Context Navigation

source: trunk-3.0/source/smbd/nttrans.c@ 101

Visit:

Last change on this file since 101 was 62, checked in by Paul Smedley, 18 years ago
Update source to 3.0.25c level
File size: 90.7 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-1998
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 2 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program; if not, write to the Free Software
19	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20	*/
21
22	#include "includes.h"
23
24	extern int max_send;
25	extern enum protocol_types Protocol;
26	extern int smb_read_error;
27	extern struct current_user current_user;
28
29	static const char *known_nt_pipes[] = {
30	"\\LANMAN",
31	"\\srvsvc",
32	"\\samr",
33	"\\wkssvc",
34	"\\NETLOGON",
35	"\\ntlsa",
36	"\\ntsvcs",
37	"\\lsass",
38	"\\lsarpc",
39	"\\winreg",
40	"\\initshutdown",
41	"\\spoolss",
42	"\\netdfs",
43	"\\rpcecho",
44	"\\svcctl",
45	"\\eventlog",
46	"\\unixinfo",
47	NULL
48	};
49
50	static char nttrans_realloc(char *ptr, size_t size)
51	{
52	if (ptr==NULL) {
53	smb_panic("nttrans_realloc() called with NULL ptr\n");
54	}
55
56	ptr = (char )SMB_REALLOC(*ptr, size);
57	if(*ptr == NULL) {
58	return NULL;
59	}
60	memset(*ptr,'\0',size);
61	return *ptr;
62	}
63
64	/****************************************************************************
65	Send the required number of replies back.
66	We assume all fields other than the data fields are
67	set correctly for the type of call.
68	HACK ! Always assumes smb_setup field is zero.
69	****************************************************************************/
70
71	int send_nt_replies(char *outbuf, int bufsize, NTSTATUS nt_error,
72	char params, int paramsize, char pdata, int datasize)
73	{
74	int data_to_send = datasize;
75	int params_to_send = paramsize;
76	int useable_space;
77	char *pp = params;
78	char *pd = pdata;
79	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80	int alignment_offset = 3;
81	int data_alignment_offset = 0;
82
83	/*
84	* Initially set the wcnt area to be 18 - this is true for all
85	* transNT replies.
86	*/
87
88	set_message(outbuf,18,0,True);
89
90	if (NT_STATUS_V(nt_error)) {
91	ERROR_NT(nt_error);
92	}
93
94	/*
95	* If there genuinely are no parameters or data to send just send
96	* the empty packet.
97	*/
98
99	if(params_to_send == 0 && data_to_send == 0) {
100	show_msg(outbuf);
101	if (!send_smb(smbd_server_fd(),outbuf)) {
102	exit_server_cleanly("send_nt_replies: send_smb failed.");
103	}
104	return 0;
105	}
106
107	/*
108	* When sending params and data ensure that both are nicely aligned.
109	* Only do this alignment when there is also data to send - else
110	* can cause NT redirector problems.
111	*/
112
113	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
114	data_alignment_offset = 4 - (params_to_send % 4);
115	}
116
117	/*
118	* Space is bufsize minus Netbios over TCP header minus SMB header.
119	* The alignment_offset is to align the param bytes on a four byte
120	* boundary (2 bytes for data len, one byte pad).
121	* NT needs this to work correctly.
122	*/
123
124	useable_space = bufsize - ((smb_buf(outbuf)+
125	alignment_offset+data_alignment_offset) -
126	outbuf);
127
128	/*
129	* useable_space can never be more than max_send minus the
130	* alignment offset.
131	*/
132
133	useable_space = MIN(useable_space,
134	max_send - (alignment_offset+data_alignment_offset));
135
136
137	while (params_to_send \|\| data_to_send) {
138
139	/*
140	* Calculate whether we will totally or partially fill this packet.
141	*/
142
143	total_sent_thistime = params_to_send + data_to_send +
144	alignment_offset + data_alignment_offset;
145
146	/*
147	* We can never send more than useable_space.
148	*/
149
150	total_sent_thistime = MIN(total_sent_thistime, useable_space);
151
152	set_message(outbuf, 18, total_sent_thistime, True);
153
154	/*
155	* Set total params and data to be sent.
156	*/
157
158	SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
159	SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
160
161	/*
162	* Calculate how many parameters and data we can fit into
163	* this packet. Parameters get precedence.
164	*/
165
166	params_sent_thistime = MIN(params_to_send,useable_space);
167	data_sent_thistime = useable_space - params_sent_thistime;
168	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
169
170	SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
171
172	if(params_sent_thistime == 0) {
173	SIVAL(outbuf,smb_ntr_ParameterOffset,0);
174	SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
175	} else {
176	/*
177	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
178	* parameter bytes, however the first 4 bytes of outbuf are
179	* the Netbios over TCP header. Thus use smb_base() to subtract
180	* them from the calculation.
181	*/
182
183	SIVAL(outbuf,smb_ntr_ParameterOffset,
184	((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
185	/*
186	* Absolute displacement of param bytes sent in this packet.
187	*/
188
189	SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
190	}
191
192	/*
193	* Deal with the data portion.
194	*/
195
196	SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
197
198	if(data_sent_thistime == 0) {
199	SIVAL(outbuf,smb_ntr_DataOffset,0);
200	SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
201	} else {
202	/*
203	* The offset of the data bytes is the offset of the
204	* parameter bytes plus the number of parameters being sent this time.
205	*/
206
207	SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
208	smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
209	SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
210	}
211
212	/*
213	* Copy the param bytes into the packet.
214	*/
215
216	if(params_sent_thistime) {
217	memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
218	}
219
220	/*
221	* Copy in the data bytes
222	*/
223
224	if(data_sent_thistime) {
225	memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
226	data_alignment_offset,pd,data_sent_thistime);
227	}
228
229	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
230	params_sent_thistime, data_sent_thistime, useable_space));
231	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
232	params_to_send, data_to_send, paramsize, datasize));
233
234	/* Send the packet */
235	show_msg(outbuf);
236	if (!send_smb(smbd_server_fd(),outbuf)) {
237	exit_server_cleanly("send_nt_replies: send_smb failed.");
238	}
239
240	pp += params_sent_thistime;
241	pd += data_sent_thistime;
242
243	params_to_send -= params_sent_thistime;
244	data_to_send -= data_sent_thistime;
245
246	/*
247	* Sanity check
248	*/
249
250	if(params_to_send < 0 \|\| data_to_send < 0) {
251	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
252	params_to_send, data_to_send));
253	return -1;
254	}
255	}
256
257	return 0;
258	}
259
260	/****************************************************************************
261	Is it an NTFS stream name ?
262	****************************************************************************/
263
264	BOOL is_ntfs_stream_name(const char *fname)
265	{
266	if (lp_posix_pathnames()) {
267	return False;
268	}
269	return (strchr_m(fname, ':') != NULL) ? True : False;
270	}
271
272	/****************************************************************************
273	Save case statics.
274	****************************************************************************/
275
276	static BOOL saved_case_sensitive;
277	static BOOL saved_case_preserve;
278	static BOOL saved_short_case_preserve;
279
280	/****************************************************************************
281	Save case semantics.
282	****************************************************************************/
283
284	static uint32 set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
285	{
286	if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
287	return file_attributes;
288	}
289
290	saved_case_sensitive = conn->case_sensitive;
291	saved_case_preserve = conn->case_preserve;
292	saved_short_case_preserve = conn->short_case_preserve;
293
294	/* Set to POSIX. */
295	conn->case_sensitive = True;
296	conn->case_preserve = True;
297	conn->short_case_preserve = True;
298
299	return (file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
300	}
301
302	/****************************************************************************
303	Restore case semantics.
304	****************************************************************************/
305
306	static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
307	{
308	if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
309	return;
310	}
311
312	conn->case_sensitive = saved_case_sensitive;
313	conn->case_preserve = saved_case_preserve;
314	conn->short_case_preserve = saved_short_case_preserve;
315	}
316
317	/****************************************************************************
318	Reply to an NT create and X call on a pipe.
319	****************************************************************************/
320
321	static int nt_open_pipe(char fname, connection_struct conn,
322	char inbuf, char outbuf, int *ppnum)
323	{
324	smb_np_struct *p = NULL;
325	uint16 vuid = SVAL(inbuf, smb_uid);
326	int i;
327
328	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
329
330	/* See if it is one we want to handle. */
331
332	if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
333	return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
334	}
335
336	for( i = 0; known_nt_pipes[i]; i++ ) {
337	if( strequal(fname,known_nt_pipes[i])) {
338	break;
339	}
340	}
341
342	if ( known_nt_pipes[i] == NULL ) {
343	return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
344	}
345
346	/* Strip \\ off the name. */
347	fname++;
348
349	DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
350
351	p = open_rpc_pipe_p(fname, conn, vuid);
352	if (!p) {
353	return(ERROR_DOS(ERRSRV,ERRnofids));
354	}
355
356	/* Add pipe to db */
357
358	if ( !store_pipe_opendb( p ) ) {
359	DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
360	}
361
362	*ppnum = p->pnum;
363	return 0;
364	}
365
366	/****************************************************************************
367	Reply to an NT create and X call for pipes.
368	****************************************************************************/
369
370	static int do_ntcreate_pipe_open(connection_struct *conn,
371	char inbuf,char outbuf,int length,int bufsize)
372	{
373	pstring fname;
374	int ret;
375	int pnum = -1;
376	char *p = NULL;
377	uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
378
379	srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
380
381	if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
382	return ret;
383	}
384
385	/*
386	* Deal with pipe return.
387	*/
388
389	if (flags & EXTENDED_RESPONSE_REQUIRED) {
390	/* This is very strange. We
391	* return 50 words, but only set
392	* the wcnt to 42 ? It's definately
393	* what happens on the wire....
394	*/
395	set_message(outbuf,50,0,True);
396	SCVAL(outbuf,smb_wct,42);
397	} else {
398	set_message(outbuf,34,0,True);
399	}
400
401	p = outbuf + smb_vwv2;
402	p++;
403	SSVAL(p,0,pnum);
404	p += 2;
405	SIVAL(p,0,FILE_WAS_OPENED);
406	p += 4;
407	p += 32;
408	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
409	p += 20;
410	/* File type. */
411	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
412	/* Device state. */
413	SSVAL(p,2, 0x5FF); /* ? */
414	p += 4;
415
416	if (flags & EXTENDED_RESPONSE_REQUIRED) {
417	p += 25;
418	SIVAL(p,0,FILE_GENERIC_ALL);
419	/*
420	* For pipes W2K3 seems to return
421	* 0x12019B next.
422	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
423	*/
424	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
425	}
426
427	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
428
429	return chain_reply(inbuf,outbuf,length,bufsize);
430	}
431
432	/****************************************************************************
433	Reply to an NT create and X call for a quota file.
434	****************************************************************************/
435
436	int reply_ntcreate_and_X_quota(connection_struct *conn,
437	char *inbuf,
438	char *outbuf,
439	int length,
440	int bufsize,
441	enum FAKE_FILE_TYPE fake_file_type,
442	const char *fname)
443	{
444	int result;
445	char *p;
446	uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
447	files_struct *fsp;
448	NTSTATUS status;
449
450	status = open_fake_file(conn, fake_file_type, fname, desired_access,
451	&fsp);
452
453	if (!NT_STATUS_IS_OK(status)) {
454	return ERROR_NT(status);
455	}
456
457	set_message(outbuf,34,0,True);
458
459	p = outbuf + smb_vwv2;
460
461	/* SCVAL(p,0,NO_OPLOCK_RETURN); */
462	p++;
463	SSVAL(p,0,fsp->fnum);
464
465	DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
466
467	result = chain_reply(inbuf,outbuf,length,bufsize);
468	return result;
469	}
470
471	/****************************************************************************
472	Reply to an NT create and X call.
473	****************************************************************************/
474
475	int reply_ntcreate_and_X(connection_struct *conn,
476	char inbuf,char outbuf,int length,int bufsize)
477	{
478	int result;
479	pstring fname;
480	uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
481	uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
482	uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
483	uint32 new_file_attributes;
484	uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
485	uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
486	uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
487	uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
488	/* Breakout the oplock request bits so we can set the
489	reply bits separately. */
490	int oplock_request = 0;
491	uint32 fattr=0;
492	SMB_OFF_T file_len = 0;
493	SMB_STRUCT_STAT sbuf;
494	int info = 0;
495	files_struct *fsp = NULL;
496	char *p = NULL;
497	struct timespec c_timespec;
498	struct timespec a_timespec;
499	struct timespec m_timespec;
500	BOOL extended_oplock_granted = False;
501	NTSTATUS status;
502
503	START_PROFILE(SMBntcreateX);
504
505	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
506	"file_attributes = 0x%x, share_access = 0x%x, "
507	"create_disposition = 0x%x create_options = 0x%x "
508	"root_dir_fid = 0x%x\n",
509	(unsigned int)flags,
510	(unsigned int)access_mask,
511	(unsigned int)file_attributes,
512	(unsigned int)share_access,
513	(unsigned int)create_disposition,
514	(unsigned int)create_options,
515	(unsigned int)root_dir_fid ));
516
517	/*
518	* If it's an IPC, use the pipe handler.
519	*/
520
521	if (IS_IPC(conn)) {
522	if (lp_nt_pipe_support()) {
523	END_PROFILE(SMBntcreateX);
524	return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
525	} else {
526	END_PROFILE(SMBntcreateX);
527	return(ERROR_DOS(ERRDOS,ERRnoaccess));
528	}
529	}
530
531	if (create_options & FILE_OPEN_BY_FILE_ID) {
532	END_PROFILE(SMBntcreateX);
533	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
534	}
535
536	/*
537	* Get the file name.
538	*/
539
540	if(root_dir_fid != 0) {
541	/*
542	* This filename is relative to a directory fid.
543	*/
544	pstring rel_fname;
545	files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
546	size_t dir_name_len;
547
548	if(!dir_fsp) {
549	END_PROFILE(SMBntcreateX);
550	return ERROR_DOS(ERRDOS,ERRbadfid);
551	}
552
553	if(!dir_fsp->is_directory) {
554
555	srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
556	if (!NT_STATUS_IS_OK(status)) {
557	END_PROFILE(SMBntcreateX);
558	return ERROR_NT(status);
559	}
560
561	/*
562	* Check to see if this is a mac fork of some kind.
563	*/
564
565	if( is_ntfs_stream_name(fname)) {
566	END_PROFILE(SMBntcreateX);
567	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
568	}
569
570	/*
571	we need to handle the case when we get a
572	relative open relative to a file and the
573	pathname is blank - this is a reopen!
574	(hint from demyn plantenberg)
575	*/
576
577	END_PROFILE(SMBntcreateX);
578	return(ERROR_DOS(ERRDOS,ERRbadfid));
579	}
580
581	/*
582	* Copy in the base directory name.
583	*/
584
585	pstrcpy( fname, dir_fsp->fsp_name );
586	dir_name_len = strlen(fname);
587
588	/*
589	* Ensure it ends in a '\'.
590	*/
591
592	if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
593	pstrcat(fname, "/");
594	dir_name_len++;
595	}
596
597	srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
598	if (!NT_STATUS_IS_OK(status)) {
599	END_PROFILE(SMBntcreateX);
600	return ERROR_NT(status);
601	}
602	pstrcat(fname, rel_fname);
603	} else {
604	srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
605	if (!NT_STATUS_IS_OK(status)) {
606	END_PROFILE(SMBntcreateX);
607	return ERROR_NT(status);
608	}
609
610	/*
611	* Check to see if this is a mac fork of some kind.
612	*/
613
614	if( is_ntfs_stream_name(fname)) {
615	enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
616	if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
617	/*
618	* Here we go! support for changing the disk quotas --metze
619	*
620	* We need to fake up to open this MAGIC QUOTA file
621	* and return a valid FID.
622	*
623	* w2k close this file directly after openening
624	* xp also tries a QUERY_FILE_INFO on the file and then close it
625	*/
626	result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
627	fake_file_type, fname);
628	END_PROFILE(SMBntcreateX);
629	return result;
630	} else {
631	END_PROFILE(SMBntcreateX);
632	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
633	}
634	}
635	}
636
637	/*
638	* Now contruct the smb_open_mode value from the filename,
639	* desired access and the share access.
640	*/
641	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
642	if (!NT_STATUS_IS_OK(status)) {
643	END_PROFILE(SMBntcreateX);
644	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
645	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
646	}
647	return ERROR_NT(status);
648	}
649
650	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
651	if (oplock_request) {
652	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
653	}
654
655	/*
656	* Ordinary file or directory.
657	*/
658
659	/*
660	* Check if POSIX semantics are wanted.
661	*/
662
663	new_file_attributes = set_posix_case_semantics(conn, file_attributes);
664
665	status = unix_convert(conn, fname, False, NULL, &sbuf);
666	if (!NT_STATUS_IS_OK(status)) {
667	restore_case_semantics(conn, file_attributes);
668	END_PROFILE(SMBntcreateX);
669	return ERROR_NT(status);
670	}
671	/* All file access must go through check_name() */
672	status = check_name(conn, fname);
673	if (!NT_STATUS_IS_OK(status)) {
674	restore_case_semantics(conn, file_attributes);
675	END_PROFILE(SMBntcreateX);
676	return ERROR_NT(status);
677	}
678
679	/* This is the correct thing to do (check every time) but can_delete is
680	expensive (it may have to read the parent directory permissions). So
681	for now we're not doing it unless we have a strong hint the client
682	is really going to delete this file. If the client is forcing FILE_CREATE
683	let the filesystem take care of the permissions. */
684
685	/* Setting FILE_SHARE_DELETE is the hint. */
686
687	if (lp_acl_check_permissions(SNUM(conn))
688	&& (create_disposition != FILE_CREATE)
689	&& (share_access & FILE_SHARE_DELETE)
690	&& (access_mask & DELETE_ACCESS)) {
691	if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) \|\|
692	!can_delete_file_in_directory(conn, fname)) {
693	restore_case_semantics(conn, file_attributes);
694	END_PROFILE(SMBntcreateX);
695	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
696	}
697	}
698
699	/*
700	* If it's a request for a directory open, deal with it separately.
701	*/
702
703	if(create_options & FILE_DIRECTORY_FILE) {
704
705	/* Can't open a temp directory. IFS kit test. */
706	if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
707	END_PROFILE(SMBntcreateX);
708	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
709	}
710
711	oplock_request = 0;
712	status = open_directory(conn, fname, &sbuf,
713	access_mask,
714	share_access,
715	create_disposition,
716	create_options,
717	new_file_attributes,
718	&info, &fsp);
719	} else {
720
721	/*
722	* Ordinary file case.
723	*/
724
725	/* NB. We have a potential bug here. If we
726	* cause an oplock break to ourselves, then we
727	* could end up processing filename related
728	* SMB requests whilst we await the oplock
729	* break response. As we may have changed the
730	* filename case semantics to be POSIX-like,
731	* this could mean a filename request could
732	* fail when it should succeed. This is a rare
733	* condition, but eventually we must arrange
734	* to restore the correct case semantics
735	* before issuing an oplock break request to
736	* our client. JRA. */
737
738	status = open_file_ntcreate(conn,fname,&sbuf,
739	access_mask,
740	share_access,
741	create_disposition,
742	create_options,
743	new_file_attributes,
744	oplock_request,
745	&info, &fsp);
746
747	if (!NT_STATUS_IS_OK(status)) {
748	/* We cheat here. There are two cases we
749	* care about. One is a directory rename,
750	* where the NT client will attempt to
751	* open the source directory for
752	* DELETE access. Note that when the
753	* NT client does this it does not
754	* set the directory bit in the
755	* request packet. This is translated
756	* into a read/write open
757	* request. POSIX states that any open
758	* for write request on a directory
759	* will generate an EISDIR error, so
760	* we can catch this here and open a
761	* pseudo handle that is flagged as a
762	* directory. The second is an open
763	* for a permissions read only, which
764	* we handle in the open_file_stat case. JRA.
765	*/
766
767	if (NT_STATUS_EQUAL(status,
768	NT_STATUS_FILE_IS_A_DIRECTORY)) {
769
770	/*
771	* Fail the open if it was explicitly a non-directory file.
772	*/
773
774	if (create_options & FILE_NON_DIRECTORY_FILE) {
775	restore_case_semantics(conn, file_attributes);
776	END_PROFILE(SMBntcreateX);
777	return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
778	}
779
780	oplock_request = 0;
781	status = open_directory(conn, fname, &sbuf,
782	access_mask,
783	share_access,
784	create_disposition,
785	create_options,
786	new_file_attributes,
787	&info, &fsp);
788
789	}
790	}
791	}
792
793	restore_case_semantics(conn, file_attributes);
794
795	if(!NT_STATUS_IS_OK(status)) {
796	END_PROFILE(SMBntcreateX);
797
798	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
799	/* We have re-scheduled this call. */
800	return -1;
801	}
802
803	return ERROR_OPEN(status);
804	}
805
806	file_len = sbuf.st_size;
807	fattr = dos_mode(conn,fname,&sbuf);
808	if(fattr == 0) {
809	fattr = FILE_ATTRIBUTE_NORMAL;
810	}
811	if (!fsp->is_directory && (fattr & aDIR)) {
812	close_file(fsp,ERROR_CLOSE);
813	END_PROFILE(SMBntcreateX);
814	return ERROR_DOS(ERRDOS,ERRnoaccess);
815	}
816
817	/* Save the requested allocation size. */
818	if ((info == FILE_WAS_CREATED) \|\| (info == FILE_WAS_OVERWRITTEN)) {
819	SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
820	#ifdef LARGE_SMB_OFF_T
821	allocation_size \|= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
822	#endif
823	if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
824	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
825	if (fsp->is_directory) {
826	close_file(fsp,ERROR_CLOSE);
827	END_PROFILE(SMBntcreateX);
828	/* Can't set allocation size on a directory. */
829	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
830	}
831	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
832	close_file(fsp,ERROR_CLOSE);
833	END_PROFILE(SMBntcreateX);
834	return ERROR_NT(NT_STATUS_DISK_FULL);
835	}
836	} else {
837	fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
838	}
839	}
840
841	/*
842	* If the caller set the extended oplock request bit
843	* and we granted one (by whatever means) - set the
844	* correct bit for extended oplock reply.
845	*/
846
847	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
848	extended_oplock_granted = True;
849	}
850
851	if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
852	extended_oplock_granted = True;
853	}
854
855	if (flags & EXTENDED_RESPONSE_REQUIRED) {
856	/* This is very strange. We
857	* return 50 words, but only set
858	* the wcnt to 42 ? It's definately
859	* what happens on the wire....
860	*/
861	set_message(outbuf,50,0,True);
862	SCVAL(outbuf,smb_wct,42);
863	} else {
864	set_message(outbuf,34,0,True);
865	}
866
867	p = outbuf + smb_vwv2;
868
869	/*
870	* Currently as we don't support level II oplocks we just report
871	* exclusive & batch here.
872	*/
873
874	if (extended_oplock_granted) {
875	if (flags & REQUEST_BATCH_OPLOCK) {
876	SCVAL(p,0, BATCH_OPLOCK_RETURN);
877	} else {
878	SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
879	}
880	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
881	SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
882	} else {
883	SCVAL(p,0,NO_OPLOCK_RETURN);
884	}
885
886	p++;
887	SSVAL(p,0,fsp->fnum);
888	p += 2;
889	if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
890	SIVAL(p,0,FILE_WAS_SUPERSEDED);
891	} else {
892	SIVAL(p,0,info);
893	}
894	p += 4;
895
896	/* Create time. */
897	c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
898	a_timespec = get_atimespec(&sbuf);
899	m_timespec = get_mtimespec(&sbuf);
900
901	if (lp_dos_filetime_resolution(SNUM(conn))) {
902	dos_filetime_timespec(&c_timespec);
903	dos_filetime_timespec(&a_timespec);
904	dos_filetime_timespec(&m_timespec);
905	}
906
907	put_long_date_timespec(p, c_timespec); /* create time. */
908	p += 8;
909	put_long_date_timespec(p, a_timespec); /* access time */
910	p += 8;
911	put_long_date_timespec(p, m_timespec); /* write time */
912	p += 8;
913	put_long_date_timespec(p, m_timespec); /* change time */
914	p += 8;
915	SIVAL(p,0,fattr); /* File Attributes. */
916	p += 4;
917	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
918	p += 8;
919	SOFF_T(p,0,file_len);
920	p += 8;
921	if (flags & EXTENDED_RESPONSE_REQUIRED) {
922	SSVAL(p,2,0x7);
923	}
924	p += 4;
925	SCVAL(p,0,fsp->is_directory ? 1 : 0);
926
927	if (flags & EXTENDED_RESPONSE_REQUIRED) {
928	uint32 perms = 0;
929	p += 25;
930	if (fsp->is_directory \|\| can_write_to_file(conn, fname, &sbuf)) {
931	perms = FILE_GENERIC_ALL;
932	} else {
933	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
934	}
935	SIVAL(p,0,perms);
936	}
937
938	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
939
940	result = chain_reply(inbuf,outbuf,length,bufsize);
941	END_PROFILE(SMBntcreateX);
942	return result;
943	}
944
945	/****************************************************************************
946	Reply to a NT_TRANSACT_CREATE call to open a pipe.
947	****************************************************************************/
948
949	static int do_nt_transact_create_pipe( connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
950	uint16 **ppsetup, uint32 setup_count,
951	char **ppparams, uint32 parameter_count,
952	char **ppdata, uint32 data_count)
953	{
954	pstring fname;
955	char params = ppparams;
956	int ret;
957	int pnum = -1;
958	char *p = NULL;
959	NTSTATUS status;
960	size_t param_len;
961	uint32 flags;
962
963	/*
964	* Ensure minimum number of parameters sent.
965	*/
966
967	if(parameter_count < 54) {
968	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
969	return ERROR_DOS(ERRDOS,ERRnoaccess);
970	}
971
972	flags = IVAL(params,0);
973
974	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
975	if (!NT_STATUS_IS_OK(status)) {
976	return ERROR_NT(status);
977	}
978
979	if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
980	return ret;
981	}
982
983	/* Realloc the size of parameters and data we will return */
984	if (flags & EXTENDED_RESPONSE_REQUIRED) {
985	/* Extended response is 32 more byyes. */
986	param_len = 101;
987	} else {
988	param_len = 69;
989	}
990	params = nttrans_realloc(ppparams, param_len);
991	if(params == NULL) {
992	return ERROR_DOS(ERRDOS,ERRnomem);
993	}
994
995	p = params;
996	SCVAL(p,0,NO_OPLOCK_RETURN);
997
998	p += 2;
999	SSVAL(p,0,pnum);
1000	p += 2;
1001	SIVAL(p,0,FILE_WAS_OPENED);
1002	p += 8;
1003
1004	p += 32;
1005	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1006	p += 20;
1007	/* File type. */
1008	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1009	/* Device state. */
1010	SSVAL(p,2, 0x5FF); /* ? */
1011	p += 4;
1012
1013	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1014	p += 25;
1015	SIVAL(p,0,FILE_GENERIC_ALL);
1016	/*
1017	* For pipes W2K3 seems to return
1018	* 0x12019B next.
1019	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
1020	*/
1021	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
1022	}
1023
1024	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1025
1026	/* Send the required number of replies */
1027	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
1028
1029	return -1;
1030	}
1031
1032	/****************************************************************************
1033	Internal fn to set security descriptors.
1034	****************************************************************************/
1035
1036	static NTSTATUS set_sd(files_struct fsp, char data, uint32 sd_len, uint32 security_info_sent)
1037	{
1038	prs_struct pd;
1039	SEC_DESC *psd = NULL;
1040	TALLOC_CTX *mem_ctx;
1041	BOOL ret;
1042
1043	if (sd_len == 0 \|\| !lp_nt_acl_support(SNUM(fsp->conn))) {
1044	return NT_STATUS_OK;
1045	}
1046
1047	/*
1048	* Init the parse struct we will unmarshall from.
1049	*/
1050
1051	if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1052	DEBUG(0,("set_sd: talloc_init failed.\n"));
1053	return NT_STATUS_NO_MEMORY;
1054	}
1055
1056	prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1057
1058	/*
1059	* Setup the prs_struct to point at the memory we just
1060	* allocated.
1061	*/
1062
1063	prs_give_memory( &pd, data, sd_len, False);
1064
1065	/*
1066	* Finally, unmarshall from the data buffer.
1067	*/
1068
1069	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1070	DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1071	/*
1072	* Return access denied for want of a better error message..
1073	*/
1074	talloc_destroy(mem_ctx);
1075	return NT_STATUS_NO_MEMORY;
1076	}
1077
1078	if (psd->owner_sid==0) {
1079	security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1080	}
1081	if (psd->group_sid==0) {
1082	security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1083	}
1084	if (psd->sacl==0) {
1085	security_info_sent &= ~SACL_SECURITY_INFORMATION;
1086	}
1087	if (psd->dacl==0) {
1088	security_info_sent &= ~DACL_SECURITY_INFORMATION;
1089	}
1090
1091	ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1092
1093	if (!ret) {
1094	talloc_destroy(mem_ctx);
1095	return NT_STATUS_ACCESS_DENIED;
1096	}
1097
1098	talloc_destroy(mem_ctx);
1099
1100	return NT_STATUS_OK;
1101	}
1102
1103	/****************************************************************************
1104	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1105	****************************************************************************/
1106
1107	static struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
1108	{
1109	struct ea_list *ea_list_head = NULL;
1110	size_t offset = 0;
1111
1112	if (data_size < 4) {
1113	return NULL;
1114	}
1115
1116	while (offset + 4 <= data_size) {
1117	size_t next_offset = IVAL(pdata,offset);
1118	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1119
1120	if (!eal) {
1121	return NULL;
1122	}
1123
1124	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1125	if (next_offset == 0) {
1126	break;
1127	}
1128	offset += next_offset;
1129	}
1130
1131	return ea_list_head;
1132	}
1133
1134	/****************************************************************************
1135	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1136	****************************************************************************/
1137
1138	static int call_nt_transact_create(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1139	uint16 **ppsetup, uint32 setup_count,
1140	char **ppparams, uint32 parameter_count,
1141	char **ppdata, uint32 data_count, uint32 max_data_count)
1142	{
1143	pstring fname;
1144	char params = ppparams;
1145	char data = ppdata;
1146	/* Breakout the oplock request bits so we can set the reply bits separately. */
1147	int oplock_request = 0;
1148	uint32 fattr=0;
1149	SMB_OFF_T file_len = 0;
1150	SMB_STRUCT_STAT sbuf;
1151	int info = 0;
1152	files_struct *fsp = NULL;
1153	char *p = NULL;
1154	BOOL extended_oplock_granted = False;
1155	uint32 flags;
1156	uint32 access_mask;
1157	uint32 file_attributes;
1158	uint32 new_file_attributes;
1159	uint32 share_access;
1160	uint32 create_disposition;
1161	uint32 create_options;
1162	uint32 sd_len;
1163	uint32 ea_len;
1164	uint16 root_dir_fid;
1165	struct timespec c_timespec;
1166	struct timespec a_timespec;
1167	struct timespec m_timespec;
1168	struct ea_list *ea_list = NULL;
1169	TALLOC_CTX *ctx = NULL;
1170	char *pdata = NULL;
1171	NTSTATUS status;
1172	size_t param_len;
1173
1174	DEBUG(5,("call_nt_transact_create\n"));
1175
1176	/*
1177	* If it's an IPC, use the pipe handler.
1178	*/
1179
1180	if (IS_IPC(conn)) {
1181	if (lp_nt_pipe_support()) {
1182	return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1183	bufsize,
1184	ppsetup, setup_count,
1185	ppparams, parameter_count,
1186	ppdata, data_count);
1187	} else {
1188	return ERROR_DOS(ERRDOS,ERRnoaccess);
1189	}
1190	}
1191
1192	/*
1193	* Ensure minimum number of parameters sent.
1194	*/
1195
1196	if(parameter_count < 54) {
1197	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1198	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1199	}
1200
1201	flags = IVAL(params,0);
1202	access_mask = IVAL(params,8);
1203	file_attributes = IVAL(params,20);
1204	share_access = IVAL(params,24);
1205	create_disposition = IVAL(params,28);
1206	create_options = IVAL(params,32);
1207	sd_len = IVAL(params,36);
1208	ea_len = IVAL(params,40);
1209	root_dir_fid = (uint16)IVAL(params,4);
1210
1211	/* Ensure the data_len is correct for the sd and ea values given. */
1212	if ((ea_len + sd_len > data_count) \|\|
1213	(ea_len > data_count) \|\| (sd_len > data_count) \|\|
1214	(ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
1215	DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1216	(unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1217	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1218	}
1219
1220	if (ea_len) {
1221	if (!lp_ea_support(SNUM(conn))) {
1222	DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1223	(unsigned int)ea_len ));
1224	return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1225	}
1226
1227	if (ea_len < 10) {
1228	DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1229	(unsigned int)ea_len ));
1230	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1231	}
1232	}
1233
1234	if (create_options & FILE_OPEN_BY_FILE_ID) {
1235	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1236	}
1237
1238	/*
1239	* Get the file name.
1240	*/
1241
1242	if(root_dir_fid != 0) {
1243	/*
1244	* This filename is relative to a directory fid.
1245	*/
1246	files_struct *dir_fsp = file_fsp(params,4);
1247	size_t dir_name_len;
1248
1249	if(!dir_fsp) {
1250	return ERROR_DOS(ERRDOS,ERRbadfid);
1251	}
1252
1253	if(!dir_fsp->is_directory) {
1254	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1255	if (!NT_STATUS_IS_OK(status)) {
1256	return ERROR_NT(status);
1257	}
1258
1259	/*
1260	* Check to see if this is a mac fork of some kind.
1261	*/
1262
1263	if( is_ntfs_stream_name(fname)) {
1264	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1265	}
1266
1267	return ERROR_DOS(ERRDOS,ERRbadfid);
1268	}
1269
1270	/*
1271	* Copy in the base directory name.
1272	*/
1273
1274	pstrcpy( fname, dir_fsp->fsp_name );
1275	dir_name_len = strlen(fname);
1276
1277	/*
1278	* Ensure it ends in a '\'.
1279	*/
1280
1281	if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1282	pstrcat(fname, "/");
1283	dir_name_len++;
1284	}
1285
1286	{
1287	pstring tmpname;
1288	srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1289	if (!NT_STATUS_IS_OK(status)) {
1290	return ERROR_NT(status);
1291	}
1292	pstrcat(fname, tmpname);
1293	}
1294	} else {
1295	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1296	if (!NT_STATUS_IS_OK(status)) {
1297	return ERROR_NT(status);
1298	}
1299
1300	/*
1301	* Check to see if this is a mac fork of some kind.
1302	*/
1303
1304	if( is_ntfs_stream_name(fname)) {
1305	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1306	}
1307	}
1308
1309	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1310	if (oplock_request) {
1311	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1312	}
1313
1314	/*
1315	* Ordinary file or directory.
1316	*/
1317
1318	/*
1319	* Check if POSIX semantics are wanted.
1320	*/
1321
1322	new_file_attributes = set_posix_case_semantics(conn, file_attributes);
1323
1324	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1325	if (!NT_STATUS_IS_OK(status)) {
1326	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1327	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1328	}
1329	return ERROR_NT(status);
1330	}
1331
1332	status = unix_convert(conn, fname, False, NULL, &sbuf);
1333	if (!NT_STATUS_IS_OK(status)) {
1334	restore_case_semantics(conn, file_attributes);
1335	return ERROR_NT(status);
1336	}
1337	/* All file access must go through check_name() */
1338	status = check_name(conn, fname);
1339	if (!NT_STATUS_IS_OK(status)) {
1340	restore_case_semantics(conn, file_attributes);
1341	return ERROR_NT(status);
1342	}
1343
1344	/* This is the correct thing to do (check every time) but can_delete is
1345	expensive (it may have to read the parent directory permissions). So
1346	for now we're not doing it unless we have a strong hint the client
1347	is really going to delete this file. If the client is forcing FILE_CREATE
1348	let the filesystem take care of the permissions. */
1349
1350	/* Setting FILE_SHARE_DELETE is the hint. */
1351
1352	if (lp_acl_check_permissions(SNUM(conn))
1353	&& (create_disposition != FILE_CREATE)
1354	&& (share_access & FILE_SHARE_DELETE)
1355	&& (access_mask & DELETE_ACCESS)) {
1356	if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) \|\|
1357	!can_delete_file_in_directory(conn, fname)) {
1358	restore_case_semantics(conn, file_attributes);
1359	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1360	}
1361	}
1362
1363	if (ea_len) {
1364	pdata = data + sd_len;
1365
1366	/* We have already checked that ea_len <= data_count here. */
1367	ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
1368	ea_len);
1369	if (!ea_list ) {
1370	restore_case_semantics(conn, file_attributes);
1371	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1372	}
1373	}
1374
1375	/*
1376	* If it's a request for a directory open, deal with it separately.
1377	*/
1378
1379	if(create_options & FILE_DIRECTORY_FILE) {
1380
1381	/* Can't open a temp directory. IFS kit test. */
1382	if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1383	restore_case_semantics(conn, file_attributes);
1384	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1385	}
1386
1387	/*
1388	* We will get a create directory here if the Win32
1389	* app specified a security descriptor in the
1390	* CreateDirectory() call.
1391	*/
1392
1393	oplock_request = 0;
1394	status = open_directory(conn, fname, &sbuf,
1395	access_mask,
1396	share_access,
1397	create_disposition,
1398	create_options,
1399	new_file_attributes,
1400	&info, &fsp);
1401	} else {
1402
1403	/*
1404	* Ordinary file case.
1405	*/
1406
1407	status = open_file_ntcreate(conn,fname,&sbuf,
1408	access_mask,
1409	share_access,
1410	create_disposition,
1411	create_options,
1412	new_file_attributes,
1413	oplock_request,
1414	&info, &fsp);
1415
1416	if (!NT_STATUS_IS_OK(status)) {
1417	if (NT_STATUS_EQUAL(status,
1418	NT_STATUS_FILE_IS_A_DIRECTORY)) {
1419
1420	/*
1421	* Fail the open if it was explicitly a non-directory file.
1422	*/
1423
1424	if (create_options & FILE_NON_DIRECTORY_FILE) {
1425	restore_case_semantics(conn, file_attributes);
1426	return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1427	}
1428
1429	oplock_request = 0;
1430	status = open_directory(conn, fname, &sbuf,
1431	access_mask,
1432	share_access,
1433	create_disposition,
1434	create_options,
1435	new_file_attributes,
1436	&info, &fsp);
1437	}
1438	}
1439	}
1440
1441	restore_case_semantics(conn, file_attributes);
1442	if(!NT_STATUS_IS_OK(status)) {
1443
1444	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1445	/* We have re-scheduled this call. */
1446	return -1;
1447	}
1448
1449	return ERROR_OPEN(status);
1450	}
1451
1452	/*
1453	* According to the MS documentation, the only time the security
1454	* descriptor is applied to the opened file is iff we created the
1455	* file; an existing file stays the same.
1456	*
1457	* Also, it seems (from observation) that you can open the file with
1458	* any access mask but you can still write the sd. We need to override
1459	* the granted access before we call set_sd
1460	* Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1461	*/
1462
1463	if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1464	uint32 saved_access_mask = fsp->access_mask;
1465
1466	/* We have already checked that sd_len <= data_count here. */
1467
1468	fsp->access_mask = FILE_GENERIC_ALL;
1469
1470	status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1471	if (!NT_STATUS_IS_OK(status)) {
1472	talloc_destroy(ctx);
1473	close_file(fsp,ERROR_CLOSE);
1474	restore_case_semantics(conn, file_attributes);
1475	return ERROR_NT(status);
1476	}
1477	fsp->access_mask = saved_access_mask;
1478	}
1479
1480	if (ea_len && (info == FILE_WAS_CREATED)) {
1481	status = set_ea(conn, fsp, fname, ea_list);
1482	if (!NT_STATUS_IS_OK(status)) {
1483	close_file(fsp,ERROR_CLOSE);
1484	restore_case_semantics(conn, file_attributes);
1485	return ERROR_NT(status);
1486	}
1487	}
1488
1489	restore_case_semantics(conn, file_attributes);
1490
1491	file_len = sbuf.st_size;
1492	fattr = dos_mode(conn,fname,&sbuf);
1493	if(fattr == 0) {
1494	fattr = FILE_ATTRIBUTE_NORMAL;
1495	}
1496	if (!fsp->is_directory && (fattr & aDIR)) {
1497	close_file(fsp,ERROR_CLOSE);
1498	return ERROR_DOS(ERRDOS,ERRnoaccess);
1499	}
1500
1501	/* Save the requested allocation size. */
1502	if ((info == FILE_WAS_CREATED) \|\| (info == FILE_WAS_OVERWRITTEN)) {
1503	SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1504	#ifdef LARGE_SMB_OFF_T
1505	allocation_size \|= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1506	#endif
1507	if (allocation_size && (allocation_size > file_len)) {
1508	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1509	if (fsp->is_directory) {
1510	close_file(fsp,ERROR_CLOSE);
1511	/* Can't set allocation size on a directory. */
1512	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1513	}
1514	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1515	close_file(fsp,ERROR_CLOSE);
1516	return ERROR_NT(NT_STATUS_DISK_FULL);
1517	}
1518	} else {
1519	fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1520	}
1521	}
1522
1523	/*
1524	* If the caller set the extended oplock request bit
1525	* and we granted one (by whatever means) - set the
1526	* correct bit for extended oplock reply.
1527	*/
1528
1529	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1530	extended_oplock_granted = True;
1531	}
1532
1533	if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1534	extended_oplock_granted = True;
1535	}
1536
1537	/* Realloc the size of parameters and data we will return */
1538	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1539	/* Extended response is 32 more byyes. */
1540	param_len = 101;
1541	} else {
1542	param_len = 69;
1543	}
1544	params = nttrans_realloc(ppparams, param_len);
1545	if(params == NULL) {
1546	return ERROR_DOS(ERRDOS,ERRnomem);
1547	}
1548
1549	p = params;
1550	if (extended_oplock_granted) {
1551	if (flags & REQUEST_BATCH_OPLOCK) {
1552	SCVAL(p,0, BATCH_OPLOCK_RETURN);
1553	} else {
1554	SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1555	}
1556	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1557	SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1558	} else {
1559	SCVAL(p,0,NO_OPLOCK_RETURN);
1560	}
1561
1562	p += 2;
1563	SSVAL(p,0,fsp->fnum);
1564	p += 2;
1565	if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1566	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1567	} else {
1568	SIVAL(p,0,info);
1569	}
1570	p += 8;
1571
1572	/* Create time. */
1573	c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1574	a_timespec = get_atimespec(&sbuf);
1575	m_timespec = get_mtimespec(&sbuf);
1576
1577	if (lp_dos_filetime_resolution(SNUM(conn))) {
1578	dos_filetime_timespec(&c_timespec);
1579	dos_filetime_timespec(&a_timespec);
1580	dos_filetime_timespec(&m_timespec);
1581	}
1582
1583	put_long_date_timespec(p, c_timespec); /* create time. */
1584	p += 8;
1585	put_long_date_timespec(p, a_timespec); /* access time */
1586	p += 8;
1587	put_long_date_timespec(p, m_timespec); /* write time */
1588	p += 8;
1589	put_long_date_timespec(p, m_timespec); /* change time */
1590	p += 8;
1591	SIVAL(p,0,fattr); /* File Attributes. */
1592	p += 4;
1593	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1594	p += 8;
1595	SOFF_T(p,0,file_len);
1596	p += 8;
1597	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1598	SSVAL(p,2,0x7);
1599	}
1600	p += 4;
1601	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1602
1603	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1604	uint32 perms = 0;
1605	p += 25;
1606	if (fsp->is_directory \|\| can_write_to_file(conn, fname, &sbuf)) {
1607	perms = FILE_GENERIC_ALL;
1608	} else {
1609	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
1610	}
1611	SIVAL(p,0,perms);
1612	}
1613
1614	DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1615
1616	/* Send the required number of replies */
1617	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
1618
1619	return -1;
1620	}
1621
1622	/****************************************************************************
1623	Reply to a NT CANCEL request.
1624	conn POINTER CAN BE NULL HERE !
1625	****************************************************************************/
1626
1627	int reply_ntcancel(connection_struct *conn,
1628	char inbuf,char outbuf,int length,int bufsize)
1629	{
1630	/*
1631	* Go through and cancel any pending change notifies.
1632	*/
1633
1634	int mid = SVAL(inbuf,smb_mid);
1635	START_PROFILE(SMBntcancel);
1636	remove_pending_change_notify_requests_by_mid(mid);
1637	remove_pending_lock_requests_by_mid(mid);
1638	srv_cancel_sign_response(mid);
1639
1640	DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1641
1642	END_PROFILE(SMBntcancel);
1643	return(-1);
1644	}
1645
1646	/****************************************************************************
1647	Copy a file.
1648	****************************************************************************/
1649
1650	static NTSTATUS copy_internals(connection_struct conn, char oldname, char *newname, uint32 attrs)
1651	{
1652	SMB_STRUCT_STAT sbuf1, sbuf2;
1653	pstring last_component_oldname;
1654	pstring last_component_newname;
1655	files_struct fsp1,fsp2;
1656	uint32 fattr;
1657	int info;
1658	SMB_OFF_T ret=-1;
1659	NTSTATUS status = NT_STATUS_OK;
1660
1661	ZERO_STRUCT(sbuf1);
1662	ZERO_STRUCT(sbuf2);
1663
1664	if (!CAN_WRITE(conn)) {
1665	return NT_STATUS_MEDIA_WRITE_PROTECTED;
1666	}
1667
1668	status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
1669	if (!NT_STATUS_IS_OK(status)) {
1670	return status;
1671	}
1672
1673	status = check_name(conn, oldname);
1674	if (!NT_STATUS_IS_OK(status)) {
1675	return status;
1676	}
1677
1678	/* Source must already exist. */
1679	if (!VALID_STAT(sbuf1)) {
1680	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1681	}
1682	/* Ensure attributes match. */
1683	fattr = dos_mode(conn,oldname,&sbuf1);
1684	if ((fattr & ~attrs) & (aHIDDEN \| aSYSTEM)) {
1685	return NT_STATUS_NO_SUCH_FILE;
1686	}
1687
1688	status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
1689	if (!NT_STATUS_IS_OK(status)) {
1690	return status;
1691	}
1692
1693	status = check_name(conn, newname);
1694	if (!NT_STATUS_IS_OK(status)) {
1695	return status;
1696	}
1697
1698	/* Disallow if newname already exists. */
1699	if (VALID_STAT(sbuf2)) {
1700	return NT_STATUS_OBJECT_NAME_COLLISION;
1701	}
1702
1703	/* No links from a directory. */
1704	if (S_ISDIR(sbuf1.st_mode)) {
1705	return NT_STATUS_FILE_IS_A_DIRECTORY;
1706	}
1707
1708	/* Ensure this is within the share. */
1709	status = reduce_name(conn, oldname);
1710	if (!NT_STATUS_IS_OK(status)) {
1711	return status;
1712	}
1713
1714	DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1715
1716	status = open_file_ntcreate(conn,oldname,&sbuf1,
1717	FILE_READ_DATA, /* Read-only. */
1718	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1719	FILE_OPEN,
1720	0, /* No create options. */
1721	FILE_ATTRIBUTE_NORMAL,
1722	NO_OPLOCK,
1723	&info, &fsp1);
1724
1725	if (!NT_STATUS_IS_OK(status)) {
1726	return status;
1727	}
1728
1729	status = open_file_ntcreate(conn,newname,&sbuf2,
1730	FILE_WRITE_DATA, /* Read-only. */
1731	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1732	FILE_CREATE,
1733	0, /* No create options. */
1734	fattr,
1735	NO_OPLOCK,
1736	&info, &fsp2);
1737
1738	if (!NT_STATUS_IS_OK(status)) {
1739	close_file(fsp1,ERROR_CLOSE);
1740	return status;
1741	}
1742
1743	if (sbuf1.st_size) {
1744	ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1745	}
1746
1747	/*
1748	* As we are opening fsp1 read-only we only expect
1749	* an error on close on fsp2 if we are out of space.
1750	* Thus we don't look at the error return from the
1751	* close of fsp1.
1752	*/
1753	close_file(fsp1,NORMAL_CLOSE);
1754
1755	/* Ensure the modtime is set correctly on the destination file. */
1756	fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1));
1757
1758	status = close_file(fsp2,NORMAL_CLOSE);
1759
1760	/* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1761	creates the file. This isn't the correct thing to do in the copy
1762	case. JRA */
1763	file_set_dosmode(conn, newname, fattr, &sbuf2,
1764	parent_dirname(newname));
1765
1766	if (ret < (SMB_OFF_T)sbuf1.st_size) {
1767	return NT_STATUS_DISK_FULL;
1768	}
1769
1770	if (!NT_STATUS_IS_OK(status)) {
1771	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1772	nt_errstr(status), oldname, newname));
1773	}
1774	return status;
1775	}
1776
1777	/****************************************************************************
1778	Reply to a NT rename request.
1779	****************************************************************************/
1780
1781	int reply_ntrename(connection_struct *conn,
1782	char inbuf,char outbuf,int length,int bufsize)
1783	{
1784	int outsize = 0;
1785	pstring oldname;
1786	pstring newname;
1787	char *p;
1788	NTSTATUS status;
1789	BOOL src_has_wcard = False;
1790	BOOL dest_has_wcard = False;
1791	uint32 attrs = SVAL(inbuf,smb_vwv0);
1792	uint16 rename_type = SVAL(inbuf,smb_vwv1);
1793
1794	START_PROFILE(SMBntrename);
1795
1796	p = smb_buf(inbuf) + 1;
1797	p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &src_has_wcard);
1798	if (!NT_STATUS_IS_OK(status)) {
1799	END_PROFILE(SMBntrename);
1800	return ERROR_NT(status);
1801	}
1802
1803	if( is_ntfs_stream_name(oldname)) {
1804	/* Can't rename a stream. */
1805	END_PROFILE(SMBntrename);
1806	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1807	}
1808
1809	if (ms_has_wild(oldname)) {
1810	END_PROFILE(SMBntrename);
1811	return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1812	}
1813
1814	p++;
1815	p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &dest_has_wcard);
1816	if (!NT_STATUS_IS_OK(status)) {
1817	END_PROFILE(SMBntrename);
1818	return ERROR_NT(status);
1819	}
1820
1821	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, oldname);
1822	if (!NT_STATUS_IS_OK(status)) {
1823	END_PROFILE(SMBntrename);
1824	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1825	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1826	}
1827	return ERROR_NT(status);
1828	}
1829
1830	status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname);
1831	if (!NT_STATUS_IS_OK(status)) {
1832	END_PROFILE(SMBntrename);
1833	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1834	return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1835	}
1836	return ERROR_NT(status);
1837	}
1838
1839	DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1840
1841	switch(rename_type) {
1842	case RENAME_FLAG_RENAME:
1843	status = rename_internals(conn, oldname, newname, attrs, False, src_has_wcard, dest_has_wcard);
1844	break;
1845	case RENAME_FLAG_HARD_LINK:
1846	if (src_has_wcard \|\| dest_has_wcard) {
1847	/* No wildcards. */
1848	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1849	} else {
1850	status = hardlink_internals(conn, oldname, newname);
1851	}
1852	break;
1853	case RENAME_FLAG_COPY:
1854	if (src_has_wcard \|\| dest_has_wcard) {
1855	/* No wildcards. */
1856	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1857	} else {
1858	status = copy_internals(conn, oldname, newname, attrs);
1859	}
1860	break;
1861	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1862	status = NT_STATUS_INVALID_PARAMETER;
1863	break;
1864	default:
1865	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1866	break;
1867	}
1868
1869	if (!NT_STATUS_IS_OK(status)) {
1870	END_PROFILE(SMBntrename);
1871	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1872	/* We have re-scheduled this call. */
1873	return -1;
1874	}
1875	return ERROR_NT(status);
1876	}
1877
1878	outsize = set_message(outbuf,0,0,False);
1879
1880	END_PROFILE(SMBntrename);
1881	return(outsize);
1882	}
1883
1884	/****************************************************************************
1885	Reply to a notify change - queue the request and
1886	don't allow a directory to be opened.
1887	****************************************************************************/
1888
1889	static int call_nt_transact_notify_change(connection_struct conn, char inbuf,
1890	char *outbuf, int length,
1891	int bufsize,
1892	uint16 **ppsetup, uint32 setup_count,
1893	char **ppparams,
1894	uint32 parameter_count,
1895	char **ppdata, uint32 data_count,
1896	uint32 max_data_count,
1897	uint32 max_param_count)
1898	{
1899	uint16 setup = ppsetup;
1900	files_struct *fsp;
1901	uint32 filter;
1902	NTSTATUS status;
1903	BOOL recursive;
1904
1905	if(setup_count < 6) {
1906	return ERROR_DOS(ERRDOS,ERRbadfunc);
1907	}
1908
1909	fsp = file_fsp((char *)setup,4);
1910	filter = IVAL(setup, 0);
1911	recursive = (SVAL(setup, 6) != 0) ? True : False;
1912
1913	DEBUG(3,("call_nt_transact_notify_change\n"));
1914
1915	if(!fsp) {
1916	return ERROR_DOS(ERRDOS,ERRbadfid);
1917	}
1918
1919	{
1920	char *filter_string;
1921
1922	if (!(filter_string = notify_filter_string(NULL, filter))) {
1923	return ERROR_NT(NT_STATUS_NO_MEMORY);
1924	}
1925
1926	DEBUG(3,("call_nt_transact_notify_change: notify change "
1927	"called on %s, filter = %s, recursive = %d\n",
1928	fsp->fsp_name, filter_string, recursive));
1929
1930	TALLOC_FREE(filter_string);
1931	}
1932
1933	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1934	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1935	}
1936
1937	if (fsp->notify == NULL) {
1938
1939	status = change_notify_create(fsp, filter, recursive);
1940
1941	if (!NT_STATUS_IS_OK(status)) {
1942	DEBUG(10, ("change_notify_create returned %s\n",
1943	nt_errstr(status)));
1944	return ERROR_NT(status);
1945	}
1946	}
1947
1948	if (fsp->notify->num_changes != 0) {
1949
1950	/*
1951	* We've got changes pending, respond immediately
1952	*/
1953
1954	/*
1955	* TODO: write a torture test to check the filtering behaviour
1956	* here.
1957	*/
1958
1959	change_notify_reply(inbuf, max_param_count, fsp->notify);
1960
1961	/*
1962	* change_notify_reply() above has independently sent its
1963	* results
1964	*/
1965	return -1;
1966	}
1967
1968	/*
1969	* No changes pending, queue the request
1970	*/
1971
1972	status = change_notify_add_request(inbuf, max_param_count, filter,
1973	recursive, fsp);
1974	if (!NT_STATUS_IS_OK(status)) {
1975	return ERROR_NT(status);
1976	}
1977
1978	return -1;
1979	}
1980
1981	/****************************************************************************
1982	Reply to an NT transact rename command.
1983	****************************************************************************/
1984
1985	static int call_nt_transact_rename(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1986	uint16 **ppsetup, uint32 setup_count,
1987	char **ppparams, uint32 parameter_count,
1988	char **ppdata, uint32 data_count, uint32 max_data_count)
1989	{
1990	char params = ppparams;
1991	pstring new_name;
1992	files_struct *fsp = NULL;
1993	BOOL replace_if_exists = False;
1994	BOOL dest_has_wcard = False;
1995	NTSTATUS status;
1996
1997	if(parameter_count < 5) {
1998	return ERROR_DOS(ERRDOS,ERRbadfunc);
1999	}
2000
2001	fsp = file_fsp(params, 0);
2002	replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
2003	CHECK_FSP(fsp, conn);
2004	srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), parameter_count - 4,
2005	STR_TERMINATE, &status, &dest_has_wcard);
2006	if (!NT_STATUS_IS_OK(status)) {
2007	return ERROR_NT(status);
2008	}
2009
2010	status = rename_internals(conn, fsp->fsp_name,
2011	new_name, 0, replace_if_exists, False, dest_has_wcard);
2012
2013	if (!NT_STATUS_IS_OK(status)) {
2014	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
2015	/* We have re-scheduled this call. */
2016	return -1;
2017	}
2018	return ERROR_NT(status);
2019	}
2020
2021	/*
2022	* Rename was successful.
2023	*/
2024	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2025
2026	DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
2027	fsp->fsp_name, new_name));
2028
2029	return -1;
2030	}
2031
2032	/******************************************************************************
2033	Fake up a completely empty SD.
2034	*******************************************************************************/
2035
2036	static size_t get_null_nt_acl(TALLOC_CTX mem_ctx, SEC_DESC *ppsd)
2037	{
2038	size_t sd_size;
2039
2040	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2041	if(!*ppsd) {
2042	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2043	sd_size = 0;
2044	}
2045
2046	return sd_size;
2047	}
2048
2049	/****************************************************************************
2050	Reply to query a security descriptor.
2051	****************************************************************************/
2052
2053	static int call_nt_transact_query_security_desc(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2054	uint16 **ppsetup, uint32 setup_count,
2055	char **ppparams, uint32 parameter_count,
2056	char **ppdata, uint32 data_count, uint32 max_data_count)
2057	{
2058	char params = ppparams;
2059	char data = ppdata;
2060	prs_struct pd;
2061	SEC_DESC *psd = NULL;
2062	size_t sd_size;
2063	uint32 security_info_wanted;
2064	TALLOC_CTX *mem_ctx;
2065	files_struct *fsp = NULL;
2066
2067	if(parameter_count < 8) {
2068	return ERROR_DOS(ERRDOS,ERRbadfunc);
2069	}
2070
2071	fsp = file_fsp(params,0);
2072	if(!fsp) {
2073	return ERROR_DOS(ERRDOS,ERRbadfid);
2074	}
2075
2076	security_info_wanted = IVAL(params,4);
2077
2078	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2079	(unsigned int)security_info_wanted ));
2080
2081	params = nttrans_realloc(ppparams, 4);
2082	if(params == NULL) {
2083	return ERROR_DOS(ERRDOS,ERRnomem);
2084	}
2085
2086	if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2087	DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2088	return ERROR_DOS(ERRDOS,ERRnomem);
2089	}
2090
2091	/*
2092	* Get the permissions to return.
2093	*/
2094
2095	if (!lp_nt_acl_support(SNUM(conn))) {
2096	sd_size = get_null_nt_acl(mem_ctx, &psd);
2097	} else {
2098	sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
2099	}
2100
2101	if (sd_size == 0) {
2102	talloc_destroy(mem_ctx);
2103	return(UNIXERROR(ERRDOS,ERRnoaccess));
2104	}
2105
2106	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2107
2108	SIVAL(params,0,(uint32)sd_size);
2109
2110	if(max_data_count < sd_size) {
2111
2112	send_nt_replies(outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2113	params, 4, *ppdata, 0);
2114	talloc_destroy(mem_ctx);
2115	return -1;
2116	}
2117
2118	/*
2119	* Allocate the data we will point this at.
2120	*/
2121
2122	data = nttrans_realloc(ppdata, sd_size);
2123	if(data == NULL) {
2124	talloc_destroy(mem_ctx);
2125	return ERROR_DOS(ERRDOS,ERRnomem);
2126	}
2127
2128	/*
2129	* Init the parse struct we will marshall into.
2130	*/
2131
2132	prs_init(&pd, 0, mem_ctx, MARSHALL);
2133
2134	/*
2135	* Setup the prs_struct to point at the memory we just
2136	* allocated.
2137	*/
2138
2139	prs_give_memory( &pd, data, (uint32)sd_size, False);
2140
2141	/*
2142	* Finally, linearize into the outgoing buffer.
2143	*/
2144
2145	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2146	DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2147	security descriptor.\n"));
2148	/*
2149	* Return access denied for want of a better error message..
2150	*/
2151	talloc_destroy(mem_ctx);
2152	return(UNIXERROR(ERRDOS,ERRnoaccess));
2153	}
2154
2155	/*
2156	* Now we can delete the security descriptor.
2157	*/
2158
2159	talloc_destroy(mem_ctx);
2160
2161	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 4, data,
2162	(int)sd_size);
2163	return -1;
2164	}
2165
2166	/****************************************************************************
2167	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2168	****************************************************************************/
2169
2170	static int call_nt_transact_set_security_desc(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2171	uint16 **ppsetup, uint32 setup_count,
2172	char **ppparams, uint32 parameter_count,
2173	char **ppdata, uint32 data_count, uint32 max_data_count)
2174	{
2175	char params= ppparams;
2176	char data = ppdata;
2177	files_struct *fsp = NULL;
2178	uint32 security_info_sent = 0;
2179	NTSTATUS nt_status;
2180
2181	if(parameter_count < 8) {
2182	return ERROR_DOS(ERRDOS,ERRbadfunc);
2183	}
2184
2185	if((fsp = file_fsp(params,0)) == NULL) {
2186	return ERROR_DOS(ERRDOS,ERRbadfid);
2187	}
2188
2189	if(!lp_nt_acl_support(SNUM(conn))) {
2190	goto done;
2191	}
2192
2193	security_info_sent = IVAL(params,4);
2194
2195	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2196	(unsigned int)security_info_sent ));
2197
2198	if (data_count == 0) {
2199	return ERROR_DOS(ERRDOS, ERRnoaccess);
2200	}
2201
2202	if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2203	return ERROR_NT(nt_status);
2204	}
2205
2206	done:
2207
2208	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2209	return -1;
2210	}
2211
2212	/****************************************************************************
2213	Reply to NT IOCTL
2214	****************************************************************************/
2215
2216	static int call_nt_transact_ioctl(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2217	uint16 **ppsetup, uint32 setup_count,
2218	char **ppparams, uint32 parameter_count,
2219	char **ppdata, uint32 data_count, uint32 max_data_count)
2220	{
2221	uint32 function;
2222	uint16 fidnum;
2223	files_struct *fsp;
2224	uint8 isFSctl;
2225	uint8 compfilter;
2226	static BOOL logged_message;
2227	char pdata = ppdata;
2228
2229	if (setup_count != 8) {
2230	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2231	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2232	}
2233
2234	function = IVAL(*ppsetup, 0);
2235	fidnum = SVAL(*ppsetup, 4);
2236	isFSctl = CVAL(*ppsetup, 6);
2237	compfilter = CVAL(*ppsetup, 7);
2238
2239	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2240	function, fidnum, isFSctl, compfilter));
2241
2242	fsp=file_fsp((char )ppsetup, 4);
2243	/* this check is done in each implemented function case for now
2244	because I don't want to break anything... --metze
2245	FSP_BELONGS_CONN(fsp,conn);*/
2246
2247	switch (function) {
2248	case FSCTL_SET_SPARSE:
2249	/* pretend this succeeded - tho strictly we should
2250	mark the file sparse (if the local fs supports it)
2251	so we can know if we need to pre-allocate or not */
2252
2253	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2254	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2255	0);
2256	return -1;
2257
2258	case FSCTL_0x000900C0:
2259	/* pretend this succeeded - don't know what this really is
2260	but works ok like this --metze
2261	*/
2262
2263	DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2264	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2265	0);
2266	return -1;
2267
2268	case FSCTL_GET_REPARSE_POINT:
2269	/* pretend this fail - my winXP does it like this
2270	* --metze
2271	*/
2272
2273	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2274	send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2275	NULL, 0, NULL, 0);
2276	return -1;
2277
2278	case FSCTL_SET_REPARSE_POINT:
2279	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2280	* --metze
2281	*/
2282
2283	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2284	send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2285	NULL, 0, NULL, 0);
2286	return -1;
2287
2288	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2289	{
2290	/*
2291	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2292	* and return their volume names. If max_data_count is 16, then it is just
2293	* asking for the number of volumes and length of the combined names.
2294	*
2295	* pdata is the data allocated by our caller, but that uses
2296	* total_data_count (which is 0 in our case) rather than max_data_count.
2297	* Allocate the correct amount and return the pointer to let
2298	* it be deallocated when we return.
2299	*/
2300	SHADOW_COPY_DATA *shadow_data = NULL;
2301	TALLOC_CTX *shadow_mem_ctx = NULL;
2302	BOOL labels = False;
2303	uint32 labels_data_count = 0;
2304	uint32 i;
2305	char *cur_pdata;
2306
2307	FSP_BELONGS_CONN(fsp,conn);
2308
2309	if (max_data_count < 16) {
2310	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2311	max_data_count));
2312	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2313	}
2314
2315	if (max_data_count > 16) {
2316	labels = True;
2317	}
2318
2319	shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2320	if (shadow_mem_ctx == NULL) {
2321	DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2322	return ERROR_NT(NT_STATUS_NO_MEMORY);
2323	}
2324
2325	shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2326	if (shadow_data == NULL) {
2327	DEBUG(0,("TALLOC_ZERO() failed!\n"));
2328	talloc_destroy(shadow_mem_ctx);
2329	return ERROR_NT(NT_STATUS_NO_MEMORY);
2330	}
2331
2332	shadow_data->mem_ctx = shadow_mem_ctx;
2333
2334	/*
2335	* Call the VFS routine to actually do the work.
2336	*/
2337	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2338	talloc_destroy(shadow_data->mem_ctx);
2339	if (errno == ENOSYS) {
2340	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2341	conn->connectpath));
2342	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2343	} else {
2344	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2345	conn->connectpath));
2346	return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2347	}
2348	}
2349
2350	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
2351
2352	if (!labels) {
2353	data_count = 16;
2354	} else {
2355	data_count = 12+labels_data_count+4;
2356	}
2357
2358	if (max_data_count<data_count) {
2359	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2360	max_data_count,data_count));
2361	talloc_destroy(shadow_data->mem_ctx);
2362	return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2363	}
2364
2365	pdata = nttrans_realloc(ppdata, data_count);
2366	if (pdata == NULL) {
2367	talloc_destroy(shadow_data->mem_ctx);
2368	return ERROR_NT(NT_STATUS_NO_MEMORY);
2369	}
2370
2371	cur_pdata = pdata;
2372
2373	/* num_volumes 4 bytes */
2374	SIVAL(pdata,0,shadow_data->num_volumes);
2375
2376	if (labels) {
2377	/* num_labels 4 bytes */
2378	SIVAL(pdata,4,shadow_data->num_volumes);
2379	}
2380
2381	/* needed_data_count 4 bytes */
2382	SIVAL(pdata,8,labels_data_count);
2383
2384	cur_pdata+=12;
2385
2386	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2387	shadow_data->num_volumes,fsp->fsp_name));
2388	if (labels && shadow_data->labels) {
2389	for (i=0;i<shadow_data->num_volumes;i++) {
2390	srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE\|STR_TERMINATE);
2391	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2392	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2393	}
2394	}
2395
2396	talloc_destroy(shadow_data->mem_ctx);
2397
2398	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2399	pdata, data_count);
2400
2401	return -1;
2402	}
2403
2404	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2405	{
2406	/* pretend this succeeded -
2407	*
2408	* we have to send back a list with all files owned by this SID
2409	*
2410	* but I have to check that --metze
2411	*/
2412	DOM_SID sid;
2413	uid_t uid;
2414	size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2415
2416	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2417
2418	FSP_BELONGS_CONN(fsp,conn);
2419
2420	/* unknown 4 bytes: this is not the length of the sid :-( */
2421	/unknown = IVAL(pdata,0);/
2422
2423	sid_parse(pdata+4,sid_len,&sid);
2424	DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2425
2426	if (!sid_to_uid(&sid, &uid)) {
2427	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2428	sid_string_static(&sid),(unsigned long)sid_len));
2429	uid = (-1);
2430	}
2431
2432	/* we can take a look at the find source :-)
2433	*
2434	* find ./ -uid $uid -name '*' is what we need here
2435	*
2436	*
2437	* and send 4bytes len and then NULL terminated unicode strings
2438	* for each file
2439	*
2440	* but I don't know how to deal with the paged results
2441	* (maybe we can hang the result anywhere in the fsp struct)
2442	*
2443	* we don't send all files at once
2444	* and at the next we should not start from the beginning,
2445	* so we have to cache the result
2446	*
2447	* --metze
2448	*/
2449
2450	/* this works for now... */
2451	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2452	NULL, 0);
2453	return -1;
2454	}
2455	default:
2456	if (!logged_message) {
2457	logged_message = True; /* Only print this once... */
2458	DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2459	function));
2460	}
2461	}
2462
2463	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2464	}
2465
2466
2467	#ifdef HAVE_SYS_QUOTAS
2468	/****************************************************************************
2469	Reply to get user quota
2470	****************************************************************************/
2471
2472	static int call_nt_transact_get_user_quota(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2473	uint16 **ppsetup, uint32 setup_count,
2474	char **ppparams, uint32 parameter_count,
2475	char **ppdata, uint32 data_count, uint32 max_data_count)
2476	{
2477	NTSTATUS nt_status = NT_STATUS_OK;
2478	char params = ppparams;
2479	char pdata = ppdata;
2480	char *entry;
2481	int data_len=0,param_len=0;
2482	int qt_len=0;
2483	int entry_len = 0;
2484	files_struct *fsp = NULL;
2485	uint16 level = 0;
2486	size_t sid_len;
2487	DOM_SID sid;
2488	BOOL start_enum = True;
2489	SMB_NTQUOTA_STRUCT qt;
2490	SMB_NTQUOTA_LIST *tmp_list;
2491	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2492
2493	ZERO_STRUCT(qt);
2494
2495	/* access check */
2496	if (current_user.ut.uid != 0) {
2497	DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2498	lp_servicename(SNUM(conn)),conn->user));
2499	return ERROR_DOS(ERRDOS,ERRnoaccess);
2500	}
2501
2502	/*
2503	* Ensure minimum number of parameters sent.
2504	*/
2505
2506	if (parameter_count < 4) {
2507	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2508	return ERROR_DOS(ERRDOS,ERRinvalidparam);
2509	}
2510
2511	/* maybe we can check the quota_fnum */
2512	fsp = file_fsp(params,0);
2513	if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2514	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2515	return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2516	}
2517
2518	/* the NULL pointer checking for fsp->fake_file_handle->pd
2519	* is done by CHECK_NTQUOTA_HANDLE_OK()
2520	*/
2521	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2522
2523	level = SVAL(params,2);
2524
2525	/* unknown 12 bytes leading in params */
2526
2527	switch (level) {
2528	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2529	/* seems that we should continue with the enum here --metze */
2530
2531	if (qt_handle->quota_list!=NULL &&
2532	qt_handle->tmp_list==NULL) {
2533
2534	/* free the list */
2535	free_ntquota_list(&(qt_handle->quota_list));
2536
2537	/* Realloc the size of parameters and data we will return */
2538	param_len = 4;
2539	params = nttrans_realloc(ppparams, param_len);
2540	if(params == NULL) {
2541	return ERROR_DOS(ERRDOS,ERRnomem);
2542	}
2543
2544	data_len = 0;
2545	SIVAL(params,0,data_len);
2546
2547	break;
2548	}
2549
2550	start_enum = False;
2551
2552	case TRANSACT_GET_USER_QUOTA_LIST_START:
2553
2554	if (qt_handle->quota_list==NULL &&
2555	qt_handle->tmp_list==NULL) {
2556	start_enum = True;
2557	}
2558
2559	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2560	return ERROR_DOS(ERRSRV,ERRerror);
2561
2562	/* Realloc the size of parameters and data we will return */
2563	param_len = 4;
2564	params = nttrans_realloc(ppparams, param_len);
2565	if(params == NULL) {
2566	return ERROR_DOS(ERRDOS,ERRnomem);
2567	}
2568
2569	/* we should not trust the value in max_data_count*/
2570	max_data_count = MIN(max_data_count,2048);
2571
2572	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2573	if(pdata == NULL) {
2574	return ERROR_DOS(ERRDOS,ERRnomem);
2575	}
2576
2577	entry = pdata;
2578
2579	/* set params Size of returned Quota Data 4 bytes*/
2580	/* but set it later when we know it */
2581
2582	/* for each entry push the data */
2583
2584	if (start_enum) {
2585	qt_handle->tmp_list = qt_handle->quota_list;
2586	}
2587
2588	tmp_list = qt_handle->tmp_list;
2589
2590	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2591	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2592
2593	sid_len = sid_size(&tmp_list->quotas->sid);
2594	entry_len = 40 + sid_len;
2595
2596	/* nextoffset entry 4 bytes */
2597	SIVAL(entry,0,entry_len);
2598
2599	/* then the len of the SID 4 bytes */
2600	SIVAL(entry,4,sid_len);
2601
2602	/* unknown data 8 bytes SMB_BIG_UINT */
2603	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2604
2605	/* the used disk space 8 bytes SMB_BIG_UINT */
2606	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2607
2608	/* the soft quotas 8 bytes SMB_BIG_UINT */
2609	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2610
2611	/* the hard quotas 8 bytes SMB_BIG_UINT */
2612	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2613
2614	/* and now the SID */
2615	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2616	}
2617
2618	qt_handle->tmp_list = tmp_list;
2619
2620	/* overwrite the offset of the last entry */
2621	SIVAL(entry-entry_len,0,0);
2622
2623	data_len = 4+qt_len;
2624	/* overwrite the params quota_data_len */
2625	SIVAL(params,0,data_len);
2626
2627	break;
2628
2629	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2630
2631	/* unknown 4 bytes IVAL(pdata,0) */
2632
2633	if (data_count < 8) {
2634	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2635	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2636	}
2637
2638	sid_len = IVAL(pdata,4);
2639	/* Ensure this is less than 1mb. */
2640	if (sid_len > (1024*1024)) {
2641	return ERROR_DOS(ERRDOS,ERRnomem);
2642	}
2643
2644	if (data_count < 8+sid_len) {
2645	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2646	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2647	}
2648
2649	data_len = 4+40+sid_len;
2650
2651	if (max_data_count < data_len) {
2652	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2653	max_data_count, data_len));
2654	param_len = 4;
2655	SIVAL(params,0,data_len);
2656	data_len = 0;
2657	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2658	break;
2659	}
2660
2661	sid_parse(pdata+8,sid_len,&sid);
2662
2663	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2664	ZERO_STRUCT(qt);
2665	/*
2666	* we have to return zero's in all fields
2667	* instead of returning an error here
2668	* --metze
2669	*/
2670	}
2671
2672	/* Realloc the size of parameters and data we will return */
2673	param_len = 4;
2674	params = nttrans_realloc(ppparams, param_len);
2675	if(params == NULL) {
2676	return ERROR_DOS(ERRDOS,ERRnomem);
2677	}
2678
2679	pdata = nttrans_realloc(ppdata, data_len);
2680	if(pdata == NULL) {
2681	return ERROR_DOS(ERRDOS,ERRnomem);
2682	}
2683
2684	entry = pdata;
2685
2686	/* set params Size of returned Quota Data 4 bytes*/
2687	SIVAL(params,0,data_len);
2688
2689	/* nextoffset entry 4 bytes */
2690	SIVAL(entry,0,0);
2691
2692	/* then the len of the SID 4 bytes */
2693	SIVAL(entry,4,sid_len);
2694
2695	/* unknown data 8 bytes SMB_BIG_UINT */
2696	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2697
2698	/* the used disk space 8 bytes SMB_BIG_UINT */
2699	SBIG_UINT(entry,16,qt.usedspace);
2700
2701	/* the soft quotas 8 bytes SMB_BIG_UINT */
2702	SBIG_UINT(entry,24,qt.softlim);
2703
2704	/* the hard quotas 8 bytes SMB_BIG_UINT */
2705	SBIG_UINT(entry,32,qt.hardlim);
2706
2707	/* and now the SID */
2708	sid_linearize(entry+40, sid_len, &sid);
2709
2710	break;
2711
2712	default:
2713	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2714	return ERROR_DOS(ERRSRV,ERRerror);
2715	break;
2716	}
2717
2718	send_nt_replies(outbuf, bufsize, nt_status, params, param_len,
2719	pdata, data_len);
2720
2721	return -1;
2722	}
2723
2724	/****************************************************************************
2725	Reply to set user quota
2726	****************************************************************************/
2727
2728	static int call_nt_transact_set_user_quota(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2729	uint16 **ppsetup, uint32 setup_count,
2730	char **ppparams, uint32 parameter_count,
2731	char **ppdata, uint32 data_count, uint32 max_data_count)
2732	{
2733	char params = ppparams;
2734	char pdata = ppdata;
2735	int data_len=0,param_len=0;
2736	SMB_NTQUOTA_STRUCT qt;
2737	size_t sid_len;
2738	DOM_SID sid;
2739	files_struct *fsp = NULL;
2740
2741	ZERO_STRUCT(qt);
2742
2743	/* access check */
2744	if (current_user.ut.uid != 0) {
2745	DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2746	lp_servicename(SNUM(conn)),conn->user));
2747	return ERROR_DOS(ERRDOS,ERRnoaccess);
2748	}
2749
2750	/*
2751	* Ensure minimum number of parameters sent.
2752	*/
2753
2754	if (parameter_count < 2) {
2755	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2756	return ERROR_DOS(ERRDOS,ERRinvalidparam);
2757	}
2758
2759	/* maybe we can check the quota_fnum */
2760	fsp = file_fsp(params,0);
2761	if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2762	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2763	return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2764	}
2765
2766	if (data_count < 40) {
2767	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2768	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2769	}
2770
2771	/* offset to next quota record.
2772	* 4 bytes IVAL(pdata,0)
2773	* unused here...
2774	*/
2775
2776	/* sid len */
2777	sid_len = IVAL(pdata,4);
2778
2779	if (data_count < 40+sid_len) {
2780	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2781	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2782	}
2783
2784	/* unknown 8 bytes in pdata
2785	* maybe its the change time in NTTIME
2786	*/
2787
2788	/* the used space 8 bytes (SMB_BIG_UINT)*/
2789	qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2790	#ifdef LARGE_SMB_OFF_T
2791	qt.usedspace \|= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2792	#else /* LARGE_SMB_OFF_T */
2793	if ((IVAL(pdata,20) != 0)&&
2794	((qt.usedspace != 0xFFFFFFFF)\|\|
2795	(IVAL(pdata,20)!=0xFFFFFFFF))) {
2796	/* more than 32 bits? */
2797	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2798	}
2799	#endif /* LARGE_SMB_OFF_T */
2800
2801	/* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2802	qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2803	#ifdef LARGE_SMB_OFF_T
2804	qt.softlim \|= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2805	#else /* LARGE_SMB_OFF_T */
2806	if ((IVAL(pdata,28) != 0)&&
2807	((qt.softlim != 0xFFFFFFFF)\|\|
2808	(IVAL(pdata,28)!=0xFFFFFFFF))) {
2809	/* more than 32 bits? */
2810	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2811	}
2812	#endif /* LARGE_SMB_OFF_T */
2813
2814	/* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2815	qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2816	#ifdef LARGE_SMB_OFF_T
2817	qt.hardlim \|= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2818	#else /* LARGE_SMB_OFF_T */
2819	if ((IVAL(pdata,36) != 0)&&
2820	((qt.hardlim != 0xFFFFFFFF)\|\|
2821	(IVAL(pdata,36)!=0xFFFFFFFF))) {
2822	/* more than 32 bits? */
2823	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2824	}
2825	#endif /* LARGE_SMB_OFF_T */
2826
2827	sid_parse(pdata+40,sid_len,&sid);
2828	DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2829
2830	/* 44 unknown bytes left... */
2831
2832	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2833	return ERROR_DOS(ERRSRV,ERRerror);
2834	}
2835
2836	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len,
2837	pdata, data_len);
2838
2839	return -1;
2840	}
2841	#endif /* HAVE_SYS_QUOTAS */
2842
2843	static int handle_nttrans(connection_struct *conn,
2844	struct trans_state *state,
2845	char inbuf, char outbuf, int size, int bufsize)
2846	{
2847	int outsize;
2848
2849	if (Protocol >= PROTOCOL_NT1) {
2850	SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) \| 0x40); /* IS_LONG_NAME */
2851	}
2852
2853	/* Now we must call the relevant NT_TRANS function */
2854	switch(state->call) {
2855	case NT_TRANSACT_CREATE:
2856	{
2857	START_PROFILE(NT_transact_create);
2858	outsize = call_nt_transact_create(conn, inbuf, outbuf,
2859	size, bufsize,
2860	&state->setup, state->setup_count,
2861	&state->param, state->total_param,
2862	&state->data, state->total_data,
2863	state->max_data_return);
2864	END_PROFILE(NT_transact_create);
2865	break;
2866	}
2867
2868	case NT_TRANSACT_IOCTL:
2869	{
2870	START_PROFILE(NT_transact_ioctl);
2871	outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2872	size, bufsize,
2873	&state->setup, state->setup_count,
2874	&state->param, state->total_param,
2875	&state->data, state->total_data, state->max_data_return);
2876	END_PROFILE(NT_transact_ioctl);
2877	break;
2878	}
2879
2880	case NT_TRANSACT_SET_SECURITY_DESC:
2881	{
2882	START_PROFILE(NT_transact_set_security_desc);
2883	outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2884	size, bufsize,
2885	&state->setup, state->setup_count,
2886	&state->param, state->total_param,
2887	&state->data, state->total_data, state->max_data_return);
2888	END_PROFILE(NT_transact_set_security_desc);
2889	break;
2890	}
2891
2892	case NT_TRANSACT_NOTIFY_CHANGE:
2893	{
2894	START_PROFILE(NT_transact_notify_change);
2895	outsize = call_nt_transact_notify_change(
2896	conn, inbuf, outbuf, size, bufsize,
2897	&state->setup, state->setup_count,
2898	&state->param, state->total_param,
2899	&state->data, state->total_data,
2900	state->max_data_return,
2901	state->max_param_return);
2902	END_PROFILE(NT_transact_notify_change);
2903	break;
2904	}
2905
2906	case NT_TRANSACT_RENAME:
2907	{
2908	START_PROFILE(NT_transact_rename);
2909	outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2910	size, bufsize,
2911	&state->setup, state->setup_count,
2912	&state->param, state->total_param,
2913	&state->data, state->total_data, state->max_data_return);
2914	END_PROFILE(NT_transact_rename);
2915	break;
2916	}
2917
2918	case NT_TRANSACT_QUERY_SECURITY_DESC:
2919	{
2920	START_PROFILE(NT_transact_query_security_desc);
2921	outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2922	size, bufsize,
2923	&state->setup, state->setup_count,
2924	&state->param, state->total_param,
2925	&state->data, state->total_data, state->max_data_return);
2926	END_PROFILE(NT_transact_query_security_desc);
2927	break;
2928	}
2929
2930	#ifdef HAVE_SYS_QUOTAS
2931	case NT_TRANSACT_GET_USER_QUOTA:
2932	{
2933	START_PROFILE(NT_transact_get_user_quota);
2934	outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2935	size, bufsize,
2936	&state->setup, state->setup_count,
2937	&state->param, state->total_param,
2938	&state->data, state->total_data, state->max_data_return);
2939	END_PROFILE(NT_transact_get_user_quota);
2940	break;
2941	}
2942
2943	case NT_TRANSACT_SET_USER_QUOTA:
2944	{
2945	START_PROFILE(NT_transact_set_user_quota);
2946	outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2947	size, bufsize,
2948	&state->setup, state->setup_count,
2949	&state->param, state->total_param,
2950	&state->data, state->total_data, state->max_data_return);
2951	END_PROFILE(NT_transact_set_user_quota);
2952	break;
2953	}
2954	#endif /* HAVE_SYS_QUOTAS */
2955
2956	default:
2957	/* Error in request */
2958	DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2959	state->call));
2960	return ERROR_DOS(ERRSRV,ERRerror);
2961	}
2962	return outsize;
2963	}
2964
2965	/****************************************************************************
2966	Reply to a SMBNTtrans.
2967	****************************************************************************/
2968
2969	int reply_nttrans(connection_struct *conn,
2970	char inbuf,char outbuf,int size,int bufsize)
2971	{
2972	int outsize = 0;
2973	uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2974	uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2975	uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2976	uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2977
2978	uint16 function_code = SVAL( inbuf, smb_nt_Function);
2979	NTSTATUS result;
2980	struct trans_state *state;
2981
2982	START_PROFILE(SMBnttrans);
2983
2984	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2985	END_PROFILE(SMBnttrans);
2986	return ERROR_DOS(ERRSRV,ERRaccess);
2987	}
2988
2989	result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2990	if (!NT_STATUS_IS_OK(result)) {
2991	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2992	END_PROFILE(SMBnttrans);
2993	return ERROR_NT(result);
2994	}
2995
2996	if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
2997	END_PROFILE(SMBnttrans);
2998	return ERROR_DOS(ERRSRV,ERRaccess);
2999	}
3000
3001	state->cmd = SMBnttrans;
3002
3003	state->mid = SVAL(inbuf,smb_mid);
3004	state->vuid = SVAL(inbuf,smb_uid);
3005	state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
3006	state->data = NULL;
3007	state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
3008	state->param = NULL;
3009	state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
3010	state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
3011
3012	/* setup count is in words */
3013	state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
3014	state->setup = NULL;
3015	state->call = function_code;
3016
3017	/*
3018	* All nttrans messages we handle have smb_wct == 19 +
3019	* state->setup_count. Ensure this is so as a sanity check.
3020	*/
3021
3022	if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
3023	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3024	CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
3025	goto bad_param;
3026	}
3027
3028	/* Don't allow more than 128mb for each value. */
3029	if ((state->total_data > (10241024128)) \|\|
3030	(state->total_param > (10241024128))) {
3031	END_PROFILE(SMBnttrans);
3032	return ERROR_DOS(ERRDOS,ERRnomem);
3033	}
3034
3035	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
3036	goto bad_param;
3037
3038	if (state->total_data) {
3039	/* Can't use talloc here, the core routines do realloc on the
3040	* params and data. */
3041	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3042	DEBUG(0,("reply_nttrans: data malloc fail for %u "
3043	"bytes !\n", (unsigned int)state->total_data));
3044	TALLOC_FREE(state);
3045	END_PROFILE(SMBnttrans);
3046	return(ERROR_DOS(ERRDOS,ERRnomem));
3047	}
3048	if ((dsoff+dscnt < dsoff) \|\| (dsoff+dscnt < dscnt))
3049	goto bad_param;
3050	if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) \|\|
3051	(smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
3052	goto bad_param;
3053
3054	memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
3055	}
3056
3057	if (state->total_param) {
3058	/* Can't use talloc here, the core routines do realloc on the
3059	* params and data. */
3060	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3061	DEBUG(0,("reply_nttrans: param malloc fail for %u "
3062	"bytes !\n", (unsigned int)state->total_param));
3063	SAFE_FREE(state->data);
3064	TALLOC_FREE(state);
3065	END_PROFILE(SMBnttrans);
3066	return(ERROR_DOS(ERRDOS,ERRnomem));
3067	}
3068	if ((psoff+pscnt < psoff) \|\| (psoff+pscnt < pscnt))
3069	goto bad_param;
3070	if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) \|\|
3071	(smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
3072	goto bad_param;
3073
3074	memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
3075	}
3076
3077	state->received_data = dscnt;
3078	state->received_param = pscnt;
3079
3080	if(state->setup_count > 0) {
3081	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3082	state->setup_count));
3083	state->setup = (uint16 *)TALLOC(state, state->setup_count);
3084	if (state->setup == NULL) {
3085	DEBUG(0,("reply_nttrans : Out of memory\n"));
3086	SAFE_FREE(state->data);
3087	SAFE_FREE(state->param);
3088	TALLOC_FREE(state);
3089	END_PROFILE(SMBnttrans);
3090	return ERROR_DOS(ERRDOS,ERRnomem);
3091	}
3092
3093	if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) \|\|
3094	(smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3095	goto bad_param;
3096	}
3097	if (smb_nt_SetupStart + state->setup_count > size) {
3098	goto bad_param;
3099	}
3100
3101	memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
3102	dump_data(10, (char *)state->setup, state->setup_count);
3103	}
3104
3105	if ((state->received_data == state->total_data) &&
3106	(state->received_param == state->total_param)) {
3107	outsize = handle_nttrans(conn, state, inbuf, outbuf,
3108	size, bufsize);
3109	SAFE_FREE(state->param);
3110	SAFE_FREE(state->data);
3111	TALLOC_FREE(state);
3112	END_PROFILE(SMBnttrans);
3113	return outsize;
3114	}
3115
3116	DLIST_ADD(conn->pending_trans, state);
3117
3118	/* We need to send an interim response then receive the rest
3119	of the parameter/data bytes */
3120	outsize = set_message(outbuf,0,0,False);
3121	show_msg(outbuf);
3122	END_PROFILE(SMBnttrans);
3123	return outsize;
3124
3125	bad_param:
3126
3127	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3128	SAFE_FREE(state->data);
3129	SAFE_FREE(state->param);
3130	TALLOC_FREE(state);
3131	END_PROFILE(SMBnttrans);
3132	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3133	}
3134
3135	/****************************************************************************
3136	Reply to a SMBnttranss
3137	****************************************************************************/
3138
3139	int reply_nttranss(connection_struct conn, char inbuf,char *outbuf,
3140	int size,int bufsize)
3141	{
3142	int outsize = 0;
3143	unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3144	struct trans_state *state;
3145
3146	START_PROFILE(SMBnttranss);
3147
3148	show_msg(inbuf);
3149
3150	for (state = conn->pending_trans; state != NULL;
3151	state = state->next) {
3152	if (state->mid == SVAL(inbuf,smb_mid)) {
3153	break;
3154	}
3155	}
3156
3157	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
3158	END_PROFILE(SMBnttranss);
3159	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3160	}
3161
3162	/* Revise state->total_param and state->total_data in case they have
3163	changed downwards */
3164	if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3165	state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3166	}
3167	if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3168	state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3169	}
3170
3171	pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3172	poff = IVAL(inbuf, smb_nts_ParameterOffset);
3173	pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3174
3175	dcnt = IVAL(inbuf, smb_nts_DataCount);
3176	ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3177	doff = IVAL(inbuf, smb_nts_DataOffset);
3178
3179	state->received_param += pcnt;
3180	state->received_data += dcnt;
3181
3182	if ((state->received_data > state->total_data) \|\|
3183	(state->received_param > state->total_param))
3184	goto bad_param;
3185
3186	if (pcnt) {
3187	if (pdisp+pcnt > state->total_param)
3188	goto bad_param;
3189	if ((pdisp+pcnt < pdisp) \|\| (pdisp+pcnt < pcnt))
3190	goto bad_param;
3191	if (pdisp > state->total_param)
3192	goto bad_param;
3193	if ((smb_base(inbuf) + poff + pcnt > inbuf + size) \|\|
3194	(smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3195	goto bad_param;
3196	if (state->param + pdisp < state->param)
3197	goto bad_param;
3198
3199	memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3200	pcnt);
3201	}
3202
3203	if (dcnt) {
3204	if (ddisp+dcnt > state->total_data)
3205	goto bad_param;
3206	if ((ddisp+dcnt < ddisp) \|\| (ddisp+dcnt < dcnt))
3207	goto bad_param;
3208	if (ddisp > state->total_data)
3209	goto bad_param;
3210	if ((smb_base(inbuf) + doff + dcnt > inbuf + size) \|\|
3211	(smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3212	goto bad_param;
3213	if (state->data + ddisp < state->data)
3214	goto bad_param;
3215
3216	memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3217	dcnt);
3218	}
3219
3220	if ((state->received_param < state->total_param) \|\|
3221	(state->received_data < state->total_data)) {
3222	END_PROFILE(SMBnttranss);
3223	return -1;
3224	}
3225
3226	/* construct_reply_common has done us the favor to pre-fill the
3227	* command field with SMBnttranss which is wrong :-)
3228	*/
3229	SCVAL(outbuf,smb_com,SMBnttrans);
3230
3231	outsize = handle_nttrans(conn, state, inbuf, outbuf,
3232	size, bufsize);
3233
3234	DLIST_REMOVE(conn->pending_trans, state);
3235	SAFE_FREE(state->data);
3236	SAFE_FREE(state->param);
3237	TALLOC_FREE(state);
3238
3239	if (outsize == 0) {
3240	END_PROFILE(SMBnttranss);
3241	return(ERROR_DOS(ERRSRV,ERRnosupport));
3242	}
3243
3244	END_PROFILE(SMBnttranss);
3245	return(outsize);
3246
3247	bad_param:
3248
3249	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3250	DLIST_REMOVE(conn->pending_trans, state);
3251	SAFE_FREE(state->data);
3252	SAFE_FREE(state->param);
3253	TALLOC_FREE(state);
3254	END_PROFILE(SMBnttranss);
3255	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3256	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: