Context Navigation

← Previous Revision
Latest Revision
Next Revision →
Blame
Revision Log

nttrans.c@ 1

Visit:

Last change on this file since 1 was 1, checked in by Paul Smedley, 18 years ago
Initial code import
File size: 85.5 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-1998
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 2 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program; if not, write to the Free Software
19	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20	*/
21
22	#include "includes.h"
23
24	extern int max_send;
25	extern enum protocol_types Protocol;
26	extern int smb_read_error;
27	extern struct current_user current_user;
28
29	static const char *known_nt_pipes[] = {
30	"\\LANMAN",
31	"\\srvsvc",
32	"\\samr",
33	"\\wkssvc",
34	"\\NETLOGON",
35	"\\ntlsa",
36	"\\ntsvcs",
37	"\\lsass",
38	"\\lsarpc",
39	"\\winreg",
40	"\\initshutdown",
41	"\\spoolss",
42	"\\netdfs",
43	"\\rpcecho",
44	"\\svcctl",
45	"\\eventlog",
46	"\\unixinfo",
47	NULL
48	};
49
50	static char nttrans_realloc(char *ptr, size_t size)
51	{
52	if (ptr==NULL) {
53	smb_panic("nttrans_realloc() called with NULL ptr\n");
54	}
55
56	ptr = (char )SMB_REALLOC(*ptr, size);
57	if(*ptr == NULL) {
58	return NULL;
59	}
60	memset(*ptr,'\0',size);
61	return *ptr;
62	}
63
64	/****************************************************************************
65	Send the required number of replies back.
66	We assume all fields other than the data fields are
67	set correctly for the type of call.
68	HACK ! Always assumes smb_setup field is zero.
69	****************************************************************************/
70
71	int send_nt_replies(char *outbuf, int bufsize, NTSTATUS nt_error,
72	char params, int paramsize, char pdata, int datasize)
73	{
74	int data_to_send = datasize;
75	int params_to_send = paramsize;
76	int useable_space;
77	char *pp = params;
78	char *pd = pdata;
79	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80	int alignment_offset = 3;
81	int data_alignment_offset = 0;
82
83	/*
84	* Initially set the wcnt area to be 18 - this is true for all
85	* transNT replies.
86	*/
87
88	set_message(outbuf,18,0,True);
89
90	if (NT_STATUS_V(nt_error)) {
91	ERROR_NT(nt_error);
92	}
93
94	/*
95	* If there genuinely are no parameters or data to send just send
96	* the empty packet.
97	*/
98
99	if(params_to_send == 0 && data_to_send == 0) {
100	show_msg(outbuf);
101	if (!send_smb(smbd_server_fd(),outbuf)) {
102	exit_server_cleanly("send_nt_replies: send_smb failed.");
103	}
104	return 0;
105	}
106
107	/*
108	* When sending params and data ensure that both are nicely aligned.
109	* Only do this alignment when there is also data to send - else
110	* can cause NT redirector problems.
111	*/
112
113	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
114	data_alignment_offset = 4 - (params_to_send % 4);
115	}
116
117	/*
118	* Space is bufsize minus Netbios over TCP header minus SMB header.
119	* The alignment_offset is to align the param bytes on a four byte
120	* boundary (2 bytes for data len, one byte pad).
121	* NT needs this to work correctly.
122	*/
123
124	useable_space = bufsize - ((smb_buf(outbuf)+
125	alignment_offset+data_alignment_offset) -
126	outbuf);
127
128	/*
129	* useable_space can never be more than max_send minus the
130	* alignment offset.
131	*/
132
133	useable_space = MIN(useable_space,
134	max_send - (alignment_offset+data_alignment_offset));
135
136
137	while (params_to_send \|\| data_to_send) {
138
139	/*
140	* Calculate whether we will totally or partially fill this packet.
141	*/
142
143	total_sent_thistime = params_to_send + data_to_send +
144	alignment_offset + data_alignment_offset;
145
146	/*
147	* We can never send more than useable_space.
148	*/
149
150	total_sent_thistime = MIN(total_sent_thistime, useable_space);
151
152	set_message(outbuf, 18, total_sent_thistime, True);
153
154	/*
155	* Set total params and data to be sent.
156	*/
157
158	SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
159	SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
160
161	/*
162	* Calculate how many parameters and data we can fit into
163	* this packet. Parameters get precedence.
164	*/
165
166	params_sent_thistime = MIN(params_to_send,useable_space);
167	data_sent_thistime = useable_space - params_sent_thistime;
168	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
169
170	SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
171
172	if(params_sent_thistime == 0) {
173	SIVAL(outbuf,smb_ntr_ParameterOffset,0);
174	SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
175	} else {
176	/*
177	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
178	* parameter bytes, however the first 4 bytes of outbuf are
179	* the Netbios over TCP header. Thus use smb_base() to subtract
180	* them from the calculation.
181	*/
182
183	SIVAL(outbuf,smb_ntr_ParameterOffset,
184	((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
185	/*
186	* Absolute displacement of param bytes sent in this packet.
187	*/
188
189	SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
190	}
191
192	/*
193	* Deal with the data portion.
194	*/
195
196	SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
197
198	if(data_sent_thistime == 0) {
199	SIVAL(outbuf,smb_ntr_DataOffset,0);
200	SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
201	} else {
202	/*
203	* The offset of the data bytes is the offset of the
204	* parameter bytes plus the number of parameters being sent this time.
205	*/
206
207	SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
208	smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
209	SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
210	}
211
212	/*
213	* Copy the param bytes into the packet.
214	*/
215
216	if(params_sent_thistime) {
217	memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
218	}
219
220	/*
221	* Copy in the data bytes
222	*/
223
224	if(data_sent_thistime) {
225	memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
226	data_alignment_offset,pd,data_sent_thistime);
227	}
228
229	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
230	params_sent_thistime, data_sent_thistime, useable_space));
231	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
232	params_to_send, data_to_send, paramsize, datasize));
233
234	/* Send the packet */
235	show_msg(outbuf);
236	if (!send_smb(smbd_server_fd(),outbuf)) {
237	exit_server_cleanly("send_nt_replies: send_smb failed.");
238	}
239
240	pp += params_sent_thistime;
241	pd += data_sent_thistime;
242
243	params_to_send -= params_sent_thistime;
244	data_to_send -= data_sent_thistime;
245
246	/*
247	* Sanity check
248	*/
249
250	if(params_to_send < 0 \|\| data_to_send < 0) {
251	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
252	params_to_send, data_to_send));
253	return -1;
254	}
255	}
256
257	return 0;
258	}
259
260	/****************************************************************************
261	Is it an NTFS stream name ?
262	****************************************************************************/
263
264	BOOL is_ntfs_stream_name(const char *fname)
265	{
266	if (lp_posix_pathnames()) {
267	return False;
268	}
269	return (strchr_m(fname, ':') != NULL) ? True : False;
270	}
271
272	/****************************************************************************
273	Save case statics.
274	****************************************************************************/
275
276	static BOOL saved_case_sensitive;
277	static BOOL saved_case_preserve;
278	static BOOL saved_short_case_preserve;
279
280	/****************************************************************************
281	Save case semantics.
282	****************************************************************************/
283
284	static uint32 set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
285	{
286	if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
287	return file_attributes;
288	}
289
290	saved_case_sensitive = conn->case_sensitive;
291	saved_case_preserve = conn->case_preserve;
292	saved_short_case_preserve = conn->short_case_preserve;
293
294	/* Set to POSIX. */
295	conn->case_sensitive = True;
296	conn->case_preserve = True;
297	conn->short_case_preserve = True;
298
299	return (file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
300	}
301
302	/****************************************************************************
303	Restore case semantics.
304	****************************************************************************/
305
306	static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
307	{
308	if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
309	return;
310	}
311
312	conn->case_sensitive = saved_case_sensitive;
313	conn->case_preserve = saved_case_preserve;
314	conn->short_case_preserve = saved_short_case_preserve;
315	}
316
317	/****************************************************************************
318	Reply to an NT create and X call on a pipe.
319	****************************************************************************/
320
321	static int nt_open_pipe(char fname, connection_struct conn,
322	char inbuf, char outbuf, int *ppnum)
323	{
324	smb_np_struct *p = NULL;
325	uint16 vuid = SVAL(inbuf, smb_uid);
326	int i;
327
328	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
329
330	/* See if it is one we want to handle. */
331
332	if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
333	return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
334	}
335
336	for( i = 0; known_nt_pipes[i]; i++ ) {
337	if( strequal(fname,known_nt_pipes[i])) {
338	break;
339	}
340	}
341
342	if ( known_nt_pipes[i] == NULL ) {
343	return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
344	}
345
346	/* Strip \\ off the name. */
347	fname++;
348
349	DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
350
351	p = open_rpc_pipe_p(fname, conn, vuid);
352	if (!p) {
353	return(ERROR_DOS(ERRSRV,ERRnofids));
354	}
355
356	/* TODO: Add pipe to db */
357
358	if ( !store_pipe_opendb( p ) ) {
359	DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
360	}
361
362	*ppnum = p->pnum;
363	return 0;
364	}
365
366	/****************************************************************************
367	Reply to an NT create and X call for pipes.
368	****************************************************************************/
369
370	static int do_ntcreate_pipe_open(connection_struct *conn,
371	char inbuf,char outbuf,int length,int bufsize)
372	{
373	pstring fname;
374	int ret;
375	int pnum = -1;
376	char *p = NULL;
377
378	srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
379
380	if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
381	return ret;
382	}
383
384	/*
385	* Deal with pipe return.
386	*/
387
388	set_message(outbuf,34,0,True);
389
390	p = outbuf + smb_vwv2;
391	p++;
392	SSVAL(p,0,pnum);
393	p += 2;
394	SIVAL(p,0,FILE_WAS_OPENED);
395	p += 4;
396	p += 32;
397	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
398	p += 20;
399	/* File type. */
400	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
401	/* Device state. */
402	SSVAL(p,2, 0x5FF); /* ? */
403
404	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
405
406	return chain_reply(inbuf,outbuf,length,bufsize);
407	}
408
409	/****************************************************************************
410	Reply to an NT create and X call for a quota file.
411	****************************************************************************/
412
413	int reply_ntcreate_and_X_quota(connection_struct *conn,
414	char *inbuf,
415	char *outbuf,
416	int length,
417	int bufsize,
418	enum FAKE_FILE_TYPE fake_file_type,
419	const char *fname)
420	{
421	int result;
422	char *p;
423	uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
424	files_struct *fsp;
425	NTSTATUS status;
426
427	status = open_fake_file(conn, fake_file_type, fname, desired_access,
428	&fsp);
429
430	if (!NT_STATUS_IS_OK(status)) {
431	return ERROR_NT(status);
432	}
433
434	set_message(outbuf,34,0,True);
435
436	p = outbuf + smb_vwv2;
437
438	/* SCVAL(p,0,NO_OPLOCK_RETURN); */
439	p++;
440	SSVAL(p,0,fsp->fnum);
441
442	DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
443
444	result = chain_reply(inbuf,outbuf,length,bufsize);
445	return result;
446	}
447
448	/****************************************************************************
449	Reply to an NT create and X call.
450	****************************************************************************/
451
452	int reply_ntcreate_and_X(connection_struct *conn,
453	char inbuf,char outbuf,int length,int bufsize)
454	{
455	int result;
456	pstring fname;
457	uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
458	uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
459	uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
460	uint32 new_file_attributes;
461	uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
462	uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
463	uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
464	uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
465	/* Breakout the oplock request bits so we can set the
466	reply bits separately. */
467	int oplock_request = 0;
468	uint32 fattr=0;
469	SMB_OFF_T file_len = 0;
470	SMB_STRUCT_STAT sbuf;
471	int info = 0;
472	files_struct *fsp=NULL;
473	char *p = NULL;
474	struct timespec c_timespec;
475	struct timespec a_timespec;
476	struct timespec m_timespec;
477	BOOL extended_oplock_granted = False;
478	NTSTATUS status;
479
480	START_PROFILE(SMBntcreateX);
481
482	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
483	"file_attributes = 0x%x, share_access = 0x%x, "
484	"create_disposition = 0x%x create_options = 0x%x "
485	"root_dir_fid = 0x%x\n",
486	(unsigned int)flags,
487	(unsigned int)access_mask,
488	(unsigned int)file_attributes,
489	(unsigned int)share_access,
490	(unsigned int)create_disposition,
491	(unsigned int)create_options,
492	(unsigned int)root_dir_fid ));
493
494	/* If it's an IPC, use the pipe handler. */
495
496	if (IS_IPC(conn)) {
497	if (lp_nt_pipe_support()) {
498	END_PROFILE(SMBntcreateX);
499	return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
500	} else {
501	END_PROFILE(SMBntcreateX);
502	return(ERROR_DOS(ERRDOS,ERRnoaccess));
503	}
504	}
505
506	if (create_options & FILE_OPEN_BY_FILE_ID) {
507	END_PROFILE(SMBntcreateX);
508	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
509	}
510
511	/*
512	* Get the file name.
513	*/
514
515	if(root_dir_fid != 0) {
516	/*
517	* This filename is relative to a directory fid.
518	*/
519	pstring rel_fname;
520	files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
521	size_t dir_name_len;
522
523	if(!dir_fsp) {
524	END_PROFILE(SMBntcreateX);
525	return(ERROR_DOS(ERRDOS,ERRbadfid));
526	}
527
528	if(!dir_fsp->is_directory) {
529
530	srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
531	if (!NT_STATUS_IS_OK(status)) {
532	END_PROFILE(SMBntcreateX);
533	return ERROR_NT(status);
534	}
535
536	/*
537	* Check to see if this is a mac fork of some kind.
538	*/
539
540	if( is_ntfs_stream_name(fname)) {
541	END_PROFILE(SMBntcreateX);
542	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
543	}
544
545	/*
546	we need to handle the case when we get a
547	relative open relative to a file and the
548	pathname is blank - this is a reopen!
549	(hint from demyn plantenberg)
550	*/
551
552	END_PROFILE(SMBntcreateX);
553	return(ERROR_DOS(ERRDOS,ERRbadfid));
554	}
555
556	/*
557	* Copy in the base directory name.
558	*/
559
560	pstrcpy( fname, dir_fsp->fsp_name );
561	dir_name_len = strlen(fname);
562
563	/*
564	* Ensure it ends in a '\'.
565	*/
566
567	if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
568	pstrcat(fname, "/");
569	dir_name_len++;
570	}
571
572	srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
573	if (!NT_STATUS_IS_OK(status)) {
574	END_PROFILE(SMBntcreateX);
575	return ERROR_NT(status);
576	}
577	pstrcat(fname, rel_fname);
578	} else {
579	srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
580	if (!NT_STATUS_IS_OK(status)) {
581	END_PROFILE(SMBntcreateX);
582	return ERROR_NT(status);
583	}
584
585	/*
586	* Check to see if this is a mac fork of some kind.
587	*/
588
589	if( is_ntfs_stream_name(fname)) {
590	enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
591	if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
592	/*
593	* Here we go! support for changing the disk quotas --metze
594	*
595	* We need to fake up to open this MAGIC QUOTA file
596	* and return a valid FID.
597	*
598	* w2k close this file directly after openening
599	* xp also tries a QUERY_FILE_INFO on the file and then close it
600	*/
601	result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
602	fake_file_type, fname);
603	END_PROFILE(SMBntcreateX);
604	return result;
605	} else {
606	END_PROFILE(SMBntcreateX);
607	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
608	}
609	}
610	}
611
612	/*
613	* Now contruct the smb_open_mode value from the filename,
614	* desired access and the share access.
615	*/
616	RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
617
618	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
619	if (oplock_request) {
620	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
621	}
622
623	/*
624	* Ordinary file or directory.
625	*/
626
627	/*
628	* Check if POSIX semantics are wanted.
629	*/
630
631	new_file_attributes = set_posix_case_semantics(conn, file_attributes);
632
633	status = unix_convert(conn, fname, False, NULL, &sbuf);
634	if (!NT_STATUS_IS_OK(status)) {
635	restore_case_semantics(conn, file_attributes);
636	END_PROFILE(SMBntcreateX);
637	return ERROR_NT(status);
638	}
639	/* All file access must go through check_name() */
640	status = check_name(conn, fname);
641	if (!NT_STATUS_IS_OK(status)) {
642	restore_case_semantics(conn, file_attributes);
643	END_PROFILE(SMBntcreateX);
644	return ERROR_NT(status);
645	}
646
647	/* This is the correct thing to do (check every time) but can_delete is
648	expensive (it may have to read the parent directory permissions). So
649	for now we're not doing it unless we have a strong hint the client
650	is really going to delete this file. If the client is forcing FILE_CREATE
651	let the filesystem take care of the permissions. */
652
653	/* Setting FILE_SHARE_DELETE is the hint. */
654
655	if (lp_acl_check_permissions(SNUM(conn))
656	&& (create_disposition != FILE_CREATE)
657	&& (share_access & FILE_SHARE_DELETE)
658	&& (access_mask & DELETE_ACCESS)) {
659	if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) \|\|
660	!can_delete_file_in_directory(conn, fname)) {
661	restore_case_semantics(conn, file_attributes);
662	END_PROFILE(SMBntcreateX);
663	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
664	}
665	}
666
667	/*
668	* If it's a request for a directory open, deal with it separately.
669	*/
670
671	if(create_options & FILE_DIRECTORY_FILE) {
672	oplock_request = 0;
673
674	/* Can't open a temp directory. IFS kit test. */
675	if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
676	END_PROFILE(SMBntcreateX);
677	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
678	}
679
680	status = open_directory(conn, fname, &sbuf,
681	access_mask,
682	share_access,
683	create_disposition,
684	create_options,
685	new_file_attributes,
686	&info, &fsp);
687
688	restore_case_semantics(conn, file_attributes);
689
690	if(!NT_STATUS_IS_OK(status)) {
691	if (!use_nt_status() && NT_STATUS_EQUAL(
692	status, NT_STATUS_OBJECT_NAME_COLLISION)) {
693	status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
694	}
695	END_PROFILE(SMBntcreateX);
696	return ERROR_NT(status);
697	}
698	} else {
699	/*
700	* Ordinary file case.
701	*/
702
703	/* NB. We have a potential bug here. If we
704	* cause an oplock break to ourselves, then we
705	* could end up processing filename related
706	* SMB requests whilst we await the oplock
707	* break response. As we may have changed the
708	* filename case semantics to be POSIX-like,
709	* this could mean a filename request could
710	* fail when it should succeed. This is a rare
711	* condition, but eventually we must arrange
712	* to restore the correct case semantics
713	* before issuing an oplock break request to
714	* our client. JRA. */
715
716	status = open_file_ntcreate(conn,fname,&sbuf,
717	access_mask,
718	share_access,
719	create_disposition,
720	create_options,
721	new_file_attributes,
722	oplock_request,
723	&info, &fsp);
724	if (!NT_STATUS_IS_OK(status)) {
725	/* We cheat here. There are two cases we
726	* care about. One is a directory rename,
727	* where the NT client will attempt to
728	* open the source directory for
729	* DELETE access. Note that when the
730	* NT client does this it does not
731	* set the directory bit in the
732	* request packet. This is translated
733	* into a read/write open
734	* request. POSIX states that any open
735	* for write request on a directory
736	* will generate an EISDIR error, so
737	* we can catch this here and open a
738	* pseudo handle that is flagged as a
739	* directory. The second is an open
740	* for a permissions read only, which
741	* we handle in the open_file_stat case. JRA.
742	*/
743
744	if (NT_STATUS_EQUAL(status,
745	NT_STATUS_FILE_IS_A_DIRECTORY)) {
746
747	/*
748	* Fail the open if it was explicitly a non-directory file.
749	*/
750
751	if (create_options & FILE_NON_DIRECTORY_FILE) {
752	restore_case_semantics(conn, file_attributes);
753	END_PROFILE(SMBntcreateX);
754	return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
755	}
756
757	oplock_request = 0;
758	status = open_directory(conn, fname, &sbuf,
759	access_mask,
760	share_access,
761	create_disposition,
762	create_options,
763	new_file_attributes,
764	&info, &fsp);
765
766	if(!NT_STATUS_IS_OK(status)) {
767	restore_case_semantics(conn, file_attributes);
768	if (!use_nt_status() && NT_STATUS_EQUAL(
769	status, NT_STATUS_OBJECT_NAME_COLLISION)) {
770	status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
771	}
772	END_PROFILE(SMBntcreateX);
773	return ERROR_NT(status);
774	}
775	} else {
776
777	restore_case_semantics(conn, file_attributes);
778	END_PROFILE(SMBntcreateX);
779	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
780	/* We have re-scheduled this call. */
781	return -1;
782	}
783	return ERROR_NT(status);
784	}
785	}
786	}
787
788	restore_case_semantics(conn, file_attributes);
789
790	file_len = sbuf.st_size;
791	fattr = dos_mode(conn,fname,&sbuf);
792	if(fattr == 0) {
793	fattr = FILE_ATTRIBUTE_NORMAL;
794	}
795	if (!fsp->is_directory && (fattr & aDIR)) {
796	close_file(fsp,ERROR_CLOSE);
797	END_PROFILE(SMBntcreateX);
798	return ERROR_DOS(ERRDOS,ERRnoaccess);
799	}
800
801	/* Save the requested allocation size. */
802	if ((info == FILE_WAS_CREATED) \|\| (info == FILE_WAS_OVERWRITTEN)) {
803	SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
804	#ifdef LARGE_SMB_OFF_T
805	allocation_size \|= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
806	#endif
807	if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
808	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
809	if (fsp->is_directory) {
810	close_file(fsp,ERROR_CLOSE);
811	END_PROFILE(SMBntcreateX);
812	/* Can't set allocation size on a directory. */
813	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
814	}
815	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
816	close_file(fsp,ERROR_CLOSE);
817	END_PROFILE(SMBntcreateX);
818	return ERROR_NT(NT_STATUS_DISK_FULL);
819	}
820	} else {
821	fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
822	}
823	}
824
825	/*
826	* If the caller set the extended oplock request bit
827	* and we granted one (by whatever means) - set the
828	* correct bit for extended oplock reply.
829	*/
830
831	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
832	extended_oplock_granted = True;
833	}
834
835	if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
836	extended_oplock_granted = True;
837	}
838
839	#if 0
840	/* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
841	set_message(outbuf,42,0,True);
842	#else
843	set_message(outbuf,34,0,True);
844	#endif
845
846	p = outbuf + smb_vwv2;
847
848	/*
849	* Currently as we don't support level II oplocks we just report
850	* exclusive & batch here.
851	*/
852
853	if (extended_oplock_granted) {
854	if (flags & REQUEST_BATCH_OPLOCK) {
855	SCVAL(p,0, BATCH_OPLOCK_RETURN);
856	} else {
857	SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
858	}
859	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
860	SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
861	} else {
862	SCVAL(p,0,NO_OPLOCK_RETURN);
863	}
864
865	p++;
866	SSVAL(p,0,fsp->fnum);
867	p += 2;
868	if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
869	SIVAL(p,0,FILE_WAS_SUPERSEDED);
870	} else {
871	SIVAL(p,0,info);
872	}
873	p += 4;
874
875	/* Create time. */
876	c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
877	a_timespec = get_atimespec(&sbuf);
878	m_timespec = get_mtimespec(&sbuf);
879
880	if (lp_dos_filetime_resolution(SNUM(conn))) {
881	dos_filetime_timespec(&c_timespec);
882	dos_filetime_timespec(&a_timespec);
883	dos_filetime_timespec(&m_timespec);
884	}
885
886	put_long_date_timespec(p, c_timespec);
887	p += 8;
888	put_long_date_timespec(p, a_timespec); /* access time */
889	p += 8;
890	put_long_date_timespec(p, m_timespec); /* write time */
891	p += 8;
892	put_long_date_timespec(p, m_timespec); /* change time */
893	p += 8;
894	SIVAL(p,0,fattr); /* File Attributes. */
895	p += 4;
896	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
897	p += 8;
898	SOFF_T(p,0,file_len);
899	p += 8;
900	if (flags & EXTENDED_RESPONSE_REQUIRED) {
901	SSVAL(p,2,0x7);
902	}
903	p += 4;
904	SCVAL(p,0,fsp->is_directory ? 1 : 0);
905
906	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
907
908	result = chain_reply(inbuf,outbuf,length,bufsize);
909	END_PROFILE(SMBntcreateX);
910	return result;
911	}
912
913	/****************************************************************************
914	Reply to a NT_TRANSACT_CREATE call to open a pipe.
915	****************************************************************************/
916
917	static int do_nt_transact_create_pipe( connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
918	uint16 **ppsetup, uint32 setup_count,
919	char **ppparams, uint32 parameter_count,
920	char **ppdata, uint32 data_count)
921	{
922	pstring fname;
923	char params = ppparams;
924	int ret;
925	int pnum = -1;
926	char *p = NULL;
927	NTSTATUS status;
928
929	/*
930	* Ensure minimum number of parameters sent.
931	*/
932
933	if(parameter_count < 54) {
934	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
935	return ERROR_DOS(ERRDOS,ERRnoaccess);
936	}
937
938	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
939	if (!NT_STATUS_IS_OK(status)) {
940	return ERROR_NT(status);
941	}
942
943	if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
944	return ret;
945	}
946
947	/* Realloc the size of parameters and data we will return */
948	params = nttrans_realloc(ppparams, 69);
949	if(params == NULL) {
950	return ERROR_DOS(ERRDOS,ERRnomem);
951	}
952
953	p = params;
954	SCVAL(p,0,NO_OPLOCK_RETURN);
955
956	p += 2;
957	SSVAL(p,0,pnum);
958	p += 2;
959	SIVAL(p,0,FILE_WAS_OPENED);
960	p += 8;
961
962	p += 32;
963	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
964	p += 20;
965	/* File type. */
966	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
967	/* Device state. */
968	SSVAL(p,2, 0x5FF); /* ? */
969
970	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
971
972	/* Send the required number of replies */
973	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
974
975	return -1;
976	}
977
978	/****************************************************************************
979	Internal fn to set security descriptors.
980	****************************************************************************/
981
982	static NTSTATUS set_sd(files_struct fsp, char data, uint32 sd_len, uint32 security_info_sent)
983	{
984	prs_struct pd;
985	SEC_DESC *psd = NULL;
986	TALLOC_CTX *mem_ctx;
987	BOOL ret;
988
989	if (sd_len == 0 \|\| !lp_nt_acl_support(SNUM(fsp->conn))) {
990	return NT_STATUS_OK;
991	}
992
993	/*
994	* Init the parse struct we will unmarshall from.
995	*/
996
997	if ((mem_ctx = talloc_init("set_sd")) == NULL) {
998	DEBUG(0,("set_sd: talloc_init failed.\n"));
999	return NT_STATUS_NO_MEMORY;
1000	}
1001
1002	prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1003
1004	/*
1005	* Setup the prs_struct to point at the memory we just
1006	* allocated.
1007	*/
1008
1009	prs_give_memory( &pd, data, sd_len, False);
1010
1011	/*
1012	* Finally, unmarshall from the data buffer.
1013	*/
1014
1015	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1016	DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1017	/*
1018	* Return access denied for want of a better error message..
1019	*/
1020	talloc_destroy(mem_ctx);
1021	return NT_STATUS_NO_MEMORY;
1022	}
1023
1024	if (psd->owner_sid==0) {
1025	security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1026	}
1027	if (psd->group_sid==0) {
1028	security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1029	}
1030	if (psd->sacl==0) {
1031	security_info_sent &= ~SACL_SECURITY_INFORMATION;
1032	}
1033	if (psd->dacl==0) {
1034	security_info_sent &= ~DACL_SECURITY_INFORMATION;
1035	}
1036
1037	ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1038
1039	if (!ret) {
1040	talloc_destroy(mem_ctx);
1041	return NT_STATUS_ACCESS_DENIED;
1042	}
1043
1044	talloc_destroy(mem_ctx);
1045
1046	return NT_STATUS_OK;
1047	}
1048
1049	/****************************************************************************
1050	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1051	****************************************************************************/
1052
1053	static struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
1054	{
1055	struct ea_list *ea_list_head = NULL;
1056	size_t offset = 0;
1057
1058	if (data_size < 4) {
1059	return NULL;
1060	}
1061
1062	while (offset + 4 <= data_size) {
1063	size_t next_offset = IVAL(pdata,offset);
1064	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1065
1066	if (!eal) {
1067	return NULL;
1068	}
1069
1070	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1071	if (next_offset == 0) {
1072	break;
1073	}
1074	offset += next_offset;
1075	}
1076
1077	return ea_list_head;
1078	}
1079
1080	/****************************************************************************
1081	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1082	****************************************************************************/
1083
1084	static int call_nt_transact_create(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1085	uint16 **ppsetup, uint32 setup_count,
1086	char **ppparams, uint32 parameter_count,
1087	char **ppdata, uint32 data_count, uint32 max_data_count)
1088	{
1089	pstring fname;
1090	char params = ppparams;
1091	char data = ppdata;
1092	/* Breakout the oplock request bits so we can set the reply bits separately. */
1093	int oplock_request = 0;
1094	uint32 fattr=0;
1095	SMB_OFF_T file_len = 0;
1096	SMB_STRUCT_STAT sbuf;
1097	int info = 0;
1098	files_struct *fsp = NULL;
1099	char *p = NULL;
1100	BOOL extended_oplock_granted = False;
1101	uint32 flags;
1102	uint32 access_mask;
1103	uint32 file_attributes;
1104	uint32 new_file_attributes;
1105	uint32 share_access;
1106	uint32 create_disposition;
1107	uint32 create_options;
1108	uint32 sd_len;
1109	uint32 ea_len;
1110	uint16 root_dir_fid;
1111	struct timespec c_timespec;
1112	struct timespec a_timespec;
1113	struct timespec m_timespec;
1114	struct ea_list *ea_list = NULL;
1115	TALLOC_CTX *ctx = NULL;
1116	char *pdata = NULL;
1117	NTSTATUS status;
1118
1119	DEBUG(5,("call_nt_transact_create\n"));
1120
1121	/*
1122	* If it's an IPC, use the pipe handler.
1123	*/
1124
1125	if (IS_IPC(conn)) {
1126	if (lp_nt_pipe_support()) {
1127	return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1128	bufsize,
1129	ppsetup, setup_count,
1130	ppparams, parameter_count,
1131	ppdata, data_count);
1132	} else {
1133	return ERROR_DOS(ERRDOS,ERRnoaccess);
1134	}
1135	}
1136
1137	/*
1138	* Ensure minimum number of parameters sent.
1139	*/
1140
1141	if(parameter_count < 54) {
1142	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1143	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1144	}
1145
1146	flags = IVAL(params,0);
1147	access_mask = IVAL(params,8);
1148	file_attributes = IVAL(params,20);
1149	share_access = IVAL(params,24);
1150	create_disposition = IVAL(params,28);
1151	create_options = IVAL(params,32);
1152	sd_len = IVAL(params,36);
1153	ea_len = IVAL(params,40);
1154	root_dir_fid = (uint16)IVAL(params,4);
1155
1156	/* Ensure the data_len is correct for the sd and ea values given. */
1157	if ((ea_len + sd_len > data_count) \|\|
1158	(ea_len > data_count) \|\| (sd_len > data_count) \|\|
1159	(ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
1160	DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1161	(unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1162	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1163	}
1164
1165	if (ea_len) {
1166	if (!lp_ea_support(SNUM(conn))) {
1167	DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1168	(unsigned int)ea_len ));
1169	return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1170	}
1171
1172	if (ea_len < 10) {
1173	DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1174	(unsigned int)ea_len ));
1175	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1176	}
1177	}
1178
1179	if (create_options & FILE_OPEN_BY_FILE_ID) {
1180	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1181	}
1182
1183	/*
1184	* Get the file name.
1185	*/
1186
1187	if(root_dir_fid != 0) {
1188	/*
1189	* This filename is relative to a directory fid.
1190	*/
1191	files_struct *dir_fsp = file_fsp(params,4);
1192	size_t dir_name_len;
1193
1194	if(!dir_fsp) {
1195	return ERROR_DOS(ERRDOS,ERRbadfid);
1196	}
1197
1198	if(!dir_fsp->is_directory) {
1199	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1200	if (!NT_STATUS_IS_OK(status)) {
1201	return ERROR_NT(status);
1202	}
1203
1204	/*
1205	* Check to see if this is a mac fork of some kind.
1206	*/
1207
1208	if( is_ntfs_stream_name(fname)) {
1209	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1210	}
1211
1212	return ERROR_DOS(ERRDOS,ERRbadfid);
1213	}
1214
1215	/*
1216	* Copy in the base directory name.
1217	*/
1218
1219	pstrcpy( fname, dir_fsp->fsp_name );
1220	dir_name_len = strlen(fname);
1221
1222	/*
1223	* Ensure it ends in a '\'.
1224	*/
1225
1226	if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1227	pstrcat(fname, "/");
1228	dir_name_len++;
1229	}
1230
1231	{
1232	pstring tmpname;
1233	srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1234	if (!NT_STATUS_IS_OK(status)) {
1235	return ERROR_NT(status);
1236	}
1237	pstrcat(fname, tmpname);
1238	}
1239	} else {
1240	srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1241	if (!NT_STATUS_IS_OK(status)) {
1242	return ERROR_NT(status);
1243	}
1244
1245	/*
1246	* Check to see if this is a mac fork of some kind.
1247	*/
1248
1249	if( is_ntfs_stream_name(fname)) {
1250	return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1251	}
1252	}
1253
1254	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1255	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1256
1257	/*
1258	* Check if POSIX semantics are wanted.
1259	*/
1260
1261	new_file_attributes = set_posix_case_semantics(conn, file_attributes);
1262
1263	RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1264
1265	status = unix_convert(conn, fname, False, NULL, &sbuf);
1266	if (!NT_STATUS_IS_OK(status)) {
1267	restore_case_semantics(conn, file_attributes);
1268	return ERROR_NT(status);
1269	}
1270	/* All file access must go through check_name() */
1271	status = check_name(conn, fname);
1272	if (!NT_STATUS_IS_OK(status)) {
1273	restore_case_semantics(conn, file_attributes);
1274	return ERROR_NT(status);
1275	}
1276
1277	/* This is the correct thing to do (check every time) but can_delete is
1278	expensive (it may have to read the parent directory permissions). So
1279	for now we're not doing it unless we have a strong hint the client
1280	is really going to delete this file. If the client is forcing FILE_CREATE
1281	let the filesystem take care of the permissions. */
1282
1283	/* Setting FILE_SHARE_DELETE is the hint. */
1284
1285	if (lp_acl_check_permissions(SNUM(conn))
1286	&& (create_disposition != FILE_CREATE)
1287	&& (share_access & FILE_SHARE_DELETE)
1288	&& (access_mask & DELETE_ACCESS)) {
1289	if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) \|\|
1290	!can_delete_file_in_directory(conn, fname)) {
1291	restore_case_semantics(conn, file_attributes);
1292	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1293	}
1294	}
1295
1296	if (ea_len) {
1297	pdata = data + sd_len;
1298
1299	/* We have already checked that ea_len <= data_count here. */
1300	ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
1301	ea_len);
1302	if (!ea_list ) {
1303	restore_case_semantics(conn, file_attributes);
1304	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1305	}
1306	}
1307
1308	/*
1309	* If it's a request for a directory open, deal with it separately.
1310	*/
1311
1312	if(create_options & FILE_DIRECTORY_FILE) {
1313
1314	/* Can't open a temp directory. IFS kit test. */
1315	if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1316	restore_case_semantics(conn, file_attributes);
1317	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1318	}
1319
1320	oplock_request = 0;
1321
1322	/*
1323	* We will get a create directory here if the Win32
1324	* app specified a security descriptor in the
1325	* CreateDirectory() call.
1326	*/
1327
1328	status = open_directory(conn, fname, &sbuf,
1329	access_mask,
1330	share_access,
1331	create_disposition,
1332	create_options,
1333	new_file_attributes,
1334	&info, &fsp);
1335	if(!NT_STATUS_IS_OK(status)) {
1336	restore_case_semantics(conn, file_attributes);
1337	return ERROR_NT(status);
1338	}
1339
1340	} else {
1341
1342	/*
1343	* Ordinary file case.
1344	*/
1345
1346	status = open_file_ntcreate(conn,fname,&sbuf,
1347	access_mask,
1348	share_access,
1349	create_disposition,
1350	create_options,
1351	new_file_attributes,
1352	oplock_request,
1353	&info, &fsp);
1354
1355	if (!NT_STATUS_IS_OK(status)) {
1356	if (NT_STATUS_EQUAL(status,
1357	NT_STATUS_FILE_IS_A_DIRECTORY)) {
1358
1359	/*
1360	* Fail the open if it was explicitly a non-directory file.
1361	*/
1362
1363	if (create_options & FILE_NON_DIRECTORY_FILE) {
1364	restore_case_semantics(conn, file_attributes);
1365	return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1366	}
1367
1368	oplock_request = 0;
1369	status = open_directory(conn, fname, &sbuf,
1370	access_mask,
1371	share_access,
1372	create_disposition,
1373	create_options,
1374	new_file_attributes,
1375	&info, &fsp);
1376	if(!NT_STATUS_IS_OK(status)) {
1377	restore_case_semantics(conn, file_attributes);
1378	return ERROR_NT(status);
1379	}
1380	} else {
1381	restore_case_semantics(conn, file_attributes);
1382	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1383	/* We have re-scheduled this call. */
1384	return -1;
1385	}
1386	return ERROR_NT(status);
1387	}
1388	}
1389	}
1390
1391	/*
1392	* According to the MS documentation, the only time the security
1393	* descriptor is applied to the opened file is iff we created the
1394	* file; an existing file stays the same.
1395	*
1396	* Also, it seems (from observation) that you can open the file with
1397	* any access mask but you can still write the sd. We need to override
1398	* the granted access before we call set_sd
1399	* Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1400	*/
1401
1402	if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1403	uint32 saved_access_mask = fsp->access_mask;
1404
1405	/* We have already checked that sd_len <= data_count here. */
1406
1407	fsp->access_mask = FILE_GENERIC_ALL;
1408
1409	status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1410	if (!NT_STATUS_IS_OK(status)) {
1411	talloc_destroy(ctx);
1412	close_file(fsp,ERROR_CLOSE);
1413	restore_case_semantics(conn, file_attributes);
1414	return ERROR_NT(status);
1415	}
1416	fsp->access_mask = saved_access_mask;
1417	}
1418
1419	if (ea_len && (info == FILE_WAS_CREATED)) {
1420	status = set_ea(conn, fsp, fname, ea_list);
1421	if (!NT_STATUS_IS_OK(status)) {
1422	close_file(fsp,ERROR_CLOSE);
1423	restore_case_semantics(conn, file_attributes);
1424	return ERROR_NT(status);
1425	}
1426	}
1427
1428	restore_case_semantics(conn, file_attributes);
1429
1430	file_len = sbuf.st_size;
1431	fattr = dos_mode(conn,fname,&sbuf);
1432	if(fattr == 0) {
1433	fattr = FILE_ATTRIBUTE_NORMAL;
1434	}
1435	if (!fsp->is_directory && (fattr & aDIR)) {
1436	close_file(fsp,ERROR_CLOSE);
1437	return ERROR_DOS(ERRDOS,ERRnoaccess);
1438	}
1439
1440	/* Save the requested allocation size. */
1441	if ((info == FILE_WAS_CREATED) \|\| (info == FILE_WAS_OVERWRITTEN)) {
1442	SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1443	#ifdef LARGE_SMB_OFF_T
1444	allocation_size \|= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1445	#endif
1446	if (allocation_size && (allocation_size > file_len)) {
1447	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1448	if (fsp->is_directory) {
1449	close_file(fsp,ERROR_CLOSE);
1450	/* Can't set allocation size on a directory. */
1451	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1452	}
1453	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1454	close_file(fsp,ERROR_CLOSE);
1455	return ERROR_NT(NT_STATUS_DISK_FULL);
1456	}
1457	} else {
1458	fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1459	}
1460	}
1461
1462	/*
1463	* If the caller set the extended oplock request bit
1464	* and we granted one (by whatever means) - set the
1465	* correct bit for extended oplock reply.
1466	*/
1467
1468	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1469	extended_oplock_granted = True;
1470	}
1471
1472	if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1473	extended_oplock_granted = True;
1474	}
1475
1476	/* Realloc the size of parameters and data we will return */
1477	params = nttrans_realloc(ppparams, 69);
1478	if(params == NULL) {
1479	return ERROR_DOS(ERRDOS,ERRnomem);
1480	}
1481
1482	p = params;
1483	if (extended_oplock_granted) {
1484	if (flags & REQUEST_BATCH_OPLOCK) {
1485	SCVAL(p,0, BATCH_OPLOCK_RETURN);
1486	} else {
1487	SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1488	}
1489	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1490	SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1491	} else {
1492	SCVAL(p,0,NO_OPLOCK_RETURN);
1493	}
1494
1495	p += 2;
1496	SSVAL(p,0,fsp->fnum);
1497	p += 2;
1498	if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1499	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1500	} else {
1501	SIVAL(p,0,info);
1502	}
1503	p += 8;
1504
1505	/* Create time. */
1506	c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1507	a_timespec = get_atimespec(&sbuf);
1508	m_timespec = get_mtimespec(&sbuf);
1509
1510	if (lp_dos_filetime_resolution(SNUM(conn))) {
1511	dos_filetime_timespec(&c_timespec);
1512	dos_filetime_timespec(&a_timespec);
1513	dos_filetime_timespec(&m_timespec);
1514	}
1515
1516	put_long_date_timespec(p, c_timespec); /* create time. */
1517	p += 8;
1518	put_long_date_timespec(p, a_timespec); /* access time */
1519	p += 8;
1520	put_long_date_timespec(p, m_timespec); /* write time */
1521	p += 8;
1522	put_long_date_timespec(p, m_timespec); /* change time */
1523	p += 8;
1524	SIVAL(p,0,fattr); /* File Attributes. */
1525	p += 4;
1526	SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1527	p += 8;
1528	SOFF_T(p,0,file_len);
1529	p += 8;
1530	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1531	SSVAL(p,2,0x7);
1532	}
1533	p += 4;
1534	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1535
1536	DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1537
1538	/* Send the required number of replies */
1539	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1540
1541	return -1;
1542	}
1543
1544	/****************************************************************************
1545	Reply to a NT CANCEL request.
1546	conn POINTER CAN BE NULL HERE !
1547	****************************************************************************/
1548
1549	int reply_ntcancel(connection_struct *conn,
1550	char inbuf,char outbuf,int length,int bufsize)
1551	{
1552	/*
1553	* Go through and cancel any pending change notifies.
1554	*/
1555
1556	int mid = SVAL(inbuf,smb_mid);
1557	START_PROFILE(SMBntcancel);
1558	remove_pending_change_notify_requests_by_mid(mid);
1559	remove_pending_lock_requests_by_mid(mid);
1560	srv_cancel_sign_response(mid);
1561
1562	DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1563
1564	END_PROFILE(SMBntcancel);
1565	return(-1);
1566	}
1567
1568	/****************************************************************************
1569	Copy a file.
1570	****************************************************************************/
1571
1572	static NTSTATUS copy_internals(connection_struct conn, char oldname, char *newname, uint32 attrs)
1573	{
1574	SMB_STRUCT_STAT sbuf1, sbuf2;
1575	pstring last_component_oldname;
1576	pstring last_component_newname;
1577	files_struct fsp1,fsp2;
1578	uint32 fattr;
1579	int info;
1580	SMB_OFF_T ret=-1;
1581	NTSTATUS status = NT_STATUS_OK;
1582
1583	ZERO_STRUCT(sbuf1);
1584	ZERO_STRUCT(sbuf2);
1585
1586	if (!CAN_WRITE(conn)) {
1587	return NT_STATUS_MEDIA_WRITE_PROTECTED;
1588	}
1589
1590	status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
1591	if (!NT_STATUS_IS_OK(status)) {
1592	return status;
1593	}
1594
1595	/* Source must already exist. */
1596	if (!VALID_STAT(sbuf1)) {
1597	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1598	}
1599	status = check_name(conn, oldname);
1600	if (!NT_STATUS_IS_OK(status)) {
1601	return status;
1602	}
1603
1604	/* Ensure attributes match. */
1605	fattr = dos_mode(conn,oldname,&sbuf1);
1606	if ((fattr & ~attrs) & (aHIDDEN \| aSYSTEM)) {
1607	return NT_STATUS_NO_SUCH_FILE;
1608	}
1609
1610	status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
1611	if (!NT_STATUS_IS_OK(status)) {
1612	return status;
1613	}
1614
1615	/* Disallow if newname already exists. */
1616	if (VALID_STAT(sbuf2)) {
1617	return NT_STATUS_OBJECT_NAME_COLLISION;
1618	}
1619
1620	status = check_name(conn, newname);
1621	if (!NT_STATUS_IS_OK(status)) {
1622	return status;
1623	}
1624
1625	/* No links from a directory. */
1626	if (S_ISDIR(sbuf1.st_mode)) {
1627	return NT_STATUS_FILE_IS_A_DIRECTORY;
1628	}
1629
1630	/* Ensure this is within the share. */
1631	status = reduce_name(conn, oldname);
1632	if (!NT_STATUS_IS_OK(status)) {
1633	return status;
1634	}
1635
1636	DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1637
1638	status = open_file_ntcreate(conn,oldname,&sbuf1,
1639	FILE_READ_DATA, /* Read-only. */
1640	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1641	FILE_OPEN,
1642	0, /* No create options. */
1643	FILE_ATTRIBUTE_NORMAL,
1644	NO_OPLOCK,
1645	&info, &fsp1);
1646
1647	if (!NT_STATUS_IS_OK(status)) {
1648	return status;
1649	}
1650
1651	status = open_file_ntcreate(conn,newname,&sbuf2,
1652	FILE_WRITE_DATA, /* Read-only. */
1653	FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE,
1654	FILE_CREATE,
1655	0, /* No create options. */
1656	fattr,
1657	NO_OPLOCK,
1658	&info, &fsp2);
1659
1660	if (!NT_STATUS_IS_OK(status)) {
1661	close_file(fsp1,ERROR_CLOSE);
1662	return status;
1663	}
1664
1665	if (sbuf1.st_size) {
1666	ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1667	}
1668
1669	/*
1670	* As we are opening fsp1 read-only we only expect
1671	* an error on close on fsp2 if we are out of space.
1672	* Thus we don't look at the error return from the
1673	* close of fsp1.
1674	*/
1675	close_file(fsp1,NORMAL_CLOSE);
1676
1677	/* Ensure the modtime is set correctly on the destination file. */
1678	fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1679
1680	status = close_file(fsp2,NORMAL_CLOSE);
1681
1682	/* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1683	creates the file. This isn't the correct thing to do in the copy
1684	case. JRA */
1685	file_set_dosmode(conn, newname, fattr, &sbuf2,
1686	parent_dirname(newname));
1687
1688	if (ret < (SMB_OFF_T)sbuf1.st_size) {
1689	return NT_STATUS_DISK_FULL;
1690	}
1691
1692	if (!NT_STATUS_IS_OK(status)) {
1693	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1694	nt_errstr(status), oldname, newname));
1695	}
1696	return status;
1697	}
1698
1699	/****************************************************************************
1700	Reply to a NT rename request.
1701	****************************************************************************/
1702
1703	int reply_ntrename(connection_struct *conn,
1704	char inbuf,char outbuf,int length,int bufsize)
1705	{
1706	int outsize = 0;
1707	pstring oldname;
1708	pstring newname;
1709	char *p;
1710	NTSTATUS status;
1711	BOOL path1_contains_wcard = False;
1712	BOOL path2_contains_wcard = False;
1713	uint32 attrs = SVAL(inbuf,smb_vwv0);
1714	uint16 rename_type = SVAL(inbuf,smb_vwv1);
1715
1716	START_PROFILE(SMBntrename);
1717
1718	p = smb_buf(inbuf) + 1;
1719	p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &path1_contains_wcard);
1720	if (!NT_STATUS_IS_OK(status)) {
1721	END_PROFILE(SMBntrename);
1722	return ERROR_NT(status);
1723	}
1724
1725	if( is_ntfs_stream_name(oldname)) {
1726	/* Can't rename a stream. */
1727	END_PROFILE(SMBntrename);
1728	return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1729	}
1730
1731	if (ms_has_wild(oldname)) {
1732	END_PROFILE(SMBntrename);
1733	return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1734	}
1735
1736	p++;
1737	p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path2_contains_wcard);
1738	if (!NT_STATUS_IS_OK(status)) {
1739	END_PROFILE(SMBntrename);
1740	return ERROR_NT(status);
1741	}
1742
1743	RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1744	RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1745
1746	DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1747
1748	switch(rename_type) {
1749	case RENAME_FLAG_RENAME:
1750	status = rename_internals(conn, oldname, newname, attrs, False, path1_contains_wcard);
1751	break;
1752	case RENAME_FLAG_HARD_LINK:
1753	if (path1_contains_wcard \|\| path2_contains_wcard) {
1754	/* No wildcards. */
1755	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1756	} else {
1757	status = hardlink_internals(conn, oldname, newname);
1758	}
1759	break;
1760	case RENAME_FLAG_COPY:
1761	if (path1_contains_wcard \|\| path2_contains_wcard) {
1762	/* No wildcards. */
1763	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1764	} else {
1765	status = copy_internals(conn, oldname, newname, attrs);
1766	}
1767	break;
1768	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1769	status = NT_STATUS_INVALID_PARAMETER;
1770	break;
1771	default:
1772	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1773	break;
1774	}
1775
1776	if (!NT_STATUS_IS_OK(status)) {
1777	END_PROFILE(SMBntrename);
1778	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1779	/* We have re-scheduled this call. */
1780	return -1;
1781	}
1782	return ERROR_NT(status);
1783	}
1784
1785	outsize = set_message(outbuf,0,0,False);
1786
1787	END_PROFILE(SMBntrename);
1788	return(outsize);
1789	}
1790
1791	/****************************************************************************
1792	Reply to a notify change - queue the request and
1793	don't allow a directory to be opened.
1794	****************************************************************************/
1795
1796	static int call_nt_transact_notify_change(connection_struct conn, char inbuf,
1797	char *outbuf, int length,
1798	int bufsize,
1799	uint16 **ppsetup, uint32 setup_count,
1800	char **ppparams,
1801	uint32 parameter_count,
1802	char **ppdata, uint32 data_count,
1803	uint32 max_data_count,
1804	uint32 max_param_count)
1805	{
1806	uint16 setup = ppsetup;
1807	files_struct *fsp;
1808	uint32 filter;
1809	NTSTATUS status;
1810	BOOL recursive;
1811
1812	if(setup_count < 6) {
1813	return ERROR_DOS(ERRDOS,ERRbadfunc);
1814	}
1815
1816	fsp = file_fsp((char *)setup,4);
1817	filter = IVAL(setup, 0);
1818	recursive = (SVAL(setup, 6) != 0) ? True : False;
1819
1820	DEBUG(3,("call_nt_transact_notify_change\n"));
1821
1822	if(!fsp) {
1823	return ERROR_DOS(ERRDOS,ERRbadfid);
1824	}
1825
1826	{
1827	char *filter_string;
1828
1829	if (!(filter_string = notify_filter_string(NULL, filter))) {
1830	return ERROR_NT(NT_STATUS_NO_MEMORY);
1831	}
1832
1833	DEBUG(3,("call_nt_transact_notify_change: notify change "
1834	"called on %s, filter = %s, recursive = %d\n",
1835	fsp->fsp_name, filter_string, recursive));
1836
1837	TALLOC_FREE(filter_string);
1838	}
1839
1840	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1841	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1842	}
1843
1844	if (fsp->notify == NULL) {
1845
1846	status = change_notify_create(fsp, filter, recursive);
1847
1848	if (!NT_STATUS_IS_OK(status)) {
1849	DEBUG(10, ("change_notify_create returned %s\n",
1850	nt_errstr(status)));
1851	return ERROR_NT(status);
1852	}
1853	}
1854
1855	if (fsp->notify->num_changes != 0) {
1856
1857	/*
1858	* We've got changes pending, respond immediately
1859	*/
1860
1861	/*
1862	* TODO: write a torture test to check the filtering behaviour
1863	* here.
1864	*/
1865
1866	change_notify_reply(inbuf, max_param_count,
1867	fsp->notify);
1868
1869	/*
1870	* change_notify_reply() above has independently sent its
1871	* results
1872	*/
1873	return -1;
1874	}
1875
1876	/*
1877	* No changes pending, queue the request
1878	*/
1879
1880	status = change_notify_add_request(inbuf, max_param_count, filter,
1881	recursive, fsp);
1882	if (!NT_STATUS_IS_OK(status)) {
1883	return ERROR_NT(status);
1884	}
1885
1886	return -1;
1887	}
1888
1889	/****************************************************************************
1890	Reply to an NT transact rename command.
1891	****************************************************************************/
1892
1893	static int call_nt_transact_rename(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1894	uint16 **ppsetup, uint32 setup_count,
1895	char **ppparams, uint32 parameter_count,
1896	char **ppdata, uint32 data_count, uint32 max_data_count)
1897	{
1898	char params = ppparams;
1899	pstring new_name;
1900	files_struct *fsp = NULL;
1901	BOOL replace_if_exists = False;
1902	BOOL path_contains_wcard = False;
1903	NTSTATUS status;
1904
1905	if(parameter_count < 5) {
1906	return ERROR_DOS(ERRDOS,ERRbadfunc);
1907	}
1908
1909	fsp = file_fsp(params, 0);
1910	replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1911	CHECK_FSP(fsp, conn);
1912	srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), parameter_count - 4, STR_TERMINATE, &status, &path_contains_wcard);
1913	if (!NT_STATUS_IS_OK(status)) {
1914	return ERROR_NT(status);
1915	}
1916
1917	status = rename_internals(conn, fsp->fsp_name,
1918	new_name, 0, replace_if_exists, path_contains_wcard);
1919
1920	if (!NT_STATUS_IS_OK(status)) {
1921	if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1922	/* We have re-scheduled this call. */
1923	return -1;
1924	}
1925	return ERROR_NT(status);
1926	}
1927
1928	/*
1929	* Rename was successful.
1930	*/
1931	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1932
1933	DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1934	fsp->fsp_name, new_name));
1935
1936	return -1;
1937	}
1938
1939	/******************************************************************************
1940	Fake up a completely empty SD.
1941	*******************************************************************************/
1942
1943	static size_t get_null_nt_acl(TALLOC_CTX mem_ctx, SEC_DESC *ppsd)
1944	{
1945	size_t sd_size;
1946
1947	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1948	if(!*ppsd) {
1949	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1950	sd_size = 0;
1951	}
1952
1953	return sd_size;
1954	}
1955
1956	/****************************************************************************
1957	Reply to query a security descriptor.
1958	****************************************************************************/
1959
1960	static int call_nt_transact_query_security_desc(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
1961	uint16 **ppsetup, uint32 setup_count,
1962	char **ppparams, uint32 parameter_count,
1963	char **ppdata, uint32 data_count, uint32 max_data_count)
1964	{
1965	char params = ppparams;
1966	char data = ppdata;
1967	prs_struct pd;
1968	SEC_DESC *psd = NULL;
1969	size_t sd_size;
1970	uint32 security_info_wanted;
1971	TALLOC_CTX *mem_ctx;
1972	files_struct *fsp = NULL;
1973
1974	if(parameter_count < 8) {
1975	return ERROR_DOS(ERRDOS,ERRbadfunc);
1976	}
1977
1978	fsp = file_fsp(params,0);
1979	if(!fsp) {
1980	return ERROR_DOS(ERRDOS,ERRbadfid);
1981	}
1982
1983	security_info_wanted = IVAL(params,4);
1984
1985	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1986	(unsigned int)security_info_wanted ));
1987
1988	params = nttrans_realloc(ppparams, 4);
1989	if(params == NULL) {
1990	return ERROR_DOS(ERRDOS,ERRnomem);
1991	}
1992
1993	if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
1994	DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1995	return ERROR_DOS(ERRDOS,ERRnomem);
1996	}
1997
1998	/*
1999	* Get the permissions to return.
2000	*/
2001
2002	if (!lp_nt_acl_support(SNUM(conn))) {
2003	sd_size = get_null_nt_acl(mem_ctx, &psd);
2004	} else {
2005	sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
2006	}
2007
2008	if (sd_size == 0) {
2009	talloc_destroy(mem_ctx);
2010	return(UNIXERROR(ERRDOS,ERRnoaccess));
2011	}
2012
2013	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2014
2015	SIVAL(params,0,(uint32)sd_size);
2016
2017	if(max_data_count < sd_size) {
2018
2019	send_nt_replies(outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2020	params, 4, *ppdata, 0);
2021	talloc_destroy(mem_ctx);
2022	return -1;
2023	}
2024
2025	/*
2026	* Allocate the data we will point this at.
2027	*/
2028
2029	data = nttrans_realloc(ppdata, sd_size);
2030	if(data == NULL) {
2031	talloc_destroy(mem_ctx);
2032	return ERROR_DOS(ERRDOS,ERRnomem);
2033	}
2034
2035	/*
2036	* Init the parse struct we will marshall into.
2037	*/
2038
2039	prs_init(&pd, 0, mem_ctx, MARSHALL);
2040
2041	/*
2042	* Setup the prs_struct to point at the memory we just
2043	* allocated.
2044	*/
2045
2046	prs_give_memory( &pd, data, (uint32)sd_size, False);
2047
2048	/*
2049	* Finally, linearize into the outgoing buffer.
2050	*/
2051
2052	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2053	DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2054	security descriptor.\n"));
2055	/*
2056	* Return access denied for want of a better error message..
2057	*/
2058	talloc_destroy(mem_ctx);
2059	return(UNIXERROR(ERRDOS,ERRnoaccess));
2060	}
2061
2062	/*
2063	* Now we can delete the security descriptor.
2064	*/
2065
2066	talloc_destroy(mem_ctx);
2067
2068	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 4, data,
2069	(int)sd_size);
2070	return -1;
2071	}
2072
2073	/****************************************************************************
2074	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2075	****************************************************************************/
2076
2077	static int call_nt_transact_set_security_desc(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2078	uint16 **ppsetup, uint32 setup_count,
2079	char **ppparams, uint32 parameter_count,
2080	char **ppdata, uint32 data_count, uint32 max_data_count)
2081	{
2082	char params= ppparams;
2083	char data = ppdata;
2084	files_struct *fsp = NULL;
2085	uint32 security_info_sent = 0;
2086	NTSTATUS nt_status;
2087
2088	if(parameter_count < 8) {
2089	return ERROR_DOS(ERRDOS,ERRbadfunc);
2090	}
2091
2092	if((fsp = file_fsp(params,0)) == NULL) {
2093	return ERROR_DOS(ERRDOS,ERRbadfid);
2094	}
2095
2096	if(!lp_nt_acl_support(SNUM(conn))) {
2097	goto done;
2098	}
2099
2100	security_info_sent = IVAL(params,4);
2101
2102	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2103	(unsigned int)security_info_sent ));
2104
2105	if (data_count == 0) {
2106	return ERROR_DOS(ERRDOS, ERRnoaccess);
2107	}
2108
2109	if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2110	return ERROR_NT(nt_status);
2111	}
2112
2113	done:
2114
2115	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2116	return -1;
2117	}
2118
2119	/****************************************************************************
2120	Reply to NT IOCTL
2121	****************************************************************************/
2122
2123	static int call_nt_transact_ioctl(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2124	uint16 **ppsetup, uint32 setup_count,
2125	char **ppparams, uint32 parameter_count,
2126	char **ppdata, uint32 data_count, uint32 max_data_count)
2127	{
2128	uint32 function;
2129	uint16 fidnum;
2130	files_struct *fsp;
2131	uint8 isFSctl;
2132	uint8 compfilter;
2133	static BOOL logged_message;
2134	char pdata = ppdata;
2135
2136	if (setup_count != 8) {
2137	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2138	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2139	}
2140
2141	function = IVAL(*ppsetup, 0);
2142	fidnum = SVAL(*ppsetup, 4);
2143	isFSctl = CVAL(*ppsetup, 6);
2144	compfilter = CVAL(*ppsetup, 7);
2145
2146	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2147	function, fidnum, isFSctl, compfilter));
2148
2149	fsp=file_fsp((char )ppsetup, 4);
2150	/* this check is done in each implemented function case for now
2151	because I don't want to break anything... --metze
2152	FSP_BELONGS_CONN(fsp,conn);*/
2153
2154	switch (function) {
2155	case FSCTL_SET_SPARSE:
2156	/* pretend this succeeded - tho strictly we should
2157	mark the file sparse (if the local fs supports it)
2158	so we can know if we need to pre-allocate or not */
2159
2160	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2161	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2162	0);
2163	return -1;
2164
2165	case FSCTL_0x000900C0:
2166	/* pretend this succeeded - don't know what this really is
2167	but works ok like this --metze
2168	*/
2169
2170	DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2171	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2172	0);
2173	return -1;
2174
2175	case FSCTL_GET_REPARSE_POINT:
2176	/* pretend this fail - my winXP does it like this
2177	* --metze
2178	*/
2179
2180	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2181	send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2182	NULL, 0, NULL, 0);
2183	return -1;
2184
2185	case FSCTL_SET_REPARSE_POINT:
2186	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2187	* --metze
2188	*/
2189
2190	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2191	send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2192	NULL, 0, NULL, 0);
2193	return -1;
2194
2195	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2196	{
2197	/*
2198	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2199	* and return their volume names. If max_data_count is 16, then it is just
2200	* asking for the number of volumes and length of the combined names.
2201	*
2202	* pdata is the data allocated by our caller, but that uses
2203	* total_data_count (which is 0 in our case) rather than max_data_count.
2204	* Allocate the correct amount and return the pointer to let
2205	* it be deallocated when we return.
2206	*/
2207	SHADOW_COPY_DATA *shadow_data = NULL;
2208	TALLOC_CTX *shadow_mem_ctx = NULL;
2209	BOOL labels = False;
2210	uint32 labels_data_count = 0;
2211	uint32 i;
2212	char *cur_pdata;
2213
2214	FSP_BELONGS_CONN(fsp,conn);
2215
2216	if (max_data_count < 16) {
2217	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2218	max_data_count));
2219	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2220	}
2221
2222	if (max_data_count > 16) {
2223	labels = True;
2224	}
2225
2226	shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2227	if (shadow_mem_ctx == NULL) {
2228	DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2229	return ERROR_NT(NT_STATUS_NO_MEMORY);
2230	}
2231
2232	shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2233	if (shadow_data == NULL) {
2234	DEBUG(0,("talloc_zero() failed!\n"));
2235	talloc_destroy(shadow_mem_ctx);
2236	return ERROR_NT(NT_STATUS_NO_MEMORY);
2237	}
2238
2239	shadow_data->mem_ctx = shadow_mem_ctx;
2240
2241	/*
2242	* Call the VFS routine to actually do the work.
2243	*/
2244	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2245	talloc_destroy(shadow_data->mem_ctx);
2246	if (errno == ENOSYS) {
2247	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2248	conn->connectpath));
2249	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2250	} else {
2251	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2252	conn->connectpath));
2253	return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2254	}
2255	}
2256
2257	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
2258
2259	if (!labels) {
2260	data_count = 16;
2261	} else {
2262	data_count = 12+labels_data_count+4;
2263	}
2264
2265	if (max_data_count<data_count) {
2266	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2267	max_data_count,data_count));
2268	talloc_destroy(shadow_data->mem_ctx);
2269	return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2270	}
2271
2272	pdata = nttrans_realloc(ppdata, data_count);
2273	if (pdata == NULL) {
2274	talloc_destroy(shadow_data->mem_ctx);
2275	return ERROR_NT(NT_STATUS_NO_MEMORY);
2276	}
2277
2278	cur_pdata = pdata;
2279
2280	/* num_volumes 4 bytes */
2281	SIVAL(pdata,0,shadow_data->num_volumes);
2282
2283	if (labels) {
2284	/* num_labels 4 bytes */
2285	SIVAL(pdata,4,shadow_data->num_volumes);
2286	}
2287
2288	/* needed_data_count 4 bytes */
2289	SIVAL(pdata,8,labels_data_count);
2290
2291	cur_pdata+=12;
2292
2293	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2294	shadow_data->num_volumes,fsp->fsp_name));
2295	if (labels && shadow_data->labels) {
2296	for (i=0;i<shadow_data->num_volumes;i++) {
2297	srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE\|STR_TERMINATE);
2298	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2299	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2300	}
2301	}
2302
2303	talloc_destroy(shadow_data->mem_ctx);
2304
2305	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2306	pdata, data_count);
2307
2308	return -1;
2309	}
2310
2311	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2312	{
2313	/* pretend this succeeded -
2314	*
2315	* we have to send back a list with all files owned by this SID
2316	*
2317	* but I have to check that --metze
2318	*/
2319	DOM_SID sid;
2320	uid_t uid;
2321	size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2322
2323	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2324
2325	FSP_BELONGS_CONN(fsp,conn);
2326
2327	/* unknown 4 bytes: this is not the length of the sid :-( */
2328	/unknown = IVAL(pdata,0);/
2329
2330	sid_parse(pdata+4,sid_len,&sid);
2331	DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2332
2333	if (!sid_to_uid(&sid, &uid)) {
2334	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2335	sid_string_static(&sid),(unsigned long)sid_len));
2336	uid = (-1);
2337	}
2338
2339	/* we can take a look at the find source :-)
2340	*
2341	* find ./ -uid $uid -name '*' is what we need here
2342	*
2343	*
2344	* and send 4bytes len and then NULL terminated unicode strings
2345	* for each file
2346	*
2347	* but I don't know how to deal with the paged results
2348	* (maybe we can hang the result anywhere in the fsp struct)
2349	*
2350	* we don't send all files at once
2351	* and at the next we should not start from the beginning,
2352	* so we have to cache the result
2353	*
2354	* --metze
2355	*/
2356
2357	/* this works for now... */
2358	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2359	NULL, 0);
2360	return -1;
2361	}
2362	default:
2363	if (!logged_message) {
2364	logged_message = True; /* Only print this once... */
2365	DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2366	function));
2367	}
2368	}
2369
2370	return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2371	}
2372
2373
2374	#ifdef HAVE_SYS_QUOTAS
2375	/****************************************************************************
2376	Reply to get user quota
2377	****************************************************************************/
2378
2379	static int call_nt_transact_get_user_quota(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2380	uint16 **ppsetup, uint32 setup_count,
2381	char **ppparams, uint32 parameter_count,
2382	char **ppdata, uint32 data_count, uint32 max_data_count)
2383	{
2384	NTSTATUS nt_status = NT_STATUS_OK;
2385	char params = ppparams;
2386	char pdata = ppdata;
2387	char *entry;
2388	int data_len=0,param_len=0;
2389	int qt_len=0;
2390	int entry_len = 0;
2391	files_struct *fsp = NULL;
2392	uint16 level = 0;
2393	size_t sid_len;
2394	DOM_SID sid;
2395	BOOL start_enum = True;
2396	SMB_NTQUOTA_STRUCT qt;
2397	SMB_NTQUOTA_LIST *tmp_list;
2398	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2399
2400	ZERO_STRUCT(qt);
2401
2402	/* access check */
2403	if (current_user.ut.uid != 0) {
2404	DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2405	lp_servicename(SNUM(conn)),conn->user));
2406	return ERROR_DOS(ERRDOS,ERRnoaccess);
2407	}
2408
2409	/*
2410	* Ensure minimum number of parameters sent.
2411	*/
2412
2413	if (parameter_count < 4) {
2414	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2415	return ERROR_DOS(ERRDOS,ERRinvalidparam);
2416	}
2417
2418	/* maybe we can check the quota_fnum */
2419	fsp = file_fsp(params,0);
2420	if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2421	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2422	return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2423	}
2424
2425	/* the NULL pointer checking for fsp->fake_file_handle->pd
2426	* is done by CHECK_NTQUOTA_HANDLE_OK()
2427	*/
2428	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2429
2430	level = SVAL(params,2);
2431
2432	/* unknown 12 bytes leading in params */
2433
2434	switch (level) {
2435	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2436	/* seems that we should continue with the enum here --metze */
2437
2438	if (qt_handle->quota_list!=NULL &&
2439	qt_handle->tmp_list==NULL) {
2440
2441	/* free the list */
2442	free_ntquota_list(&(qt_handle->quota_list));
2443
2444	/* Realloc the size of parameters and data we will return */
2445	param_len = 4;
2446	params = nttrans_realloc(ppparams, param_len);
2447	if(params == NULL) {
2448	return ERROR_DOS(ERRDOS,ERRnomem);
2449	}
2450
2451	data_len = 0;
2452	SIVAL(params,0,data_len);
2453
2454	break;
2455	}
2456
2457	start_enum = False;
2458
2459	case TRANSACT_GET_USER_QUOTA_LIST_START:
2460
2461	if (qt_handle->quota_list==NULL &&
2462	qt_handle->tmp_list==NULL) {
2463	start_enum = True;
2464	}
2465
2466	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2467	return ERROR_DOS(ERRSRV,ERRerror);
2468
2469	/* Realloc the size of parameters and data we will return */
2470	param_len = 4;
2471	params = nttrans_realloc(ppparams, param_len);
2472	if(params == NULL) {
2473	return ERROR_DOS(ERRDOS,ERRnomem);
2474	}
2475
2476	/* we should not trust the value in max_data_count*/
2477	max_data_count = MIN(max_data_count,2048);
2478
2479	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2480	if(pdata == NULL) {
2481	return ERROR_DOS(ERRDOS,ERRnomem);
2482	}
2483
2484	entry = pdata;
2485
2486	/* set params Size of returned Quota Data 4 bytes*/
2487	/* but set it later when we know it */
2488
2489	/* for each entry push the data */
2490
2491	if (start_enum) {
2492	qt_handle->tmp_list = qt_handle->quota_list;
2493	}
2494
2495	tmp_list = qt_handle->tmp_list;
2496
2497	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2498	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2499
2500	sid_len = sid_size(&tmp_list->quotas->sid);
2501	entry_len = 40 + sid_len;
2502
2503	/* nextoffset entry 4 bytes */
2504	SIVAL(entry,0,entry_len);
2505
2506	/* then the len of the SID 4 bytes */
2507	SIVAL(entry,4,sid_len);
2508
2509	/* unknown data 8 bytes SMB_BIG_UINT */
2510	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2511
2512	/* the used disk space 8 bytes SMB_BIG_UINT */
2513	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2514
2515	/* the soft quotas 8 bytes SMB_BIG_UINT */
2516	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2517
2518	/* the hard quotas 8 bytes SMB_BIG_UINT */
2519	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2520
2521	/* and now the SID */
2522	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2523	}
2524
2525	qt_handle->tmp_list = tmp_list;
2526
2527	/* overwrite the offset of the last entry */
2528	SIVAL(entry-entry_len,0,0);
2529
2530	data_len = 4+qt_len;
2531	/* overwrite the params quota_data_len */
2532	SIVAL(params,0,data_len);
2533
2534	break;
2535
2536	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2537
2538	/* unknown 4 bytes IVAL(pdata,0) */
2539
2540	if (data_count < 8) {
2541	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2542	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2543	}
2544
2545	sid_len = IVAL(pdata,4);
2546	/* Ensure this is less than 1mb. */
2547	if (sid_len > (1024*1024)) {
2548	return ERROR_DOS(ERRDOS,ERRnomem);
2549	}
2550
2551	if (data_count < 8+sid_len) {
2552	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2553	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2554	}
2555
2556	data_len = 4+40+sid_len;
2557
2558	if (max_data_count < data_len) {
2559	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2560	max_data_count, data_len));
2561	param_len = 4;
2562	SIVAL(params,0,data_len);
2563	data_len = 0;
2564	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2565	break;
2566	}
2567
2568	sid_parse(pdata+8,sid_len,&sid);
2569
2570	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2571	ZERO_STRUCT(qt);
2572	/*
2573	* we have to return zero's in all fields
2574	* instead of returning an error here
2575	* --metze
2576	*/
2577	}
2578
2579	/* Realloc the size of parameters and data we will return */
2580	param_len = 4;
2581	params = nttrans_realloc(ppparams, param_len);
2582	if(params == NULL) {
2583	return ERROR_DOS(ERRDOS,ERRnomem);
2584	}
2585
2586	pdata = nttrans_realloc(ppdata, data_len);
2587	if(pdata == NULL) {
2588	return ERROR_DOS(ERRDOS,ERRnomem);
2589	}
2590
2591	entry = pdata;
2592
2593	/* set params Size of returned Quota Data 4 bytes*/
2594	SIVAL(params,0,data_len);
2595
2596	/* nextoffset entry 4 bytes */
2597	SIVAL(entry,0,0);
2598
2599	/* then the len of the SID 4 bytes */
2600	SIVAL(entry,4,sid_len);
2601
2602	/* unknown data 8 bytes SMB_BIG_UINT */
2603	SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2604
2605	/* the used disk space 8 bytes SMB_BIG_UINT */
2606	SBIG_UINT(entry,16,qt.usedspace);
2607
2608	/* the soft quotas 8 bytes SMB_BIG_UINT */
2609	SBIG_UINT(entry,24,qt.softlim);
2610
2611	/* the hard quotas 8 bytes SMB_BIG_UINT */
2612	SBIG_UINT(entry,32,qt.hardlim);
2613
2614	/* and now the SID */
2615	sid_linearize(entry+40, sid_len, &sid);
2616
2617	break;
2618
2619	default:
2620	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2621	return ERROR_DOS(ERRSRV,ERRerror);
2622	break;
2623	}
2624
2625	send_nt_replies(outbuf, bufsize, nt_status, params, param_len,
2626	pdata, data_len);
2627
2628	return -1;
2629	}
2630
2631	/****************************************************************************
2632	Reply to set user quota
2633	****************************************************************************/
2634
2635	static int call_nt_transact_set_user_quota(connection_struct conn, char inbuf, char *outbuf, int length, int bufsize,
2636	uint16 **ppsetup, uint32 setup_count,
2637	char **ppparams, uint32 parameter_count,
2638	char **ppdata, uint32 data_count, uint32 max_data_count)
2639	{
2640	char params = ppparams;
2641	char pdata = ppdata;
2642	int data_len=0,param_len=0;
2643	SMB_NTQUOTA_STRUCT qt;
2644	size_t sid_len;
2645	DOM_SID sid;
2646	files_struct *fsp = NULL;
2647
2648	ZERO_STRUCT(qt);
2649
2650	/* access check */
2651	if (current_user.ut.uid != 0) {
2652	DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2653	lp_servicename(SNUM(conn)),conn->user));
2654	return ERROR_DOS(ERRDOS,ERRnoaccess);
2655	}
2656
2657	/*
2658	* Ensure minimum number of parameters sent.
2659	*/
2660
2661	if (parameter_count < 2) {
2662	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2663	return ERROR_DOS(ERRDOS,ERRinvalidparam);
2664	}
2665
2666	/* maybe we can check the quota_fnum */
2667	fsp = file_fsp(params,0);
2668	if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2669	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2670	return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2671	}
2672
2673	if (data_count < 40) {
2674	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2675	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2676	}
2677
2678	/* offset to next quota record.
2679	* 4 bytes IVAL(pdata,0)
2680	* unused here...
2681	*/
2682
2683	/* sid len */
2684	sid_len = IVAL(pdata,4);
2685
2686	if (data_count < 40+sid_len) {
2687	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2688	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2689	}
2690
2691	/* unknown 8 bytes in pdata
2692	* maybe its the change time in NTTIME
2693	*/
2694
2695	/* the used space 8 bytes (SMB_BIG_UINT)*/
2696	qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2697	#ifdef LARGE_SMB_OFF_T
2698	qt.usedspace \|= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2699	#else /* LARGE_SMB_OFF_T */
2700	if ((IVAL(pdata,20) != 0)&&
2701	((qt.usedspace != 0xFFFFFFFF)\|\|
2702	(IVAL(pdata,20)!=0xFFFFFFFF))) {
2703	/* more than 32 bits? */
2704	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2705	}
2706	#endif /* LARGE_SMB_OFF_T */
2707
2708	/* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2709	qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2710	#ifdef LARGE_SMB_OFF_T
2711	qt.softlim \|= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2712	#else /* LARGE_SMB_OFF_T */
2713	if ((IVAL(pdata,28) != 0)&&
2714	((qt.softlim != 0xFFFFFFFF)\|\|
2715	(IVAL(pdata,28)!=0xFFFFFFFF))) {
2716	/* more than 32 bits? */
2717	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2718	}
2719	#endif /* LARGE_SMB_OFF_T */
2720
2721	/* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2722	qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2723	#ifdef LARGE_SMB_OFF_T
2724	qt.hardlim \|= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2725	#else /* LARGE_SMB_OFF_T */
2726	if ((IVAL(pdata,36) != 0)&&
2727	((qt.hardlim != 0xFFFFFFFF)\|\|
2728	(IVAL(pdata,36)!=0xFFFFFFFF))) {
2729	/* more than 32 bits? */
2730	return ERROR_DOS(ERRDOS,ERRunknownlevel);
2731	}
2732	#endif /* LARGE_SMB_OFF_T */
2733
2734	sid_parse(pdata+40,sid_len,&sid);
2735	DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2736
2737	/* 44 unknown bytes left... */
2738
2739	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2740	return ERROR_DOS(ERRSRV,ERRerror);
2741	}
2742
2743	send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len,
2744	pdata, data_len);
2745
2746	return -1;
2747	}
2748	#endif /* HAVE_SYS_QUOTAS */
2749
2750	static int handle_nttrans(connection_struct *conn,
2751	struct trans_state *state,
2752	char inbuf, char outbuf, int size, int bufsize)
2753	{
2754	int outsize;
2755
2756	if (Protocol >= PROTOCOL_NT1) {
2757	SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) \| 0x40); /* IS_LONG_NAME */
2758	}
2759
2760	/* Now we must call the relevant NT_TRANS function */
2761	switch(state->call) {
2762	case NT_TRANSACT_CREATE:
2763	{
2764	START_PROFILE(NT_transact_create);
2765	outsize = call_nt_transact_create(conn, inbuf, outbuf,
2766	size, bufsize,
2767	&state->setup, state->setup_count,
2768	&state->param, state->total_param,
2769	&state->data, state->total_data,
2770	state->max_data_return);
2771	END_PROFILE(NT_transact_create);
2772	break;
2773	}
2774
2775	case NT_TRANSACT_IOCTL:
2776	{
2777	START_PROFILE(NT_transact_ioctl);
2778	outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2779	size, bufsize,
2780	&state->setup, state->setup_count,
2781	&state->param, state->total_param,
2782	&state->data, state->total_data, state->max_data_return);
2783	END_PROFILE(NT_transact_ioctl);
2784	break;
2785	}
2786
2787	case NT_TRANSACT_SET_SECURITY_DESC:
2788	{
2789	START_PROFILE(NT_transact_set_security_desc);
2790	outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2791	size, bufsize,
2792	&state->setup, state->setup_count,
2793	&state->param, state->total_param,
2794	&state->data, state->total_data, state->max_data_return);
2795	END_PROFILE(NT_transact_set_security_desc);
2796	break;
2797	}
2798
2799	case NT_TRANSACT_NOTIFY_CHANGE:
2800	{
2801	START_PROFILE(NT_transact_notify_change);
2802	outsize = call_nt_transact_notify_change(
2803	conn, inbuf, outbuf, size, bufsize,
2804	&state->setup, state->setup_count,
2805	&state->param, state->total_param,
2806	&state->data, state->total_data,
2807	state->max_data_return,
2808	state->max_param_return);
2809	END_PROFILE(NT_transact_notify_change);
2810	break;
2811	}
2812
2813	case NT_TRANSACT_RENAME:
2814	{
2815	START_PROFILE(NT_transact_rename);
2816	outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2817	size, bufsize,
2818	&state->setup, state->setup_count,
2819	&state->param, state->total_param,
2820	&state->data, state->total_data, state->max_data_return);
2821	END_PROFILE(NT_transact_rename);
2822	break;
2823	}
2824
2825	case NT_TRANSACT_QUERY_SECURITY_DESC:
2826	{
2827	START_PROFILE(NT_transact_query_security_desc);
2828	outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2829	size, bufsize,
2830	&state->setup, state->setup_count,
2831	&state->param, state->total_param,
2832	&state->data, state->total_data, state->max_data_return);
2833	END_PROFILE(NT_transact_query_security_desc);
2834	break;
2835	}
2836
2837	#ifdef HAVE_SYS_QUOTAS
2838	case NT_TRANSACT_GET_USER_QUOTA:
2839	{
2840	START_PROFILE(NT_transact_get_user_quota);
2841	outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2842	size, bufsize,
2843	&state->setup, state->setup_count,
2844	&state->param, state->total_param,
2845	&state->data, state->total_data, state->max_data_return);
2846	END_PROFILE(NT_transact_get_user_quota);
2847	break;
2848	}
2849
2850	case NT_TRANSACT_SET_USER_QUOTA:
2851	{
2852	START_PROFILE(NT_transact_set_user_quota);
2853	outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2854	size, bufsize,
2855	&state->setup, state->setup_count,
2856	&state->param, state->total_param,
2857	&state->data, state->total_data, state->max_data_return);
2858	END_PROFILE(NT_transact_set_user_quota);
2859	break;
2860	}
2861	#endif /* HAVE_SYS_QUOTAS */
2862
2863	default:
2864	/* Error in request */
2865	DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2866	state->call));
2867	return ERROR_DOS(ERRSRV,ERRerror);
2868	}
2869	return outsize;
2870	}
2871
2872	/****************************************************************************
2873	Reply to a SMBNTtrans.
2874	****************************************************************************/
2875
2876	int reply_nttrans(connection_struct *conn,
2877	char inbuf,char outbuf,int size,int bufsize)
2878	{
2879	int outsize = 0;
2880	uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2881	uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2882	uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2883	uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2884
2885	uint16 function_code = SVAL( inbuf, smb_nt_Function);
2886	NTSTATUS result;
2887	struct trans_state *state;
2888
2889	START_PROFILE(SMBnttrans);
2890
2891	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2892	END_PROFILE(SMBnttrans);
2893	return ERROR_DOS(ERRSRV,ERRaccess);
2894	}
2895
2896	result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2897	if (!NT_STATUS_IS_OK(result)) {
2898	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2899	END_PROFILE(SMBnttrans);
2900	return ERROR_NT(result);
2901	}
2902
2903	if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
2904	END_PROFILE(SMBnttrans);
2905	return ERROR_DOS(ERRSRV,ERRaccess);
2906	}
2907
2908	state->cmd = SMBnttrans;
2909
2910	state->mid = SVAL(inbuf,smb_mid);
2911	state->vuid = SVAL(inbuf,smb_uid);
2912	state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
2913	state->data = NULL;
2914	state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
2915	state->param = NULL;
2916	state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
2917	state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
2918
2919	/* setup count is in words */
2920	state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
2921	state->setup = NULL;
2922	state->call = function_code;
2923
2924	/*
2925	* All nttrans messages we handle have smb_wct == 19 +
2926	* state->setup_count. Ensure this is so as a sanity check.
2927	*/
2928
2929	if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
2930	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2931	CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
2932	goto bad_param;
2933	}
2934
2935	/* Don't allow more than 128mb for each value. */
2936	if ((state->total_data > (10241024128)) \|\|
2937	(state->total_param > (10241024128))) {
2938	END_PROFILE(SMBnttrans);
2939	return ERROR_DOS(ERRDOS,ERRnomem);
2940	}
2941
2942	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
2943	goto bad_param;
2944
2945	if (state->total_data) {
2946	/* Can't use talloc here, the core routines do realloc on the
2947	* params and data. */
2948	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2949	DEBUG(0,("reply_nttrans: data malloc fail for %u "
2950	"bytes !\n", (unsigned int)state->total_data));
2951	TALLOC_FREE(state);
2952	END_PROFILE(SMBnttrans);
2953	return(ERROR_DOS(ERRDOS,ERRnomem));
2954	}
2955	if ((dsoff+dscnt < dsoff) \|\| (dsoff+dscnt < dscnt))
2956	goto bad_param;
2957	if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) \|\|
2958	(smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
2959	goto bad_param;
2960
2961	memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
2962	}
2963
2964	if (state->total_param) {
2965	/* Can't use talloc here, the core routines do realloc on the
2966	* params and data. */
2967	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2968	DEBUG(0,("reply_nttrans: param malloc fail for %u "
2969	"bytes !\n", (unsigned int)state->total_param));
2970	SAFE_FREE(state->data);
2971	TALLOC_FREE(state);
2972	END_PROFILE(SMBnttrans);
2973	return(ERROR_DOS(ERRDOS,ERRnomem));
2974	}
2975	if ((psoff+pscnt < psoff) \|\| (psoff+pscnt < pscnt))
2976	goto bad_param;
2977	if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) \|\|
2978	(smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
2979	goto bad_param;
2980
2981	memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
2982	}
2983
2984	state->received_data = dscnt;
2985	state->received_param = pscnt;
2986
2987	if(state->setup_count > 0) {
2988	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2989	state->setup_count));
2990	state->setup = (uint16 *)TALLOC(state, state->setup_count);
2991	if (state->setup == NULL) {
2992	DEBUG(0,("reply_nttrans : Out of memory\n"));
2993	SAFE_FREE(state->data);
2994	SAFE_FREE(state->param);
2995	TALLOC_FREE(state);
2996	END_PROFILE(SMBnttrans);
2997	return ERROR_DOS(ERRDOS,ERRnomem);
2998	}
2999
3000	if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) \|\|
3001	(smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3002	goto bad_param;
3003	}
3004	if (smb_nt_SetupStart + state->setup_count > size) {
3005	goto bad_param;
3006	}
3007
3008	memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
3009	dump_data(10, (char *)state->setup, state->setup_count);
3010	}
3011
3012	if ((state->received_data == state->total_data) &&
3013	(state->received_param == state->total_param)) {
3014	outsize = handle_nttrans(conn, state, inbuf, outbuf,
3015	size, bufsize);
3016	SAFE_FREE(state->param);
3017	SAFE_FREE(state->data);
3018	TALLOC_FREE(state);
3019	END_PROFILE(SMBnttrans);
3020	return outsize;
3021	}
3022
3023	DLIST_ADD(conn->pending_trans, state);
3024
3025	/* We need to send an interim response then receive the rest
3026	of the parameter/data bytes */
3027	outsize = set_message(outbuf,0,0,False);
3028	show_msg(outbuf);
3029	END_PROFILE(SMBnttrans);
3030	return outsize;
3031
3032	bad_param:
3033
3034	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3035	SAFE_FREE(state->data);
3036	SAFE_FREE(state->param);
3037	TALLOC_FREE(state);
3038	END_PROFILE(SMBnttrans);
3039	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3040	}
3041
3042	/****************************************************************************
3043	Reply to a SMBnttranss
3044	****************************************************************************/
3045
3046	int reply_nttranss(connection_struct conn, char inbuf,char *outbuf,
3047	int size,int bufsize)
3048	{
3049	int outsize = 0;
3050	unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3051	struct trans_state *state;
3052
3053	START_PROFILE(SMBnttranss);
3054
3055	show_msg(inbuf);
3056
3057	for (state = conn->pending_trans; state != NULL;
3058	state = state->next) {
3059	if (state->mid == SVAL(inbuf,smb_mid)) {
3060	break;
3061	}
3062	}
3063
3064	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
3065	END_PROFILE(SMBnttranss);
3066	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3067	}
3068
3069	/* Revise state->total_param and state->total_data in case they have
3070	changed downwards */
3071	if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3072	state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3073	}
3074	if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3075	state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3076	}
3077
3078	pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3079	poff = IVAL(inbuf, smb_nts_ParameterOffset);
3080	pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3081
3082	dcnt = IVAL(inbuf, smb_nts_DataCount);
3083	ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3084	doff = IVAL(inbuf, smb_nts_DataOffset);
3085
3086	state->received_param += pcnt;
3087	state->received_data += dcnt;
3088
3089	if ((state->received_data > state->total_data) \|\|
3090	(state->received_param > state->total_param))
3091	goto bad_param;
3092
3093	if (pcnt) {
3094	if (pdisp+pcnt > state->total_param)
3095	goto bad_param;
3096	if ((pdisp+pcnt < pdisp) \|\| (pdisp+pcnt < pcnt))
3097	goto bad_param;
3098	if (pdisp > state->total_param)
3099	goto bad_param;
3100	if ((smb_base(inbuf) + poff + pcnt > inbuf + size) \|\|
3101	(smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3102	goto bad_param;
3103	if (state->param + pdisp < state->param)
3104	goto bad_param;
3105
3106	memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3107	pcnt);
3108	}
3109
3110	if (dcnt) {
3111	if (ddisp+dcnt > state->total_data)
3112	goto bad_param;
3113	if ((ddisp+dcnt < ddisp) \|\| (ddisp+dcnt < dcnt))
3114	goto bad_param;
3115	if (ddisp > state->total_data)
3116	goto bad_param;
3117	if ((smb_base(inbuf) + doff + dcnt > inbuf + size) \|\|
3118	(smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3119	goto bad_param;
3120	if (state->data + ddisp < state->data)
3121	goto bad_param;
3122
3123	memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3124	dcnt);
3125	}
3126
3127	if ((state->received_param < state->total_param) \|\|
3128	(state->received_data < state->total_data)) {
3129	END_PROFILE(SMBnttranss);
3130	return -1;
3131	}
3132
3133	/* construct_reply_common has done us the favor to pre-fill the
3134	* command field with SMBnttranss which is wrong :-)
3135	*/
3136	SCVAL(outbuf,smb_com,SMBnttrans);
3137
3138	outsize = handle_nttrans(conn, state, inbuf, outbuf,
3139	size, bufsize);
3140
3141	DLIST_REMOVE(conn->pending_trans, state);
3142	SAFE_FREE(state->data);
3143	SAFE_FREE(state->param);
3144	TALLOC_FREE(state);
3145
3146	if (outsize == 0) {
3147	END_PROFILE(SMBnttranss);
3148	return(ERROR_DOS(ERRSRV,ERRnosupport));
3149	}
3150
3151	END_PROFILE(SMBnttranss);
3152	return(outsize);
3153
3154	bad_param:
3155
3156	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3157	DLIST_REMOVE(conn->pending_trans, state);
3158	SAFE_FREE(state->data);
3159	SAFE_FREE(state->param);
3160	TALLOC_FREE(state);
3161	END_PROFILE(SMBnttranss);
3162	return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3163	}

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: trunk/samba-3.0.25pre1/source/smbd/nttrans.c@ 1

Download in other formats: