ASSERT(sd_size == blob.length);
1647	memcpy(data, blob.data, sd_size);
1648
1649	send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1650
1651	return;
1652	}
1653
1654	/****************************************************************************
1655	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1656	****************************************************************************/
1657
1658	static void call_nt_transact_set_security_desc(connection_struct *conn,
1659	struct smb_request *req,
1660	uint16 **ppsetup,
1661	uint32 setup_count,
1662	char **ppparams,
1663	uint32 parameter_count,
1664	char **ppdata,
1665	uint32 data_count,
1666	uint32 max_data_count)
1667	{
1668	char params= ppparams;
1669	char data = ppdata;
1670	files_struct *fsp = NULL;
1671	uint32 security_info_sent = 0;
1672	NTSTATUS status;
1673
1674	if(parameter_count < 8) {
1675	reply_doserror(req, ERRDOS, ERRbadfunc);
1676	return;
1677	}
1678
1679	if((fsp = file_fsp(SVAL(params,0))) == NULL) {
1680	reply_doserror(req, ERRDOS, ERRbadfid);
1681	return;
1682	}
1683
1684	if(!lp_nt_acl_support(SNUM(conn))) {
1685	goto done;
1686	}
1687
1688	security_info_sent = IVAL(params,4);
1689
1690	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1691	(unsigned int)security_info_sent ));
1692
1693	if (data_count == 0) {
1694	reply_doserror(req, ERRDOS, ERRnoaccess);
1695	return;
1696	}
1697
1698	status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1699
1700	if (!NT_STATUS_IS_OK(status)) {
1701	reply_nterror(req, status);
1702	return;
1703	}
1704
1705	done:
1706	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1707	return;
1708	}
1709
1710	/****************************************************************************
1711	Reply to NT IOCTL
1712	****************************************************************************/
1713
1714	static void call_nt_transact_ioctl(connection_struct *conn,
1715	struct smb_request *req,
1716	uint16 **ppsetup, uint32 setup_count,
1717	char **ppparams, uint32 parameter_count,
1718	char **ppdata, uint32 data_count,
1719	uint32 max_data_count)
1720	{
1721	uint32 function;
1722	uint16 fidnum;
1723	files_struct *fsp;
1724	uint8 isFSctl;
1725	uint8 compfilter;
1726	static bool logged_message;
1727	char pdata = ppdata;
1728
1729	if (setup_count != 8) {
1730	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1731	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1732	return;
1733	}
1734
1735	function = IVAL(*ppsetup, 0);
1736	fidnum = SVAL(*ppsetup, 4);
1737	isFSctl = CVAL(*ppsetup, 6);
1738	compfilter = CVAL(*ppsetup, 7);
1739
1740	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1741	function, fidnum, isFSctl, compfilter));
1742
1743	fsp=file_fsp(fidnum);
1744	/* this check is done in each implemented function case for now
1745	because I don't want to break anything... --metze
1746	FSP_BELONGS_CONN(fsp,conn);*/
1747
1748	switch (function) {
1749	case FSCTL_SET_SPARSE:
1750	/* pretend this succeeded - tho strictly we should
1751	mark the file sparse (if the local fs supports it)
1752	so we can know if we need to pre-allocate or not */
1753
1754	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1755	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1756	return;
1757
1758	case FSCTL_CREATE_OR_GET_OBJECT_ID:
1759	{
1760	unsigned char objid[16];
1761
1762	/* This should return the object-id on this file.
1763	* I think I'll make this be the inode+dev. JRA.
1764	*/
1765
1766	DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1767
1768	if (!fsp_belongs_conn(conn, req, fsp)) {
1769	return;
1770	}
1771
1772	data_count = 64;
1773	pdata = nttrans_realloc(ppdata, data_count);
1774	if (pdata == NULL) {
1775	reply_nterror(req, NT_STATUS_NO_MEMORY);
1776	return;
1777	}
1778	push_file_id_16(pdata, &fsp->file_id);
1779	memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1780	push_file_id_16(pdata+32, &fsp->file_id);
1781	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1782	pdata, data_count);
1783	return;
1784	}
1785
1786	case FSCTL_GET_REPARSE_POINT:
1787	/* pretend this fail - my winXP does it like this
1788	* --metze
1789	*/
1790
1791	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1792	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1793	return;
1794
1795	case FSCTL_SET_REPARSE_POINT:
1796	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1797	* --metze
1798	*/
1799
1800	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1801	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1802	return;
1803
1804	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1805	{
1806	/*
1807	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1808	* and return their volume names. If max_data_count is 16, then it is just
1809	* asking for the number of volumes and length of the combined names.
