source: branches/samba-3.5.x/source3/smbd/reply.c

Last change on this file was 733, checked in by Silvan Scherrer, 13 years ago

Samba Server 3.5: update branche to 3.5.13
File size: 198.5 KB
RevLine 
[429]1/*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22/*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25*/
26
27#include "includes.h"
28#include "smbd/globals.h"
29
30/****************************************************************************
31 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
32 path or anything including wildcards.
33 We're assuming here that '/' is not the second byte in any multibyte char
34 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
35 set.
36****************************************************************************/
37
38/* Custom version for processing POSIX paths. */
39#define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
40
41static NTSTATUS check_path_syntax_internal(char *path,
42 bool posix_path,
43 bool *p_last_component_contains_wcard)
44{
45 char *d = path;
46 const char *s = path;
47 NTSTATUS ret = NT_STATUS_OK;
48 bool start_of_name_component = True;
49 bool stream_started = false;
50
51 *p_last_component_contains_wcard = False;
52
53 while (*s) {
54 if (stream_started) {
55 switch (*s) {
56 case '/':
57 case '\\':
58 return NT_STATUS_OBJECT_NAME_INVALID;
59 case ':':
60 if (s[1] == '\0') {
61 return NT_STATUS_OBJECT_NAME_INVALID;
62 }
63 if (strchr_m(&s[1], ':')) {
64 return NT_STATUS_OBJECT_NAME_INVALID;
65 }
66 break;
67 }
68 }
69
70 if ((*s == ':') && !posix_path && !stream_started) {
71 if (*p_last_component_contains_wcard) {
72 return NT_STATUS_OBJECT_NAME_INVALID;
73 }
74 /* Stream names allow more characters than file names.
75 We're overloading posix_path here to allow a wider
76 range of characters. If stream_started is true this
77 is still a Windows path even if posix_path is true.
78 JRA.
79 */
80 stream_started = true;
81 start_of_name_component = false;
82 posix_path = true;
83
84 if (s[1] == '\0') {
85 return NT_STATUS_OBJECT_NAME_INVALID;
86 }
87 }
88
89 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
90 /*
91 * Safe to assume is not the second part of a mb char
92 * as this is handled below.
93 */
94 /* Eat multiple '/' or '\\' */
95 while (IS_PATH_SEP(*s,posix_path)) {
96 s++;
97 }
98 if ((d != path) && (*s != '\0')) {
99 /* We only care about non-leading or trailing '/' or '\\' */
100 *d++ = '/';
101 }
102
103 start_of_name_component = True;
104 /* New component. */
105 *p_last_component_contains_wcard = False;
106 continue;
107 }
108
109 if (start_of_name_component) {
110 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
111 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
112
113 /*
114 * No mb char starts with '.' so we're safe checking the directory separator here.
115 */
116
117 /* If we just added a '/' - delete it */
118 if ((d > path) && (*(d-1) == '/')) {
119 *(d-1) = '\0';
120 d--;
121 }
122
123 /* Are we at the start ? Can't go back further if so. */
124 if (d <= path) {
125 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
126 break;
127 }
128 /* Go back one level... */
129 /* We know this is safe as '/' cannot be part of a mb sequence. */
130 /* NOTE - if this assumption is invalid we are not in good shape... */
131 /* Decrement d first as d points to the *next* char to write into. */
132 for (d--; d > path; d--) {
133 if (*d == '/')
134 break;
135 }
136 s += 2; /* Else go past the .. */
137 /* We're still at the start of a name component, just the previous one. */
138 continue;
139
140 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
141 if (posix_path) {
142 /* Eat the '.' */
143 s++;
144 continue;
145 }
146 }
147
148 }
149
150 if (!(*s & 0x80)) {
151 if (!posix_path) {
152 if (*s <= 0x1f || *s == '|') {
153 return NT_STATUS_OBJECT_NAME_INVALID;
154 }
155 switch (*s) {
156 case '*':
157 case '?':
158 case '<':
159 case '>':
160 case '"':
161 *p_last_component_contains_wcard = True;
162 break;
163 default:
164 break;
165 }
166 }
167 *d++ = *s++;
168 } else {
169 size_t siz;
170 /* Get the size of the next MB character. */
171 next_codepoint(s,&siz);
172 switch(siz) {
173 case 5:
174 *d++ = *s++;
175 /*fall through*/
176 case 4:
177 *d++ = *s++;
178 /*fall through*/
179 case 3:
180 *d++ = *s++;
181 /*fall through*/
182 case 2:
183 *d++ = *s++;
184 /*fall through*/
185 case 1:
186 *d++ = *s++;
187 break;
188 default:
189 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
190 *d = '\0';
191 return NT_STATUS_INVALID_PARAMETER;
192 }
193 }
194 start_of_name_component = False;
195 }
196
197 *d = '\0';
198
199 return ret;
200}
201
202/****************************************************************************
203 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
204 No wildcards allowed.
205****************************************************************************/
206
207NTSTATUS check_path_syntax(char *path)
208{
209 bool ignore;
210 return check_path_syntax_internal(path, False, &ignore);
211}
212
213/****************************************************************************
214 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
215 Wildcards allowed - p_contains_wcard returns true if the last component contained
216 a wildcard.
217****************************************************************************/
218
219NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
220{
221 return check_path_syntax_internal(path, False, p_contains_wcard);
222}
223
224/****************************************************************************
225 Check the path for a POSIX client.
226 We're assuming here that '/' is not the second byte in any multibyte char
227 set (a safe assumption).
228****************************************************************************/
229
230NTSTATUS check_path_syntax_posix(char *path)
231{
232 bool ignore;
233 return check_path_syntax_internal(path, True, &ignore);
234}
235
236/****************************************************************************
237 Pull a string and check the path allowing a wilcard - provide for error return.
238****************************************************************************/
239
240size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
241 const char *base_ptr,
242 uint16 smb_flags2,
243 char **pp_dest,
244 const char *src,
245 size_t src_len,
246 int flags,
247 NTSTATUS *err,
248 bool *contains_wcard)
249{
250 size_t ret;
251
252 *pp_dest = NULL;
253
254 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
255 src_len, flags);
256
257 if (!*pp_dest) {
258 *err = NT_STATUS_INVALID_PARAMETER;
259 return ret;
260 }
261
262 *contains_wcard = False;
263
264 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
265 /*
266 * For a DFS path the function parse_dfs_path()
267 * will do the path processing, just make a copy.
268 */
269 *err = NT_STATUS_OK;
270 return ret;
271 }
272
273 if (lp_posix_pathnames()) {
274 *err = check_path_syntax_posix(*pp_dest);
275 } else {
276 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
277 }
278
279 return ret;
280}
281
282/****************************************************************************
283 Pull a string and check the path - provide for error return.
284****************************************************************************/
285
286size_t srvstr_get_path(TALLOC_CTX *ctx,
287 const char *base_ptr,
288 uint16 smb_flags2,
289 char **pp_dest,
290 const char *src,
291 size_t src_len,
292 int flags,
293 NTSTATUS *err)
294{
295 bool ignore;
296 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
297 src_len, flags, err, &ignore);
298}
299
300size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
301 char **pp_dest, const char *src, int flags,
302 NTSTATUS *err, bool *contains_wcard)
303{
304 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
305 pp_dest, src, smbreq_bufrem(req, src),
306 flags, err, contains_wcard);
307}
308
309size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
310 char **pp_dest, const char *src, int flags,
311 NTSTATUS *err)
312{
313 bool ignore;
314 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
315 flags, err, &ignore);
316}
317
318/****************************************************************************
319 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
320****************************************************************************/
321
322bool check_fsp_open(connection_struct *conn, struct smb_request *req,
323 files_struct *fsp)
324{
325 if (!(fsp) || !(conn)) {
326 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
327 return False;
328 }
329 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
330 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
331 return False;
332 }
333 return True;
334}
335
336/****************************************************************************
337 Check if we have a correct fsp pointing to a file.
338****************************************************************************/
339
340bool check_fsp(connection_struct *conn, struct smb_request *req,
341 files_struct *fsp)
342{
343 if (!check_fsp_open(conn, req, fsp)) {
344 return False;
345 }
346 if ((fsp)->is_directory) {
347 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
348 return False;
349 }
350 if ((fsp)->fh->fd == -1) {
351 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
352 return False;
353 }
354 (fsp)->num_smb_operations++;
355 return True;
356}
357
358/****************************************************************************
359 Check if we have a correct fsp pointing to a quota fake file. Replacement for
360 the CHECK_NTQUOTA_HANDLE_OK macro.
361****************************************************************************/
362
363bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
364 files_struct *fsp)
365{
366 if (!check_fsp_open(conn, req, fsp)) {
367 return false;
368 }
369
370 if (fsp->is_directory) {
371 return false;
372 }
373
374 if (fsp->fake_file_handle == NULL) {
375 return false;
376 }
377
378 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
379 return false;
380 }
381
382 if (fsp->fake_file_handle->private_data == NULL) {
383 return false;
384 }
385
386 return true;
387}
388
389/****************************************************************************
390 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
391****************************************************************************/
392
393bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
394 files_struct *fsp)
395{
396 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
397 && (req->vuid == (fsp)->vuid)) {
398 return True;
399 }
400
401 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
402 return False;
403}
404
405static bool netbios_session_retarget(const char *name, int name_type)
406{
407 char *trim_name;
408 char *trim_name_type;
409 const char *retarget_parm;
410 char *retarget;
411 char *p;
412 int retarget_type = 0x20;
413 int retarget_port = 139;
414 struct sockaddr_storage retarget_addr;
415 struct sockaddr_in *in_addr;
416 bool ret = false;
417 uint8_t outbuf[10];
418
419 if (get_socket_port(smbd_server_fd()) != 139) {
420 return false;
421 }
422
423 trim_name = talloc_strdup(talloc_tos(), name);
424 if (trim_name == NULL) {
425 goto fail;
426 }
427 trim_char(trim_name, ' ', ' ');
428
429 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
430 name_type);
431 if (trim_name_type == NULL) {
432 goto fail;
433 }
434
435 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
436 trim_name_type, NULL);
437 if (retarget_parm == NULL) {
438 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
439 trim_name, NULL);
440 }
441 if (retarget_parm == NULL) {
442 goto fail;
443 }
444
445 retarget = talloc_strdup(trim_name, retarget_parm);
446 if (retarget == NULL) {
447 goto fail;
448 }
449
450 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
451
452 p = strchr(retarget, ':');
453 if (p != NULL) {
454 *p++ = '\0';
455 retarget_port = atoi(p);
456 }
457
458 p = strchr_m(retarget, '#');
459 if (p != NULL) {
460 *p++ = '\0';
461 sscanf(p, "%x", &retarget_type);
462 }
463
464 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
465 if (!ret) {
466 DEBUG(10, ("could not resolve %s\n", retarget));
467 goto fail;
468 }
469
470 if (retarget_addr.ss_family != AF_INET) {
471 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
472 goto fail;
473 }
474
475 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
476
477 _smb_setlen(outbuf, 6);
478 SCVAL(outbuf, 0, 0x84);
479 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
480 *(uint16_t *)(outbuf+8) = htons(retarget_port);
481
482 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
483 NULL)) {
484 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
485 "failed.");
486 }
487
488 ret = true;
489 fail:
490 TALLOC_FREE(trim_name);
491 return ret;
492}
493
494/****************************************************************************
495 Reply to a (netbios-level) special message.
496****************************************************************************/
497
[590]498void reply_special(char *inbuf, size_t inbuf_size)
[429]499{
500 int msg_type = CVAL(inbuf,0);
501 int msg_flags = CVAL(inbuf,1);
502 struct smbd_server_connection *sconn = smbd_server_conn;
503 /*
504 * We only really use 4 bytes of the outbuf, but for the smb_setlen
505 * calculation & friends (srv_send_smb uses that) we need the full smb
506 * header.
507 */
508 char outbuf[smb_size];
509
510 memset(outbuf, '\0', sizeof(outbuf));
511
512 smb_setlen(outbuf,0);
513
514 switch (msg_type) {
515 case 0x81: /* session request */
[590]516 {
517 /* inbuf_size is guarenteed to be at least 4. */
518 fstring name1,name2;
519 int name_type1, name_type2;
520 int name_len1, name_len2;
[429]521
[590]522 *name1 = *name2 = 0;
523
[429]524 if (sconn->nbt.got_session) {
525 exit_server_cleanly("multiple session request not permitted");
526 }
527
528 SCVAL(outbuf,0,0x82);
529 SCVAL(outbuf,3,0);
[590]530
531 /* inbuf_size is guaranteed to be at least 4. */
532 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
533 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
[429]534 DEBUG(0,("Invalid name length in session request\n"));
535 return;
536 }
[590]537 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
538 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
539 DEBUG(0,("Invalid name length in session request\n"));
540 return;
541 }
542
543 name_type1 = name_extract((unsigned char *)inbuf,
544 inbuf_size,(unsigned int)4,name1);
545 name_type2 = name_extract((unsigned char *)inbuf,
546 inbuf_size,(unsigned int)(4 + name_len1),name2);
547
548 if (name_type1 == -1 || name_type2 == -1) {
549 DEBUG(0,("Invalid name type in session request\n"));
550 return;
551 }
552
[429]553 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
554 name1, name_type1, name2, name_type2));
555
556 if (netbios_session_retarget(name1, name_type1)) {
557 exit_server_cleanly("retargeted client");
558 }
559
560 set_local_machine_name(name1, True);
561 set_remote_machine_name(name2, True);
562
563 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
564 get_local_machine_name(), get_remote_machine_name(),
565 name_type2));
566
567 if (name_type2 == 'R') {
568 /* We are being asked for a pathworks session ---
569 no thanks! */
570 SCVAL(outbuf, 0,0x83);
571 break;
572 }
573
574 /* only add the client's machine name to the list
575 of possibly valid usernames if we are operating
576 in share mode security */
577 if (lp_security() == SEC_SHARE) {
578 add_session_user(sconn, get_remote_machine_name());
579 }
580
581 reload_services(True);
582 reopen_logs();
583
584 sconn->nbt.got_session = true;
585 break;
[590]586 }
[429]587
588 case 0x89: /* session keepalive request
589 (some old clients produce this?) */
590 SCVAL(outbuf,0,SMBkeepalive);
591 SCVAL(outbuf,3,0);
592 break;
593
594 case 0x82: /* positive session response */
595 case 0x83: /* negative session response */
596 case 0x84: /* retarget session response */
597 DEBUG(0,("Unexpected session response\n"));
598 break;
599
600 case SMBkeepalive: /* session keepalive */
601 default:
602 return;
603 }
604
605 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
606 msg_type, msg_flags));
607
608 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
609 return;
610}
611
612/****************************************************************************
613 Reply to a tcon.
614 conn POINTER CAN BE NULL HERE !
615****************************************************************************/
616
617void reply_tcon(struct smb_request *req)
618{
619 connection_struct *conn = req->conn;
620 const char *service;
621 char *service_buf = NULL;
622 char *password = NULL;
623 char *dev = NULL;
624 int pwlen=0;
625 NTSTATUS nt_status;
626 const char *p;
627 DATA_BLOB password_blob;
628 TALLOC_CTX *ctx = talloc_tos();
629 struct smbd_server_connection *sconn = smbd_server_conn;
630
631 START_PROFILE(SMBtcon);
632
633 if (req->buflen < 4) {
634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
635 END_PROFILE(SMBtcon);
636 return;
637 }
638
639 p = (const char *)req->buf + 1;
640 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
641 p += 1;
642 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
643 p += pwlen+1;
644 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
645 p += 1;
646
647 if (service_buf == NULL || password == NULL || dev == NULL) {
648 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
649 END_PROFILE(SMBtcon);
650 return;
651 }
652 p = strrchr_m(service_buf,'\\');
653 if (p) {
654 service = p+1;
655 } else {
656 service = service_buf;
657 }
658
659 password_blob = data_blob(password, pwlen+1);
660
661 conn = make_connection(sconn,service,password_blob,dev,
662 req->vuid,&nt_status);
663 req->conn = conn;
664
665 data_blob_clear_free(&password_blob);
666
667 if (!conn) {
668 reply_nterror(req, nt_status);
669 END_PROFILE(SMBtcon);
670 return;
671 }
672
673 reply_outbuf(req, 2, 0);
674 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
675 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
676 SSVAL(req->outbuf,smb_tid,conn->cnum);
677
678 DEBUG(3,("tcon service=%s cnum=%d\n",
679 service, conn->cnum));
680
681 END_PROFILE(SMBtcon);
682 return;
683}
684
685/****************************************************************************
686 Reply to a tcon and X.
687 conn POINTER CAN BE NULL HERE !
688****************************************************************************/
689
690void reply_tcon_and_X(struct smb_request *req)
691{
692 connection_struct *conn = req->conn;
693 const char *service = NULL;
694 DATA_BLOB password;
695 TALLOC_CTX *ctx = talloc_tos();
696 /* what the cleint thinks the device is */
697 char *client_devicetype = NULL;
698 /* what the server tells the client the share represents */
699 const char *server_devicetype;
700 NTSTATUS nt_status;
701 int passlen;
702 char *path = NULL;
703 const char *p, *q;
704 uint16 tcon_flags;
705 struct smbd_server_connection *sconn = smbd_server_conn;
706
707 START_PROFILE(SMBtconX);
708
709 if (req->wct < 4) {
710 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
711 END_PROFILE(SMBtconX);
712 return;
713 }
714
715 passlen = SVAL(req->vwv+3, 0);
716 tcon_flags = SVAL(req->vwv+2, 0);
717
718 /* we might have to close an old one */
719 if ((tcon_flags & 0x1) && conn) {
720 close_cnum(conn,req->vuid);
721 req->conn = NULL;
722 conn = NULL;
723 }
724
725 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
726 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
727 END_PROFILE(SMBtconX);
728 return;
729 }
730
731 if (sconn->smb1.negprot.encrypted_passwords) {
732 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
733 if (lp_security() == SEC_SHARE) {
734 /*
735 * Security = share always has a pad byte
736 * after the password.
737 */
738 p = (const char *)req->buf + passlen + 1;
739 } else {
740 p = (const char *)req->buf + passlen;
741 }
742 } else {
743 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
744 /* Ensure correct termination */
745 password.data[passlen]=0;
746 p = (const char *)req->buf + passlen + 1;
747 }
748
749 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
750
751 if (path == NULL) {
752 data_blob_clear_free(&password);
753 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
754 END_PROFILE(SMBtconX);
755 return;
756 }
757
758 /*
759 * the service name can be either: \\server\share
760 * or share directly like on the DELL PowerVault 705
761 */
762 if (*path=='\\') {
763 q = strchr_m(path+2,'\\');
764 if (!q) {
765 data_blob_clear_free(&password);
766 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
767 END_PROFILE(SMBtconX);
768 return;
769 }
770 service = q+1;
771 } else {
772 service = path;
773 }
774
775 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
776 &client_devicetype, p,
777 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
778
779 if (client_devicetype == NULL) {
780 data_blob_clear_free(&password);
781 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
782 END_PROFILE(SMBtconX);
783 return;
784 }
785
786 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
787
788 conn = make_connection(sconn, service, password, client_devicetype,
789 req->vuid, &nt_status);
790 req->conn =conn;
791
792 data_blob_clear_free(&password);
793
794 if (!conn) {
795 reply_nterror(req, nt_status);
796 END_PROFILE(SMBtconX);
797 return;
798 }
799
800 if ( IS_IPC(conn) )
801 server_devicetype = "IPC";
802 else if ( IS_PRINT(conn) )
803 server_devicetype = "LPT1:";
804 else
805 server_devicetype = "A:";
806
807 if (get_Protocol() < PROTOCOL_NT1) {
808 reply_outbuf(req, 2, 0);
809 if (message_push_string(&req->outbuf, server_devicetype,
810 STR_TERMINATE|STR_ASCII) == -1) {
811 reply_nterror(req, NT_STATUS_NO_MEMORY);
812 END_PROFILE(SMBtconX);
813 return;
814 }
815 } else {
816 /* NT sets the fstype of IPC$ to the null string */
817 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
818
819 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
820 /* Return permissions. */
821 uint32 perm1 = 0;
822 uint32 perm2 = 0;
823
824 reply_outbuf(req, 7, 0);
825
826 if (IS_IPC(conn)) {
827 perm1 = FILE_ALL_ACCESS;
828 perm2 = FILE_ALL_ACCESS;
829 } else {
830 perm1 = CAN_WRITE(conn) ?
831 SHARE_ALL_ACCESS :
832 SHARE_READ_ONLY;
833 }
834
835 SIVAL(req->outbuf, smb_vwv3, perm1);
836 SIVAL(req->outbuf, smb_vwv5, perm2);
837 } else {
838 reply_outbuf(req, 3, 0);
839 }
840
841 if ((message_push_string(&req->outbuf, server_devicetype,
842 STR_TERMINATE|STR_ASCII) == -1)
843 || (message_push_string(&req->outbuf, fstype,
844 STR_TERMINATE) == -1)) {
845 reply_nterror(req, NT_STATUS_NO_MEMORY);
846 END_PROFILE(SMBtconX);
847 return;
848 }
849
850 /* what does setting this bit do? It is set by NT4 and
851 may affect the ability to autorun mounted cdroms */
852 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
853 (lp_csc_policy(SNUM(conn)) << 2));
854
855 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
856 DEBUG(2,("Serving %s as a Dfs root\n",
857 lp_servicename(SNUM(conn)) ));
858 SSVAL(req->outbuf, smb_vwv2,
859 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
860 }
861 }
862
863
864 DEBUG(3,("tconX service=%s \n",
865 service));
866
867 /* set the incoming and outgoing tid to the just created one */
868 SSVAL(req->inbuf,smb_tid,conn->cnum);
869 SSVAL(req->outbuf,smb_tid,conn->cnum);
870
871 END_PROFILE(SMBtconX);
872
873 req->tid = conn->cnum;
874 chain_reply(req);
875 return;
876}
877
878/****************************************************************************
879 Reply to an unknown type.
880****************************************************************************/
881
882void reply_unknown_new(struct smb_request *req, uint8 type)
883{
884 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
885 smb_fn_name(type), type, type));
886 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
887 return;
888}
889
890/****************************************************************************
891 Reply to an ioctl.
892 conn POINTER CAN BE NULL HERE !
893****************************************************************************/
894
895void reply_ioctl(struct smb_request *req)
896{
897 connection_struct *conn = req->conn;
898 uint16 device;
899 uint16 function;
900 uint32 ioctl_code;
901 int replysize;
902 char *p;
903
904 START_PROFILE(SMBioctl);
905
906 if (req->wct < 3) {
907 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
908 END_PROFILE(SMBioctl);
909 return;
910 }
911
912 device = SVAL(req->vwv+1, 0);
913 function = SVAL(req->vwv+2, 0);
914 ioctl_code = (device << 16) + function;
915
916 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
917
918 switch (ioctl_code) {
919 case IOCTL_QUERY_JOB_INFO:
920 replysize = 32;
921 break;
922 default:
923 reply_force_doserror(req, ERRSRV, ERRnosupport);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927
928 reply_outbuf(req, 8, replysize+1);
929 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
930 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
931 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
932 p = smb_buf(req->outbuf);
933 memset(p, '\0', replysize+1); /* valgrind-safe. */
934 p += 1; /* Allow for alignment */
935
936 switch (ioctl_code) {
937 case IOCTL_QUERY_JOB_INFO:
938 {
939 files_struct *fsp = file_fsp(
940 req, SVAL(req->vwv+0, 0));
941 if (!fsp) {
942 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
943 END_PROFILE(SMBioctl);
944 return;
945 }
946 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
947 srvstr_push((char *)req->outbuf, req->flags2, p+2,
948 global_myname(), 15,
949 STR_TERMINATE|STR_ASCII);
950 if (conn) {
951 srvstr_push((char *)req->outbuf, req->flags2,
952 p+18, lp_servicename(SNUM(conn)),
953 13, STR_TERMINATE|STR_ASCII);
954 } else {
955 memset(p+18, 0, 13);
956 }
957 break;
958 }
959 }
960
961 END_PROFILE(SMBioctl);
962 return;
963}
964
965/****************************************************************************
966 Strange checkpath NTSTATUS mapping.
967****************************************************************************/
968
969static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
970{
971 /* Strange DOS error code semantics only for checkpath... */
972 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
973 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
974 /* We need to map to ERRbadpath */
975 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
976 }
977 }
978 return status;
979}
980
981/****************************************************************************
982 Reply to a checkpath.
983****************************************************************************/
984
985void reply_checkpath(struct smb_request *req)
986{
987 connection_struct *conn = req->conn;
988 struct smb_filename *smb_fname = NULL;
989 char *name = NULL;
990 NTSTATUS status;
991 TALLOC_CTX *ctx = talloc_tos();
992
993 START_PROFILE(SMBcheckpath);
994
995 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
996 STR_TERMINATE, &status);
997
998 if (!NT_STATUS_IS_OK(status)) {
999 status = map_checkpath_error(req->flags2, status);
1000 reply_nterror(req, status);
1001 END_PROFILE(SMBcheckpath);
1002 return;
1003 }
1004
1005 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1006
1007 status = filename_convert(ctx,
1008 conn,
1009 req->flags2 & FLAGS2_DFS_PATHNAMES,
1010 name,
1011 0,
1012 NULL,
1013 &smb_fname);
1014
1015 if (!NT_STATUS_IS_OK(status)) {
1016 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1017 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1018 ERRSRV, ERRbadpath);
1019 END_PROFILE(SMBcheckpath);
1020 return;
1021 }
1022 goto path_err;
1023 }
1024
1025 if (!VALID_STAT(smb_fname->st) &&
1026 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1027 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1028 smb_fname_str_dbg(smb_fname), strerror(errno)));
1029 status = map_nt_error_from_unix(errno);
1030 goto path_err;
1031 }
1032
1033 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1034 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1035 ERRDOS, ERRbadpath);
1036 goto out;
1037 }
1038
1039 reply_outbuf(req, 0, 0);
1040
1041 path_err:
1042 /* We special case this - as when a Windows machine
1043 is parsing a path is steps through the components
1044 one at a time - if a component fails it expects
1045 ERRbadpath, not ERRbadfile.
1046 */
1047 status = map_checkpath_error(req->flags2, status);
1048 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1049 /*
1050 * Windows returns different error codes if
1051 * the parent directory is valid but not the
1052 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1053 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1054 * if the path is invalid.
1055 */
1056 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1057 ERRDOS, ERRbadpath);
1058 goto out;
1059 }
1060
1061 reply_nterror(req, status);
1062
1063 out:
1064 TALLOC_FREE(smb_fname);
1065 END_PROFILE(SMBcheckpath);
1066 return;
1067}
1068
1069/****************************************************************************
1070 Reply to a getatr.
1071****************************************************************************/
1072
1073void reply_getatr(struct smb_request *req)
1074{
1075 connection_struct *conn = req->conn;
1076 struct smb_filename *smb_fname = NULL;
1077 char *fname = NULL;
1078 int mode=0;
1079 SMB_OFF_T size=0;
1080 time_t mtime=0;
1081 const char *p;
1082 NTSTATUS status;
1083 TALLOC_CTX *ctx = talloc_tos();
1084 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1085
1086 START_PROFILE(SMBgetatr);
1087
1088 p = (const char *)req->buf + 1;
1089 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1090 if (!NT_STATUS_IS_OK(status)) {
1091 reply_nterror(req, status);
1092 goto out;
1093 }
1094
1095 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1096 under WfWg - weird! */
1097 if (*fname == '\0') {
1098 mode = aHIDDEN | aDIR;
1099 if (!CAN_WRITE(conn)) {
1100 mode |= aRONLY;
1101 }
1102 size = 0;
1103 mtime = 0;
1104 } else {
1105 status = filename_convert(ctx,
1106 conn,
1107 req->flags2 & FLAGS2_DFS_PATHNAMES,
1108 fname,
1109 0,
1110 NULL,
1111 &smb_fname);
1112 if (!NT_STATUS_IS_OK(status)) {
1113 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1114 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1115 ERRSRV, ERRbadpath);
1116 goto out;
1117 }
1118 reply_nterror(req, status);
1119 goto out;
1120 }
1121 if (!VALID_STAT(smb_fname->st) &&
1122 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1123 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1124 smb_fname_str_dbg(smb_fname),
1125 strerror(errno)));
1126 reply_nterror(req, map_nt_error_from_unix(errno));
1127 goto out;
1128 }
1129
1130 mode = dos_mode(conn, smb_fname);
1131 size = smb_fname->st.st_ex_size;
1132
1133 if (ask_sharemode) {
1134 struct timespec write_time_ts;
1135 struct file_id fileid;
1136
1137 ZERO_STRUCT(write_time_ts);
1138 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1139 get_file_infos(fileid, NULL, &write_time_ts);
1140 if (!null_timespec(write_time_ts)) {
1141 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1142 }
1143 }
1144
1145 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1146 if (mode & aDIR) {
1147 size = 0;
1148 }
1149 }
1150
1151 reply_outbuf(req, 10, 0);
1152
1153 SSVAL(req->outbuf,smb_vwv0,mode);
1154 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1155 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1156 } else {
1157 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1158 }
1159 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1160
1161 if (get_Protocol() >= PROTOCOL_NT1) {
1162 SSVAL(req->outbuf, smb_flg2,
1163 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1164 }
1165
1166 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1167 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1168
1169 out:
1170 TALLOC_FREE(smb_fname);
1171 TALLOC_FREE(fname);
1172 END_PROFILE(SMBgetatr);
1173 return;
1174}
1175
1176/****************************************************************************
1177 Reply to a setatr.
1178****************************************************************************/
1179
1180void reply_setatr(struct smb_request *req)
1181{
1182 struct smb_file_time ft;
1183 connection_struct *conn = req->conn;
1184 struct smb_filename *smb_fname = NULL;
1185 char *fname = NULL;
1186 int mode;
1187 time_t mtime;
1188 const char *p;
1189 NTSTATUS status;
1190 TALLOC_CTX *ctx = talloc_tos();
1191
1192 START_PROFILE(SMBsetatr);
1193
1194 ZERO_STRUCT(ft);
1195
1196 if (req->wct < 2) {
1197 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1198 goto out;
1199 }
1200
1201 p = (const char *)req->buf + 1;
1202 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1203 if (!NT_STATUS_IS_OK(status)) {
1204 reply_nterror(req, status);
1205 goto out;
1206 }
1207
1208 status = filename_convert(ctx,
1209 conn,
1210 req->flags2 & FLAGS2_DFS_PATHNAMES,
1211 fname,
1212 0,
1213 NULL,
1214 &smb_fname);
1215 if (!NT_STATUS_IS_OK(status)) {
1216 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1217 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1218 ERRSRV, ERRbadpath);
1219 goto out;
1220 }
1221 reply_nterror(req, status);
1222 goto out;
1223 }
1224
1225 if (smb_fname->base_name[0] == '.' &&
1226 smb_fname->base_name[1] == '\0') {
1227 /*
1228 * Not sure here is the right place to catch this
1229 * condition. Might be moved to somewhere else later -- vl
1230 */
1231 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1232 goto out;
1233 }
1234
1235 mode = SVAL(req->vwv+0, 0);
1236 mtime = srv_make_unix_date3(req->vwv+1);
1237
1238 ft.mtime = convert_time_t_to_timespec(mtime);
1239 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1240 if (!NT_STATUS_IS_OK(status)) {
1241 reply_nterror(req, status);
1242 goto out;
1243 }
1244
1245 if (mode != FILE_ATTRIBUTE_NORMAL) {
1246 if (VALID_STAT_OF_DIR(smb_fname->st))
1247 mode |= aDIR;
1248 else
1249 mode &= ~aDIR;
1250
1251 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1252 false) != 0) {
1253 reply_nterror(req, map_nt_error_from_unix(errno));
1254 goto out;
1255 }
1256 }
1257
1258 reply_outbuf(req, 0, 0);
1259
1260 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1261 mode));
1262 out:
1263 TALLOC_FREE(smb_fname);
1264 END_PROFILE(SMBsetatr);
1265 return;
1266}
1267
1268/****************************************************************************
1269 Reply to a dskattr.
1270****************************************************************************/
1271
1272void reply_dskattr(struct smb_request *req)
1273{
1274 connection_struct *conn = req->conn;
1275 uint64_t dfree,dsize,bsize;
1276 START_PROFILE(SMBdskattr);
1277
1278 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1279 reply_nterror(req, map_nt_error_from_unix(errno));
1280 END_PROFILE(SMBdskattr);
1281 return;
1282 }
1283
1284 reply_outbuf(req, 5, 0);
1285
1286 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1287 double total_space, free_space;
1288 /* we need to scale this to a number that DOS6 can handle. We
1289 use floating point so we can handle large drives on systems
1290 that don't have 64 bit integers
1291
1292 we end up displaying a maximum of 2G to DOS systems
1293 */
1294 total_space = dsize * (double)bsize;
1295 free_space = dfree * (double)bsize;
1296
1297 dsize = (uint64_t)((total_space+63*512) / (64*512));
1298 dfree = (uint64_t)((free_space+63*512) / (64*512));
1299
1300 if (dsize > 0xFFFF) dsize = 0xFFFF;
1301 if (dfree > 0xFFFF) dfree = 0xFFFF;
1302
1303 SSVAL(req->outbuf,smb_vwv0,dsize);
1304 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1305 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1306 SSVAL(req->outbuf,smb_vwv3,dfree);
1307 } else {
1308 SSVAL(req->outbuf,smb_vwv0,dsize);
1309 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1310 SSVAL(req->outbuf,smb_vwv2,512);
1311 SSVAL(req->outbuf,smb_vwv3,dfree);
1312 }
1313
1314 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1315
1316 END_PROFILE(SMBdskattr);
1317 return;
1318}
1319
1320/*
1321 * Utility function to split the filename from the directory.
1322 */
1323static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1324 char **fname_dir_out,
1325 char **fname_mask_out)
1326{
1327 const char *p = NULL;
1328 char *fname_dir = NULL;
1329 char *fname_mask = NULL;
1330
1331 p = strrchr_m(fname_in, '/');
1332 if (!p) {
1333 fname_dir = talloc_strdup(ctx, ".");
1334 fname_mask = talloc_strdup(ctx, fname_in);
1335 } else {
1336 fname_dir = talloc_strndup(ctx, fname_in,
1337 PTR_DIFF(p, fname_in));
1338 fname_mask = talloc_strdup(ctx, p+1);
1339 }
1340
1341 if (!fname_dir || !fname_mask) {
1342 TALLOC_FREE(fname_dir);
1343 TALLOC_FREE(fname_mask);
1344 return NT_STATUS_NO_MEMORY;
1345 }
1346
1347 *fname_dir_out = fname_dir;
1348 *fname_mask_out = fname_mask;
1349 return NT_STATUS_OK;
1350}
1351
1352/****************************************************************************
1353 Reply to a search.
1354 Can be called from SMBsearch, SMBffirst or SMBfunique.
1355****************************************************************************/
1356
1357void reply_search(struct smb_request *req)
1358{
1359 connection_struct *conn = req->conn;
1360 char *path = NULL;
1361 const char *mask = NULL;
1362 char *directory = NULL;
1363 struct smb_filename *smb_fname = NULL;
1364 char *fname = NULL;
1365 SMB_OFF_T size;
1366 uint32 mode;
1367 struct timespec date;
1368 uint32 dirtype;
1369 unsigned int numentries = 0;
1370 unsigned int maxentries = 0;
1371 bool finished = False;
1372 const char *p;
1373 int status_len;
1374 char status[21];
1375 int dptr_num= -1;
1376 bool check_descend = False;
1377 bool expect_close = False;
1378 NTSTATUS nt_status;
1379 bool mask_contains_wcard = False;
1380 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1381 TALLOC_CTX *ctx = talloc_tos();
1382 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1383 struct dptr_struct *dirptr = NULL;
1384 struct smbd_server_connection *sconn = smbd_server_conn;
1385
1386 START_PROFILE(SMBsearch);
1387
1388 if (req->wct < 2) {
1389 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1390 goto out;
1391 }
1392
1393 if (lp_posix_pathnames()) {
1394 reply_unknown_new(req, req->cmd);
1395 goto out;
1396 }
1397
1398 /* If we were called as SMBffirst then we must expect close. */
1399 if(req->cmd == SMBffirst) {
1400 expect_close = True;
1401 }
1402
1403 reply_outbuf(req, 1, 3);
1404 maxentries = SVAL(req->vwv+0, 0);
1405 dirtype = SVAL(req->vwv+1, 0);
1406 p = (const char *)req->buf + 1;
1407 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1408 &nt_status, &mask_contains_wcard);
1409 if (!NT_STATUS_IS_OK(nt_status)) {
1410 reply_nterror(req, nt_status);
1411 goto out;
1412 }
1413
1414 p++;
1415 status_len = SVAL(p, 0);
1416 p += 2;
1417
1418 /* dirtype &= ~aDIR; */
1419
1420 if (status_len == 0) {
1421 nt_status = filename_convert(ctx, conn,
1422 req->flags2 & FLAGS2_DFS_PATHNAMES,
1423 path,
1424 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1425 &mask_contains_wcard,
1426 &smb_fname);
1427 if (!NT_STATUS_IS_OK(nt_status)) {
1428 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1429 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1430 ERRSRV, ERRbadpath);
1431 goto out;
1432 }
1433 reply_nterror(req, nt_status);
1434 goto out;
1435 }
1436
1437 directory = smb_fname->base_name;
1438
1439 p = strrchr_m(directory,'/');
1440 if ((p != NULL) && (*directory != '/')) {
1441 mask = p + 1;
1442 directory = talloc_strndup(ctx, directory,
1443 PTR_DIFF(p, directory));
1444 } else {
1445 mask = directory;
1446 directory = talloc_strdup(ctx,".");
1447 }
1448
1449 if (!directory) {
1450 reply_nterror(req, NT_STATUS_NO_MEMORY);
1451 goto out;
1452 }
1453
1454 memset((char *)status,'\0',21);
1455 SCVAL(status,0,(dirtype & 0x1F));
1456
1457 nt_status = dptr_create(conn,
1458 directory,
1459 True,
1460 expect_close,
1461 req->smbpid,
1462 mask,
1463 mask_contains_wcard,
1464 dirtype,
1465 &dirptr);
1466 if (!NT_STATUS_IS_OK(nt_status)) {
1467 reply_nterror(req, nt_status);
1468 goto out;
1469 }
1470 dptr_num = dptr_dnum(dirptr);
1471 } else {
1472 int status_dirtype;
1473 const char *dirpath;
1474
1475 memcpy(status,p,21);
1476 status_dirtype = CVAL(status,0) & 0x1F;
1477 if (status_dirtype != (dirtype & 0x1F)) {
1478 dirtype = status_dirtype;
1479 }
1480
1481 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1482 if (!dirptr) {
1483 goto SearchEmpty;
1484 }
1485 dirpath = dptr_path(sconn, dptr_num);
1486 directory = talloc_strdup(ctx, dirpath);
1487 if (!directory) {
1488 reply_nterror(req, NT_STATUS_NO_MEMORY);
1489 goto out;
1490 }
1491
1492 mask = dptr_wcard(sconn, dptr_num);
1493 if (!mask) {
1494 goto SearchEmpty;
1495 }
1496 /*
1497 * For a 'continue' search we have no string. So
1498 * check from the initial saved string.
1499 */
1500 mask_contains_wcard = ms_has_wild(mask);
1501 dirtype = dptr_attr(sconn, dptr_num);
1502 }
1503
1504 DEBUG(4,("dptr_num is %d\n",dptr_num));
1505
1506 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1507 dptr_init_search_op(dirptr);
1508
1509 if ((dirtype&0x1F) == aVOLID) {
1510 char buf[DIR_STRUCT_SIZE];
1511 memcpy(buf,status,21);
1512 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1513 0,aVOLID,0,!allow_long_path_components)) {
1514 reply_nterror(req, NT_STATUS_NO_MEMORY);
1515 goto out;
1516 }
1517 dptr_fill(sconn, buf+12,dptr_num);
1518 if (dptr_zero(buf+12) && (status_len==0)) {
1519 numentries = 1;
1520 } else {
1521 numentries = 0;
1522 }
1523 if (message_push_blob(&req->outbuf,
1524 data_blob_const(buf, sizeof(buf)))
1525 == -1) {
1526 reply_nterror(req, NT_STATUS_NO_MEMORY);
1527 goto out;
1528 }
1529 } else {
1530 unsigned int i;
1531 maxentries = MIN(
1532 maxentries,
1533 ((BUFFER_SIZE -
1534 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1535 /DIR_STRUCT_SIZE));
1536
1537 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1538 directory,lp_dontdescend(SNUM(conn))));
1539 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1540 check_descend = True;
1541 }
1542
1543 for (i=numentries;(i<maxentries) && !finished;i++) {
1544 finished = !get_dir_entry(ctx,
1545 dirptr,
1546 mask,
1547 dirtype,
1548 &fname,
1549 &size,
1550 &mode,
1551 &date,
1552 check_descend,
1553 ask_sharemode);
1554 if (!finished) {
1555 char buf[DIR_STRUCT_SIZE];
1556 memcpy(buf,status,21);
1557 if (!make_dir_struct(ctx,
1558 buf,
1559 mask,
1560 fname,
1561 size,
1562 mode,
1563 convert_timespec_to_time_t(date),
1564 !allow_long_path_components)) {
1565 reply_nterror(req, NT_STATUS_NO_MEMORY);
1566 goto out;
1567 }
1568 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1569 break;
1570 }
1571 if (message_push_blob(&req->outbuf,
1572 data_blob_const(buf, sizeof(buf)))
1573 == -1) {
1574 reply_nterror(req, NT_STATUS_NO_MEMORY);
1575 goto out;
1576 }
1577 numentries++;
1578 }
1579 }
1580 }
1581
1582 SearchEmpty:
1583
1584 /* If we were called as SMBffirst with smb_search_id == NULL
1585 and no entries were found then return error and close dirptr
1586 (X/Open spec) */
1587
1588 if (numentries == 0) {
1589 dptr_close(sconn, &dptr_num);
1590 } else if(expect_close && status_len == 0) {
1591 /* Close the dptr - we know it's gone */
1592 dptr_close(sconn, &dptr_num);
1593 }
1594
1595 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1596 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1597 dptr_close(sconn, &dptr_num);
1598 }
1599
1600 if ((numentries == 0) && !mask_contains_wcard) {
1601 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1602 goto out;
1603 }
1604
1605 SSVAL(req->outbuf,smb_vwv0,numentries);
1606 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1607 SCVAL(smb_buf(req->outbuf),0,5);
1608 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1609
1610 /* The replies here are never long name. */
1611 SSVAL(req->outbuf, smb_flg2,
1612 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1613 if (!allow_long_path_components) {
1614 SSVAL(req->outbuf, smb_flg2,
1615 SVAL(req->outbuf, smb_flg2)
1616 & (~FLAGS2_LONG_PATH_COMPONENTS));
1617 }
1618
1619 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1620 SSVAL(req->outbuf, smb_flg2,
1621 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1622
1623 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1624 smb_fn_name(req->cmd),
1625 mask,
1626 directory,
1627 dirtype,
1628 numentries,
1629 maxentries ));
1630 out:
1631 TALLOC_FREE(directory);
1632 TALLOC_FREE(smb_fname);
1633 END_PROFILE(SMBsearch);
1634 return;
1635}
1636
1637/****************************************************************************
1638 Reply to a fclose (stop directory search).
1639****************************************************************************/
1640
1641void reply_fclose(struct smb_request *req)
1642{
1643 int status_len;
1644 char status[21];
1645 int dptr_num= -2;
1646 const char *p;
1647 char *path = NULL;
1648 NTSTATUS err;
1649 bool path_contains_wcard = False;
1650 TALLOC_CTX *ctx = talloc_tos();
1651 struct smbd_server_connection *sconn = smbd_server_conn;
1652
1653 START_PROFILE(SMBfclose);
1654
1655 if (lp_posix_pathnames()) {
1656 reply_unknown_new(req, req->cmd);
1657 END_PROFILE(SMBfclose);
1658 return;
1659 }
1660
1661 p = (const char *)req->buf + 1;
1662 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1663 &err, &path_contains_wcard);
1664 if (!NT_STATUS_IS_OK(err)) {
1665 reply_nterror(req, err);
1666 END_PROFILE(SMBfclose);
1667 return;
1668 }
1669 p++;
1670 status_len = SVAL(p,0);
1671 p += 2;
1672
1673 if (status_len == 0) {
1674 reply_force_doserror(req, ERRSRV, ERRsrverror);
1675 END_PROFILE(SMBfclose);
1676 return;
1677 }
1678
1679 memcpy(status,p,21);
1680
1681 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1682 /* Close the dptr - we know it's gone */
1683 dptr_close(sconn, &dptr_num);
1684 }
1685
1686 reply_outbuf(req, 1, 0);
1687 SSVAL(req->outbuf,smb_vwv0,0);
1688
1689 DEBUG(3,("search close\n"));
1690
1691 END_PROFILE(SMBfclose);
1692 return;
1693}
1694
1695/****************************************************************************
1696 Reply to an open.
1697****************************************************************************/
1698
1699void reply_open(struct smb_request *req)
1700{
1701 connection_struct *conn = req->conn;
1702 struct smb_filename *smb_fname = NULL;
1703 char *fname = NULL;
1704 uint32 fattr=0;
1705 SMB_OFF_T size = 0;
1706 time_t mtime=0;
1707 int info;
1708 files_struct *fsp;
1709 int oplock_request;
1710 int deny_mode;
1711 uint32 dos_attr;
1712 uint32 access_mask;
1713 uint32 share_mode;
1714 uint32 create_disposition;
1715 uint32 create_options = 0;
1716 NTSTATUS status;
1717 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1718 TALLOC_CTX *ctx = talloc_tos();
1719
1720 START_PROFILE(SMBopen);
1721
1722 if (req->wct < 2) {
1723 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1724 goto out;
1725 }
1726
1727 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1728 deny_mode = SVAL(req->vwv+0, 0);
1729 dos_attr = SVAL(req->vwv+1, 0);
1730
1731 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1732 STR_TERMINATE, &status);
1733 if (!NT_STATUS_IS_OK(status)) {
1734 reply_nterror(req, status);
1735 goto out;
1736 }
1737
1738 status = filename_convert(ctx,
1739 conn,
1740 req->flags2 & FLAGS2_DFS_PATHNAMES,
1741 fname,
1742 0,
1743 NULL,
1744 &smb_fname);
1745 if (!NT_STATUS_IS_OK(status)) {
1746 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1747 reply_botherror(req,
1748 NT_STATUS_PATH_NOT_COVERED,
1749 ERRSRV, ERRbadpath);
1750 goto out;
1751 }
1752 reply_nterror(req, status);
1753 goto out;
1754 }
1755
[732]1756 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
[429]1757 OPENX_FILE_EXISTS_OPEN, &access_mask,
1758 &share_mode, &create_disposition,
1759 &create_options)) {
1760 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1761 goto out;
1762 }
1763
1764 status = SMB_VFS_CREATE_FILE(
1765 conn, /* conn */
1766 req, /* req */
1767 0, /* root_dir_fid */
1768 smb_fname, /* fname */
1769 access_mask, /* access_mask */
1770 share_mode, /* share_access */
1771 create_disposition, /* create_disposition*/
1772 create_options, /* create_options */
1773 dos_attr, /* file_attributes */
1774 oplock_request, /* oplock_request */
1775 0, /* allocation_size */
1776 NULL, /* sd */
1777 NULL, /* ea_list */
1778 &fsp, /* result */
1779 &info); /* pinfo */
1780
1781 if (!NT_STATUS_IS_OK(status)) {
1782 if (open_was_deferred(req->mid)) {
1783 /* We have re-scheduled this call. */
1784 goto out;
1785 }
1786 reply_openerror(req, status);
1787 goto out;
1788 }
1789
1790 size = smb_fname->st.st_ex_size;
1791 fattr = dos_mode(conn, smb_fname);
1792
1793 /* Deal with other possible opens having a modified
1794 write time. JRA. */
1795 if (ask_sharemode) {
1796 struct timespec write_time_ts;
1797
1798 ZERO_STRUCT(write_time_ts);
1799 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1800 if (!null_timespec(write_time_ts)) {
1801 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1802 }
1803 }
1804
1805 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1806
1807 if (fattr & aDIR) {
1808 DEBUG(3,("attempt to open a directory %s\n",
1809 fsp_str_dbg(fsp)));
1810 close_file(req, fsp, ERROR_CLOSE);
1811 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1812 ERRDOS, ERRnoaccess);
1813 goto out;
1814 }
1815
1816 reply_outbuf(req, 7, 0);
1817 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1818 SSVAL(req->outbuf,smb_vwv1,fattr);
1819 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1820 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1821 } else {
1822 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1823 }
1824 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1825 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1826
1827 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1828 SCVAL(req->outbuf,smb_flg,
1829 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1830 }
1831
1832 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1833 SCVAL(req->outbuf,smb_flg,
1834 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1835 }
1836 out:
1837 TALLOC_FREE(smb_fname);
1838 END_PROFILE(SMBopen);
1839 return;
1840}
1841
1842/****************************************************************************
1843 Reply to an open and X.
1844****************************************************************************/
1845
1846void reply_open_and_X(struct smb_request *req)
1847{
1848 connection_struct *conn = req->conn;
1849 struct smb_filename *smb_fname = NULL;
1850 char *fname = NULL;
1851 uint16 open_flags;
1852 int deny_mode;
1853 uint32 smb_attr;
1854 /* Breakout the oplock request bits so we can set the
1855 reply bits separately. */
1856 int ex_oplock_request;
1857 int core_oplock_request;
1858 int oplock_request;
1859#if 0
1860 int smb_sattr = SVAL(req->vwv+4, 0);
1861 uint32 smb_time = make_unix_date3(req->vwv+6);
1862#endif
1863 int smb_ofun;
1864 uint32 fattr=0;
1865 int mtime=0;
1866 int smb_action = 0;
1867 files_struct *fsp;
1868 NTSTATUS status;
1869 uint64_t allocation_size;
1870 ssize_t retval = -1;
1871 uint32 access_mask;
1872 uint32 share_mode;
1873 uint32 create_disposition;
1874 uint32 create_options = 0;
1875 TALLOC_CTX *ctx = talloc_tos();
1876
1877 START_PROFILE(SMBopenX);
1878
1879 if (req->wct < 15) {
1880 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1881 goto out;
1882 }
1883
1884 open_flags = SVAL(req->vwv+2, 0);
1885 deny_mode = SVAL(req->vwv+3, 0);
1886 smb_attr = SVAL(req->vwv+5, 0);
1887 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1888 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1889 oplock_request = ex_oplock_request | core_oplock_request;
1890 smb_ofun = SVAL(req->vwv+8, 0);
1891 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1892
1893 /* If it's an IPC, pass off the pipe handler. */
1894 if (IS_IPC(conn)) {
1895 if (lp_nt_pipe_support()) {
1896 reply_open_pipe_and_X(conn, req);
1897 } else {
1898 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1899 }
1900 goto out;
1901 }
1902
1903 /* XXXX we need to handle passed times, sattr and flags */
1904 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1905 STR_TERMINATE, &status);
1906 if (!NT_STATUS_IS_OK(status)) {
1907 reply_nterror(req, status);
1908 goto out;
1909 }
1910
1911 status = filename_convert(ctx,
1912 conn,
1913 req->flags2 & FLAGS2_DFS_PATHNAMES,
1914 fname,
1915 0,
1916 NULL,
1917 &smb_fname);
1918 if (!NT_STATUS_IS_OK(status)) {
1919 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1920 reply_botherror(req,
1921 NT_STATUS_PATH_NOT_COVERED,
1922 ERRSRV, ERRbadpath);
1923 goto out;
1924 }
1925 reply_nterror(req, status);
1926 goto out;
1927 }
1928
[732]1929 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1930 smb_ofun,
[429]1931 &access_mask, &share_mode,
1932 &create_disposition,
1933 &create_options)) {
1934 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1935 goto out;
1936 }
1937
1938 status = SMB_VFS_CREATE_FILE(
1939 conn, /* conn */
1940 req, /* req */
1941 0, /* root_dir_fid */
1942 smb_fname, /* fname */
1943 access_mask, /* access_mask */
1944 share_mode, /* share_access */
1945 create_disposition, /* create_disposition*/
1946 create_options, /* create_options */
1947 smb_attr, /* file_attributes */
1948 oplock_request, /* oplock_request */
1949 0, /* allocation_size */
1950 NULL, /* sd */
1951 NULL, /* ea_list */
1952 &fsp, /* result */
1953 &smb_action); /* pinfo */
1954
1955 if (!NT_STATUS_IS_OK(status)) {
1956 if (open_was_deferred(req->mid)) {
1957 /* We have re-scheduled this call. */
1958 goto out;
1959 }
1960 reply_openerror(req, status);
1961 goto out;
1962 }
1963
1964 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1965 if the file is truncated or created. */
1966 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1967 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1968 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1969 close_file(req, fsp, ERROR_CLOSE);
1970 reply_nterror(req, NT_STATUS_DISK_FULL);
1971 goto out;
1972 }
1973 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1974 if (retval < 0) {
1975 close_file(req, fsp, ERROR_CLOSE);
1976 reply_nterror(req, NT_STATUS_DISK_FULL);
1977 goto out;
1978 }
1979 smb_fname->st.st_ex_size =
1980 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1981 }
1982
1983 fattr = dos_mode(conn, smb_fname);
1984 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1985 if (fattr & aDIR) {
1986 close_file(req, fsp, ERROR_CLOSE);
1987 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1988 goto out;
1989 }
1990
1991 /* If the caller set the extended oplock request bit
1992 and we granted one (by whatever means) - set the
1993 correct bit for extended oplock reply.
1994 */
1995
1996 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1997 smb_action |= EXTENDED_OPLOCK_GRANTED;
1998 }
1999
2000 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2001 smb_action |= EXTENDED_OPLOCK_GRANTED;
2002 }
2003
2004 /* If the caller set the core oplock request bit
2005 and we granted one (by whatever means) - set the
2006 correct bit for core oplock reply.
2007 */
2008
2009 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2010 reply_outbuf(req, 19, 0);
2011 } else {
2012 reply_outbuf(req, 15, 0);
2013 }
2014
2015 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2016 SCVAL(req->outbuf, smb_flg,
2017 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2018 }
2019
2020 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2021 SCVAL(req->outbuf, smb_flg,
2022 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2023 }
2024
2025 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2026 SSVAL(req->outbuf,smb_vwv3,fattr);
2027 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2028 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2029 } else {
2030 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2031 }
2032 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2033 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2034 SSVAL(req->outbuf,smb_vwv11,smb_action);
2035
2036 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2037 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2038 }
2039
2040 chain_reply(req);
2041 out:
2042 TALLOC_FREE(smb_fname);
2043 END_PROFILE(SMBopenX);
2044 return;
2045}
2046
2047/****************************************************************************
2048 Reply to a SMBulogoffX.
2049****************************************************************************/
2050
2051void reply_ulogoffX(struct smb_request *req)
2052{
2053 struct smbd_server_connection *sconn = smbd_server_conn;
2054 user_struct *vuser;
2055
2056 START_PROFILE(SMBulogoffX);
2057
2058 vuser = get_valid_user_struct(sconn, req->vuid);
2059
2060 if(vuser == NULL) {
2061 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2062 req->vuid));
2063 }
2064
2065 /* in user level security we are supposed to close any files
2066 open by this user */
2067 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2068 file_close_user(req->vuid);
2069 }
2070
2071 invalidate_vuid(sconn, req->vuid);
2072
2073 reply_outbuf(req, 2, 0);
2074
2075 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2076
2077 END_PROFILE(SMBulogoffX);
2078 req->vuid = UID_FIELD_INVALID;
2079 chain_reply(req);
2080}
2081
2082/****************************************************************************
2083 Reply to a mknew or a create.
2084****************************************************************************/
2085
2086void reply_mknew(struct smb_request *req)
2087{
2088 connection_struct *conn = req->conn;
2089 struct smb_filename *smb_fname = NULL;
2090 char *fname = NULL;
2091 uint32 fattr = 0;
2092 struct smb_file_time ft;
2093 files_struct *fsp;
2094 int oplock_request = 0;
2095 NTSTATUS status;
2096 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2097 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2098 uint32 create_disposition;
2099 uint32 create_options = 0;
2100 TALLOC_CTX *ctx = talloc_tos();
2101
2102 START_PROFILE(SMBcreate);
2103 ZERO_STRUCT(ft);
2104
2105 if (req->wct < 3) {
2106 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2107 goto out;
2108 }
2109
2110 fattr = SVAL(req->vwv+0, 0);
2111 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2112
2113 /* mtime. */
2114 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2115
2116 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2117 STR_TERMINATE, &status);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 reply_nterror(req, status);
2120 goto out;
2121 }
2122
2123 status = filename_convert(ctx,
2124 conn,
2125 req->flags2 & FLAGS2_DFS_PATHNAMES,
2126 fname,
2127 0,
2128 NULL,
2129 &smb_fname);
2130 if (!NT_STATUS_IS_OK(status)) {
2131 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2132 reply_botherror(req,
2133 NT_STATUS_PATH_NOT_COVERED,
2134 ERRSRV, ERRbadpath);
2135 goto out;
2136 }
2137 reply_nterror(req, status);
2138 goto out;
2139 }
2140
2141 if (fattr & aVOLID) {
2142 DEBUG(0,("Attempt to create file (%s) with volid set - "
2143 "please report this\n",
2144 smb_fname_str_dbg(smb_fname)));
2145 }
2146
2147 if(req->cmd == SMBmknew) {
2148 /* We should fail if file exists. */
2149 create_disposition = FILE_CREATE;
2150 } else {
2151 /* Create if file doesn't exist, truncate if it does. */
2152 create_disposition = FILE_OVERWRITE_IF;
2153 }
2154
2155 status = SMB_VFS_CREATE_FILE(
2156 conn, /* conn */
2157 req, /* req */
2158 0, /* root_dir_fid */
2159 smb_fname, /* fname */
2160 access_mask, /* access_mask */
2161 share_mode, /* share_access */
2162 create_disposition, /* create_disposition*/
2163 create_options, /* create_options */
2164 fattr, /* file_attributes */
2165 oplock_request, /* oplock_request */
2166 0, /* allocation_size */
2167 NULL, /* sd */
2168 NULL, /* ea_list */
2169 &fsp, /* result */
2170 NULL); /* pinfo */
2171
2172 if (!NT_STATUS_IS_OK(status)) {
2173 if (open_was_deferred(req->mid)) {
2174 /* We have re-scheduled this call. */
2175 goto out;
2176 }
2177 reply_openerror(req, status);
2178 goto out;
2179 }
2180
2181 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2182 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2183 if (!NT_STATUS_IS_OK(status)) {
2184 END_PROFILE(SMBcreate);
2185 goto out;
2186 }
2187
2188 reply_outbuf(req, 1, 0);
2189 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2190
2191 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2192 SCVAL(req->outbuf,smb_flg,
2193 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2194 }
2195
2196 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2197 SCVAL(req->outbuf,smb_flg,
2198 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2199 }
2200
2201 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2202 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2203 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2204 (unsigned int)fattr));
2205
2206 out:
2207 TALLOC_FREE(smb_fname);
2208 END_PROFILE(SMBcreate);
2209 return;
2210}
2211
2212/****************************************************************************
2213 Reply to a create temporary file.
2214****************************************************************************/
2215
2216void reply_ctemp(struct smb_request *req)
2217{
2218 connection_struct *conn = req->conn;
2219 struct smb_filename *smb_fname = NULL;
2220 char *fname = NULL;
2221 uint32 fattr;
2222 files_struct *fsp;
2223 int oplock_request;
2224 int tmpfd;
2225 char *s;
2226 NTSTATUS status;
2227 TALLOC_CTX *ctx = talloc_tos();
2228
2229 START_PROFILE(SMBctemp);
2230
2231 if (req->wct < 3) {
2232 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2233 goto out;
2234 }
2235
2236 fattr = SVAL(req->vwv+0, 0);
2237 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2238
2239 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2240 STR_TERMINATE, &status);
2241 if (!NT_STATUS_IS_OK(status)) {
2242 reply_nterror(req, status);
2243 goto out;
2244 }
2245 if (*fname) {
2246 fname = talloc_asprintf(ctx,
2247 "%s/TMXXXXXX",
2248 fname);
2249 } else {
2250 fname = talloc_strdup(ctx, "TMXXXXXX");
2251 }
2252
2253 if (!fname) {
2254 reply_nterror(req, NT_STATUS_NO_MEMORY);
2255 goto out;
2256 }
2257
2258 status = filename_convert(ctx, conn,
2259 req->flags2 & FLAGS2_DFS_PATHNAMES,
2260 fname,
2261 0,
2262 NULL,
2263 &smb_fname);
2264 if (!NT_STATUS_IS_OK(status)) {
2265 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2266 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2267 ERRSRV, ERRbadpath);
2268 goto out;
2269 }
2270 reply_nterror(req, status);
2271 goto out;
2272 }
2273
2274 tmpfd = mkstemp(smb_fname->base_name);
2275 if (tmpfd == -1) {
2276 reply_nterror(req, map_nt_error_from_unix(errno));
2277 goto out;
2278 }
2279
2280 SMB_VFS_STAT(conn, smb_fname);
2281
2282 /* We should fail if file does not exist. */
2283 status = SMB_VFS_CREATE_FILE(
2284 conn, /* conn */
2285 req, /* req */
2286 0, /* root_dir_fid */
2287 smb_fname, /* fname */
2288 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2289 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2290 FILE_OPEN, /* create_disposition*/
2291 0, /* create_options */
2292 fattr, /* file_attributes */
2293 oplock_request, /* oplock_request */
2294 0, /* allocation_size */
2295 NULL, /* sd */
2296 NULL, /* ea_list */
2297 &fsp, /* result */
2298 NULL); /* pinfo */
2299
2300 /* close fd from mkstemp() */
2301 close(tmpfd);
2302
2303 if (!NT_STATUS_IS_OK(status)) {
2304 if (open_was_deferred(req->mid)) {
2305 /* We have re-scheduled this call. */
2306 goto out;
2307 }
2308 reply_openerror(req, status);
2309 goto out;
2310 }
2311
2312 reply_outbuf(req, 1, 0);
2313 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2314
2315 /* the returned filename is relative to the directory */
2316 s = strrchr_m(fsp->fsp_name->base_name, '/');
2317 if (!s) {
2318 s = fsp->fsp_name->base_name;
2319 } else {
2320 s++;
2321 }
2322
2323#if 0
2324 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2325 thing in the byte section. JRA */
2326 SSVALS(p, 0, -1); /* what is this? not in spec */
2327#endif
2328 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2329 == -1) {
2330 reply_nterror(req, NT_STATUS_NO_MEMORY);
2331 goto out;
2332 }
2333
2334 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2335 SCVAL(req->outbuf, smb_flg,
2336 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2337 }
2338
2339 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2340 SCVAL(req->outbuf, smb_flg,
2341 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2342 }
2343
2344 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2345 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2346 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2347 out:
2348 TALLOC_FREE(smb_fname);
2349 END_PROFILE(SMBctemp);
2350 return;
2351}
2352
2353/*******************************************************************
2354 Check if a user is allowed to rename a file.
2355********************************************************************/
2356
2357static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2358 uint16 dirtype)
2359{
2360 uint32 fmode;
2361
2362 if (!CAN_WRITE(conn)) {
2363 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2364 }
2365
2366 fmode = dos_mode(conn, fsp->fsp_name);
2367 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2368 return NT_STATUS_NO_SUCH_FILE;
2369 }
2370
2371 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2372 if (fsp->posix_open) {
2373 return NT_STATUS_OK;
2374 }
2375
2376 /* If no pathnames are open below this
2377 directory, allow the rename. */
2378
2379 if (file_find_subpath(fsp)) {
2380 return NT_STATUS_ACCESS_DENIED;
2381 }
2382 return NT_STATUS_OK;
2383 }
2384
2385 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2386 return NT_STATUS_OK;
2387 }
2388
2389 return NT_STATUS_ACCESS_DENIED;
2390}
2391
2392/*******************************************************************
2393 * unlink a file with all relevant access checks
2394 *******************************************************************/
2395
2396static NTSTATUS do_unlink(connection_struct *conn,
2397 struct smb_request *req,
2398 struct smb_filename *smb_fname,
2399 uint32 dirtype)
2400{
2401 uint32 fattr;
2402 files_struct *fsp;
2403 uint32 dirtype_orig = dirtype;
2404 NTSTATUS status;
2405 int ret;
2406 bool posix_paths = lp_posix_pathnames();
2407
2408 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2409 smb_fname_str_dbg(smb_fname),
2410 dirtype));
2411
2412 if (!CAN_WRITE(conn)) {
2413 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2414 }
2415
2416 if (posix_paths) {
2417 ret = SMB_VFS_LSTAT(conn, smb_fname);
2418 } else {
2419 ret = SMB_VFS_STAT(conn, smb_fname);
2420 }
2421 if (ret != 0) {
2422 return map_nt_error_from_unix(errno);
2423 }
2424
2425 fattr = dos_mode(conn, smb_fname);
2426
2427 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2428 dirtype = aDIR|aARCH|aRONLY;
2429 }
2430
2431 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2432 if (!dirtype) {
2433 return NT_STATUS_NO_SUCH_FILE;
2434 }
2435
2436 if (!dir_check_ftype(conn, fattr, dirtype)) {
2437 if (fattr & aDIR) {
2438 return NT_STATUS_FILE_IS_A_DIRECTORY;
2439 }
2440 return NT_STATUS_NO_SUCH_FILE;
2441 }
2442
2443 if (dirtype_orig & 0x8000) {
2444 /* These will never be set for POSIX. */
2445 return NT_STATUS_NO_SUCH_FILE;
2446 }
2447
2448#if 0
2449 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2450 return NT_STATUS_FILE_IS_A_DIRECTORY;
2451 }
2452
2453 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2454 return NT_STATUS_NO_SUCH_FILE;
2455 }
2456
2457 if (dirtype & 0xFF00) {
2458 /* These will never be set for POSIX. */
2459 return NT_STATUS_NO_SUCH_FILE;
2460 }
2461
2462 dirtype &= 0xFF;
2463 if (!dirtype) {
2464 return NT_STATUS_NO_SUCH_FILE;
2465 }
2466
2467 /* Can't delete a directory. */
2468 if (fattr & aDIR) {
2469 return NT_STATUS_FILE_IS_A_DIRECTORY;
2470 }
2471#endif
2472
2473#if 0 /* JRATEST */
2474 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2475 return NT_STATUS_OBJECT_NAME_INVALID;
2476#endif /* JRATEST */
2477
2478 /* On open checks the open itself will check the share mode, so
2479 don't do it here as we'll get it wrong. */
2480
2481 status = SMB_VFS_CREATE_FILE
2482 (conn, /* conn */
2483 req, /* req */
2484 0, /* root_dir_fid */
2485 smb_fname, /* fname */
2486 DELETE_ACCESS, /* access_mask */
2487 FILE_SHARE_NONE, /* share_access */
2488 FILE_OPEN, /* create_disposition*/
2489 FILE_NON_DIRECTORY_FILE, /* create_options */
2490 /* file_attributes */
2491 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2492 FILE_ATTRIBUTE_NORMAL,
2493 0, /* oplock_request */
2494 0, /* allocation_size */
2495 NULL, /* sd */
2496 NULL, /* ea_list */
2497 &fsp, /* result */
2498 NULL); /* pinfo */
2499
2500 if (!NT_STATUS_IS_OK(status)) {
2501 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2502 nt_errstr(status)));
2503 return status;
2504 }
2505
2506 status = can_set_delete_on_close(fsp, fattr);
2507 if (!NT_STATUS_IS_OK(status)) {
2508 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2509 "(%s)\n",
2510 smb_fname_str_dbg(smb_fname),
2511 nt_errstr(status)));
2512 close_file(req, fsp, NORMAL_CLOSE);
2513 return status;
2514 }
2515
2516 /* The set is across all open files on this dev/inode pair. */
2517 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2518 close_file(req, fsp, NORMAL_CLOSE);
2519 return NT_STATUS_ACCESS_DENIED;
2520 }
2521
2522 return close_file(req, fsp, NORMAL_CLOSE);
2523}
2524
2525/****************************************************************************
2526 The guts of the unlink command, split out so it may be called by the NT SMB
2527 code.
2528****************************************************************************/
2529
2530NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2531 uint32 dirtype, struct smb_filename *smb_fname,
2532 bool has_wild)
2533{
2534 char *fname_dir = NULL;
2535 char *fname_mask = NULL;
2536 int count=0;
2537 NTSTATUS status = NT_STATUS_OK;
2538 TALLOC_CTX *ctx = talloc_tos();
2539
2540 /* Split up the directory from the filename/mask. */
2541 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2542 &fname_dir, &fname_mask);
2543 if (!NT_STATUS_IS_OK(status)) {
2544 goto out;
2545 }
2546
2547 /*
2548 * We should only check the mangled cache
2549 * here if unix_convert failed. This means
2550 * that the path in 'mask' doesn't exist
2551 * on the file system and so we need to look
2552 * for a possible mangle. This patch from
2553 * Tine Smukavec <valentin.smukavec@hermes.si>.
2554 */
2555
2556 if (!VALID_STAT(smb_fname->st) &&
2557 mangle_is_mangled(fname_mask, conn->params)) {
2558 char *new_mask = NULL;
2559 mangle_lookup_name_from_8_3(ctx, fname_mask,
2560 &new_mask, conn->params);
2561 if (new_mask) {
2562 TALLOC_FREE(fname_mask);
2563 fname_mask = new_mask;
2564 }
2565 }
2566
2567 if (!has_wild) {
2568
2569 /*
2570 * Only one file needs to be unlinked. Append the mask back
2571 * onto the directory.
2572 */
2573 TALLOC_FREE(smb_fname->base_name);
2574 smb_fname->base_name = talloc_asprintf(smb_fname,
2575 "%s/%s",
2576 fname_dir,
2577 fname_mask);
2578 if (!smb_fname->base_name) {
2579 status = NT_STATUS_NO_MEMORY;
2580 goto out;
2581 }
2582 if (dirtype == 0) {
2583 dirtype = FILE_ATTRIBUTE_NORMAL;
2584 }
2585
2586 status = check_name(conn, smb_fname->base_name);
2587 if (!NT_STATUS_IS_OK(status)) {
2588 goto out;
2589 }
2590
2591 status = do_unlink(conn, req, smb_fname, dirtype);
2592 if (!NT_STATUS_IS_OK(status)) {
2593 goto out;
2594 }
2595
2596 count++;
2597 } else {
2598 struct smb_Dir *dir_hnd = NULL;
2599 long offset = 0;
2600 const char *dname = NULL;
2601 char *talloced = NULL;
2602
2603 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2604 status = NT_STATUS_OBJECT_NAME_INVALID;
2605 goto out;
2606 }
2607
2608 if (strequal(fname_mask,"????????.???")) {
2609 TALLOC_FREE(fname_mask);
2610 fname_mask = talloc_strdup(ctx, "*");
2611 if (!fname_mask) {
2612 status = NT_STATUS_NO_MEMORY;
2613 goto out;
2614 }
2615 }
2616
2617 status = check_name(conn, fname_dir);
2618 if (!NT_STATUS_IS_OK(status)) {
2619 goto out;
2620 }
2621
2622 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2623 dirtype);
2624 if (dir_hnd == NULL) {
2625 status = map_nt_error_from_unix(errno);
2626 goto out;
2627 }
2628
2629 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2630 the pattern matches against the long name, otherwise the short name
2631 We don't implement this yet XXXX
2632 */
2633
2634 status = NT_STATUS_NO_SUCH_FILE;
2635
2636 while ((dname = ReadDirName(dir_hnd, &offset,
2637 &smb_fname->st, &talloced))) {
2638 TALLOC_CTX *frame = talloc_stackframe();
2639
2640 if (!is_visible_file(conn, fname_dir, dname,
2641 &smb_fname->st, true)) {
2642 TALLOC_FREE(frame);
2643 TALLOC_FREE(talloced);
2644 continue;
2645 }
2646
2647 /* Quick check for "." and ".." */
2648 if (ISDOT(dname) || ISDOTDOT(dname)) {
2649 TALLOC_FREE(frame);
2650 TALLOC_FREE(talloced);
2651 continue;
2652 }
2653
2654 if(!mask_match(dname, fname_mask,
2655 conn->case_sensitive)) {
2656 TALLOC_FREE(frame);
2657 TALLOC_FREE(talloced);
2658 continue;
2659 }
2660
2661 TALLOC_FREE(smb_fname->base_name);
2662 smb_fname->base_name =
2663 talloc_asprintf(smb_fname, "%s/%s",
2664 fname_dir, dname);
2665
2666 if (!smb_fname->base_name) {
2667 TALLOC_FREE(dir_hnd);
2668 status = NT_STATUS_NO_MEMORY;
2669 TALLOC_FREE(frame);
2670 TALLOC_FREE(talloced);
2671 goto out;
2672 }
2673
2674 status = check_name(conn, smb_fname->base_name);
2675 if (!NT_STATUS_IS_OK(status)) {
2676 TALLOC_FREE(dir_hnd);
2677 TALLOC_FREE(frame);
2678 TALLOC_FREE(talloced);
2679 goto out;
2680 }
2681
2682 status = do_unlink(conn, req, smb_fname, dirtype);
2683 if (!NT_STATUS_IS_OK(status)) {
2684 TALLOC_FREE(frame);
2685 TALLOC_FREE(talloced);
2686 continue;
2687 }
2688
2689 count++;
2690 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2691 smb_fname->base_name));
2692
2693 TALLOC_FREE(frame);
2694 TALLOC_FREE(talloced);
2695 }
2696 TALLOC_FREE(dir_hnd);
2697 }
2698
2699 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2700 status = map_nt_error_from_unix(errno);
2701 }
2702
2703 out:
2704 TALLOC_FREE(fname_dir);
2705 TALLOC_FREE(fname_mask);
2706 return status;
2707}
2708
2709/****************************************************************************
2710 Reply to a unlink
2711****************************************************************************/
2712
2713void reply_unlink(struct smb_request *req)
2714{
2715 connection_struct *conn = req->conn;
2716 char *name = NULL;
2717 struct smb_filename *smb_fname = NULL;
2718 uint32 dirtype;
2719 NTSTATUS status;
2720 bool path_contains_wcard = False;
2721 TALLOC_CTX *ctx = talloc_tos();
2722
2723 START_PROFILE(SMBunlink);
2724
2725 if (req->wct < 1) {
2726 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2727 goto out;
2728 }
2729
2730 dirtype = SVAL(req->vwv+0, 0);
2731
2732 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2733 STR_TERMINATE, &status,
2734 &path_contains_wcard);
2735 if (!NT_STATUS_IS_OK(status)) {
2736 reply_nterror(req, status);
2737 goto out;
2738 }
2739
2740 status = filename_convert(ctx, conn,
2741 req->flags2 & FLAGS2_DFS_PATHNAMES,
2742 name,
2743 UCF_COND_ALLOW_WCARD_LCOMP,
2744 &path_contains_wcard,
2745 &smb_fname);
2746 if (!NT_STATUS_IS_OK(status)) {
2747 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2748 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2749 ERRSRV, ERRbadpath);
2750 goto out;
2751 }
2752 reply_nterror(req, status);
2753 goto out;
2754 }
2755
2756 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2757
2758 status = unlink_internals(conn, req, dirtype, smb_fname,
2759 path_contains_wcard);
2760 if (!NT_STATUS_IS_OK(status)) {
2761 if (open_was_deferred(req->mid)) {
2762 /* We have re-scheduled this call. */
2763 goto out;
2764 }
2765 reply_nterror(req, status);
2766 goto out;
2767 }
2768
2769 reply_outbuf(req, 0, 0);
2770 out:
2771 TALLOC_FREE(smb_fname);
2772 END_PROFILE(SMBunlink);
2773 return;
2774}
2775
2776/****************************************************************************
2777 Fail for readbraw.
2778****************************************************************************/
2779
2780static void fail_readraw(void)
2781{
2782 const char *errstr = talloc_asprintf(talloc_tos(),
2783 "FAIL ! reply_readbraw: socket write fail (%s)",
2784 strerror(errno));
2785 if (!errstr) {
2786 errstr = "";
2787 }
2788 exit_server_cleanly(errstr);
2789}
2790
2791/****************************************************************************
2792 Fake (read/write) sendfile. Returns -1 on read or write fail.
2793****************************************************************************/
2794
2795static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2796 size_t nread)
2797{
2798 size_t bufsize;
2799 size_t tosend = nread;
2800 char *buf;
2801
2802 if (nread == 0) {
2803 return 0;
2804 }
2805
2806 bufsize = MIN(nread, 65536);
2807
2808 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2809 return -1;
2810 }
2811
2812 while (tosend > 0) {
2813 ssize_t ret;
2814 size_t cur_read;
2815
2816 if (tosend > bufsize) {
2817 cur_read = bufsize;
2818 } else {
2819 cur_read = tosend;
2820 }
2821 ret = read_file(fsp,buf,startpos,cur_read);
2822 if (ret == -1) {
2823 SAFE_FREE(buf);
2824 return -1;
2825 }
2826
2827 /* If we had a short read, fill with zeros. */
2828 if (ret < cur_read) {
2829 memset(buf + ret, '\0', cur_read - ret);
2830 }
2831
2832 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2833 SAFE_FREE(buf);
2834 return -1;
2835 }
2836 tosend -= cur_read;
2837 startpos += cur_read;
2838 }
2839
2840 SAFE_FREE(buf);
2841 return (ssize_t)nread;
2842}
2843
2844#if defined(WITH_SENDFILE)
2845/****************************************************************************
2846 Deal with the case of sendfile reading less bytes from the file than
2847 requested. Fill with zeros (all we can do).
2848****************************************************************************/
2849
2850static void sendfile_short_send(files_struct *fsp,
2851 ssize_t nread,
2852 size_t headersize,
2853 size_t smb_maxcnt)
2854{
2855#define SHORT_SEND_BUFSIZE 1024
2856 if (nread < headersize) {
2857 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2858 "header for file %s (%s). Terminating\n",
2859 fsp_str_dbg(fsp), strerror(errno)));
2860 exit_server_cleanly("sendfile_short_send failed");
2861 }
2862
2863 nread -= headersize;
2864
2865 if (nread < smb_maxcnt) {
2866 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2867 if (!buf) {
2868 exit_server_cleanly("sendfile_short_send: "
2869 "malloc failed");
2870 }
2871
2872 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2873 "with zeros !\n", fsp_str_dbg(fsp)));
2874
2875 while (nread < smb_maxcnt) {
2876 /*
2877 * We asked for the real file size and told sendfile
2878 * to not go beyond the end of the file. But it can
2879 * happen that in between our fstat call and the
2880 * sendfile call the file was truncated. This is very
2881 * bad because we have already announced the larger
2882 * number of bytes to the client.
2883 *
2884 * The best we can do now is to send 0-bytes, just as
2885 * a read from a hole in a sparse file would do.
2886 *
2887 * This should happen rarely enough that I don't care
2888 * about efficiency here :-)
2889 */
2890 size_t to_write;
2891
2892 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2893 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2894 exit_server_cleanly("sendfile_short_send: "
2895 "write_data failed");
2896 }
2897 nread += to_write;
2898 }
2899 SAFE_FREE(buf);
2900 }
2901}
2902#endif /* defined WITH_SENDFILE */
2903
2904/****************************************************************************
2905 Return a readbraw error (4 bytes of zero).
2906****************************************************************************/
2907
2908static void reply_readbraw_error(void)
2909{
2910 char header[4];
2911 SIVAL(header,0,0);
2912 if (write_data(smbd_server_fd(),header,4) != 4) {
2913 fail_readraw();
2914 }
2915}
2916
2917/****************************************************************************
2918 Use sendfile in readbraw.
2919****************************************************************************/
2920
2921static void send_file_readbraw(connection_struct *conn,
2922 struct smb_request *req,
2923 files_struct *fsp,
2924 SMB_OFF_T startpos,
2925 size_t nread,
2926 ssize_t mincount)
2927{
2928 char *outbuf = NULL;
2929 ssize_t ret=0;
2930
2931#if defined(WITH_SENDFILE)
2932 /*
2933 * We can only use sendfile on a non-chained packet
2934 * but we can use on a non-oplocked file. tridge proved this
2935 * on a train in Germany :-). JRA.
2936 * reply_readbraw has already checked the length.
2937 */
2938
2939 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2940 (fsp->wcp == NULL) &&
2941 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2942 ssize_t sendfile_read = -1;
2943 char header[4];
2944 DATA_BLOB header_blob;
2945
2946 _smb_setlen(header,nread);
2947 header_blob = data_blob_const(header, 4);
2948
2949 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2950 &header_blob, startpos, nread)) == -1) {
2951 /* Returning ENOSYS means no data at all was sent.
2952 * Do this as a normal read. */
2953 if (errno == ENOSYS) {
2954 goto normal_readbraw;
2955 }
2956
2957 /*
2958 * Special hack for broken Linux with no working sendfile. If we
2959 * return EINTR we sent the header but not the rest of the data.
2960 * Fake this up by doing read/write calls.
2961 */
2962 if (errno == EINTR) {
2963 /* Ensure we don't do this again. */
2964 set_use_sendfile(SNUM(conn), False);
2965 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2966
2967 if (fake_sendfile(fsp, startpos, nread) == -1) {
2968 DEBUG(0,("send_file_readbraw: "
2969 "fake_sendfile failed for "
2970 "file %s (%s).\n",
2971 fsp_str_dbg(fsp),
2972 strerror(errno)));
2973 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2974 }
2975 return;
2976 }
2977
2978 DEBUG(0,("send_file_readbraw: sendfile failed for "
2979 "file %s (%s). Terminating\n",
2980 fsp_str_dbg(fsp), strerror(errno)));
2981 exit_server_cleanly("send_file_readbraw sendfile failed");
2982 } else if (sendfile_read == 0) {
2983 /*
2984 * Some sendfile implementations return 0 to indicate
2985 * that there was a short read, but nothing was
2986 * actually written to the socket. In this case,
2987 * fallback to the normal read path so the header gets
2988 * the correct byte count.
2989 */
2990 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2991 "bytes falling back to the normal read: "
2992 "%s\n", fsp_str_dbg(fsp)));
2993 goto normal_readbraw;
2994 }
2995
2996 /* Deal with possible short send. */
2997 if (sendfile_read != 4+nread) {
2998 sendfile_short_send(fsp, sendfile_read, 4, nread);
2999 }
3000 return;
3001 }
3002
3003normal_readbraw:
3004#endif
3005
3006 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3007 if (!outbuf) {
3008 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3009 (unsigned)(nread+4)));
3010 reply_readbraw_error();
3011 return;
3012 }
3013
3014 if (nread > 0) {
3015 ret = read_file(fsp,outbuf+4,startpos,nread);
3016#if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3017 if (ret < mincount)
3018 ret = 0;
3019#else
3020 if (ret < nread)
3021 ret = 0;
3022#endif
3023 }
3024
3025 _smb_setlen(outbuf,ret);
3026 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3027 fail_readraw();
3028
3029 TALLOC_FREE(outbuf);
3030}
3031
3032/****************************************************************************
3033 Reply to a readbraw (core+ protocol).
3034****************************************************************************/
3035
3036void reply_readbraw(struct smb_request *req)
3037{
3038 connection_struct *conn = req->conn;
3039 ssize_t maxcount,mincount;
3040 size_t nread = 0;
3041 SMB_OFF_T startpos;
3042 files_struct *fsp;
3043 struct lock_struct lock;
3044 SMB_OFF_T size = 0;
3045
3046 START_PROFILE(SMBreadbraw);
3047
3048 if (srv_is_signing_active(smbd_server_conn) ||
3049 is_encrypted_packet(req->inbuf)) {
3050 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3051 "raw reads/writes are disallowed.");
3052 }
3053
3054 if (req->wct < 8) {
3055 reply_readbraw_error();
3056 END_PROFILE(SMBreadbraw);
3057 return;
3058 }
3059
3060 /*
3061 * Special check if an oplock break has been issued
3062 * and the readraw request croses on the wire, we must
3063 * return a zero length response here.
3064 */
3065
3066 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3067
3068 /*
3069 * We have to do a check_fsp by hand here, as
3070 * we must always return 4 zero bytes on error,
3071 * not a NTSTATUS.
3072 */
3073
3074 if (!fsp || !conn || conn != fsp->conn ||
3075 req->vuid != fsp->vuid ||
3076 fsp->is_directory || fsp->fh->fd == -1) {
3077 /*
3078 * fsp could be NULL here so use the value from the packet. JRA.
3079 */
3080 DEBUG(3,("reply_readbraw: fnum %d not valid "
3081 "- cache prime?\n",
3082 (int)SVAL(req->vwv+0, 0)));
3083 reply_readbraw_error();
3084 END_PROFILE(SMBreadbraw);
3085 return;
3086 }
3087
3088 /* Do a "by hand" version of CHECK_READ. */
3089 if (!(fsp->can_read ||
3090 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3091 (fsp->access_mask & FILE_EXECUTE)))) {
3092 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3093 (int)SVAL(req->vwv+0, 0)));
3094 reply_readbraw_error();
3095 END_PROFILE(SMBreadbraw);
3096 return;
3097 }
3098
3099 flush_write_cache(fsp, READRAW_FLUSH);
3100
3101 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3102 if(req->wct == 10) {
3103 /*
3104 * This is a large offset (64 bit) read.
3105 */
3106#ifdef LARGE_SMB_OFF_T
3107
3108 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3109
3110#else /* !LARGE_SMB_OFF_T */
3111
3112 /*
3113 * Ensure we haven't been sent a >32 bit offset.
3114 */
3115
3116 if(IVAL(req->vwv+8, 0) != 0) {
3117 DEBUG(0,("reply_readbraw: large offset "
3118 "(%x << 32) used and we don't support "
3119 "64 bit offsets.\n",
3120 (unsigned int)IVAL(req->vwv+8, 0) ));
3121 reply_readbraw_error();
3122 END_PROFILE(SMBreadbraw);
3123 return;
3124 }
3125
3126#endif /* LARGE_SMB_OFF_T */
3127
3128 if(startpos < 0) {
3129 DEBUG(0,("reply_readbraw: negative 64 bit "
3130 "readraw offset (%.0f) !\n",
3131 (double)startpos ));
3132 reply_readbraw_error();
3133 END_PROFILE(SMBreadbraw);
3134 return;
3135 }
3136 }
3137
3138 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3139 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3140
3141 /* ensure we don't overrun the packet size */
3142 maxcount = MIN(65535,maxcount);
3143
3144 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3145 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3146 &lock);
3147
3148 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3149 reply_readbraw_error();
3150 END_PROFILE(SMBreadbraw);
3151 return;
3152 }
3153
3154 if (fsp_stat(fsp) == 0) {
3155 size = fsp->fsp_name->st.st_ex_size;
3156 }
3157
3158 if (startpos >= size) {
3159 nread = 0;
3160 } else {
3161 nread = MIN(maxcount,(size - startpos));
3162 }
3163
3164#if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3165 if (nread < mincount)
3166 nread = 0;
3167#endif
3168
3169 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3170 "min=%lu nread=%lu\n",
3171 fsp->fnum, (double)startpos,
3172 (unsigned long)maxcount,
3173 (unsigned long)mincount,
3174 (unsigned long)nread ) );
3175
3176 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3177
3178 DEBUG(5,("reply_readbraw finished\n"));
3179
3180 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3181
3182 END_PROFILE(SMBreadbraw);
3183 return;
3184}
3185
3186#undef DBGC_CLASS
3187#define DBGC_CLASS DBGC_LOCKING
3188
3189/****************************************************************************
3190 Reply to a lockread (core+ protocol).
3191****************************************************************************/
3192
3193void reply_lockread(struct smb_request *req)
3194{
3195 connection_struct *conn = req->conn;
3196 ssize_t nread = -1;
3197 char *data;
3198 SMB_OFF_T startpos;
3199 size_t numtoread;
3200 NTSTATUS status;
3201 files_struct *fsp;
3202 struct byte_range_lock *br_lck = NULL;
3203 char *p = NULL;
3204 struct smbd_server_connection *sconn = smbd_server_conn;
3205
3206 START_PROFILE(SMBlockread);
3207
3208 if (req->wct < 5) {
3209 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3210 END_PROFILE(SMBlockread);
3211 return;
3212 }
3213
3214 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3215
3216 if (!check_fsp(conn, req, fsp)) {
3217 END_PROFILE(SMBlockread);
3218 return;
3219 }
3220
3221 if (!CHECK_READ(fsp,req)) {
3222 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3223 END_PROFILE(SMBlockread);
3224 return;
3225 }
3226
3227 numtoread = SVAL(req->vwv+1, 0);
3228 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3229
3230 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3231
3232 reply_outbuf(req, 5, numtoread + 3);
3233
3234 data = smb_buf(req->outbuf) + 3;
3235
3236 /*
3237 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3238 * protocol request that predates the read/write lock concept.
3239 * Thus instead of asking for a read lock here we need to ask
3240 * for a write lock. JRA.
3241 * Note that the requested lock size is unaffected by max_recv.
3242 */
3243
3244 br_lck = do_lock(smbd_messaging_context(),
3245 fsp,
3246 req->smbpid,
3247 (uint64_t)numtoread,
3248 (uint64_t)startpos,
3249 WRITE_LOCK,
3250 WINDOWS_LOCK,
3251 False, /* Non-blocking lock. */
3252 &status,
3253 NULL,
3254 NULL);
3255 TALLOC_FREE(br_lck);
3256
3257 if (NT_STATUS_V(status)) {
3258 reply_nterror(req, status);
3259 END_PROFILE(SMBlockread);
3260 return;
3261 }
3262
3263 /*
3264 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3265 */
3266
3267 if (numtoread > sconn->smb1.negprot.max_recv) {
3268 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3269Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3270 (unsigned int)numtoread,
3271 (unsigned int)sconn->smb1.negprot.max_recv));
3272 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3273 }
3274 nread = read_file(fsp,data,startpos,numtoread);
3275
3276 if (nread < 0) {
3277 reply_nterror(req, map_nt_error_from_unix(errno));
3278 END_PROFILE(SMBlockread);
3279 return;
3280 }
3281
3282 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3283
3284 SSVAL(req->outbuf,smb_vwv0,nread);
3285 SSVAL(req->outbuf,smb_vwv5,nread+3);
3286 p = smb_buf(req->outbuf);
3287 SCVAL(p,0,0); /* pad byte. */
3288 SSVAL(p,1,nread);
3289
3290 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3291 fsp->fnum, (int)numtoread, (int)nread));
3292
3293 END_PROFILE(SMBlockread);
3294 return;
3295}
3296
3297#undef DBGC_CLASS
3298#define DBGC_CLASS DBGC_ALL
3299
3300/****************************************************************************
3301 Reply to a read.
3302****************************************************************************/
3303
3304void reply_read(struct smb_request *req)
3305{
3306 connection_struct *conn = req->conn;
3307 size_t numtoread;
3308 ssize_t nread = 0;
3309 char *data;
3310 SMB_OFF_T startpos;
3311 int outsize = 0;
3312 files_struct *fsp;
3313 struct lock_struct lock;
3314 struct smbd_server_connection *sconn = smbd_server_conn;
3315
3316 START_PROFILE(SMBread);
3317
3318 if (req->wct < 3) {
3319 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3320 END_PROFILE(SMBread);
3321 return;
3322 }
3323
3324 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3325
3326 if (!check_fsp(conn, req, fsp)) {
3327 END_PROFILE(SMBread);
3328 return;
3329 }
3330
3331 if (!CHECK_READ(fsp,req)) {
3332 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3333 END_PROFILE(SMBread);
3334 return;
3335 }
3336
3337 numtoread = SVAL(req->vwv+1, 0);
3338 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3339
3340 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3341
3342 /*
3343 * The requested read size cannot be greater than max_recv. JRA.
3344 */
3345 if (numtoread > sconn->smb1.negprot.max_recv) {
3346 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3347Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3348 (unsigned int)numtoread,
3349 (unsigned int)sconn->smb1.negprot.max_recv));
3350 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3351 }
3352
3353 reply_outbuf(req, 5, numtoread+3);
3354
3355 data = smb_buf(req->outbuf) + 3;
3356
3357 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3358 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3359 &lock);
3360
3361 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3362 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3363 END_PROFILE(SMBread);
3364 return;
3365 }
3366
3367 if (numtoread > 0)
3368 nread = read_file(fsp,data,startpos,numtoread);
3369
3370 if (nread < 0) {
3371 reply_nterror(req, map_nt_error_from_unix(errno));
3372 goto strict_unlock;
3373 }
3374
3375 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3376
3377 SSVAL(req->outbuf,smb_vwv0,nread);
3378 SSVAL(req->outbuf,smb_vwv5,nread+3);
3379 SCVAL(smb_buf(req->outbuf),0,1);
3380 SSVAL(smb_buf(req->outbuf),1,nread);
3381
3382 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3383 fsp->fnum, (int)numtoread, (int)nread ) );
3384
3385strict_unlock:
3386 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3387
3388 END_PROFILE(SMBread);
3389 return;
3390}
3391
3392/****************************************************************************
3393 Setup readX header.
3394****************************************************************************/
3395
3396static int setup_readX_header(struct smb_request *req, char *outbuf,
3397 size_t smb_maxcnt)
3398{
3399 int outsize;
3400 char *data;
3401
3402 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3403 data = smb_buf(outbuf);
3404
3405 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3406
3407 SCVAL(outbuf,smb_vwv0,0xFF);
3408 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3409 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3410 SSVAL(outbuf,smb_vwv6,
3411 req_wct_ofs(req)
3412 + 1 /* the wct field */
3413 + 12 * sizeof(uint16_t) /* vwv */
3414 + 2); /* the buflen field */
3415 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3416 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3417 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3418 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3419 return outsize;
3420}
3421
3422/****************************************************************************
3423 Reply to a read and X - possibly using sendfile.
3424****************************************************************************/
3425
3426static void send_file_readX(connection_struct *conn, struct smb_request *req,
3427 files_struct *fsp, SMB_OFF_T startpos,
3428 size_t smb_maxcnt)
3429{
3430 ssize_t nread = -1;
3431 struct lock_struct lock;
3432 int saved_errno = 0;
3433
3434 if(fsp_stat(fsp) == -1) {
3435 reply_nterror(req, map_nt_error_from_unix(errno));
3436 return;
3437 }
3438
3439 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3440 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3441 &lock);
3442
3443 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3444 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3445 return;
3446 }
3447
3448 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3449 (startpos > fsp->fsp_name->st.st_ex_size)
3450 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3451 /*
3452 * We already know that we would do a short read, so don't
3453 * try the sendfile() path.
3454 */
3455 goto nosendfile_read;
3456 }
3457
3458#if defined(WITH_SENDFILE)
3459 /*
3460 * We can only use sendfile on a non-chained packet
3461 * but we can use on a non-oplocked file. tridge proved this
3462 * on a train in Germany :-). JRA.
3463 */
3464
3465 if (!req_is_in_chain(req) &&
3466 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3467 (fsp->wcp == NULL) &&
3468 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3469 uint8 headerbuf[smb_size + 12 * 2];
3470 DATA_BLOB header;
3471
3472 /*
3473 * Set up the packet header before send. We
3474 * assume here the sendfile will work (get the
3475 * correct amount of data).
3476 */
3477
3478 header = data_blob_const(headerbuf, sizeof(headerbuf));
3479
3480 construct_reply_common_req(req, (char *)headerbuf);
3481 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3482
3483 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3484 /* Returning ENOSYS means no data at all was sent.
3485 Do this as a normal read. */
3486 if (errno == ENOSYS) {
3487 goto normal_read;
3488 }
3489
3490 /*
3491 * Special hack for broken Linux with no working sendfile. If we
3492 * return EINTR we sent the header but not the rest of the data.
3493 * Fake this up by doing read/write calls.
3494 */
3495
3496 if (errno == EINTR) {
3497 /* Ensure we don't do this again. */
3498 set_use_sendfile(SNUM(conn), False);
3499 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3500 nread = fake_sendfile(fsp, startpos,
3501 smb_maxcnt);
3502 if (nread == -1) {
3503 DEBUG(0,("send_file_readX: "
3504 "fake_sendfile failed for "
3505 "file %s (%s).\n",
3506 fsp_str_dbg(fsp),
3507 strerror(errno)));
3508 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3509 }
3510 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3511 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3512 /* No outbuf here means successful sendfile. */
3513 goto strict_unlock;
3514 }
3515
3516 DEBUG(0,("send_file_readX: sendfile failed for file "
3517 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3518 strerror(errno)));
3519 exit_server_cleanly("send_file_readX sendfile failed");
3520 } else if (nread == 0) {
3521 /*
3522 * Some sendfile implementations return 0 to indicate
3523 * that there was a short read, but nothing was
3524 * actually written to the socket. In this case,
3525 * fallback to the normal read path so the header gets
3526 * the correct byte count.
3527 */
3528 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3529 "falling back to the normal read: %s\n",
3530 fsp_str_dbg(fsp)));
3531 goto normal_read;
3532 }
3533
3534 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3535 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3536
3537 /* Deal with possible short send. */
3538 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3539 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3540 }
3541 /* No outbuf here means successful sendfile. */
3542 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3543 SMB_PERFCOUNT_END(&req->pcd);
3544 goto strict_unlock;
3545 }
3546
3547normal_read:
3548
3549#endif
3550
3551 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3552 uint8 headerbuf[smb_size + 2*12];
3553
3554 construct_reply_common_req(req, (char *)headerbuf);
3555 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3556
3557 /* Send out the header. */
3558 if (write_data(smbd_server_fd(), (char *)headerbuf,
3559 sizeof(headerbuf)) != sizeof(headerbuf)) {
3560 DEBUG(0,("send_file_readX: write_data failed for file "
3561 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3562 strerror(errno)));
3563 exit_server_cleanly("send_file_readX sendfile failed");
3564 }
3565 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3566 if (nread == -1) {
3567 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3568 "file %s (%s).\n", fsp_str_dbg(fsp),
3569 strerror(errno)));
3570 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3571 }
3572 goto strict_unlock;
3573 }
3574
3575nosendfile_read:
3576
3577 reply_outbuf(req, 12, smb_maxcnt);
3578
3579 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3580 saved_errno = errno;
3581
3582 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3583
3584 if (nread < 0) {
3585 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3586 return;
3587 }
3588
3589 setup_readX_header(req, (char *)req->outbuf, nread);
3590
3591 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3592 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3593
3594 chain_reply(req);
3595 return;
3596
3597 strict_unlock:
3598 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3599 TALLOC_FREE(req->outbuf);
3600 return;
3601}
3602
3603/****************************************************************************
3604 Reply to a read and X.
3605****************************************************************************/
3606
3607void reply_read_and_X(struct smb_request *req)
3608{
3609 connection_struct *conn = req->conn;
3610 files_struct *fsp;
3611 SMB_OFF_T startpos;
3612 size_t smb_maxcnt;
3613 bool big_readX = False;
3614#if 0
3615 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3616#endif
3617
3618 START_PROFILE(SMBreadX);
3619
3620 if ((req->wct != 10) && (req->wct != 12)) {
3621 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3622 return;
3623 }
3624
3625 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3626 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3627 smb_maxcnt = SVAL(req->vwv+5, 0);
3628
3629 /* If it's an IPC, pass off the pipe handler. */
3630 if (IS_IPC(conn)) {
3631 reply_pipe_read_and_X(req);
3632 END_PROFILE(SMBreadX);
3633 return;
3634 }
3635
3636 if (!check_fsp(conn, req, fsp)) {
3637 END_PROFILE(SMBreadX);
3638 return;
3639 }
3640
3641 if (!CHECK_READ(fsp,req)) {
3642 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3643 END_PROFILE(SMBreadX);
3644 return;
3645 }
3646
3647 if (global_client_caps & CAP_LARGE_READX) {
3648 size_t upper_size = SVAL(req->vwv+7, 0);
3649 smb_maxcnt |= (upper_size<<16);
3650 if (upper_size > 1) {
3651 /* Can't do this on a chained packet. */
3652 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3653 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3654 END_PROFILE(SMBreadX);
3655 return;
3656 }
3657 /* We currently don't do this on signed or sealed data. */
3658 if (srv_is_signing_active(smbd_server_conn) ||
3659 is_encrypted_packet(req->inbuf)) {
3660 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3661 END_PROFILE(SMBreadX);
3662 return;
3663 }
3664 /* Is there room in the reply for this data ? */
3665 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3666 reply_nterror(req,
3667 NT_STATUS_INVALID_PARAMETER);
3668 END_PROFILE(SMBreadX);
3669 return;
3670 }
3671 big_readX = True;
3672 }
3673 }
3674
3675 if (req->wct == 12) {
3676#ifdef LARGE_SMB_OFF_T
3677 /*
3678 * This is a large offset (64 bit) read.
3679 */
3680 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3681
3682#else /* !LARGE_SMB_OFF_T */
3683
3684 /*
3685 * Ensure we haven't been sent a >32 bit offset.
3686 */
3687
3688 if(IVAL(req->vwv+10, 0) != 0) {
3689 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3690 "used and we don't support 64 bit offsets.\n",
3691 (unsigned int)IVAL(req->vwv+10, 0) ));
3692 END_PROFILE(SMBreadX);
3693 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3694 return;
3695 }
3696
3697#endif /* LARGE_SMB_OFF_T */
3698
3699 }
3700
3701 if (!big_readX &&
3702 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3703 goto out;
3704 }
3705
3706 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3707
3708 out:
3709 END_PROFILE(SMBreadX);
3710 return;
3711}
3712
3713/****************************************************************************
3714 Error replies to writebraw must have smb_wct == 1. Fix this up.
3715****************************************************************************/
3716
3717void error_to_writebrawerr(struct smb_request *req)
3718{
3719 uint8 *old_outbuf = req->outbuf;
3720
3721 reply_outbuf(req, 1, 0);
3722
3723 memcpy(req->outbuf, old_outbuf, smb_size);
3724 TALLOC_FREE(old_outbuf);
3725}
3726
3727/****************************************************************************
3728 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3729****************************************************************************/
3730
3731void reply_writebraw(struct smb_request *req)
3732{
3733 connection_struct *conn = req->conn;
3734 char *buf = NULL;
3735 ssize_t nwritten=0;
3736 ssize_t total_written=0;
3737 size_t numtowrite=0;
3738 size_t tcount;
3739 SMB_OFF_T startpos;
3740 char *data=NULL;
3741 bool write_through;
3742 files_struct *fsp;
3743 struct lock_struct lock;
3744 NTSTATUS status;
3745
3746 START_PROFILE(SMBwritebraw);
3747
3748 /*
3749 * If we ever reply with an error, it must have the SMB command
3750 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3751 * we're finished.
3752 */
3753 SCVAL(req->inbuf,smb_com,SMBwritec);
3754
3755 if (srv_is_signing_active(smbd_server_conn)) {
3756 END_PROFILE(SMBwritebraw);
3757 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3758 "raw reads/writes are disallowed.");
3759 }
3760
3761 if (req->wct < 12) {
3762 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3763 error_to_writebrawerr(req);
3764 END_PROFILE(SMBwritebraw);
3765 return;
3766 }
3767
3768 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3769 if (!check_fsp(conn, req, fsp)) {
3770 error_to_writebrawerr(req);
3771 END_PROFILE(SMBwritebraw);
3772 return;
3773 }
3774
3775 if (!CHECK_WRITE(fsp)) {
3776 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3777 error_to_writebrawerr(req);
3778 END_PROFILE(SMBwritebraw);
3779 return;
3780 }
3781
3782 tcount = IVAL(req->vwv+1, 0);
3783 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3784 write_through = BITSETW(req->vwv+7,0);
3785
3786 /* We have to deal with slightly different formats depending
3787 on whether we are using the core+ or lanman1.0 protocol */
3788
3789 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3790 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3791 data = smb_buf(req->inbuf);
3792 } else {
3793 numtowrite = SVAL(req->vwv+10, 0);
3794 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3795 }
3796
3797 /* Ensure we don't write bytes past the end of this packet. */
3798 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3799 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3800 error_to_writebrawerr(req);
3801 END_PROFILE(SMBwritebraw);
3802 return;
3803 }
3804
3805 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3806 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3807 &lock);
3808
3809 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3810 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3811 error_to_writebrawerr(req);
3812 END_PROFILE(SMBwritebraw);
3813 return;
3814 }
3815
3816 if (numtowrite>0) {
3817 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3818 }
3819
3820 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3821 "wrote=%d sync=%d\n",
3822 fsp->fnum, (double)startpos, (int)numtowrite,
3823 (int)nwritten, (int)write_through));
3824
3825 if (nwritten < (ssize_t)numtowrite) {
3826 reply_nterror(req, NT_STATUS_DISK_FULL);
3827 error_to_writebrawerr(req);
3828 goto strict_unlock;
3829 }
3830
3831 total_written = nwritten;
3832
3833 /* Allocate a buffer of 64k + length. */
3834 buf = TALLOC_ARRAY(NULL, char, 65540);
3835 if (!buf) {
3836 reply_nterror(req, NT_STATUS_NO_MEMORY);
3837 error_to_writebrawerr(req);
3838 goto strict_unlock;
3839 }
3840
3841 /* Return a SMBwritebraw message to the redirector to tell
3842 * it to send more bytes */
3843
3844 memcpy(buf, req->inbuf, smb_size);
3845 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3846 SCVAL(buf,smb_com,SMBwritebraw);
3847 SSVALS(buf,smb_vwv0,0xFFFF);
3848 show_msg(buf);
3849 if (!srv_send_smb(smbd_server_fd(),
3850 buf,
3851 false, 0, /* no signing */
3852 IS_CONN_ENCRYPTED(conn),
3853 &req->pcd)) {
3854 exit_server_cleanly("reply_writebraw: srv_send_smb "
3855 "failed.");
3856 }
3857
3858 /* Now read the raw data into the buffer and write it */
3859 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3860 &numtowrite);
3861 if (!NT_STATUS_IS_OK(status)) {
3862 exit_server_cleanly("secondary writebraw failed");
3863 }
3864
3865 /* Set up outbuf to return the correct size */
3866 reply_outbuf(req, 1, 0);
3867
3868 if (numtowrite != 0) {
3869
3870 if (numtowrite > 0xFFFF) {
3871 DEBUG(0,("reply_writebraw: Oversize secondary write "
3872 "raw requested (%u). Terminating\n",
3873 (unsigned int)numtowrite ));
3874 exit_server_cleanly("secondary writebraw failed");
3875 }
3876
3877 if (tcount > nwritten+numtowrite) {
3878 DEBUG(3,("reply_writebraw: Client overestimated the "
3879 "write %d %d %d\n",
3880 (int)tcount,(int)nwritten,(int)numtowrite));
3881 }
3882
3883 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3884
3885 if (!NT_STATUS_IS_OK(status)) {
3886 DEBUG(0,("reply_writebraw: Oversize secondary write "
3887 "raw read failed (%s). Terminating\n",
3888 nt_errstr(status)));
3889 exit_server_cleanly("secondary writebraw failed");
3890 }
3891
3892 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3893 if (nwritten == -1) {
3894 TALLOC_FREE(buf);
3895 reply_nterror(req, map_nt_error_from_unix(errno));
3896 error_to_writebrawerr(req);
3897 goto strict_unlock;
3898 }
3899
3900 if (nwritten < (ssize_t)numtowrite) {
3901 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3902 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3903 }
3904
3905 if (nwritten > 0) {
3906 total_written += nwritten;
3907 }
3908 }
3909
3910 TALLOC_FREE(buf);
3911 SSVAL(req->outbuf,smb_vwv0,total_written);
3912
3913 status = sync_file(conn, fsp, write_through);
3914 if (!NT_STATUS_IS_OK(status)) {
3915 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3916 fsp_str_dbg(fsp), nt_errstr(status)));
3917 reply_nterror(req, status);
3918 error_to_writebrawerr(req);
3919 goto strict_unlock;
3920 }
3921
3922 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3923 "wrote=%d\n",
3924 fsp->fnum, (double)startpos, (int)numtowrite,
3925 (int)total_written));
3926
3927 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3928
3929 /* We won't return a status if write through is not selected - this
3930 * follows what WfWg does */
3931 END_PROFILE(SMBwritebraw);
3932
3933 if (!write_through && total_written==tcount) {
3934
3935#if RABBIT_PELLET_FIX
3936 /*
3937 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3938 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3939 * JRA.
3940 */
3941 if (!send_keepalive(smbd_server_fd())) {
3942 exit_server_cleanly("reply_writebraw: send of "
3943 "keepalive failed");
3944 }
3945#endif
3946 TALLOC_FREE(req->outbuf);
3947 }
3948 return;
3949
3950strict_unlock:
3951 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3952
3953 END_PROFILE(SMBwritebraw);
3954 return;
3955}
3956
3957#undef DBGC_CLASS
3958#define DBGC_CLASS DBGC_LOCKING
3959
3960/****************************************************************************
3961 Reply to a writeunlock (core+).
3962****************************************************************************/
3963
3964void reply_writeunlock(struct smb_request *req)
3965{
3966 connection_struct *conn = req->conn;
3967 ssize_t nwritten = -1;
3968 size_t numtowrite;
3969 SMB_OFF_T startpos;
3970 const char *data;
3971 NTSTATUS status = NT_STATUS_OK;
3972 files_struct *fsp;
3973 struct lock_struct lock;
3974 int saved_errno = 0;
3975
3976 START_PROFILE(SMBwriteunlock);
3977
3978 if (req->wct < 5) {
3979 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3980 END_PROFILE(SMBwriteunlock);
3981 return;
3982 }
3983
3984 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3985
3986 if (!check_fsp(conn, req, fsp)) {
3987 END_PROFILE(SMBwriteunlock);
3988 return;
3989 }
3990
3991 if (!CHECK_WRITE(fsp)) {
3992 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3993 END_PROFILE(SMBwriteunlock);
3994 return;
3995 }
3996
3997 numtowrite = SVAL(req->vwv+1, 0);
3998 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3999 data = (const char *)req->buf + 3;
4000
4001 if (numtowrite) {
4002 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4003 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4004 &lock);
4005
4006 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4007 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4008 END_PROFILE(SMBwriteunlock);
4009 return;
4010 }
4011 }
4012
4013 /* The special X/Open SMB protocol handling of
4014 zero length writes is *NOT* done for
4015 this call */
4016 if(numtowrite == 0) {
4017 nwritten = 0;
4018 } else {
4019 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4020 saved_errno = errno;
4021 }
4022
4023 status = sync_file(conn, fsp, False /* write through */);
4024 if (!NT_STATUS_IS_OK(status)) {
4025 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4026 fsp_str_dbg(fsp), nt_errstr(status)));
4027 reply_nterror(req, status);
4028 goto strict_unlock;
4029 }
4030
4031 if(nwritten < 0) {
4032 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4033 goto strict_unlock;
4034 }
4035
4036 if((nwritten < numtowrite) && (numtowrite != 0)) {
4037 reply_nterror(req, NT_STATUS_DISK_FULL);
4038 goto strict_unlock;
4039 }
4040
4041 if (numtowrite) {
4042 status = do_unlock(smbd_messaging_context(),
4043 fsp,
4044 req->smbpid,
4045 (uint64_t)numtowrite,
4046 (uint64_t)startpos,
4047 WINDOWS_LOCK);
4048
4049 if (NT_STATUS_V(status)) {
4050 reply_nterror(req, status);
4051 goto strict_unlock;
4052 }
4053 }
4054
4055 reply_outbuf(req, 1, 0);
4056
4057 SSVAL(req->outbuf,smb_vwv0,nwritten);
4058
4059 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4060 fsp->fnum, (int)numtowrite, (int)nwritten));
4061
4062strict_unlock:
4063 if (numtowrite) {
4064 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4065 }
4066
4067 END_PROFILE(SMBwriteunlock);
4068 return;
4069}
4070
4071#undef DBGC_CLASS
4072#define DBGC_CLASS DBGC_ALL
4073
4074/****************************************************************************
4075 Reply to a write.
4076****************************************************************************/
4077
4078void reply_write(struct smb_request *req)
4079{
4080 connection_struct *conn = req->conn;
4081 size_t numtowrite;
4082 ssize_t nwritten = -1;
4083 SMB_OFF_T startpos;
4084 const char *data;
4085 files_struct *fsp;
4086 struct lock_struct lock;
4087 NTSTATUS status;
4088 int saved_errno = 0;
4089
4090 START_PROFILE(SMBwrite);
4091
4092 if (req->wct < 5) {
4093 END_PROFILE(SMBwrite);
4094 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4095 return;
4096 }
4097
4098 /* If it's an IPC, pass off the pipe handler. */
4099 if (IS_IPC(conn)) {
4100 reply_pipe_write(req);
4101 END_PROFILE(SMBwrite);
4102 return;
4103 }
4104
4105 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4106
4107 if (!check_fsp(conn, req, fsp)) {
4108 END_PROFILE(SMBwrite);
4109 return;
4110 }
4111
4112 if (!CHECK_WRITE(fsp)) {
4113 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4114 END_PROFILE(SMBwrite);
4115 return;
4116 }
4117
4118 numtowrite = SVAL(req->vwv+1, 0);
4119 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4120 data = (const char *)req->buf + 3;
4121
4122 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4123 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4124 &lock);
4125
4126 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4127 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4128 END_PROFILE(SMBwrite);
4129 return;
4130 }
4131
4132 /*
4133 * X/Open SMB protocol says that if smb_vwv1 is
4134 * zero then the file size should be extended or
4135 * truncated to the size given in smb_vwv[2-3].
4136 */
4137
4138 if(numtowrite == 0) {
4139 /*
4140 * This is actually an allocate call, and set EOF. JRA.
4141 */
4142 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4143 if (nwritten < 0) {
4144 reply_nterror(req, NT_STATUS_DISK_FULL);
4145 goto strict_unlock;
4146 }
4147 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4148 if (nwritten < 0) {
4149 reply_nterror(req, NT_STATUS_DISK_FULL);
4150 goto strict_unlock;
4151 }
4152 trigger_write_time_update_immediate(fsp);
4153 } else {
4154 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4155 }
4156
4157 status = sync_file(conn, fsp, False);
4158 if (!NT_STATUS_IS_OK(status)) {
4159 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4160 fsp_str_dbg(fsp), nt_errstr(status)));
4161 reply_nterror(req, status);
4162 goto strict_unlock;
4163 }
4164
4165 if(nwritten < 0) {
4166 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4167 goto strict_unlock;
4168 }
4169
4170 if((nwritten == 0) && (numtowrite != 0)) {
4171 reply_nterror(req, NT_STATUS_DISK_FULL);
4172 goto strict_unlock;
4173 }
4174
4175 reply_outbuf(req, 1, 0);
4176
4177 SSVAL(req->outbuf,smb_vwv0,nwritten);
4178
4179 if (nwritten < (ssize_t)numtowrite) {
4180 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4181 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4182 }
4183
4184 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4185
4186strict_unlock:
4187 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4188
4189 END_PROFILE(SMBwrite);
4190 return;
4191}
4192
4193/****************************************************************************
4194 Ensure a buffer is a valid writeX for recvfile purposes.
4195****************************************************************************/
4196
4197#define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4198 (2*14) + /* word count (including bcc) */ \
4199 1 /* pad byte */)
4200
4201bool is_valid_writeX_buffer(const uint8_t *inbuf)
4202{
4203 size_t numtowrite;
4204 connection_struct *conn = NULL;
4205 unsigned int doff = 0;
4206 size_t len = smb_len_large(inbuf);
4207 struct smbd_server_connection *sconn = smbd_server_conn;
4208
4209 if (is_encrypted_packet(inbuf)) {
4210 /* Can't do this on encrypted
4211 * connections. */
4212 return false;
4213 }
4214
4215 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4216 return false;
4217 }
4218
4219 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4220 CVAL(inbuf,smb_wct) != 14) {
4221 DEBUG(10,("is_valid_writeX_buffer: chained or "
4222 "invalid word length.\n"));
4223 return false;
4224 }
4225
4226 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4227 if (conn == NULL) {
4228 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4229 return false;
4230 }
4231 if (IS_IPC(conn)) {
4232 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4233 return false;
4234 }
4235 if (IS_PRINT(conn)) {
4236 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4237 return false;
4238 }
4239 doff = SVAL(inbuf,smb_vwv11);
4240
4241 numtowrite = SVAL(inbuf,smb_vwv10);
4242
4243 if (len > doff && len - doff > 0xFFFF) {
4244 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4245 }
4246
4247 if (numtowrite == 0) {
4248 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4249 return false;
4250 }
4251
4252 /* Ensure the sizes match up. */
4253 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4254 /* no pad byte...old smbclient :-( */
4255 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4256 (unsigned int)doff,
4257 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4258 return false;
4259 }
4260
4261 if (len - doff != numtowrite) {
4262 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4263 "len = %u, doff = %u, numtowrite = %u\n",
4264 (unsigned int)len,
4265 (unsigned int)doff,
4266 (unsigned int)numtowrite ));
4267 return false;
4268 }
4269
4270 DEBUG(10,("is_valid_writeX_buffer: true "
4271 "len = %u, doff = %u, numtowrite = %u\n",
4272 (unsigned int)len,
4273 (unsigned int)doff,
4274 (unsigned int)numtowrite ));
4275
4276 return true;
4277}
4278
4279/****************************************************************************
4280 Reply to a write and X.
4281****************************************************************************/
4282
4283void reply_write_and_X(struct smb_request *req)
4284{
4285 connection_struct *conn = req->conn;
4286 files_struct *fsp;
4287 struct lock_struct lock;
4288 SMB_OFF_T startpos;
4289 size_t numtowrite;
4290 bool write_through;
4291 ssize_t nwritten;
4292 unsigned int smb_doff;
4293 unsigned int smblen;
4294 char *data;
4295 NTSTATUS status;
4296
4297 START_PROFILE(SMBwriteX);
4298
4299 if ((req->wct != 12) && (req->wct != 14)) {
4300 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4301 END_PROFILE(SMBwriteX);
4302 return;
4303 }
4304
4305 numtowrite = SVAL(req->vwv+10, 0);
4306 smb_doff = SVAL(req->vwv+11, 0);
4307 smblen = smb_len(req->inbuf);
4308
4309 if (req->unread_bytes > 0xFFFF ||
4310 (smblen > smb_doff &&
4311 smblen - smb_doff > 0xFFFF)) {
4312 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4313 }
4314
4315 if (req->unread_bytes) {
4316 /* Can't do a recvfile write on IPC$ */
4317 if (IS_IPC(conn)) {
4318 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4319 END_PROFILE(SMBwriteX);
4320 return;
4321 }
4322 if (numtowrite != req->unread_bytes) {
4323 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4324 END_PROFILE(SMBwriteX);
4325 return;
4326 }
4327 } else {
4328 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4329 smb_doff + numtowrite > smblen) {
4330 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4331 END_PROFILE(SMBwriteX);
4332 return;
4333 }
4334 }
4335
4336 /* If it's an IPC, pass off the pipe handler. */
4337 if (IS_IPC(conn)) {
4338 if (req->unread_bytes) {
4339 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4340 END_PROFILE(SMBwriteX);
4341 return;
4342 }
4343 reply_pipe_write_and_X(req);
4344 END_PROFILE(SMBwriteX);
4345 return;
4346 }
4347
4348 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4349 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4350 write_through = BITSETW(req->vwv+7,0);
4351
4352 if (!check_fsp(conn, req, fsp)) {
4353 END_PROFILE(SMBwriteX);
4354 return;
4355 }
4356
4357 if (!CHECK_WRITE(fsp)) {
4358 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4359 END_PROFILE(SMBwriteX);
4360 return;
4361 }
4362
4363 data = smb_base(req->inbuf) + smb_doff;
4364
4365 if(req->wct == 14) {
4366#ifdef LARGE_SMB_OFF_T
4367 /*
4368 * This is a large offset (64 bit) write.
4369 */
4370 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4371
4372#else /* !LARGE_SMB_OFF_T */
4373
4374 /*
4375 * Ensure we haven't been sent a >32 bit offset.
4376 */
4377
4378 if(IVAL(req->vwv+12, 0) != 0) {
4379 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4380 "used and we don't support 64 bit offsets.\n",
4381 (unsigned int)IVAL(req->vwv+12, 0) ));
4382 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4383 END_PROFILE(SMBwriteX);
4384 return;
4385 }
4386
4387#endif /* LARGE_SMB_OFF_T */
4388 }
4389
4390 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4391 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4392 &lock);
4393
4394 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4395 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4396 END_PROFILE(SMBwriteX);
4397 return;
4398 }
4399
4400 /* X/Open SMB protocol says that, unlike SMBwrite
4401 if the length is zero then NO truncation is
4402 done, just a write of zero. To truncate a file,
4403 use SMBwrite. */
4404
4405 if(numtowrite == 0) {
4406 nwritten = 0;
4407 } else {
4408
4409 if ((req->unread_bytes == 0) &&
4410 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4411 numtowrite)) {
4412 goto strict_unlock;
4413 }
4414
4415 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4416 }
4417
4418 if(nwritten < 0) {
4419 reply_nterror(req, map_nt_error_from_unix(errno));
4420 goto strict_unlock;
4421 }
4422
4423 if((nwritten == 0) && (numtowrite != 0)) {
4424 reply_nterror(req, NT_STATUS_DISK_FULL);
4425 goto strict_unlock;
4426 }
4427
4428 reply_outbuf(req, 6, 0);
4429 SSVAL(req->outbuf,smb_vwv2,nwritten);
4430 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4431
4432 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4433 fsp->fnum, (int)numtowrite, (int)nwritten));
4434
4435 status = sync_file(conn, fsp, write_through);
4436 if (!NT_STATUS_IS_OK(status)) {
4437 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4438 fsp_str_dbg(fsp), nt_errstr(status)));
4439 reply_nterror(req, status);
4440 goto strict_unlock;
4441 }
4442
4443 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4444
4445 END_PROFILE(SMBwriteX);
4446 chain_reply(req);
4447 return;
4448
4449strict_unlock:
4450 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4451
4452 END_PROFILE(SMBwriteX);
4453 return;
4454}
4455
4456/****************************************************************************
4457 Reply to a lseek.
4458****************************************************************************/
4459
4460void reply_lseek(struct smb_request *req)
4461{
4462 connection_struct *conn = req->conn;
4463 SMB_OFF_T startpos;
4464 SMB_OFF_T res= -1;
4465 int mode,umode;
4466 files_struct *fsp;
4467
4468 START_PROFILE(SMBlseek);
4469
4470 if (req->wct < 4) {
4471 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4472 END_PROFILE(SMBlseek);
4473 return;
4474 }
4475
4476 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4477
4478 if (!check_fsp(conn, req, fsp)) {
4479 return;
4480 }
4481
4482 flush_write_cache(fsp, SEEK_FLUSH);
4483
4484 mode = SVAL(req->vwv+1, 0) & 3;
4485 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4486 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4487
4488 switch (mode) {
4489 case 0:
4490 umode = SEEK_SET;
4491 res = startpos;
4492 break;
4493 case 1:
4494 umode = SEEK_CUR;
4495 res = fsp->fh->pos + startpos;
4496 break;
4497 case 2:
4498 umode = SEEK_END;
4499 break;
4500 default:
4501 umode = SEEK_SET;
4502 res = startpos;
4503 break;
4504 }
4505
4506 if (umode == SEEK_END) {
4507 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4508 if(errno == EINVAL) {
4509 SMB_OFF_T current_pos = startpos;
4510
4511 if(fsp_stat(fsp) == -1) {
4512 reply_nterror(req,
4513 map_nt_error_from_unix(errno));
4514 END_PROFILE(SMBlseek);
4515 return;
4516 }
4517
4518 current_pos += fsp->fsp_name->st.st_ex_size;
4519 if(current_pos < 0)
4520 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4521 }
4522 }
4523
4524 if(res == -1) {
4525 reply_nterror(req, map_nt_error_from_unix(errno));
4526 END_PROFILE(SMBlseek);
4527 return;
4528 }
4529 }
4530
4531 fsp->fh->pos = res;
4532
4533 reply_outbuf(req, 2, 0);
4534 SIVAL(req->outbuf,smb_vwv0,res);
4535
4536 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4537 fsp->fnum, (double)startpos, (double)res, mode));
4538
4539 END_PROFILE(SMBlseek);
4540 return;
4541}
4542
4543/****************************************************************************
4544 Reply to a flush.
4545****************************************************************************/
4546
4547void reply_flush(struct smb_request *req)
4548{
4549 connection_struct *conn = req->conn;
4550 uint16 fnum;
4551 files_struct *fsp;
4552
4553 START_PROFILE(SMBflush);
4554
4555 if (req->wct < 1) {
4556 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4557 return;
4558 }
4559
4560 fnum = SVAL(req->vwv+0, 0);
4561 fsp = file_fsp(req, fnum);
4562
4563 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4564 return;
4565 }
4566
4567 if (!fsp) {
4568 file_sync_all(conn);
4569 } else {
4570 NTSTATUS status = sync_file(conn, fsp, True);
4571 if (!NT_STATUS_IS_OK(status)) {
4572 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4573 fsp_str_dbg(fsp), nt_errstr(status)));
4574 reply_nterror(req, status);
4575 END_PROFILE(SMBflush);
4576 return;
4577 }
4578 }
4579
4580 reply_outbuf(req, 0, 0);
4581
4582 DEBUG(3,("flush\n"));
4583 END_PROFILE(SMBflush);
4584 return;
4585}
4586
4587/****************************************************************************
4588 Reply to a exit.
4589 conn POINTER CAN BE NULL HERE !
4590****************************************************************************/
4591
4592void reply_exit(struct smb_request *req)
4593{
4594 START_PROFILE(SMBexit);
4595
4596 file_close_pid(req->smbpid, req->vuid);
4597
4598 reply_outbuf(req, 0, 0);
4599
4600 DEBUG(3,("exit\n"));
4601
4602 END_PROFILE(SMBexit);
4603 return;
4604}
4605
4606/****************************************************************************
4607 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4608****************************************************************************/
4609
4610void reply_close(struct smb_request *req)
4611{
4612 connection_struct *conn = req->conn;
4613 NTSTATUS status = NT_STATUS_OK;
4614 files_struct *fsp = NULL;
4615 START_PROFILE(SMBclose);
4616
4617 if (req->wct < 3) {
4618 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4619 END_PROFILE(SMBclose);
4620 return;
4621 }
4622
4623 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4624
4625 /*
4626 * We can only use check_fsp if we know it's not a directory.
4627 */
4628
4629 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4630 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4631 END_PROFILE(SMBclose);
4632 return;
4633 }
4634
4635 if(fsp->is_directory) {
4636 /*
4637 * Special case - close NT SMB directory handle.
4638 */
4639 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4640 status = close_file(req, fsp, NORMAL_CLOSE);
4641 } else {
4642 time_t t;
4643 /*
4644 * Close ordinary file.
4645 */
4646
4647 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4648 fsp->fh->fd, fsp->fnum,
4649 conn->num_files_open));
4650
4651 /*
4652 * Take care of any time sent in the close.
4653 */
4654
4655 t = srv_make_unix_date3(req->vwv+1);
4656 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4657
4658 /*
4659 * close_file() returns the unix errno if an error
4660 * was detected on close - normally this is due to
4661 * a disk full error. If not then it was probably an I/O error.
4662 */
4663
4664 status = close_file(req, fsp, NORMAL_CLOSE);
4665 }
4666
4667 if (!NT_STATUS_IS_OK(status)) {
4668 reply_nterror(req, status);
4669 END_PROFILE(SMBclose);
4670 return;
4671 }
4672
4673 reply_outbuf(req, 0, 0);
4674 END_PROFILE(SMBclose);
4675 return;
4676}
4677
4678/****************************************************************************
4679 Reply to a writeclose (Core+ protocol).
4680****************************************************************************/
4681
4682void reply_writeclose(struct smb_request *req)
4683{
4684 connection_struct *conn = req->conn;
4685 size_t numtowrite;
4686 ssize_t nwritten = -1;
4687 NTSTATUS close_status = NT_STATUS_OK;
4688 SMB_OFF_T startpos;
4689 const char *data;
4690 struct timespec mtime;
4691 files_struct *fsp;
4692 struct lock_struct lock;
4693
4694 START_PROFILE(SMBwriteclose);
4695
4696 if (req->wct < 6) {
4697 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4698 END_PROFILE(SMBwriteclose);
4699 return;
4700 }
4701
4702 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4703
4704 if (!check_fsp(conn, req, fsp)) {
4705 END_PROFILE(SMBwriteclose);
4706 return;
4707 }
4708 if (!CHECK_WRITE(fsp)) {
4709 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4710 END_PROFILE(SMBwriteclose);
4711 return;
4712 }
4713
4714 numtowrite = SVAL(req->vwv+1, 0);
4715 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4716 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4717 data = (const char *)req->buf + 1;
4718
4719 if (numtowrite) {
4720 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4721 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4722 &lock);
4723
4724 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4725 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4726 END_PROFILE(SMBwriteclose);
4727 return;
4728 }
4729 }
4730
4731 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4732
4733 set_close_write_time(fsp, mtime);
4734
4735 /*
4736 * More insanity. W2K only closes the file if writelen > 0.
4737 * JRA.
4738 */
4739
4740 if (numtowrite) {
4741 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4742 "file %s\n", fsp_str_dbg(fsp)));
4743 close_status = close_file(req, fsp, NORMAL_CLOSE);
4744 }
4745
4746 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4747 fsp->fnum, (int)numtowrite, (int)nwritten,
4748 conn->num_files_open));
4749
4750 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4751 reply_nterror(req, NT_STATUS_DISK_FULL);
4752 goto strict_unlock;
4753 }
4754
4755 if(!NT_STATUS_IS_OK(close_status)) {
4756 reply_nterror(req, close_status);
4757 goto strict_unlock;
4758 }
4759
4760 reply_outbuf(req, 1, 0);
4761
4762 SSVAL(req->outbuf,smb_vwv0,nwritten);
4763
4764strict_unlock:
4765 if (numtowrite) {
4766 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4767 }
4768
4769 END_PROFILE(SMBwriteclose);
4770 return;
4771}
4772
4773#undef DBGC_CLASS
4774#define DBGC_CLASS DBGC_LOCKING
4775
4776/****************************************************************************
4777 Reply to a lock.
4778****************************************************************************/
4779
4780void reply_lock(struct smb_request *req)
4781{
4782 connection_struct *conn = req->conn;
4783 uint64_t count,offset;
4784 NTSTATUS status;
4785 files_struct *fsp;
4786 struct byte_range_lock *br_lck = NULL;
4787
4788 START_PROFILE(SMBlock);
4789
4790 if (req->wct < 5) {
4791 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4792 END_PROFILE(SMBlock);
4793 return;
4794 }
4795
4796 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4797
4798 if (!check_fsp(conn, req, fsp)) {
4799 END_PROFILE(SMBlock);
4800 return;
4801 }
4802
4803 count = (uint64_t)IVAL(req->vwv+1, 0);
4804 offset = (uint64_t)IVAL(req->vwv+3, 0);
4805
4806 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4807 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4808
4809 br_lck = do_lock(smbd_messaging_context(),
4810 fsp,
4811 req->smbpid,
4812 count,
4813 offset,
4814 WRITE_LOCK,
4815 WINDOWS_LOCK,
4816 False, /* Non-blocking lock. */
4817 &status,
4818 NULL,
4819 NULL);
4820
4821 TALLOC_FREE(br_lck);
4822
4823 if (NT_STATUS_V(status)) {
4824 reply_nterror(req, status);
4825 END_PROFILE(SMBlock);
4826 return;
4827 }
4828
4829 reply_outbuf(req, 0, 0);
4830
4831 END_PROFILE(SMBlock);
4832 return;
4833}
4834
4835/****************************************************************************
4836 Reply to a unlock.
4837****************************************************************************/
4838
4839void reply_unlock(struct smb_request *req)
4840{
4841 connection_struct *conn = req->conn;
4842 uint64_t count,offset;
4843 NTSTATUS status;
4844 files_struct *fsp;
4845
4846 START_PROFILE(SMBunlock);
4847
4848 if (req->wct < 5) {
4849 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4850 END_PROFILE(SMBunlock);
4851 return;
4852 }
4853
4854 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4855
4856 if (!check_fsp(conn, req, fsp)) {
4857 END_PROFILE(SMBunlock);
4858 return;
4859 }
4860
4861 count = (uint64_t)IVAL(req->vwv+1, 0);
4862 offset = (uint64_t)IVAL(req->vwv+3, 0);
4863
4864 status = do_unlock(smbd_messaging_context(),
4865 fsp,
4866 req->smbpid,
4867 count,
4868 offset,
4869 WINDOWS_LOCK);
4870
4871 if (NT_STATUS_V(status)) {
4872 reply_nterror(req, status);
4873 END_PROFILE(SMBunlock);
4874 return;
4875 }
4876
4877 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4878 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4879
4880 reply_outbuf(req, 0, 0);
4881
4882 END_PROFILE(SMBunlock);
4883 return;
4884}
4885
4886#undef DBGC_CLASS
4887#define DBGC_CLASS DBGC_ALL
4888
4889/****************************************************************************
4890 Reply to a tdis.
4891 conn POINTER CAN BE NULL HERE !
4892****************************************************************************/
4893
4894void reply_tdis(struct smb_request *req)
4895{
4896 connection_struct *conn = req->conn;
4897 START_PROFILE(SMBtdis);
4898
4899 if (!conn) {
4900 DEBUG(4,("Invalid connection in tdis\n"));
4901 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
4902 END_PROFILE(SMBtdis);
4903 return;
4904 }
4905
4906 conn->used = False;
4907
4908 close_cnum(conn,req->vuid);
4909 req->conn = NULL;
4910
4911 reply_outbuf(req, 0, 0);
4912 END_PROFILE(SMBtdis);
4913 return;
4914}
4915
4916/****************************************************************************
4917 Reply to a echo.
4918 conn POINTER CAN BE NULL HERE !
4919****************************************************************************/
4920
4921void reply_echo(struct smb_request *req)
4922{
4923 connection_struct *conn = req->conn;
4924 struct smb_perfcount_data local_pcd;
4925 struct smb_perfcount_data *cur_pcd;
4926 int smb_reverb;
4927 int seq_num;
4928
4929 START_PROFILE(SMBecho);
4930
4931 smb_init_perfcount_data(&local_pcd);
4932
4933 if (req->wct < 1) {
4934 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4935 END_PROFILE(SMBecho);
4936 return;
4937 }
4938
4939 smb_reverb = SVAL(req->vwv+0, 0);
4940
4941 reply_outbuf(req, 1, req->buflen);
4942
4943 /* copy any incoming data back out */
4944 if (req->buflen > 0) {
4945 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4946 }
4947
4948 if (smb_reverb > 100) {
4949 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4950 smb_reverb = 100;
4951 }
4952
4953 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4954
4955 /* this makes sure we catch the request pcd */
4956 if (seq_num == smb_reverb) {
4957 cur_pcd = &req->pcd;
4958 } else {
4959 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4960 cur_pcd = &local_pcd;
4961 }
4962
4963 SSVAL(req->outbuf,smb_vwv0,seq_num);
4964
4965 show_msg((char *)req->outbuf);
4966 if (!srv_send_smb(smbd_server_fd(),
4967 (char *)req->outbuf,
4968 true, req->seqnum+1,
4969 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4970 cur_pcd))
4971 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4972 }
4973
4974 DEBUG(3,("echo %d times\n", smb_reverb));
4975
4976 TALLOC_FREE(req->outbuf);
4977
4978 END_PROFILE(SMBecho);
4979 return;
4980}
4981
4982/****************************************************************************
4983 Reply to a printopen.
4984****************************************************************************/
4985
4986void reply_printopen(struct smb_request *req)
4987{
4988 connection_struct *conn = req->conn;
4989 files_struct *fsp;
4990 NTSTATUS status;
4991
4992 START_PROFILE(SMBsplopen);
4993
4994 if (req->wct < 2) {
4995 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4996 END_PROFILE(SMBsplopen);
4997 return;
4998 }
4999
5000 if (!CAN_PRINT(conn)) {
5001 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5002 END_PROFILE(SMBsplopen);
5003 return;
5004 }
5005
5006 status = file_new(req, conn, &fsp);
5007 if(!NT_STATUS_IS_OK(status)) {
5008 reply_nterror(req, status);
5009 END_PROFILE(SMBsplopen);
5010 return;
5011 }
5012
5013 /* Open for exclusive use, write only. */
5014 status = print_fsp_open(req, conn, NULL, req->vuid, fsp);
5015
5016 if (!NT_STATUS_IS_OK(status)) {
5017 file_free(req, fsp);
5018 reply_nterror(req, status);
5019 END_PROFILE(SMBsplopen);
5020 return;
5021 }
5022
5023 reply_outbuf(req, 1, 0);
5024 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5025
5026 DEBUG(3,("openprint fd=%d fnum=%d\n",
5027 fsp->fh->fd, fsp->fnum));
5028
5029 END_PROFILE(SMBsplopen);
5030 return;
5031}
5032
5033/****************************************************************************
5034 Reply to a printclose.
5035****************************************************************************/
5036
5037void reply_printclose(struct smb_request *req)
5038{
5039 connection_struct *conn = req->conn;
5040 files_struct *fsp;
5041 NTSTATUS status;
5042
5043 START_PROFILE(SMBsplclose);
5044
5045 if (req->wct < 1) {
5046 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5047 END_PROFILE(SMBsplclose);
5048 return;
5049 }
5050
5051 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5052
5053 if (!check_fsp(conn, req, fsp)) {
5054 END_PROFILE(SMBsplclose);
5055 return;
5056 }
5057
5058 if (!CAN_PRINT(conn)) {
5059 reply_force_doserror(req, ERRSRV, ERRerror);
5060 END_PROFILE(SMBsplclose);
5061 return;
5062 }
5063
5064 DEBUG(3,("printclose fd=%d fnum=%d\n",
5065 fsp->fh->fd,fsp->fnum));
5066
5067 status = close_file(req, fsp, NORMAL_CLOSE);
5068
5069 if(!NT_STATUS_IS_OK(status)) {
5070 reply_nterror(req, status);
5071 END_PROFILE(SMBsplclose);
5072 return;
5073 }
5074
5075 reply_outbuf(req, 0, 0);
5076
5077 END_PROFILE(SMBsplclose);
5078 return;
5079}
5080
5081/****************************************************************************
5082 Reply to a printqueue.
5083****************************************************************************/
5084
5085void reply_printqueue(struct smb_request *req)
5086{
5087 connection_struct *conn = req->conn;
5088 int max_count;
5089 int start_index;
5090
5091 START_PROFILE(SMBsplretq);
5092
5093 if (req->wct < 2) {
5094 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5095 END_PROFILE(SMBsplretq);
5096 return;
5097 }
5098
5099 max_count = SVAL(req->vwv+0, 0);
5100 start_index = SVAL(req->vwv+1, 0);
5101
5102 /* we used to allow the client to get the cnum wrong, but that
5103 is really quite gross and only worked when there was only
5104 one printer - I think we should now only accept it if they
5105 get it right (tridge) */
5106 if (!CAN_PRINT(conn)) {
5107 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5108 END_PROFILE(SMBsplretq);
5109 return;
5110 }
5111
5112 reply_outbuf(req, 2, 3);
5113 SSVAL(req->outbuf,smb_vwv0,0);
5114 SSVAL(req->outbuf,smb_vwv1,0);
5115 SCVAL(smb_buf(req->outbuf),0,1);
5116 SSVAL(smb_buf(req->outbuf),1,0);
5117
5118 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5119 start_index, max_count));
5120
5121 {
5122 print_queue_struct *queue = NULL;
5123 print_status_struct status;
5124 int count = print_queue_status(SNUM(conn), &queue, &status);
5125 int num_to_get = ABS(max_count);
5126 int first = (max_count>0?start_index:start_index+max_count+1);
5127 int i;
5128
5129 if (first >= count)
5130 num_to_get = 0;
5131 else
5132 num_to_get = MIN(num_to_get,count-first);
5133
5134
5135 for (i=first;i<first+num_to_get;i++) {
5136 char blob[28];
5137 char *p = blob;
5138
5139 srv_put_dos_date2(p,0,queue[i].time);
5140 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5141 SSVAL(p,5, queue[i].job);
5142 SIVAL(p,7,queue[i].size);
5143 SCVAL(p,11,0);
5144 srvstr_push(blob, req->flags2, p+12,
5145 queue[i].fs_user, 16, STR_ASCII);
5146
5147 if (message_push_blob(
5148 &req->outbuf,
5149 data_blob_const(
5150 blob, sizeof(blob))) == -1) {
5151 reply_nterror(req, NT_STATUS_NO_MEMORY);
5152 END_PROFILE(SMBsplretq);
5153 return;
5154 }
5155 }
5156
5157 if (count > 0) {
5158 SSVAL(req->outbuf,smb_vwv0,count);
5159 SSVAL(req->outbuf,smb_vwv1,
5160 (max_count>0?first+count:first-1));
5161 SCVAL(smb_buf(req->outbuf),0,1);
5162 SSVAL(smb_buf(req->outbuf),1,28*count);
5163 }
5164
5165 SAFE_FREE(queue);
5166
5167 DEBUG(3,("%d entries returned in queue\n",count));
5168 }
5169
5170 END_PROFILE(SMBsplretq);
5171 return;
5172}
5173
5174/****************************************************************************
5175 Reply to a printwrite.
5176****************************************************************************/
5177
5178void reply_printwrite(struct smb_request *req)
5179{
5180 connection_struct *conn = req->conn;
5181 int numtowrite;
5182 const char *data;
5183 files_struct *fsp;
5184
5185 START_PROFILE(SMBsplwr);
5186
5187 if (req->wct < 1) {
5188 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5189 END_PROFILE(SMBsplwr);
5190 return;
5191 }
5192
5193 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5194
5195 if (!check_fsp(conn, req, fsp)) {
5196 END_PROFILE(SMBsplwr);
5197 return;
5198 }
5199
5200 if (!CAN_PRINT(conn)) {
5201 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5202 END_PROFILE(SMBsplwr);
5203 return;
5204 }
5205
5206 if (!CHECK_WRITE(fsp)) {
5207 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5208 END_PROFILE(SMBsplwr);
5209 return;
5210 }
5211
5212 numtowrite = SVAL(req->buf, 1);
5213
5214 if (req->buflen < numtowrite + 3) {
5215 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5216 END_PROFILE(SMBsplwr);
5217 return;
5218 }
5219
5220 data = (const char *)req->buf + 3;
5221
5222 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5223 reply_nterror(req, map_nt_error_from_unix(errno));
5224 END_PROFILE(SMBsplwr);
5225 return;
5226 }
5227
5228 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5229
5230 END_PROFILE(SMBsplwr);
5231 return;
5232}
5233
5234/****************************************************************************
5235 Reply to a mkdir.
5236****************************************************************************/
5237
5238void reply_mkdir(struct smb_request *req)
5239{
5240 connection_struct *conn = req->conn;
5241 struct smb_filename *smb_dname = NULL;
5242 char *directory = NULL;
5243 NTSTATUS status;
5244 TALLOC_CTX *ctx = talloc_tos();
5245
5246 START_PROFILE(SMBmkdir);
5247
5248 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5249 STR_TERMINATE, &status);
5250 if (!NT_STATUS_IS_OK(status)) {
5251 reply_nterror(req, status);
5252 goto out;
5253 }
5254
5255 status = filename_convert(ctx, conn,
5256 req->flags2 & FLAGS2_DFS_PATHNAMES,
5257 directory,
5258 0,
5259 NULL,
5260 &smb_dname);
5261 if (!NT_STATUS_IS_OK(status)) {
5262 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5263 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5264 ERRSRV, ERRbadpath);
5265 goto out;
5266 }
5267 reply_nterror(req, status);
5268 goto out;
5269 }
5270
5271 status = create_directory(conn, req, smb_dname);
5272
5273 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5274
5275 if (!NT_STATUS_IS_OK(status)) {
5276
5277 if (!use_nt_status()
5278 && NT_STATUS_EQUAL(status,
5279 NT_STATUS_OBJECT_NAME_COLLISION)) {
5280 /*
5281 * Yes, in the DOS error code case we get a
5282 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5283 * samba4 torture test.
5284 */
5285 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5286 }
5287
5288 reply_nterror(req, status);
5289 goto out;
5290 }
5291
5292 reply_outbuf(req, 0, 0);
5293
5294 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5295 out:
5296 TALLOC_FREE(smb_dname);
5297 END_PROFILE(SMBmkdir);
5298 return;
5299}
5300
5301/****************************************************************************
5302 Reply to a rmdir.
5303****************************************************************************/
5304
5305void reply_rmdir(struct smb_request *req)
5306{
5307 connection_struct *conn = req->conn;
5308 struct smb_filename *smb_dname = NULL;
5309 char *directory = NULL;
5310 NTSTATUS status;
5311 TALLOC_CTX *ctx = talloc_tos();
5312 files_struct *fsp = NULL;
5313 int info = 0;
5314 struct smbd_server_connection *sconn = smbd_server_conn;
5315
5316 START_PROFILE(SMBrmdir);
5317
5318 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5319 STR_TERMINATE, &status);
5320 if (!NT_STATUS_IS_OK(status)) {
5321 reply_nterror(req, status);
5322 goto out;
5323 }
5324
5325 status = filename_convert(ctx, conn,
5326 req->flags2 & FLAGS2_DFS_PATHNAMES,
5327 directory,
5328 0,
5329 NULL,
5330 &smb_dname);
5331 if (!NT_STATUS_IS_OK(status)) {
5332 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5333 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5334 ERRSRV, ERRbadpath);
5335 goto out;
5336 }
5337 reply_nterror(req, status);
5338 goto out;
5339 }
5340
5341 if (is_ntfs_stream_smb_fname(smb_dname)) {
5342 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5343 goto out;
5344 }
5345
5346 status = SMB_VFS_CREATE_FILE(
5347 conn, /* conn */
5348 req, /* req */
5349 0, /* root_dir_fid */
5350 smb_dname, /* fname */
5351 DELETE_ACCESS, /* access_mask */
5352 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5353 FILE_SHARE_DELETE),
5354 FILE_OPEN, /* create_disposition*/
5355 FILE_DIRECTORY_FILE, /* create_options */
5356 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5357 0, /* oplock_request */
5358 0, /* allocation_size */
5359 NULL, /* sd */
5360 NULL, /* ea_list */
5361 &fsp, /* result */
5362 &info); /* pinfo */
5363
5364 if (!NT_STATUS_IS_OK(status)) {
5365 if (open_was_deferred(req->mid)) {
5366 /* We have re-scheduled this call. */
5367 goto out;
5368 }
5369 reply_nterror(req, status);
5370 goto out;
5371 }
5372
5373 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5374 if (!NT_STATUS_IS_OK(status)) {
5375 close_file(req, fsp, ERROR_CLOSE);
5376 reply_nterror(req, status);
5377 goto out;
5378 }
5379
5380 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5381 close_file(req, fsp, ERROR_CLOSE);
5382 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5383 goto out;
5384 }
5385
5386 status = close_file(req, fsp, NORMAL_CLOSE);
5387 if (!NT_STATUS_IS_OK(status)) {
5388 reply_nterror(req, status);
5389 } else {
5390 reply_outbuf(req, 0, 0);
5391 }
5392
5393 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5394
5395 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5396 out:
5397 TALLOC_FREE(smb_dname);
5398 END_PROFILE(SMBrmdir);
5399 return;
5400}
5401
5402/*******************************************************************
5403 Resolve wildcards in a filename rename.
5404********************************************************************/
5405
5406static bool resolve_wildcards(TALLOC_CTX *ctx,
5407 const char *name1,
5408 const char *name2,
5409 char **pp_newname)
5410{
5411 char *name2_copy = NULL;
5412 char *root1 = NULL;
5413 char *root2 = NULL;
5414 char *ext1 = NULL;
5415 char *ext2 = NULL;
5416 char *p,*p2, *pname1, *pname2;
5417
5418 name2_copy = talloc_strdup(ctx, name2);
5419 if (!name2_copy) {
5420 return False;
5421 }
5422
5423 pname1 = strrchr_m(name1,'/');
5424 pname2 = strrchr_m(name2_copy,'/');
5425
5426 if (!pname1 || !pname2) {
5427 return False;
5428 }
5429
5430 /* Truncate the copy of name2 at the last '/' */
5431 *pname2 = '\0';
5432
5433 /* Now go past the '/' */
5434 pname1++;
5435 pname2++;
5436
5437 root1 = talloc_strdup(ctx, pname1);
5438 root2 = talloc_strdup(ctx, pname2);
5439
5440 if (!root1 || !root2) {
5441 return False;
5442 }
5443
5444 p = strrchr_m(root1,'.');
5445 if (p) {
5446 *p = 0;
5447 ext1 = talloc_strdup(ctx, p+1);
5448 } else {
5449 ext1 = talloc_strdup(ctx, "");
5450 }
5451 p = strrchr_m(root2,'.');
5452 if (p) {
5453 *p = 0;
5454 ext2 = talloc_strdup(ctx, p+1);
5455 } else {
5456 ext2 = talloc_strdup(ctx, "");
5457 }
5458
5459 if (!ext1 || !ext2) {
5460 return False;
5461 }
5462
5463 p = root1;
5464 p2 = root2;
5465 while (*p2) {
5466 if (*p2 == '?') {
5467 /* Hmmm. Should this be mb-aware ? */
5468 *p2 = *p;
5469 p2++;
5470 } else if (*p2 == '*') {
5471 *p2 = '\0';
5472 root2 = talloc_asprintf(ctx, "%s%s",
5473 root2,
5474 p);
5475 if (!root2) {
5476 return False;
5477 }
5478 break;
5479 } else {
5480 p2++;
5481 }
5482 if (*p) {
5483 p++;
5484 }
5485 }
5486
5487 p = ext1;
5488 p2 = ext2;
5489 while (*p2) {
5490 if (*p2 == '?') {
5491 /* Hmmm. Should this be mb-aware ? */
5492 *p2 = *p;
5493 p2++;
5494 } else if (*p2 == '*') {
5495 *p2 = '\0';
5496 ext2 = talloc_asprintf(ctx, "%s%s",
5497 ext2,
5498 p);
5499 if (!ext2) {
5500 return False;
5501 }
5502 break;
5503 } else {
5504 p2++;
5505 }
5506 if (*p) {
5507 p++;
5508 }
5509 }
5510
5511 if (*ext2) {
5512 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5513 name2_copy,
5514 root2,
5515 ext2);
5516 } else {
5517 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5518 name2_copy,
5519 root2);
5520 }
5521
5522 if (!*pp_newname) {
5523 return False;
5524 }
5525
5526 return True;
5527}
5528
5529/****************************************************************************
5530 Ensure open files have their names updated. Updated to notify other smbd's
5531 asynchronously.
5532****************************************************************************/
5533
5534static void rename_open_files(connection_struct *conn,
5535 struct share_mode_lock *lck,
5536 const struct smb_filename *smb_fname_dst)
5537{
5538 files_struct *fsp;
5539 bool did_rename = False;
5540 NTSTATUS status;
5541
5542 for(fsp = file_find_di_first(lck->id); fsp;
5543 fsp = file_find_di_next(fsp)) {
5544 /* fsp_name is a relative path under the fsp. To change this for other
5545 sharepaths we need to manipulate relative paths. */
5546 /* TODO - create the absolute path and manipulate the newname
5547 relative to the sharepath. */
5548 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5549 continue;
5550 }
5551 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5552 "(file_id %s) from %s -> %s\n", fsp->fnum,
5553 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5554 smb_fname_str_dbg(smb_fname_dst)));
5555
5556 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5557 if (NT_STATUS_IS_OK(status)) {
5558 did_rename = True;
5559 }
5560 }
5561
5562 if (!did_rename) {
5563 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5564 "for %s\n", file_id_string_tos(&lck->id),
5565 smb_fname_str_dbg(smb_fname_dst)));
5566 }
5567
5568 /* Send messages to all smbd's (not ourself) that the name has changed. */
5569 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5570 smb_fname_dst);
5571
5572}
5573
5574/****************************************************************************
5575 We need to check if the source path is a parent directory of the destination
5576 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5577 refuse the rename with a sharing violation. Under UNIX the above call can
5578 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5579 probably need to check that the client is a Windows one before disallowing
5580 this as a UNIX client (one with UNIX extensions) can know the source is a
5581 symlink and make this decision intelligently. Found by an excellent bug
5582 report from <AndyLiebman@aol.com>.
5583****************************************************************************/
5584
5585static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5586 const struct smb_filename *smb_fname_dst)
5587{
5588 const char *psrc = smb_fname_src->base_name;
5589 const char *pdst = smb_fname_dst->base_name;
5590 size_t slen;
5591
5592 if (psrc[0] == '.' && psrc[1] == '/') {
5593 psrc += 2;
5594 }
5595 if (pdst[0] == '.' && pdst[1] == '/') {
5596 pdst += 2;
5597 }
5598 if ((slen = strlen(psrc)) > strlen(pdst)) {
5599 return False;
5600 }
5601 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5602}
5603
5604/*
5605 * Do the notify calls from a rename
5606 */
5607
5608static void notify_rename(connection_struct *conn, bool is_dir,
5609 const struct smb_filename *smb_fname_src,
5610 const struct smb_filename *smb_fname_dst)
5611{
5612 char *parent_dir_src = NULL;
5613 char *parent_dir_dst = NULL;
5614 uint32 mask;
5615
5616 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5617 : FILE_NOTIFY_CHANGE_FILE_NAME;
5618
5619 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5620 &parent_dir_src, NULL) ||
5621 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5622 &parent_dir_dst, NULL)) {
5623 goto out;
5624 }
5625
5626 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5627 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5628 smb_fname_src->base_name);
5629 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5630 smb_fname_dst->base_name);
5631 }
5632 else {
5633 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5634 smb_fname_src->base_name);
5635 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5636 smb_fname_dst->base_name);
5637 }
5638
5639 /* this is a strange one. w2k3 gives an additional event for
5640 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5641 files, but not directories */
5642 if (!is_dir) {
5643 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5644 FILE_NOTIFY_CHANGE_ATTRIBUTES
5645 |FILE_NOTIFY_CHANGE_CREATION,
5646 smb_fname_dst->base_name);
5647 }
5648 out:
5649 TALLOC_FREE(parent_dir_src);
5650 TALLOC_FREE(parent_dir_dst);
5651}
5652
5653/****************************************************************************
5654 Rename an open file - given an fsp.
5655****************************************************************************/
5656
5657NTSTATUS rename_internals_fsp(connection_struct *conn,
5658 files_struct *fsp,
5659 const struct smb_filename *smb_fname_dst_in,
5660 uint32 attrs,
5661 bool replace_if_exists)
5662{
5663 TALLOC_CTX *ctx = talloc_tos();
5664 struct smb_filename *smb_fname_dst = NULL;
5665 NTSTATUS status = NT_STATUS_OK;
5666 struct share_mode_lock *lck = NULL;
5667 bool dst_exists, old_is_stream, new_is_stream;
5668
[454]5669/* borrowed from 3.3 source patch by Apple */
5670#ifdef __OS2__
5671 bool check_dest_exist = False;
5672#else
5673 bool check_dest_exist = True;
5674#endif
5675
[429]5676 status = check_name(conn, smb_fname_dst_in->base_name);
5677 if (!NT_STATUS_IS_OK(status)) {
5678 return status;
5679 }
5680
5681 /* Make a copy of the dst smb_fname structs */
5682
5683 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5684 if (!NT_STATUS_IS_OK(status)) {
5685 goto out;
5686 }
5687
5688 /* Ensure the dst smb_fname contains a '/' */
5689 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5690 char * tmp;
5691 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5692 smb_fname_dst->base_name);
5693 if (!tmp) {
5694 status = NT_STATUS_NO_MEMORY;
5695 goto out;
5696 }
5697 TALLOC_FREE(smb_fname_dst->base_name);
5698 smb_fname_dst->base_name = tmp;
5699 }
5700
5701 /*
5702 * Check for special case with case preserving and not
5703 * case sensitive. If the old last component differs from the original
5704 * last component only by case, then we should allow
5705 * the rename (user is trying to change the case of the
5706 * filename).
5707 */
5708 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5709 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5710 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5711 char *last_slash;
5712 char *fname_dst_lcomp_base_mod = NULL;
5713 struct smb_filename *smb_fname_orig_lcomp = NULL;
5714
5715 /*
5716 * Get the last component of the destination name. Note that
5717 * we guarantee that destination name contains a '/' character
5718 * above.
5719 */
5720 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5721 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5722 if (!fname_dst_lcomp_base_mod) {
5723 status = NT_STATUS_NO_MEMORY;
5724 goto out;
5725 }
5726
5727 /*
5728 * Create an smb_filename struct using the original last
5729 * component of the destination.
5730 */
5731 status = create_synthetic_smb_fname_split(ctx,
5732 smb_fname_dst->original_lcomp, NULL,
5733 &smb_fname_orig_lcomp);
5734 if (!NT_STATUS_IS_OK(status)) {
5735 TALLOC_FREE(fname_dst_lcomp_base_mod);
5736 goto out;
5737 }
5738
5739 /* If the base names only differ by case, use original. */
5740 if(!strcsequal(fname_dst_lcomp_base_mod,
5741 smb_fname_orig_lcomp->base_name)) {
5742 char *tmp;
5743 /*
5744 * Replace the modified last component with the
5745 * original.
5746 */
5747 *last_slash = '\0'; /* Truncate at the '/' */
5748 tmp = talloc_asprintf(smb_fname_dst,
5749 "%s/%s",
5750 smb_fname_dst->base_name,
5751 smb_fname_orig_lcomp->base_name);
5752 if (tmp == NULL) {
5753 status = NT_STATUS_NO_MEMORY;
5754 TALLOC_FREE(fname_dst_lcomp_base_mod);
5755 TALLOC_FREE(smb_fname_orig_lcomp);
5756 goto out;
5757 }
5758 TALLOC_FREE(smb_fname_dst->base_name);
5759 smb_fname_dst->base_name = tmp;
5760 }
5761
5762 /* If the stream_names only differ by case, use original. */
5763 if(!strcsequal(smb_fname_dst->stream_name,
5764 smb_fname_orig_lcomp->stream_name)) {
5765 char *tmp = NULL;
5766 /* Use the original stream. */
5767 tmp = talloc_strdup(smb_fname_dst,
5768 smb_fname_orig_lcomp->stream_name);
5769 if (tmp == NULL) {
5770 status = NT_STATUS_NO_MEMORY;
5771 TALLOC_FREE(fname_dst_lcomp_base_mod);
5772 TALLOC_FREE(smb_fname_orig_lcomp);
5773 goto out;
5774 }
5775 TALLOC_FREE(smb_fname_dst->stream_name);
5776 smb_fname_dst->stream_name = tmp;
5777 }
5778 TALLOC_FREE(fname_dst_lcomp_base_mod);
5779 TALLOC_FREE(smb_fname_orig_lcomp);
5780 }
5781
5782 /*
5783 * If the src and dest names are identical - including case,
5784 * don't do the rename, just return success.
5785 */
5786
5787 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5788 strcsequal(fsp->fsp_name->stream_name,
5789 smb_fname_dst->stream_name)) {
5790 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5791 "- returning success\n",
5792 smb_fname_str_dbg(smb_fname_dst)));
5793 status = NT_STATUS_OK;
5794 goto out;
5795 }
5796
5797 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
5798 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5799
5800 /* Return the correct error code if both names aren't streams. */
5801 if (!old_is_stream && new_is_stream) {
5802 status = NT_STATUS_OBJECT_NAME_INVALID;
5803 goto out;
5804 }
5805
5806 if (old_is_stream && !new_is_stream) {
5807 status = NT_STATUS_INVALID_PARAMETER;
5808 goto out;
5809 }
5810
5811 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5812
[454]5813 if(check_dest_exist && !replace_if_exists && dst_exists) {
[429]5814 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5815 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5816 smb_fname_str_dbg(smb_fname_dst)));
5817 status = NT_STATUS_OBJECT_NAME_COLLISION;
5818 goto out;
5819 }
5820
5821 if (dst_exists) {
5822 struct file_id fileid = vfs_file_id_from_sbuf(conn,
5823 &smb_fname_dst->st);
5824 files_struct *dst_fsp = file_find_di_first(fileid);
5825 /* The file can be open when renaming a stream */
5826 if (dst_fsp && !new_is_stream) {
5827 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5828 status = NT_STATUS_ACCESS_DENIED;
5829 goto out;
5830 }
5831 }
5832
5833 /* Ensure we have a valid stat struct for the source. */
5834 status = vfs_stat_fsp(fsp);
5835 if (!NT_STATUS_IS_OK(status)) {
5836 goto out;
5837 }
5838
5839 status = can_rename(conn, fsp, attrs);
5840
5841 if (!NT_STATUS_IS_OK(status)) {
5842 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5843 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5844 smb_fname_str_dbg(smb_fname_dst)));
5845 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5846 status = NT_STATUS_ACCESS_DENIED;
5847 goto out;
5848 }
5849
5850 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
5851 status = NT_STATUS_ACCESS_DENIED;
5852 }
5853
5854 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5855 NULL);
5856
5857 /*
5858 * We have the file open ourselves, so not being able to get the
5859 * corresponding share mode lock is a fatal error.
5860 */
5861
5862 SMB_ASSERT(lck != NULL);
5863
5864 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
5865 uint32 create_options = fsp->fh->private_options;
5866
5867 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
5868 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5869 smb_fname_str_dbg(smb_fname_dst)));
5870
[590]5871 if (!lp_posix_pathnames() &&
5872 (lp_map_archive(SNUM(conn)) ||
5873 lp_store_dos_attributes(SNUM(conn)))) {
[429]5874 /* We must set the archive bit on the newly
5875 renamed file. */
5876 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
5877 uint32_t old_dosmode = dos_mode(conn,
5878 smb_fname_dst);
5879 file_set_dosmode(conn,
5880 smb_fname_dst,
5881 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
5882 NULL,
5883 true);
5884 }
5885 }
5886
5887 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
5888 smb_fname_dst);
5889
5890 rename_open_files(conn, lck, smb_fname_dst);
5891
5892 /*
5893 * A rename acts as a new file create w.r.t. allowing an initial delete
5894 * on close, probably because in Windows there is a new handle to the
5895 * new file. If initial delete on close was requested but not
5896 * originally set, we need to set it here. This is probably not 100% correct,
5897 * but will work for the CIFSFS client which in non-posix mode
5898 * depends on these semantics. JRA.
5899 */
5900
5901 if (create_options & FILE_DELETE_ON_CLOSE) {
5902 status = can_set_delete_on_close(fsp, 0);
5903
5904 if (NT_STATUS_IS_OK(status)) {
5905 /* Note that here we set the *inital* delete on close flag,
5906 * not the regular one. The magic gets handled in close. */
5907 fsp->initial_delete_on_close = True;
5908 }
5909 }
5910 TALLOC_FREE(lck);
5911 status = NT_STATUS_OK;
5912 goto out;
5913 }
5914
5915 TALLOC_FREE(lck);
5916
5917 if (errno == ENOTDIR || errno == EISDIR) {
5918 status = NT_STATUS_OBJECT_NAME_COLLISION;
5919 } else {
5920 status = map_nt_error_from_unix(errno);
5921 }
5922
5923 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5924 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5925 smb_fname_str_dbg(smb_fname_dst)));
5926
5927 out:
5928 TALLOC_FREE(smb_fname_dst);
5929
5930 return status;
5931}
5932
5933/****************************************************************************
5934 The guts of the rename command, split out so it may be called by the NT SMB
5935 code.
5936****************************************************************************/
5937
5938NTSTATUS rename_internals(TALLOC_CTX *ctx,
5939 connection_struct *conn,
5940 struct smb_request *req,
5941 struct smb_filename *smb_fname_src,
5942 struct smb_filename *smb_fname_dst,
5943 uint32 attrs,
5944 bool replace_if_exists,
5945 bool src_has_wild,
5946 bool dest_has_wild,
5947 uint32_t access_mask)
5948{
5949 char *fname_src_dir = NULL;
5950 char *fname_src_mask = NULL;
5951 int count=0;
5952 NTSTATUS status = NT_STATUS_OK;
5953 struct smb_Dir *dir_hnd = NULL;
5954 const char *dname = NULL;
5955 char *talloced = NULL;
5956 long offset = 0;
5957 int create_options = 0;
5958 bool posix_pathnames = lp_posix_pathnames();
5959
5960 /*
5961 * Split the old name into directory and last component
5962 * strings. Note that unix_convert may have stripped off a
5963 * leading ./ from both name and newname if the rename is
5964 * at the root of the share. We need to make sure either both
5965 * name and newname contain a / character or neither of them do
5966 * as this is checked in resolve_wildcards().
5967 */
5968
5969 /* Split up the directory from the filename/mask. */
5970 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
5971 &fname_src_dir, &fname_src_mask);
5972 if (!NT_STATUS_IS_OK(status)) {
5973 status = NT_STATUS_NO_MEMORY;
5974 goto out;
5975 }
5976
5977 /*
5978 * We should only check the mangled cache
5979 * here if unix_convert failed. This means
5980 * that the path in 'mask' doesn't exist
5981 * on the file system and so we need to look
5982 * for a possible mangle. This patch from
5983 * Tine Smukavec <valentin.smukavec@hermes.si>.
5984 */
5985
5986 if (!VALID_STAT(smb_fname_src->st) &&
5987 mangle_is_mangled(fname_src_mask, conn->params)) {
5988 char *new_mask = NULL;
5989 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
5990 conn->params);
5991 if (new_mask) {
5992 TALLOC_FREE(fname_src_mask);
5993 fname_src_mask = new_mask;
5994 }
5995 }
5996
5997 if (!src_has_wild) {
5998 files_struct *fsp;
5999
6000 /*
6001 * Only one file needs to be renamed. Append the mask back
6002 * onto the directory.
6003 */
6004 TALLOC_FREE(smb_fname_src->base_name);
6005 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6006 "%s/%s",
6007 fname_src_dir,
6008 fname_src_mask);
6009 if (!smb_fname_src->base_name) {
6010 status = NT_STATUS_NO_MEMORY;
6011 goto out;
6012 }
6013
6014 /* Ensure dst fname contains a '/' also */
6015 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6016 char *tmp;
6017 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6018 smb_fname_dst->base_name);
6019 if (!tmp) {
6020 status = NT_STATUS_NO_MEMORY;
6021 goto out;
6022 }
6023 TALLOC_FREE(smb_fname_dst->base_name);
6024 smb_fname_dst->base_name = tmp;
6025 }
6026
6027 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6028 "case_preserve = %d, short case preserve = %d, "
6029 "directory = %s, newname = %s, "
6030 "last_component_dest = %s\n",
6031 conn->case_sensitive, conn->case_preserve,
6032 conn->short_case_preserve,
6033 smb_fname_str_dbg(smb_fname_src),
6034 smb_fname_str_dbg(smb_fname_dst),
6035 smb_fname_dst->original_lcomp));
6036
6037 /* The dest name still may have wildcards. */
6038 if (dest_has_wild) {
6039 char *fname_dst_mod = NULL;
6040 if (!resolve_wildcards(smb_fname_dst,
6041 smb_fname_src->base_name,
6042 smb_fname_dst->base_name,
6043 &fname_dst_mod)) {
6044 DEBUG(6, ("rename_internals: resolve_wildcards "
6045 "%s %s failed\n",
6046 smb_fname_src->base_name,
6047 smb_fname_dst->base_name));
6048 status = NT_STATUS_NO_MEMORY;
6049 goto out;
6050 }
6051 TALLOC_FREE(smb_fname_dst->base_name);
6052 smb_fname_dst->base_name = fname_dst_mod;
6053 }
6054
6055 ZERO_STRUCT(smb_fname_src->st);
6056 if (posix_pathnames) {
6057 SMB_VFS_LSTAT(conn, smb_fname_src);
6058 } else {
6059 SMB_VFS_STAT(conn, smb_fname_src);
6060 }
6061
6062 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6063 create_options |= FILE_DIRECTORY_FILE;
6064 }
6065
6066 status = SMB_VFS_CREATE_FILE(
6067 conn, /* conn */
6068 req, /* req */
6069 0, /* root_dir_fid */
6070 smb_fname_src, /* fname */
6071 access_mask, /* access_mask */
6072 (FILE_SHARE_READ | /* share_access */
6073 FILE_SHARE_WRITE),
6074 FILE_OPEN, /* create_disposition*/
6075 create_options, /* create_options */
6076 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6077 0, /* oplock_request */
6078 0, /* allocation_size */
6079 NULL, /* sd */
6080 NULL, /* ea_list */
6081 &fsp, /* result */
6082 NULL); /* pinfo */
6083
6084 if (!NT_STATUS_IS_OK(status)) {
6085 DEBUG(3, ("Could not open rename source %s: %s\n",
6086 smb_fname_str_dbg(smb_fname_src),
6087 nt_errstr(status)));
6088 goto out;
6089 }
6090
6091 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6092 attrs, replace_if_exists);
6093
6094 close_file(req, fsp, NORMAL_CLOSE);
6095
6096 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6097 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6098 smb_fname_str_dbg(smb_fname_dst)));
6099
6100 goto out;
6101 }
6102
6103 /*
6104 * Wildcards - process each file that matches.
6105 */
6106 if (strequal(fname_src_mask, "????????.???")) {
6107 TALLOC_FREE(fname_src_mask);
6108 fname_src_mask = talloc_strdup(ctx, "*");
6109 if (!fname_src_mask) {
6110 status = NT_STATUS_NO_MEMORY;
6111 goto out;
6112 }
6113 }
6114
6115 status = check_name(conn, fname_src_dir);
6116 if (!NT_STATUS_IS_OK(status)) {
6117 goto out;
6118 }
6119
6120 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6121 attrs);
6122 if (dir_hnd == NULL) {
6123 status = map_nt_error_from_unix(errno);
6124 goto out;
6125 }
6126
6127 status = NT_STATUS_NO_SUCH_FILE;
6128 /*
6129 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6130 * - gentest fix. JRA
6131 */
6132
6133 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6134 &talloced))) {
6135 files_struct *fsp = NULL;
6136 char *destname = NULL;
6137 bool sysdir_entry = False;
6138
6139 /* Quick check for "." and ".." */
6140 if (ISDOT(dname) || ISDOTDOT(dname)) {
6141 if (attrs & aDIR) {
6142 sysdir_entry = True;
6143 } else {
6144 TALLOC_FREE(talloced);
6145 continue;
6146 }
6147 }
6148
6149 if (!is_visible_file(conn, fname_src_dir, dname,
6150 &smb_fname_src->st, false)) {
6151 TALLOC_FREE(talloced);
6152 continue;
6153 }
6154
6155 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6156 TALLOC_FREE(talloced);
6157 continue;
6158 }
6159
6160 if (sysdir_entry) {
6161 status = NT_STATUS_OBJECT_NAME_INVALID;
6162 break;
6163 }
6164
6165 TALLOC_FREE(smb_fname_src->base_name);
6166 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6167 "%s/%s",
6168 fname_src_dir,
6169 dname);
6170 if (!smb_fname_src->base_name) {
6171 status = NT_STATUS_NO_MEMORY;
6172 goto out;
6173 }
6174
6175 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6176 smb_fname_dst->base_name,
6177 &destname)) {
6178 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6179 smb_fname_src->base_name, destname));
6180 TALLOC_FREE(talloced);
6181 continue;
6182 }
6183 if (!destname) {
6184 status = NT_STATUS_NO_MEMORY;
6185 goto out;
6186 }
6187
6188 TALLOC_FREE(smb_fname_dst->base_name);
6189 smb_fname_dst->base_name = destname;
6190
6191 ZERO_STRUCT(smb_fname_src->st);
6192 if (posix_pathnames) {
6193 SMB_VFS_LSTAT(conn, smb_fname_src);
6194 } else {
6195 SMB_VFS_STAT(conn, smb_fname_src);
6196 }
6197
6198 create_options = 0;
6199
6200 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6201 create_options |= FILE_DIRECTORY_FILE;
6202 }
6203
6204 status = SMB_VFS_CREATE_FILE(
6205 conn, /* conn */
6206 req, /* req */
6207 0, /* root_dir_fid */
6208 smb_fname_src, /* fname */
6209 access_mask, /* access_mask */
6210 (FILE_SHARE_READ | /* share_access */
6211 FILE_SHARE_WRITE),
6212 FILE_OPEN, /* create_disposition*/
6213 create_options, /* create_options */
6214 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6215 0, /* oplock_request */
6216 0, /* allocation_size */
6217 NULL, /* sd */
6218 NULL, /* ea_list */
6219 &fsp, /* result */
6220 NULL); /* pinfo */
6221
6222 if (!NT_STATUS_IS_OK(status)) {
6223 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6224 "returned %s rename %s -> %s\n",
6225 nt_errstr(status),
6226 smb_fname_str_dbg(smb_fname_src),
6227 smb_fname_str_dbg(smb_fname_dst)));
6228 break;
6229 }
6230
6231 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6232 dname);
6233 if (!smb_fname_dst->original_lcomp) {
6234 status = NT_STATUS_NO_MEMORY;
6235 goto out;
6236 }
6237
6238 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6239 attrs, replace_if_exists);
6240
6241 close_file(req, fsp, NORMAL_CLOSE);
6242
6243 if (!NT_STATUS_IS_OK(status)) {
6244 DEBUG(3, ("rename_internals_fsp returned %s for "
6245 "rename %s -> %s\n", nt_errstr(status),
6246 smb_fname_str_dbg(smb_fname_src),
6247 smb_fname_str_dbg(smb_fname_dst)));
6248 break;
6249 }
6250
6251 count++;
6252
6253 DEBUG(3,("rename_internals: doing rename on %s -> "
6254 "%s\n", smb_fname_str_dbg(smb_fname_src),
6255 smb_fname_str_dbg(smb_fname_src)));
6256 TALLOC_FREE(talloced);
6257 }
6258 TALLOC_FREE(dir_hnd);
6259
6260 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6261 status = map_nt_error_from_unix(errno);
6262 }
6263
6264 out:
6265 TALLOC_FREE(talloced);
6266 TALLOC_FREE(fname_src_dir);
6267 TALLOC_FREE(fname_src_mask);
6268 return status;
6269}
6270
6271/****************************************************************************
6272 Reply to a mv.
6273****************************************************************************/
6274
6275void reply_mv(struct smb_request *req)
6276{
6277 connection_struct *conn = req->conn;
6278 char *name = NULL;
6279 char *newname = NULL;
6280 const char *p;
6281 uint32 attrs;
6282 NTSTATUS status;
6283 bool src_has_wcard = False;
6284 bool dest_has_wcard = False;
6285 TALLOC_CTX *ctx = talloc_tos();
6286 struct smb_filename *smb_fname_src = NULL;
6287 struct smb_filename *smb_fname_dst = NULL;
[733]6288 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6289 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
[429]6290
6291 START_PROFILE(SMBmv);
6292
6293 if (req->wct < 1) {
6294 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6295 goto out;
6296 }
6297
6298 attrs = SVAL(req->vwv+0, 0);
6299
6300 p = (const char *)req->buf + 1;
6301 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6302 &status, &src_has_wcard);
6303 if (!NT_STATUS_IS_OK(status)) {
6304 reply_nterror(req, status);
6305 goto out;
6306 }
6307 p++;
6308 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6309 &status, &dest_has_wcard);
6310 if (!NT_STATUS_IS_OK(status)) {
6311 reply_nterror(req, status);
6312 goto out;
6313 }
6314
6315 status = filename_convert(ctx,
6316 conn,
6317 req->flags2 & FLAGS2_DFS_PATHNAMES,
6318 name,
[733]6319 src_ucf_flags,
[429]6320 &src_has_wcard,
6321 &smb_fname_src);
6322
6323 if (!NT_STATUS_IS_OK(status)) {
6324 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6325 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6326 ERRSRV, ERRbadpath);
6327 goto out;
6328 }
6329 reply_nterror(req, status);
6330 goto out;
6331 }
6332
6333 status = filename_convert(ctx,
6334 conn,
6335 req->flags2 & FLAGS2_DFS_PATHNAMES,
6336 newname,
[733]6337 dst_ucf_flags,
[429]6338 &dest_has_wcard,
6339 &smb_fname_dst);
6340
6341 if (!NT_STATUS_IS_OK(status)) {
6342 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6343 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6344 ERRSRV, ERRbadpath);
6345 goto out;
6346 }
6347 reply_nterror(req, status);
6348 goto out;
6349 }
6350
6351 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6352 smb_fname_str_dbg(smb_fname_dst)));
6353
6354 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6355 attrs, False, src_has_wcard, dest_has_wcard,
6356 DELETE_ACCESS);
6357 if (!NT_STATUS_IS_OK(status)) {
6358 if (open_was_deferred(req->mid)) {
6359 /* We have re-scheduled this call. */
6360 goto out;
6361 }
6362 reply_nterror(req, status);
6363 goto out;
6364 }
6365
6366 reply_outbuf(req, 0, 0);
6367 out:
6368 TALLOC_FREE(smb_fname_src);
6369 TALLOC_FREE(smb_fname_dst);
6370 END_PROFILE(SMBmv);
6371 return;
6372}
6373
6374/*******************************************************************
6375 Copy a file as part of a reply_copy.
6376******************************************************************/
6377
6378/*
6379 * TODO: check error codes on all callers
6380 */
6381
6382NTSTATUS copy_file(TALLOC_CTX *ctx,
6383 connection_struct *conn,
6384 struct smb_filename *smb_fname_src,
6385 struct smb_filename *smb_fname_dst,
6386 int ofun,
6387 int count,
6388 bool target_is_directory)
6389{
6390 struct smb_filename *smb_fname_dst_tmp = NULL;
6391 SMB_OFF_T ret=-1;
6392 files_struct *fsp1,*fsp2;
6393 uint32 dosattrs;
6394 uint32 new_create_disposition;
6395 NTSTATUS status;
6396
6397
6398 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6399 if (!NT_STATUS_IS_OK(status)) {
6400 return status;
6401 }
6402
6403 /*
6404 * If the target is a directory, extract the last component from the
6405 * src filename and append it to the dst filename
6406 */
6407 if (target_is_directory) {
6408 const char *p;
6409
6410 /* dest/target can't be a stream if it's a directory. */
6411 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6412
6413 p = strrchr_m(smb_fname_src->base_name,'/');
6414 if (p) {
6415 p++;
6416 } else {
6417 p = smb_fname_src->base_name;
6418 }
6419 smb_fname_dst_tmp->base_name =
6420 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6421 p);
6422 if (!smb_fname_dst_tmp->base_name) {
6423 status = NT_STATUS_NO_MEMORY;
6424 goto out;
6425 }
6426 }
6427
6428 status = vfs_file_exist(conn, smb_fname_src);
6429 if (!NT_STATUS_IS_OK(status)) {
6430 goto out;
6431 }
6432
6433 if (!target_is_directory && count) {
6434 new_create_disposition = FILE_OPEN;
6435 } else {
[732]6436 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6437 0, ofun,
[429]6438 NULL, NULL,
6439 &new_create_disposition,
6440 NULL)) {
6441 status = NT_STATUS_INVALID_PARAMETER;
6442 goto out;
6443 }
6444 }
6445
6446 /* Open the src file for reading. */
6447 status = SMB_VFS_CREATE_FILE(
6448 conn, /* conn */
6449 NULL, /* req */
6450 0, /* root_dir_fid */
6451 smb_fname_src, /* fname */
6452 FILE_GENERIC_READ, /* access_mask */
6453 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6454 FILE_OPEN, /* create_disposition*/
6455 0, /* create_options */
6456 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6457 INTERNAL_OPEN_ONLY, /* oplock_request */
6458 0, /* allocation_size */
6459 NULL, /* sd */
6460 NULL, /* ea_list */
6461 &fsp1, /* result */
6462 NULL); /* psbuf */
6463
6464 if (!NT_STATUS_IS_OK(status)) {
6465 goto out;
6466 }
6467
6468 dosattrs = dos_mode(conn, smb_fname_src);
6469
6470 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6471 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6472 }
6473
6474 /* Open the dst file for writing. */
6475 status = SMB_VFS_CREATE_FILE(
6476 conn, /* conn */
6477 NULL, /* req */
6478 0, /* root_dir_fid */
6479 smb_fname_dst, /* fname */
6480 FILE_GENERIC_WRITE, /* access_mask */
6481 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6482 new_create_disposition, /* create_disposition*/
6483 0, /* create_options */
6484 dosattrs, /* file_attributes */
6485 INTERNAL_OPEN_ONLY, /* oplock_request */
6486 0, /* allocation_size */
6487 NULL, /* sd */
6488 NULL, /* ea_list */
6489 &fsp2, /* result */
6490 NULL); /* psbuf */
6491
6492 if (!NT_STATUS_IS_OK(status)) {
6493 close_file(NULL, fsp1, ERROR_CLOSE);
6494 goto out;
6495 }
6496
6497 if ((ofun&3) == 1) {
6498 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6499 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6500 /*
6501 * Stop the copy from occurring.
6502 */
6503 ret = -1;
6504 smb_fname_src->st.st_ex_size = 0;
6505 }
6506 }
6507
6508 /* Do the actual copy. */
6509 if (smb_fname_src->st.st_ex_size) {
6510 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6511 }
6512
6513 close_file(NULL, fsp1, NORMAL_CLOSE);
6514
6515 /* Ensure the modtime is set correctly on the destination file. */
6516 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6517
6518 /*
6519 * As we are opening fsp1 read-only we only expect
6520 * an error on close on fsp2 if we are out of space.
6521 * Thus we don't look at the error return from the
6522 * close of fsp1.
6523 */
6524 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6525
6526 if (!NT_STATUS_IS_OK(status)) {
6527 goto out;
6528 }
6529
6530 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6531 status = NT_STATUS_DISK_FULL;
6532 goto out;
6533 }
6534
6535 status = NT_STATUS_OK;
6536
6537 out:
6538 TALLOC_FREE(smb_fname_dst_tmp);
6539 return status;
6540}
6541
6542/****************************************************************************
6543 Reply to a file copy.
6544****************************************************************************/
6545
6546void reply_copy(struct smb_request *req)
6547{
6548 connection_struct *conn = req->conn;
6549 struct smb_filename *smb_fname_src = NULL;
6550 struct smb_filename *smb_fname_dst = NULL;
6551 char *fname_src = NULL;
6552 char *fname_dst = NULL;
6553 char *fname_src_mask = NULL;
6554 char *fname_src_dir = NULL;
6555 const char *p;
6556 int count=0;
6557 int error = ERRnoaccess;
6558 int tid2;
6559 int ofun;
6560 int flags;
6561 bool target_is_directory=False;
6562 bool source_has_wild = False;
6563 bool dest_has_wild = False;
6564 NTSTATUS status;
6565 TALLOC_CTX *ctx = talloc_tos();
6566
6567 START_PROFILE(SMBcopy);
6568
6569 if (req->wct < 3) {
6570 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6571 goto out;
6572 }
6573
6574 tid2 = SVAL(req->vwv+0, 0);
6575 ofun = SVAL(req->vwv+1, 0);
6576 flags = SVAL(req->vwv+2, 0);
6577
6578 p = (const char *)req->buf;
6579 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6580 &status, &source_has_wild);
6581 if (!NT_STATUS_IS_OK(status)) {
6582 reply_nterror(req, status);
6583 goto out;
6584 }
6585 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6586 &status, &dest_has_wild);
6587 if (!NT_STATUS_IS_OK(status)) {
6588 reply_nterror(req, status);
6589 goto out;
6590 }
6591
6592 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6593
6594 if (tid2 != conn->cnum) {
6595 /* can't currently handle inter share copies XXXX */
6596 DEBUG(3,("Rejecting inter-share copy\n"));
6597 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6598 goto out;
6599 }
6600
6601 status = filename_convert(ctx, conn,
6602 req->flags2 & FLAGS2_DFS_PATHNAMES,
6603 fname_src,
6604 UCF_COND_ALLOW_WCARD_LCOMP,
6605 &source_has_wild,
6606 &smb_fname_src);
6607 if (!NT_STATUS_IS_OK(status)) {
6608 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6609 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6610 ERRSRV, ERRbadpath);
6611 goto out;
6612 }
6613 reply_nterror(req, status);
6614 goto out;
6615 }
6616
6617 status = filename_convert(ctx, conn,
6618 req->flags2 & FLAGS2_DFS_PATHNAMES,
6619 fname_dst,
6620 UCF_COND_ALLOW_WCARD_LCOMP,
6621 &dest_has_wild,
6622 &smb_fname_dst);
6623 if (!NT_STATUS_IS_OK(status)) {
6624 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6625 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6626 ERRSRV, ERRbadpath);
6627 goto out;
6628 }
6629 reply_nterror(req, status);
6630 goto out;
6631 }
6632
6633 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6634
6635 if ((flags&1) && target_is_directory) {
6636 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6637 goto out;
6638 }
6639
6640 if ((flags&2) && !target_is_directory) {
6641 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6642 goto out;
6643 }
6644
6645 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6646 /* wants a tree copy! XXXX */
6647 DEBUG(3,("Rejecting tree copy\n"));
6648 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6649 goto out;
6650 }
6651
6652 /* Split up the directory from the filename/mask. */
6653 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6654 &fname_src_dir, &fname_src_mask);
6655 if (!NT_STATUS_IS_OK(status)) {
6656 reply_nterror(req, NT_STATUS_NO_MEMORY);
6657 goto out;
6658 }
6659
6660 /*
6661 * We should only check the mangled cache
6662 * here if unix_convert failed. This means
6663 * that the path in 'mask' doesn't exist
6664 * on the file system and so we need to look
6665 * for a possible mangle. This patch from
6666 * Tine Smukavec <valentin.smukavec@hermes.si>.
6667 */
6668 if (!VALID_STAT(smb_fname_src->st) &&
6669 mangle_is_mangled(fname_src_mask, conn->params)) {
6670 char *new_mask = NULL;
6671 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6672 &new_mask, conn->params);
6673
6674 /* Use demangled name if one was successfully found. */
6675 if (new_mask) {
6676 TALLOC_FREE(fname_src_mask);
6677 fname_src_mask = new_mask;
6678 }
6679 }
6680
6681 if (!source_has_wild) {
6682
6683 /*
6684 * Only one file needs to be copied. Append the mask back onto
6685 * the directory.
6686 */
6687 TALLOC_FREE(smb_fname_src->base_name);
6688 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6689 "%s/%s",
6690 fname_src_dir,
6691 fname_src_mask);
6692 if (!smb_fname_src->base_name) {
6693 reply_nterror(req, NT_STATUS_NO_MEMORY);
6694 goto out;
6695 }
6696
6697 if (dest_has_wild) {
6698 char *fname_dst_mod = NULL;
6699 if (!resolve_wildcards(smb_fname_dst,
6700 smb_fname_src->base_name,
6701 smb_fname_dst->base_name,
6702 &fname_dst_mod)) {
6703 reply_nterror(req, NT_STATUS_NO_MEMORY);
6704 goto out;
6705 }
6706 TALLOC_FREE(smb_fname_dst->base_name);
6707 smb_fname_dst->base_name = fname_dst_mod;
6708 }
6709
6710 status = check_name(conn, smb_fname_src->base_name);
6711 if (!NT_STATUS_IS_OK(status)) {
6712 reply_nterror(req, status);
6713 goto out;
6714 }
6715
6716 status = check_name(conn, smb_fname_dst->base_name);
6717 if (!NT_STATUS_IS_OK(status)) {
6718 reply_nterror(req, status);
6719 goto out;
6720 }
6721
6722 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6723 ofun, count, target_is_directory);
6724
6725 if(!NT_STATUS_IS_OK(status)) {
6726 reply_nterror(req, status);
6727 goto out;
6728 } else {
6729 count++;
6730 }
6731 } else {
6732 struct smb_Dir *dir_hnd = NULL;
6733 const char *dname = NULL;
6734 char *talloced = NULL;
6735 long offset = 0;
6736
6737 /*
6738 * There is a wildcard that requires us to actually read the
6739 * src dir and copy each file matching the mask to the dst.
6740 * Right now streams won't be copied, but this could
6741 * presumably be added with a nested loop for reach dir entry.
6742 */
6743 SMB_ASSERT(!smb_fname_src->stream_name);
6744 SMB_ASSERT(!smb_fname_dst->stream_name);
6745
6746 smb_fname_src->stream_name = NULL;
6747 smb_fname_dst->stream_name = NULL;
6748
6749 if (strequal(fname_src_mask,"????????.???")) {
6750 TALLOC_FREE(fname_src_mask);
6751 fname_src_mask = talloc_strdup(ctx, "*");
6752 if (!fname_src_mask) {
6753 reply_nterror(req, NT_STATUS_NO_MEMORY);
6754 goto out;
6755 }
6756 }
6757
6758 status = check_name(conn, fname_src_dir);
6759 if (!NT_STATUS_IS_OK(status)) {
6760 reply_nterror(req, status);
6761 goto out;
6762 }
6763
6764 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6765 if (dir_hnd == NULL) {
6766 status = map_nt_error_from_unix(errno);
6767 reply_nterror(req, status);
6768 goto out;
6769 }
6770
6771 error = ERRbadfile;
6772
6773 /* Iterate over the src dir copying each entry to the dst. */
6774 while ((dname = ReadDirName(dir_hnd, &offset,
6775 &smb_fname_src->st, &talloced))) {
6776 char *destname = NULL;
6777
6778 if (ISDOT(dname) || ISDOTDOT(dname)) {
6779 TALLOC_FREE(talloced);
6780 continue;
6781 }
6782
6783 if (!is_visible_file(conn, fname_src_dir, dname,
6784 &smb_fname_src->st, false)) {
6785 TALLOC_FREE(talloced);
6786 continue;
6787 }
6788
6789 if(!mask_match(dname, fname_src_mask,
6790 conn->case_sensitive)) {
6791 TALLOC_FREE(talloced);
6792 continue;
6793 }
6794
6795 error = ERRnoaccess;
6796
6797 /* Get the src smb_fname struct setup. */
6798 TALLOC_FREE(smb_fname_src->base_name);
6799 smb_fname_src->base_name =
6800 talloc_asprintf(smb_fname_src, "%s/%s",
6801 fname_src_dir, dname);
6802
6803 if (!smb_fname_src->base_name) {
6804 TALLOC_FREE(dir_hnd);
6805 TALLOC_FREE(talloced);
6806 reply_nterror(req, NT_STATUS_NO_MEMORY);
6807 goto out;
6808 }
6809
6810 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6811 smb_fname_dst->base_name,
6812 &destname)) {
6813 TALLOC_FREE(talloced);
6814 continue;
6815 }
6816 if (!destname) {
6817 TALLOC_FREE(dir_hnd);
6818 TALLOC_FREE(talloced);
6819 reply_nterror(req, NT_STATUS_NO_MEMORY);
6820 goto out;
6821 }
6822
6823 TALLOC_FREE(smb_fname_dst->base_name);
6824 smb_fname_dst->base_name = destname;
6825
6826 status = check_name(conn, smb_fname_src->base_name);
6827 if (!NT_STATUS_IS_OK(status)) {
6828 TALLOC_FREE(dir_hnd);
6829 TALLOC_FREE(talloced);
6830 reply_nterror(req, status);
6831 goto out;
6832 }
6833
6834 status = check_name(conn, smb_fname_dst->base_name);
6835 if (!NT_STATUS_IS_OK(status)) {
6836 TALLOC_FREE(dir_hnd);
6837 TALLOC_FREE(talloced);
6838 reply_nterror(req, status);
6839 goto out;
6840 }
6841
6842 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
6843 smb_fname_src->base_name,
6844 smb_fname_dst->base_name));
6845
6846 status = copy_file(ctx, conn, smb_fname_src,
6847 smb_fname_dst, ofun, count,
6848 target_is_directory);
6849 if (NT_STATUS_IS_OK(status)) {
6850 count++;
6851 }
6852
6853 TALLOC_FREE(talloced);
6854 }
6855 TALLOC_FREE(dir_hnd);
6856 }
6857
6858 if (count == 0) {
6859 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
6860 goto out;
6861 }
6862
6863 reply_outbuf(req, 1, 0);
6864 SSVAL(req->outbuf,smb_vwv0,count);
6865 out:
6866 TALLOC_FREE(smb_fname_src);
6867 TALLOC_FREE(smb_fname_dst);
6868 TALLOC_FREE(fname_src);
6869 TALLOC_FREE(fname_dst);
6870 TALLOC_FREE(fname_src_mask);
6871 TALLOC_FREE(fname_src_dir);
6872
6873 END_PROFILE(SMBcopy);
6874 return;
6875}
6876
6877#undef DBGC_CLASS
6878#define DBGC_CLASS DBGC_LOCKING
6879
6880/****************************************************************************
6881 Get a lock pid, dealing with large count requests.
6882****************************************************************************/
6883
6884uint32 get_lock_pid(const uint8_t *data, int data_offset,
6885 bool large_file_format)
6886{
6887 if(!large_file_format)
6888 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6889 else
6890 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6891}
6892
6893/****************************************************************************
6894 Get a lock count, dealing with large count requests.
6895****************************************************************************/
6896
6897uint64_t get_lock_count(const uint8_t *data, int data_offset,
6898 bool large_file_format)
6899{
6900 uint64_t count = 0;
6901
6902 if(!large_file_format) {
6903 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6904 } else {
6905
6906#if defined(HAVE_LONGLONG)
6907 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6908 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6909#else /* HAVE_LONGLONG */
6910
6911 /*
6912 * NT4.x seems to be broken in that it sends large file (64 bit)
6913 * lockingX calls even if the CAP_LARGE_FILES was *not*
6914 * negotiated. For boxes without large unsigned ints truncate the
6915 * lock count by dropping the top 32 bits.
6916 */
6917
6918 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6919 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6920 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6921 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6922 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6923 }
6924
6925 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6926#endif /* HAVE_LONGLONG */
6927 }
6928
6929 return count;
6930}
6931
6932#if !defined(HAVE_LONGLONG)
6933/****************************************************************************
6934 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6935****************************************************************************/
6936
6937static uint32 map_lock_offset(uint32 high, uint32 low)
6938{
6939 unsigned int i;
6940 uint32 mask = 0;
6941 uint32 highcopy = high;
6942
6943 /*
6944 * Try and find out how many significant bits there are in high.
6945 */
6946
6947 for(i = 0; highcopy; i++)
6948 highcopy >>= 1;
6949
6950 /*
6951 * We use 31 bits not 32 here as POSIX
6952 * lock offsets may not be negative.
6953 */
6954
6955 mask = (~0) << (31 - i);
6956
6957 if(low & mask)
6958 return 0; /* Fail. */
6959
6960 high <<= (31 - i);
6961
6962 return (high|low);
6963}
6964#endif /* !defined(HAVE_LONGLONG) */
6965
6966/****************************************************************************
6967 Get a lock offset, dealing with large offset requests.
6968****************************************************************************/
6969
6970uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6971 bool large_file_format, bool *err)
6972{
6973 uint64_t offset = 0;
6974
6975 *err = False;
6976
6977 if(!large_file_format) {
6978 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6979 } else {
6980
6981#if defined(HAVE_LONGLONG)
6982 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6983 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6984#else /* HAVE_LONGLONG */
6985
6986 /*
6987 * NT4.x seems to be broken in that it sends large file (64 bit)
6988 * lockingX calls even if the CAP_LARGE_FILES was *not*
6989 * negotiated. For boxes without large unsigned ints mangle the
6990 * lock offset by mapping the top 32 bits onto the lower 32.
6991 */
6992
6993 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6994 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6995 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6996 uint32 new_low = 0;
6997
6998 if((new_low = map_lock_offset(high, low)) == 0) {
6999 *err = True;
7000 return (uint64_t)-1;
7001 }
7002
7003 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7004 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7005 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7006 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7007 }
7008
7009 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7010#endif /* HAVE_LONGLONG */
7011 }
7012
7013 return offset;
7014}
7015
7016NTSTATUS smbd_do_locking(struct smb_request *req,
7017 files_struct *fsp,
7018 uint8_t type,
7019 int32_t timeout,
7020 uint16_t num_ulocks,
7021 struct smbd_lock_element *ulocks,
7022 uint16_t num_locks,
7023 struct smbd_lock_element *locks,
7024 bool *async)
7025{
7026 connection_struct *conn = req->conn;
7027 int i;
7028 NTSTATUS status = NT_STATUS_OK;
7029
7030 *async = false;
7031
7032 /* Data now points at the beginning of the list
7033 of smb_unlkrng structs */
7034 for(i = 0; i < (int)num_ulocks; i++) {
7035 struct smbd_lock_element *e = &ulocks[i];
7036
7037 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7038 "pid %u, file %s\n",
7039 (double)e->offset,
7040 (double)e->count,
7041 (unsigned int)e->smbpid,
7042 fsp_str_dbg(fsp)));
7043
7044 if (e->brltype != UNLOCK_LOCK) {
7045 /* this can only happen with SMB2 */
7046 return NT_STATUS_INVALID_PARAMETER;
7047 }
7048
7049 status = do_unlock(smbd_messaging_context(),
7050 fsp,
7051 e->smbpid,
7052 e->count,
7053 e->offset,
7054 WINDOWS_LOCK);
7055
7056 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7057 nt_errstr(status)));
7058
7059 if (!NT_STATUS_IS_OK(status)) {
7060 return status;
7061 }
7062 }
7063
7064 /* Setup the timeout in seconds. */
7065
7066 if (!lp_blocking_locks(SNUM(conn))) {
7067 timeout = 0;
7068 }
7069
7070 /* Data now points at the beginning of the list
7071 of smb_lkrng structs */
7072
7073 for(i = 0; i < (int)num_locks; i++) {
7074 struct smbd_lock_element *e = &locks[i];
7075
7076 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7077 "%u, file %s timeout = %d\n",
7078 (double)e->offset,
7079 (double)e->count,
7080 (unsigned int)e->smbpid,
7081 fsp_str_dbg(fsp),
7082 (int)timeout));
7083
7084 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7085 struct blocking_lock_record *blr = NULL;
7086
7087 if (num_locks > 1) {
7088 /*
7089 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7090 * if the lock vector contains one entry. When given mutliple cancel
7091 * requests in a single PDU we expect the server to return an
7092 * error. Windows servers seem to accept the request but only
7093 * cancel the first lock.
7094 * JRA - Do what Windows does (tm) :-).
7095 */
7096
7097#if 0
7098 /* MS-CIFS (2.2.4.32.1) behavior. */
7099 return NT_STATUS_DOS(ERRDOS,
7100 ERRcancelviolation);
7101#else
7102 /* Windows behavior. */
7103 if (i != 0) {
7104 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7105 "cancel request\n"));
7106 continue;
7107 }
7108#endif
7109 }
7110
7111 if (lp_blocking_locks(SNUM(conn))) {
7112
7113 /* Schedule a message to ourselves to
7114 remove the blocking lock record and
7115 return the right error. */
7116
7117 blr = blocking_lock_cancel(fsp,
7118 e->smbpid,
7119 e->offset,
7120 e->count,
7121 WINDOWS_LOCK,
7122 type,
7123 NT_STATUS_FILE_LOCK_CONFLICT);
7124 if (blr == NULL) {
7125 return NT_STATUS_DOS(
7126 ERRDOS,
7127 ERRcancelviolation);
7128 }
7129 }
7130 /* Remove a matching pending lock. */
7131 status = do_lock_cancel(fsp,
7132 e->smbpid,
7133 e->count,
7134 e->offset,
7135 WINDOWS_LOCK,
7136 blr);
7137 } else {
7138 bool blocking_lock = timeout ? true : false;
7139 bool defer_lock = false;
7140 struct byte_range_lock *br_lck;
7141 uint32_t block_smbpid;
7142
7143 br_lck = do_lock(smbd_messaging_context(),
7144 fsp,
7145 e->smbpid,
7146 e->count,
7147 e->offset,
7148 e->brltype,
7149 WINDOWS_LOCK,
7150 blocking_lock,
7151 &status,
7152 &block_smbpid,
7153 NULL);
7154
7155 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7156 /* Windows internal resolution for blocking locks seems
7157 to be about 200ms... Don't wait for less than that. JRA. */
7158 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7159 timeout = lp_lock_spin_time();
7160 }
7161 defer_lock = true;
7162 }
7163
7164 /* If a lock sent with timeout of zero would fail, and
7165 * this lock has been requested multiple times,
7166 * according to brl_lock_failed() we convert this
7167 * request to a blocking lock with a timeout of between
7168 * 150 - 300 milliseconds.
7169 *
7170 * If lp_lock_spin_time() has been set to 0, we skip
7171 * this blocking retry and fail immediately.
7172 *
7173 * Replacement for do_lock_spin(). JRA. */
7174
7175 if (br_lck && lp_blocking_locks(SNUM(conn)) &&
7176 lp_lock_spin_time() && !blocking_lock &&
7177 NT_STATUS_EQUAL((status),
7178 NT_STATUS_FILE_LOCK_CONFLICT))
7179 {
7180 defer_lock = true;
7181 timeout = lp_lock_spin_time();
7182 }
7183
7184 if (br_lck && defer_lock) {
7185 /*
7186 * A blocking lock was requested. Package up
7187 * this smb into a queued request and push it
7188 * onto the blocking lock queue.
7189 */
7190 if(push_blocking_lock_request(br_lck,
7191 req,
7192 fsp,
7193 timeout,
7194 i,
7195 e->smbpid,
7196 e->brltype,
7197 WINDOWS_LOCK,
7198 e->offset,
7199 e->count,
7200 block_smbpid)) {
7201 TALLOC_FREE(br_lck);
7202 *async = true;
7203 return NT_STATUS_OK;
7204 }
7205 }
7206
7207 TALLOC_FREE(br_lck);
7208 }
7209
7210 if (!NT_STATUS_IS_OK(status)) {
7211 break;
7212 }
7213 }
7214
7215 /* If any of the above locks failed, then we must unlock
7216 all of the previous locks (X/Open spec). */
7217
7218 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7219
7220 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7221 i = -1; /* we want to skip the for loop */
7222 }
7223
7224 /*
7225 * Ensure we don't do a remove on the lock that just failed,
7226 * as under POSIX rules, if we have a lock already there, we
7227 * will delete it (and we shouldn't) .....
7228 */
7229 for(i--; i >= 0; i--) {
7230 struct smbd_lock_element *e = &locks[i];
7231
7232 do_unlock(smbd_messaging_context(),
7233 fsp,
7234 e->smbpid,
7235 e->count,
7236 e->offset,
7237 WINDOWS_LOCK);
7238 }
7239 return status;
7240 }
7241
7242 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7243 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7244
7245 return NT_STATUS_OK;
7246}
7247
7248/****************************************************************************
7249 Reply to a lockingX request.
7250****************************************************************************/
7251
7252void reply_lockingX(struct smb_request *req)
7253{
7254 connection_struct *conn = req->conn;
7255 files_struct *fsp;
7256 unsigned char locktype;
7257 unsigned char oplocklevel;
7258 uint16 num_ulocks;
7259 uint16 num_locks;
7260 int32 lock_timeout;
7261 int i;
7262 const uint8_t *data;
7263 bool large_file_format;
7264 bool err;
7265 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7266 struct smbd_lock_element *ulocks;
7267 struct smbd_lock_element *locks;
7268 bool async = false;
7269
7270 START_PROFILE(SMBlockingX);
7271
7272 if (req->wct < 8) {
7273 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7274 END_PROFILE(SMBlockingX);
7275 return;
7276 }
7277
7278 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7279 locktype = CVAL(req->vwv+3, 0);
7280 oplocklevel = CVAL(req->vwv+3, 1);
7281 num_ulocks = SVAL(req->vwv+6, 0);
7282 num_locks = SVAL(req->vwv+7, 0);
7283 lock_timeout = IVAL(req->vwv+4, 0);
7284 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7285
7286 if (!check_fsp(conn, req, fsp)) {
7287 END_PROFILE(SMBlockingX);
7288 return;
7289 }
7290
7291 data = req->buf;
7292
7293 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7294 /* we don't support these - and CANCEL_LOCK makes w2k
7295 and XP reboot so I don't really want to be
7296 compatible! (tridge) */
7297 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7298 END_PROFILE(SMBlockingX);
7299 return;
7300 }
7301
7302 /* Check if this is an oplock break on a file
7303 we have granted an oplock on.
7304 */
7305 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7306 /* Client can insist on breaking to none. */
7307 bool break_to_none = (oplocklevel == 0);
7308 bool result;
7309
7310 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7311 "for fnum = %d\n", (unsigned int)oplocklevel,
7312 fsp->fnum ));
7313
7314 /*
7315 * Make sure we have granted an exclusive or batch oplock on
7316 * this file.
7317 */
7318
7319 if (fsp->oplock_type == 0) {
7320
7321 /* The Samba4 nbench simulator doesn't understand
7322 the difference between break to level2 and break
7323 to none from level2 - it sends oplock break
7324 replies in both cases. Don't keep logging an error
7325 message here - just ignore it. JRA. */
7326
7327 DEBUG(5,("reply_lockingX: Error : oplock break from "
7328 "client for fnum = %d (oplock=%d) and no "
7329 "oplock granted on this file (%s).\n",
7330 fsp->fnum, fsp->oplock_type,
7331 fsp_str_dbg(fsp)));
7332
7333 /* if this is a pure oplock break request then don't
7334 * send a reply */
7335 if (num_locks == 0 && num_ulocks == 0) {
7336 END_PROFILE(SMBlockingX);
7337 return;
7338 } else {
7339 END_PROFILE(SMBlockingX);
7340 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7341 return;
7342 }
7343 }
7344
7345 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7346 (break_to_none)) {
7347 result = remove_oplock(fsp);
7348 } else {
7349 result = downgrade_oplock(fsp);
7350 }
7351
7352 if (!result) {
7353 DEBUG(0, ("reply_lockingX: error in removing "
7354 "oplock on file %s\n", fsp_str_dbg(fsp)));
7355 /* Hmmm. Is this panic justified? */
7356 smb_panic("internal tdb error");
7357 }
7358
7359 reply_to_oplock_break_requests(fsp);
7360
7361 /* if this is a pure oplock break request then don't send a
7362 * reply */
7363 if (num_locks == 0 && num_ulocks == 0) {
7364 /* Sanity check - ensure a pure oplock break is not a
7365 chained request. */
7366 if(CVAL(req->vwv+0, 0) != 0xff)
7367 DEBUG(0,("reply_lockingX: Error : pure oplock "
7368 "break is a chained %d request !\n",
7369 (unsigned int)CVAL(req->vwv+0, 0)));
7370 END_PROFILE(SMBlockingX);
7371 return;
7372 }
7373 }
7374
7375 if (req->buflen <
7376 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7377 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7378 END_PROFILE(SMBlockingX);
7379 return;
7380 }
7381
7382 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7383 if (ulocks == NULL) {
7384 reply_nterror(req, NT_STATUS_NO_MEMORY);
7385 END_PROFILE(SMBlockingX);
7386 return;
7387 }
7388
7389 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7390 if (locks == NULL) {
7391 reply_nterror(req, NT_STATUS_NO_MEMORY);
7392 END_PROFILE(SMBlockingX);
7393 return;
7394 }
7395
7396 /* Data now points at the beginning of the list
7397 of smb_unlkrng structs */
7398 for(i = 0; i < (int)num_ulocks; i++) {
7399 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7400 ulocks[i].count = get_lock_count(data, i, large_file_format);
7401 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7402 ulocks[i].brltype = UNLOCK_LOCK;
7403
7404 /*
7405 * There is no error code marked "stupid client bug".... :-).
7406 */
7407 if(err) {
7408 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7409 END_PROFILE(SMBlockingX);
7410 return;
7411 }
7412 }
7413
7414 /* Now do any requested locks */
7415 data += ((large_file_format ? 20 : 10)*num_ulocks);
7416
7417 /* Data now points at the beginning of the list
7418 of smb_lkrng structs */
7419
7420 for(i = 0; i < (int)num_locks; i++) {
7421 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7422 locks[i].count = get_lock_count(data, i, large_file_format);
7423 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7424
7425 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7426 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7427 locks[i].brltype = PENDING_READ_LOCK;
7428 } else {
7429 locks[i].brltype = READ_LOCK;
7430 }
7431 } else {
7432 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7433 locks[i].brltype = PENDING_WRITE_LOCK;
7434 } else {
7435 locks[i].brltype = WRITE_LOCK;
7436 }
7437 }
7438
7439 /*
7440 * There is no error code marked "stupid client bug".... :-).
7441 */
7442 if(err) {
7443 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7444 END_PROFILE(SMBlockingX);
7445 return;
7446 }
7447 }
7448
7449 status = smbd_do_locking(req, fsp,
7450 locktype, lock_timeout,
7451 num_ulocks, ulocks,
7452 num_locks, locks,
7453 &async);
7454 if (!NT_STATUS_IS_OK(status)) {
7455 END_PROFILE(SMBlockingX);
7456 reply_nterror(req, status);
7457 return;
7458 }
7459 if (async) {
7460 END_PROFILE(SMBlockingX);
7461 return;
7462 }
7463
7464 reply_outbuf(req, 2, 0);
7465
7466 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7467 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7468
7469 END_PROFILE(SMBlockingX);
7470 chain_reply(req);
7471}
7472
7473#undef DBGC_CLASS
7474#define DBGC_CLASS DBGC_ALL
7475
7476/****************************************************************************
7477 Reply to a SMBreadbmpx (read block multiplex) request.
7478 Always reply with an error, if someone has a platform really needs this,
7479 please contact vl@samba.org
7480****************************************************************************/
7481
7482void reply_readbmpx(struct smb_request *req)
7483{
7484 START_PROFILE(SMBreadBmpx);
7485 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7486 END_PROFILE(SMBreadBmpx);
7487 return;
7488}
7489
7490/****************************************************************************
7491 Reply to a SMBreadbs (read block multiplex secondary) request.
7492 Always reply with an error, if someone has a platform really needs this,
7493 please contact vl@samba.org
7494****************************************************************************/
7495
7496void reply_readbs(struct smb_request *req)
7497{
7498 START_PROFILE(SMBreadBs);
7499 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7500 END_PROFILE(SMBreadBs);
7501 return;
7502}
7503
7504/****************************************************************************
7505 Reply to a SMBsetattrE.
7506****************************************************************************/
7507
7508void reply_setattrE(struct smb_request *req)
7509{
7510 connection_struct *conn = req->conn;
7511 struct smb_file_time ft;
7512 files_struct *fsp;
7513 NTSTATUS status;
7514
7515 START_PROFILE(SMBsetattrE);
7516 ZERO_STRUCT(ft);
7517
7518 if (req->wct < 7) {
7519 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7520 goto out;
7521 }
7522
7523 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7524
7525 if(!fsp || (fsp->conn != conn)) {
7526 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7527 goto out;
7528 }
7529
7530 /*
7531 * Convert the DOS times into unix times.
7532 */
7533
7534 ft.atime = convert_time_t_to_timespec(
7535 srv_make_unix_date2(req->vwv+3));
7536 ft.mtime = convert_time_t_to_timespec(
7537 srv_make_unix_date2(req->vwv+5));
7538 ft.create_time = convert_time_t_to_timespec(
7539 srv_make_unix_date2(req->vwv+1));
7540
7541 reply_outbuf(req, 0, 0);
7542
7543 /*
7544 * Patch from Ray Frush <frush@engr.colostate.edu>
7545 * Sometimes times are sent as zero - ignore them.
7546 */
7547
7548 /* Ensure we have a valid stat struct for the source. */
7549 status = vfs_stat_fsp(fsp);
7550 if (!NT_STATUS_IS_OK(status)) {
7551 reply_nterror(req, status);
7552 goto out;
7553 }
7554
7555 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7556 if (!NT_STATUS_IS_OK(status)) {
7557 reply_nterror(req, status);
7558 goto out;
7559 }
7560
7561 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7562 " createtime=%u\n",
7563 fsp->fnum,
7564 (unsigned int)ft.atime.tv_sec,
7565 (unsigned int)ft.mtime.tv_sec,
7566 (unsigned int)ft.create_time.tv_sec
7567 ));
7568 out:
7569 END_PROFILE(SMBsetattrE);
7570 return;
7571}
7572
7573
7574/* Back from the dead for OS/2..... JRA. */
7575
7576/****************************************************************************
7577 Reply to a SMBwritebmpx (write block multiplex primary) request.
7578 Always reply with an error, if someone has a platform really needs this,
7579 please contact vl@samba.org
7580****************************************************************************/
7581
7582void reply_writebmpx(struct smb_request *req)
7583{
7584 START_PROFILE(SMBwriteBmpx);
7585 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7586 END_PROFILE(SMBwriteBmpx);
7587 return;
7588}
7589
7590/****************************************************************************
7591 Reply to a SMBwritebs (write block multiplex secondary) request.
7592 Always reply with an error, if someone has a platform really needs this,
7593 please contact vl@samba.org
7594****************************************************************************/
7595
7596void reply_writebs(struct smb_request *req)
7597{
7598 START_PROFILE(SMBwriteBs);
7599 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7600 END_PROFILE(SMBwriteBs);
7601 return;
7602}
7603
7604/****************************************************************************
7605 Reply to a SMBgetattrE.
7606****************************************************************************/
7607
7608void reply_getattrE(struct smb_request *req)
7609{
7610 connection_struct *conn = req->conn;
7611 int mode;
7612 files_struct *fsp;
7613 struct timespec create_ts;
7614
7615 START_PROFILE(SMBgetattrE);
7616
7617 if (req->wct < 1) {
7618 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7619 END_PROFILE(SMBgetattrE);
7620 return;
7621 }
7622
7623 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7624
7625 if(!fsp || (fsp->conn != conn)) {
7626 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7627 END_PROFILE(SMBgetattrE);
7628 return;
7629 }
7630
7631 /* Do an fstat on this file */
7632 if(fsp_stat(fsp)) {
7633 reply_nterror(req, map_nt_error_from_unix(errno));
7634 END_PROFILE(SMBgetattrE);
7635 return;
7636 }
7637
7638 mode = dos_mode(conn, fsp->fsp_name);
7639
7640 /*
7641 * Convert the times into dos times. Set create
7642 * date to be last modify date as UNIX doesn't save
7643 * this.
7644 */
7645
7646 reply_outbuf(req, 11, 0);
7647
7648 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7649 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7650 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7651 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7652 /* Should we check pending modtime here ? JRA */
7653 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7654 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7655
7656 if (mode & aDIR) {
7657 SIVAL(req->outbuf, smb_vwv6, 0);
7658 SIVAL(req->outbuf, smb_vwv8, 0);
7659 } else {
7660 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7661 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7662 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7663 }
7664 SSVAL(req->outbuf,smb_vwv10, mode);
7665
7666 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7667
7668 END_PROFILE(SMBgetattrE);
7669 return;
7670}
Note: See TracBrowser for help on using the repository browser.