1810	*
1811	* pdata is the data allocated by our caller, but that uses
1812	* total_data_count (which is 0 in our case) rather than max_data_count.
1813	* Allocate the correct amount and return the pointer to let
1814	* it be deallocated when we return.
1815	*/
1816	SHADOW_COPY_DATA *shadow_data = NULL;
1817	TALLOC_CTX *shadow_mem_ctx = NULL;
1818	bool labels = False;
1819	uint32 labels_data_count = 0;
1820	uint32 i;
1821	char *cur_pdata;
1822
1823	if (!fsp_belongs_conn(conn, req, fsp)) {
1824	return;
1825	}
1826
1827	if (max_data_count < 16) {
1828	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1829	max_data_count));
1830	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1831	return;
1832	}
1833
1834	if (max_data_count > 16) {
1835	labels = True;
1836	}
1837
1838	shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1839	if (shadow_mem_ctx == NULL) {
1840	DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1841	reply_nterror(req, NT_STATUS_NO_MEMORY);
1842	return;
1843	}
1844
1845	shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1846	if (shadow_data == NULL) {
1847	DEBUG(0,("TALLOC_ZERO() failed!\n"));
1848	talloc_destroy(shadow_mem_ctx);
1849	reply_nterror(req, NT_STATUS_NO_MEMORY);
1850	return;
1851	}
1852
1853	shadow_data->mem_ctx = shadow_mem_ctx;
1854
1855	/*
1856	* Call the VFS routine to actually do the work.
1857	*/
1858	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1859	talloc_destroy(shadow_data->mem_ctx);
1860	if (errno == ENOSYS) {
1861	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1862	conn->connectpath));
1863	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1864	return;
1865	} else {
1866	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1867	conn->connectpath));
1868	reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1869	return;
1870	}
1871	}
1872
1873	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
1874
1875	if (!labels) {
1876	data_count = 16;
1877	} else {
1878	data_count = 12+labels_data_count+4;
1879	}
1880
1881	if (max_data_count<data_count) {
1882	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1883	max_data_count,data_count));
1884	talloc_destroy(shadow_data->mem_ctx);
1885	reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1886	return;
1887	}
1888
1889	pdata = nttrans_realloc(ppdata, data_count);
1890	if (pdata == NULL) {
1891	talloc_destroy(shadow_data->mem_ctx);
1892	reply_nterror(req, NT_STATUS_NO_MEMORY);
1893	return;
1894	}
1895
1896	cur_pdata = pdata;
1897
1898	/* num_volumes 4 bytes */
1899	SIVAL(pdata,0,shadow_data->num_volumes);
1900
1901	if (labels) {
1902	/* num_labels 4 bytes */
1903	SIVAL(pdata,4,shadow_data->num_volumes);
1904	}
1905
1906	/* needed_data_count 4 bytes */
1907	SIVAL(pdata, 8, labels_data_count+4);
1908
1909	cur_pdata+=12;
1910
1911	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1912	shadow_data->num_volumes,fsp->fsp_name));
1913	if (labels && shadow_data->labels) {
1914	for (i=0;i<shadow_data->num_volumes;i++) {
1915	srvstr_push(pdata, req->flags2,
1916	cur_pdata, shadow_data->labels[i],
1917	2*sizeof(SHADOW_COPY_LABEL),
1918	STR_UNICODE\|STR_TERMINATE);
1919	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1920	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1921	}
1922	}
1923
1924	talloc_destroy(shadow_data->mem_ctx);
1925
1926	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1927	pdata, data_count);
1928
1929	return;
1930	}
1931
1932	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1933	{
1934	/* pretend this succeeded -
1935	*
1936	* we have to send back a list with all files owned by this SID
1937	*
1938	* but I have to check that --metze
1939	*/
1940	DOM_SID sid;
1941	uid_t uid;
1942	size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1943
1944	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1945
1946	if (!fsp_belongs_conn(conn, req, fsp)) {
1947	return;
1948	}
1949
1950	/* unknown 4 bytes: this is not the length of the sid :-( */
1951	/unknown = IVAL(pdata,0);/
1952
1953	if (!sid_parse(pdata+4,sid_len,&sid)) {
1954	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1955	return;
1956	}
1957
1958	DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1959
1960	if (!sid_to_uid(&sid, &uid)) {
1961	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1962	sid_string_dbg(&sid),
1963	(unsigned long)sid_len));
1964	uid = (-1);
1965	}
1966
1967	/* we can take a look at the find source :-)
1968	*
1969	* find ./ -uid $uid -name '*' is what we need here
1970	*
1971	*
1972	* and send 4bytes len and then NULL terminated unicode strings
1973	* for each file
1974	*
1975	* but I don't know how to deal with the paged results
1976	* (maybe we can hang the result anywhere in the fsp struct)
1977	*
1978	* we don't send all files at once
1979	* and at the next we should not start from the beginning,
1980	* so we have to cache the result
1981	*
1982	* --metze
1983	*/
1984
1985	/* this works for now... */
1986	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1987	return;
1988	}
1989	default:
1990	if (!logged_message) {
1991	logged_message = True; /* Only print this once... */
1992	DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
1993	function));
1994	}
1995	}
1996
1997	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1998	}
1999
2000
2001	#ifdef HAVE_SYS_QUOTAS
2002	/****************************************************************************
2003	Reply to get user quota
2004	****************************************************************************/
2005
2006	static void call_nt_transact_get_user_quota(connection_struct *conn,
2007	struct smb_request *req,
2008	uint16 **ppsetup,
2009	uint32 setup_count,
2010	char **ppparams,
2011	uint32 parameter_count,
2012	char **ppdata,
2013	uint32 data_count,
2014	uint32 max_data_count)
2015	{
2016	NTSTATUS nt_status = NT_STATUS_OK;
2017	char params = ppparams;
2018	char pdata = ppdata;
2019	char *entry;
2020	int data_len=0,param_len=0;
2021	int qt_len=0;
2022	int entry_len = 0;
2023	files_struct *fsp = NULL;
2024	uint16 level = 0;
2025	size_t sid_len;
2026	DOM_SID sid;
2027	bool start_enum = True;
2028	SMB_NTQUOTA_STRUCT qt;
2029	SMB_NTQUOTA_LIST *tmp_list;
2030	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2031
2032	ZERO_STRUCT(qt);
2033
2034	/* access check */
2035	if (conn->server_info->utok.uid != 0) {
2036	DEBUG(1,("get_user_quota: access_denied service [%s] user "
2037	"[%s]\n", lp_servicename(SNUM(conn)),
2038	conn->server_info->unix_name));
2039	reply_doserror(req, ERRDOS, ERRnoaccess);
2040	return;
2041	}
2042
2043	/*
2044	* Ensure minimum number of parameters sent.
2045	*/
2046
2047	if (parameter_count < 4) {
2048	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2049	reply_doserror(req, ERRDOS, ERRinvalidparam);
2050	return;
2051	}
2052
2053	/* maybe we can check the quota_fnum */
2054	fsp = file_fsp(SVAL(params,0));
2055	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2056	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2057	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2058	return;
2059	}
2060
2061	/* the NULL pointer checking for fsp->fake_file_handle->pd
2062	* is done by CHECK_NTQUOTA_HANDLE_OK()
2063	*/
2064	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2065
2066	level = SVAL(params,2);
2067
2068	/* unknown 12 bytes leading in params */
2069
2070	switch (level) {
2071	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2072	/* seems that we should continue with the enum here --metze */
2073
2074	if (qt_handle->quota_list!=NULL &&
2075	qt_handle->tmp_list==NULL) {
2076
2077	/* free the list */
2078	free_ntquota_list(&(qt_handle->quota_list));
2079
2080	/* Realloc the size of parameters and data we will return */
2081	param_len = 4;
2082	params = nttrans_realloc(ppparams, param_len);
2083	if(params == NULL) {
2084	reply_doserror(req, ERRDOS, ERRnomem);
2085	return;
2086	}
2087
2088	data_len = 0;
2089	SIVAL(params,0,data_len);
2090
2091	break;
2092	}
2093
2094	start_enum = False;
2095
2096	case TRANSACT_GET_USER_QUOTA_LIST_START:
2097
2098	if (qt_handle->quota_list==NULL &&
2099	qt_handle->tmp_list==NULL) {
2100	start_enum = True;
2101	}
2102
2103	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2104	reply_doserror(req, ERRSRV, ERRerror);
2105	return;
2106	}
2107
2108	/* Realloc the size of parameters and data we will return */
2109	param_len = 4;
2110	params = nttrans_realloc(ppparams, param_len);
2111	if(params == NULL) {
2112	reply_doserror(req, ERRDOS, ERRnomem);
2113	return;
2114	}
2115
2116	/* we should not trust the value in max_data_count*/
2117	max_data_count = MIN(max_data_count,2048);
2118
2119	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2120	if(pdata == NULL) {
2121	reply_doserror(req, ERRDOS, ERRnomem);
2122	return;
2123	}
2124
2125	entry = pdata;
2126
2127	/* set params Size of returned Quota Data 4 bytes*/
2128	/* but set it later when we know it */
2129
2130	/* for each entry push the data */
2131
2132	if (start_enum) {
2133	qt_handle->tmp_list = qt_handle->quota_list;
2134	}
2135
2136	tmp_list = qt_handle->tmp_list;
2137
2138	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2139	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2140
2141	sid_len = ndr_size_dom_sid(
2142	&tmp_list->quotas->sid, 0);
2143	entry_len = 40 + sid_len;
2144
2145	/* nextoffset entry 4 bytes */
2146	SIVAL(entry,0,entry_len);
2147
2148	/* then the len of the SID 4 bytes */
2149	SIVAL(entry,4,sid_len);
2150
2151	/* unknown data 8 bytes SMB_BIG_UINT */
2152	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2153
2154	/* the used disk space 8 bytes SMB_BIG_UINT */
2155	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2156
2157	/* the soft quotas 8 bytes SMB_BIG_UINT */
2158	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2159
2160	/* the hard quotas 8 bytes SMB_BIG_UINT */
2161	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2162
2163	/* and now the SID */
2164	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2165	}
2166
2167	qt_handle->tmp_list = tmp_list;
2168
2169	/* overwrite the offset of the last entry */
2170	SIVAL(entry-entry_len,0,0);
2171
2172	data_len = 4+qt_len;
2173	/* overwrite the params quota_data_len */
2174	SIVAL(params,0,data_len);
2175
2176	break;
2177
2178	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2179
2180	/* unknown 4 bytes IVAL(pdata,0) */
2181
2182	if (data_count < 8) {
2183	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2184	reply_doserror(req, ERRDOS, ERRunknownlevel);
2185	return;
2186	}
2187
2188	sid_len = IVAL(pdata,4);
2189	/* Ensure this is less than 1mb. */
2190	if (sid_len > (1024*1024)) {
2191	reply_doserror(req, ERRDOS, ERRnomem);
2192	return;
2193	}
2194
2195	if (data_count < 8+sid_len) {
2196	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2197	reply_doserror(req, ERRDOS, ERRunknownlevel);
2198	return;
2199	}
2200
2201	data_len = 4+40+sid_len;
2202
2203	if (max_data_count < data_len) {
2204	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2205	max_data_count, data_len));
2206	param_len = 4;
2207	SIVAL(params,0,data_len);
2208	data_len = 0;
2209	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2210	break;
2211	}
2212
2213	if (!sid_parse(pdata+8,sid_len,&sid)) {
2214	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2215	return;
2216	}
2217
2218	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2219	ZERO_STRUCT(qt);
2220	/*
2221	* we have to return zero's in all fields
2222	* instead of returning an error here
2223	* --metze
2224	*/
2225	}
2226
2227	/* Realloc the size of parameters and data we will return */
2228	param_len = 4;
2229	params = nttrans_realloc(ppparams, param_len);
2230	if(params == NULL) {
2231	reply_doserror(req, ERRDOS, ERRnomem);
2232	return;
2233	}
2234
2235	pdata = nttrans_realloc(ppdata, data_len);
2236	if(pdata == NULL) {
2237	reply_doserror(req, ERRDOS, ERRnomem);
2238	return;
2239	}
2240
2241	entry = pdata;
2242
2243	/* set params Size of returned Quota Data 4 bytes*/
2244	SIVAL(params,0,data_len);
2245
2246	/* nextoffset entry 4 bytes */
2247	SIVAL(entry,0,0);
2248
2249	/* then the len of the SID 4 bytes */
2250	SIVAL(entry,4,sid_len);
2251
2252	/* unknown data 8 bytes SMB_BIG_UINT */
2253	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2254
2255	/* the used disk space 8 bytes SMB_BIG_UINT */
2256	SBIG_UINT(entry,16,qt.usedspace);
2257
2258	/* the soft quotas 8 bytes SMB_BIG_UINT */
2259	SBIG_UINT(entry,24,qt.softlim);
2260
2261	/* the hard quotas 8 bytes SMB_BIG_UINT */
2262	SBIG_UINT(entry,32,qt.hardlim);
2263
2264	/* and now the SID */
2265	sid_linearize(entry+40, sid_len, &sid);
2266
2267	break;
2268
2269	default:
2270	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2271	reply_doserror(req, ERRSRV, ERRerror);
2272	return;
2273	break;
2274	}
2275
2276	send_nt_replies(conn, req, nt_status, params, param_len,
2277	pdata, data_len);
2278	}
2279
2280	/****************************************************************************
2281	Reply to set user quota
2282	****************************************************************************/
2283
2284	static void call_nt_transact_set_user_quota(connection_struct *conn,
2285	struct smb_request *req,
2286	uint16 **ppsetup,
2287	uint32 setup_count,
2288	char **ppparams,
2289	uint32 parameter_count,
2290	char **ppdata,
2291	uint32 data_count,
2292	uint32 max_data_count)
2293	{
2294	char params = ppparams;
2295	char pdata = ppdata;
2296	int data_len=0,param_len=0;
2297	SMB_NTQUOTA_STRUCT qt;
2298	size_t sid_len;
2299	DOM_SID sid;
2300	files_struct *fsp = NULL;
2301
2302	ZERO_STRUCT(qt);
2303
2304	/* access check */
2305	if (conn->server_info->utok.uid != 0) {
2306	DEBUG(1,("set_user_quota: access_denied service [%s] user "
2307	"[%s]\n", lp_servicename(SNUM(conn)),
2308	conn->server_info->unix_name));
2309	reply_doserror(req, ERRDOS, ERRnoaccess);
2310	return;
2311	}
2312
2313	/*
2314	* Ensure minimum number of parameters sent.
2315	*/
2316
2317	if (parameter_count < 2) {
2318	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2319	reply_doserror(req, ERRDOS, ERRinvalidparam);
2320	return;
2321	}
2322
2323	/* maybe we can check the quota_fnum */
2324	fsp = file_fsp(SVAL(params,0));
2325	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2326	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2327	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2328	return;
2329	}
2330
2331	if (data_count < 40) {
2332	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2333	reply_doserror(req, ERRDOS, ERRunknownlevel);
2334	return;
2335	}
2336
2337	/* offset to next quota record.
2338	* 4 bytes IVAL(pdata,0)
2339	* unused here...
2340	*/
2341
2342	/* sid len */
2343	sid_len = IVAL(pdata,4);
2344
2345	if (data_count < 40+sid_len) {
2346	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2347	reply_doserror(req, ERRDOS, ERRunknownlevel);
2348	return;
2349	}
2350
2351	/* unknown 8 bytes in pdata
2352	* maybe its the change time in NTTIME
2353	*/
2354
2355	/* the used space 8 bytes (SMB_BIG_UINT)*/
2356	qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2357	#ifdef LARGE_SMB_OFF_T
2358	qt.usedspace \|= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2359	#else /* LARGE_SMB_OFF_T */
2360	if ((IVAL(pdata,20) != 0)&&
2361	((qt.usedspace != 0xFFFFFFFF)\|\|
2362	(IVAL(pdata,20)!=0xFFFFFFFF))) {
2363	/* more than 32 bits? */
2364	reply_doserror(req, ERRDOS, ERRunknownlevel);
2365	return;
2366	}
2367	#endif /* LARGE_SMB_OFF_T */
2368
2369	/* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2370	qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2371	#ifdef LARGE_SMB_OFF_T
2372	qt.softlim \|= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2373	#else /* LARGE_SMB_OFF_T */
2374	if ((IVAL(pdata,28) != 0)&&
2375	((qt.softlim != 0xFFFFFFFF)\|\|
2376	(IVAL(pdata,28)!=0xFFFFFFFF))) {
2377	/* more than 32 bits? */
2378	reply_doserror(req, ERRDOS, ERRunknownlevel);
2379	return;
2380	}
2381	#endif /* LARGE_SMB_OFF_T */
2382
2383	/* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2384	qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2385	#ifdef LARGE_SMB_OFF_T
2386	qt.hardlim \|= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2387	#else /* LARGE_SMB_OFF_T */
2388	if ((IVAL(pdata,36) != 0)&&
2389	((qt.hardlim != 0xFFFFFFFF)\|\|
2390	(IVAL(pdata,36)!=0xFFFFFFFF))) {
2391	/* more than 32 bits? */
2392	reply_doserror(req, ERRDOS, ERRunknownlevel);
2393	return;
2394	}
2395	#endif /* LARGE_SMB_OFF_T */
2396
2397	if (!sid_parse(pdata+40,sid_len,&sid)) {
2398	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2399	return;
2400	}
2401
2402	DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2403
2404	/* 44 unknown bytes left... */
2405
2406	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2407	reply_doserror(req, ERRSRV, ERRerror);
2408	return;
2409	}
2410
2411	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2412	pdata, data_len);
2413	}
2414	#endif /* HAVE_SYS_QUOTAS */
2415
2416	static void handle_nttrans(connection_struct *conn,
2417	struct trans_state *state,
2418	struct smb_request *req)
2419	{
2420	if (Protocol >= PROTOCOL_NT1) {
2421	req->flags2 \|= 0x40; /* IS_LONG_NAME */
2422	SSVAL(req->inbuf,smb_flg2,req->flags2);
2423	}
2424
2425	/* Now we must call the relevant NT_TRANS function */
2426	switch(state->call) {
2427	case NT_TRANSACT_CREATE:
2428	{
2429	START_PROFILE(NT_transact_create);
2430	call_nt_transact_create(
2431	conn, req,
2432	&state->setup, state->setup_count,
2433	&state->param, state->total_param,
2434	&state->data, state->total_data,
2435	state->max_data_return);
2436	END_PROFILE(NT_transact_create);
2437	break;
2438	}
2439
2440	case NT_TRANSACT_IOCTL:
2441	{
2442	START_PROFILE(NT_transact_ioctl);
2443	call_nt_transact_ioctl(
2444	conn, req,
2445	&state->setup, state->setup_count,
2446	&state->param, state->total_param,
2447	&state->data, state->total_data,
2448	state->max_data_return);
2449	END_PROFILE(NT_transact_ioctl);
2450	break;
2451	}
2452
2453	case NT_TRANSACT_SET_SECURITY_DESC:
2454	{
2455	START_PROFILE(NT_transact_set_security_desc);
2456	call_nt_transact_set_security_desc(
2457	conn, req,
2458	&state->setup, state->setup_count,
2459	&state->param, state->total_param,
2460	&state->data, state->total_data,
2461	state->max_data_return);
2462	END_PROFILE(NT_transact_set_security_desc);
2463	break;
2464	}
2465
2466	case NT_TRANSACT_NOTIFY_CHANGE:
2467	{
2468	START_PROFILE(NT_transact_notify_change);
2469	call_nt_transact_notify_change(
2470	conn, req,
2471	&state->setup, state->setup_count,
2472	&state->param, state->total_param,
2473	&state->data, state->total_data,
2474	state->max_data_return,
2475	state->max_param_return);
2476	END_PROFILE(NT_transact_notify_change);
2477	break;
2478	}
2479
2480	case NT_TRANSACT_RENAME:
2481	{
2482	START_PROFILE(NT_transact_rename);
2483	call_nt_transact_rename(
2484	conn, req,
2485	&state->setup, state->setup_count,
2486	&state->param, state->total_param,
2487	&state->data, state->total_data,
2488	state->max_data_return);
2489	END_PROFILE(NT_transact_rename);
2490	break;
2491	}
2492
2493	case NT_TRANSACT_QUERY_SECURITY_DESC:
2494	{
2495	START_PROFILE(NT_transact_query_security_desc);
2496	call_nt_transact_query_security_desc(
2497	conn, req,
2498	&state->setup, state->setup_count,
2499	&state->param, state->total_param,
2500	&state->data, state->total_data,
2501	state->max_data_return);
2502	END_PROFILE(NT_transact_query_security_desc);
2503	break;
2504	}
2505
2506	#ifdef HAVE_SYS_QUOTAS
2507	case NT_TRANSACT_GET_USER_QUOTA:
2508	{
2509	START_PROFILE(NT_transact_get_user_quota);
2510	call_nt_transact_get_user_quota(
2511	conn, req,
2512	&state->setup, state->setup_count,
2513	&state->param, state->total_param,
2514	&state->data, state->total_data,
2515	state->max_data_return);
2516	END_PROFILE(NT_transact_get_user_quota);
2517	break;
2518	}
2519
2520	case NT_TRANSACT_SET_USER_QUOTA:
2521	{
2522	START_PROFILE(NT_transact_set_user_quota);
2523	call_nt_transact_set_user_quota(
2524	conn, req,
2525	&state->setup, state->setup_count,
2526	&state->param, state->total_param,
2527	&state->data, state->total_data,
2528	state->max_data_return);
2529	END_PROFILE(NT_transact_set_user_quota);
2530	break;
2531	}
2532	#endif /* HAVE_SYS_QUOTAS */
2533
2534	default:
2535	/* Error in request */
2536	DEBUG(0,("handle_nttrans: Unknown request %d in "
2537	"nttrans call\n", state->call));
2538	reply_doserror(req, ERRSRV, ERRerror);
2539	return;
2540	}
2541	return;
2542	}
2543
2544	/****************************************************************************
2545	Reply to a SMBNTtrans.
2546	****************************************************************************/
2547
2548	void reply_nttrans(struct smb_request *req)
2549	{
2550	connection_struct *conn = req->conn;
2551	uint32_t pscnt;
2552	uint32_t psoff;
2553	uint32_t dscnt;
2554	uint32_t dsoff;
2555	uint16 function_code;
2556	NTSTATUS result;
2557	struct trans_state *state;
2558	uint32_t size;
2559	uint32_t av_size;
2560
2561	START_PROFILE(SMBnttrans);
2562
2563	if (req->wct < 19) {
2564	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2565	END_PROFILE(SMBnttrans);
2566	return;
2567	}
2568
2569	size = smb_len(req->inbuf) + 4;
2570	av_size = smb_len(req->inbuf);
2571	pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2572	psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2573	dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2574	dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2575	function_code = SVAL(req->inbuf, smb_nt_Function);
2576
2577	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2578	reply_doserror(req, ERRSRV, ERRaccess);
2579	END_PROFILE(SMBnttrans);
2580	return;
2581	}
2582
2583	result = allow_new_trans(conn->pending_trans, req->mid);
2584	if (!NT_STATUS_IS_OK(result)) {
2585	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2586	reply_nterror(req, result);
2587	END_PROFILE(SMBnttrans);
2588	return;
2589	}
2590
2591	if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2592	reply_doserror(req, ERRSRV, ERRaccess);
2593	END_PROFILE(SMBnttrans);
2594	return;
2595	}
2596
2597	state->cmd = SMBnttrans;
2598
2599	state->mid = req->mid;
2600	state->vuid = req->vuid;
2601	state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2602	state->data = NULL;
2603	state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2604	state->param = NULL;
2605	state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2606	state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2607
2608	/* setup count is in words */
2609	state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2610	state->setup = NULL;
2611	state->call = function_code;
2612
2613	/*
2614	* All nttrans messages we handle have smb_wct == 19 +
2615	* state->setup_count. Ensure this is so as a sanity check.
2616	*/
2617
2618	if(req->wct != 19 + (state->setup_count/2)) {
2619	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2620	req->wct, 19 + (state->setup_count/2)));
2621	goto bad_param;
2622	}
2623
2624	/* Don't allow more than 128mb for each value. */
2625	if ((state->total_data > (10241024128)) \|\|
2626	(state->total_param > (10241024128))) {
2627	reply_doserror(req, ERRDOS, ERRnomem);
2628	END_PROFILE(SMBnttrans);
2629	return;
2630	}
2631
2632	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
2633	goto bad_param;
2634
2635	if (state->total_data) {
2636	/* Can't use talloc here, the core routines do realloc on the
2637	* params and data. */
2638	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2639	DEBUG(0,("reply_nttrans: data malloc fail for %u "
2640	"bytes !\n", (unsigned int)state->total_data));
2641	TALLOC_FREE(state);
2642	reply_doserror(req, ERRDOS, ERRnomem);
2643	END_PROFILE(SMBnttrans);
2644	return;
2645	}
2646
2647	if (dscnt > state->total_data \|\|
2648	dsoff+dscnt < dsoff) {
2649	goto bad_param;
2650	}
2651
2652	if (dsoff > av_size \|\|
2653	dscnt > av_size \|\|
2654	dsoff+dscnt > av_size) {
2655	goto bad_param;
2656	}
2657
2658	memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2659	}
2660
2661	if (state->total_param) {
2662	/* Can't use talloc here, the core routines do realloc on the
2663	* params and data. */
2664	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2665	DEBUG(0,("reply_nttrans: param malloc fail for %u "
2666	"bytes !\n", (unsigned int)state->total_param));
2667	SAFE_FREE(state->data);
2668	TALLOC_FREE(state);
2669	reply_doserror(req, ERRDOS, ERRnomem);
2670	END_PROFILE(SMBnttrans);
2671	return;
2672	}
2673
2674	if (pscnt > state->total_param \|\|
2675	psoff+pscnt < psoff) {
2676	goto bad_param;
2677	}
2678
2679	if (psoff > av_size \|\|
2680	pscnt > av_size \|\|
2681	psoff+pscnt > av_size) {
2682	goto bad_param;
2683	}
2684
2685	memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2686	}
2687
2688	state->received_data = dscnt;
2689	state->received_param = pscnt;
2690
2691	if(state->setup_count > 0) {
2692	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2693	state->setup_count));
2694	state->setup = (uint16 *)TALLOC(state, state->setup_count);
2695	if (state->setup == NULL) {
2696	DEBUG(0,("reply_nttrans : Out of memory\n"));
2697	SAFE_FREE(state->data);
2698	SAFE_FREE(state->param);
2699	TALLOC_FREE(state);
2700	reply_doserror(req, ERRDOS, ERRnomem);
2701	END_PROFILE(SMBnttrans);
2702	return;
2703	}
2704
2705	if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) \|\|
2706	(smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2707	goto bad_param;
2708	}
2709	if (smb_nt_SetupStart + state->setup_count > size) {
2710	goto bad_param;
2711	}
2712
2713	memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2714	state->setup_count);
2715	dump_data(10, (uint8 *)state->setup, state->setup_count);
2716	}
2717
2718	if ((state->received_data == state->total_data) &&
2719	(state->received_param == state->total_param)) {
2720	handle_nttrans(conn, state, req);
2721	SAFE_FREE(state->param);
2722	SAFE_FREE(state->data);
2723	TALLOC_FREE(state);
2724	END_PROFILE(SMBnttrans);
2725	return;
2726	}
2727
2728	DLIST_ADD(conn->pending_trans, state);
2729
2730	/* We need to send an interim response then receive the rest
2731	of the parameter/data bytes */
2732	reply_outbuf(req, 0, 0);
2733	show_msg((char *)req->outbuf);
2734	END_PROFILE(SMBnttrans);
2735	return;
2736
2737	bad_param:
2738
2739	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2740	SAFE_FREE(state->data);
2741	SAFE_FREE(state->param);
2742	TALLOC_FREE(state);
2743	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2744	END_PROFILE(SMBnttrans);
2745	return;
2746	}
2747
2748	/****************************************************************************
2749	Reply to a SMBnttranss
2750	****************************************************************************/
2751
2752	void reply_nttranss(struct smb_request *req)
2753	{
2754	connection_struct *conn = req->conn;
2755	uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2756	struct trans_state *state;
2757	uint32_t av_size;
2758	uint32_t size;
2759
2760	START_PROFILE(SMBnttranss);
2761
2762	show_msg((char *)req->inbuf);
2763
2764	if (req->wct < 18) {
2765	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2766	END_PROFILE(SMBnttranss);
2767	return;
2768	}
2769
2770	for (state = conn->pending_trans; state != NULL;
2771	state = state->next) {
2772	if (state->mid == req->mid) {
2773	break;
2774	}
2775	}
2776
2777	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
2778	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2779	END_PROFILE(SMBnttranss);
2780	return;
2781	}
2782
2783	/* Revise state->total_param and state->total_data in case they have
2784	changed downwards */
2785	if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2786	< state->total_param) {
2787	state->total_param = IVAL(req->inbuf,
2788	smb_nts_TotalParameterCount);
2789	}
2790	if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2791	state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2792	}
2793
2794	size = smb_len(req->inbuf) + 4;
2795	av_size = smb_len(req->inbuf);
2796
2797	pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2798	poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2799	pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2800
2801	dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2802	ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2803	doff = IVAL(req->inbuf, smb_nts_DataOffset);
2804
2805	state->received_param += pcnt;
2806	state->received_data += dcnt;
2807
2808	if ((state->received_data > state->total_data) \|\|
2809	(state->received_param > state->total_param))
2810	goto bad_param;
2811
2812	if (pcnt) {
2813	if (pdisp > state->total_param \|\|
2814	pcnt > state->total_param \|\|
2815	pdisp+pcnt > state->total_param \|\|
2816	pdisp+pcnt < pdisp) {
2817	goto bad_param;
2818	}
2819
2820	if (poff > av_size \|\|
2821	pcnt > av_size \|\|
2822	poff+pcnt > av_size \|\|
2823	poff+pcnt < poff) {
2824	goto bad_param;
2825	}
2826
2827	memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2828	pcnt);
2829	}
2830
2831	if (dcnt) {
2832	if (ddisp > state->total_data \|\|
2833	dcnt > state->total_data \|\|
2834	ddisp+dcnt > state->total_data \|\|
2835	ddisp+dcnt < ddisp) {
2836	goto bad_param;
2837	}
2838
2839	if (doff > av_size \|\|
2840	dcnt > av_size \|\|
2841	doff+dcnt > av_size \|\|
2842	doff+dcnt < doff) {
2843	goto bad_param;
2844	}
2845
2846	memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2847	dcnt);
2848	}
2849
2850	if ((state->received_param < state->total_param) \|\|
2851	(state->received_data < state->total_data)) {
2852	END_PROFILE(SMBnttranss);
2853	return;
2854	}
2855
2856	/*
2857	* construct_reply_common will copy smb_com from inbuf to
2858	* outbuf. SMBnttranss is wrong here.
2859	*/
2860	SCVAL(req->inbuf,smb_com,SMBnttrans);
2861
2862	handle_nttrans(conn, state, req);
2863
2864	DLIST_REMOVE(conn->pending_trans, state);
2865	SAFE_FREE(state->data);
2866	SAFE_FREE(state->param);
2867	TALLOC_FREE(state);
2868	END_PROFILE(SMBnttranss);
2869	return;
2870
2871	bad_param:
2872
2873	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2874	DLIST_REMOVE(conn->pending_trans, state);
2875	SAFE_FREE(state->data);
2876	SAFE_FREE(state->param);
2877	TALLOC_FREE(state);
2878	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2879	END_PROFILE(SMBnttranss);
2880	return;
2881	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: