source: trunk/samba-3.0.25pre1/source/smbd/nttrans.c@ 7

Last change on this file since 7 was 1, checked in by Paul Smedley, 18 years ago

Initial code import
File size: 85.5 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20*/
21
22#include "includes.h"
23
24extern int max_send;
25extern enum protocol_types Protocol;
26extern int smb_read_error;
27extern struct current_user current_user;
28
29static const char *known_nt_pipes[] = {
30 "\\LANMAN",
31 "\\srvsvc",
32 "\\samr",
33 "\\wkssvc",
34 "\\NETLOGON",
35 "\\ntlsa",
36 "\\ntsvcs",
37 "\\lsass",
38 "\\lsarpc",
39 "\\winreg",
40 "\\initshutdown",
41 "\\spoolss",
42 "\\netdfs",
43 "\\rpcecho",
44 "\\svcctl",
45 "\\eventlog",
46 "\\unixinfo",
47 NULL
48};
49
50static char *nttrans_realloc(char **ptr, size_t size)
51{
52 if (ptr==NULL) {
53 smb_panic("nttrans_realloc() called with NULL ptr\n");
54 }
55
56 *ptr = (char *)SMB_REALLOC(*ptr, size);
57 if(*ptr == NULL) {
58 return NULL;
59 }
60 memset(*ptr,'\0',size);
61 return *ptr;
62}
63
64/****************************************************************************
65 Send the required number of replies back.
66 We assume all fields other than the data fields are
67 set correctly for the type of call.
68 HACK ! Always assumes smb_setup field is zero.
69****************************************************************************/
70
71int send_nt_replies(char *outbuf, int bufsize, NTSTATUS nt_error,
72 char *params, int paramsize, char *pdata, int datasize)
73{
74 int data_to_send = datasize;
75 int params_to_send = paramsize;
76 int useable_space;
77 char *pp = params;
78 char *pd = pdata;
79 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80 int alignment_offset = 3;
81 int data_alignment_offset = 0;
82
83 /*
84 * Initially set the wcnt area to be 18 - this is true for all
85 * transNT replies.
86 */
87
88 set_message(outbuf,18,0,True);
89
90 if (NT_STATUS_V(nt_error)) {
91 ERROR_NT(nt_error);
92 }
93
94 /*
95 * If there genuinely are no parameters or data to send just send
96 * the empty packet.
97 */
98
99 if(params_to_send == 0 && data_to_send == 0) {
100 show_msg(outbuf);
101 if (!send_smb(smbd_server_fd(),outbuf)) {
102 exit_server_cleanly("send_nt_replies: send_smb failed.");
103 }
104 return 0;
105 }
106
107 /*
108 * When sending params and data ensure that both are nicely aligned.
109 * Only do this alignment when there is also data to send - else
110 * can cause NT redirector problems.
111 */
112
113 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
114 data_alignment_offset = 4 - (params_to_send % 4);
115 }
116
117 /*
118 * Space is bufsize minus Netbios over TCP header minus SMB header.
119 * The alignment_offset is to align the param bytes on a four byte
120 * boundary (2 bytes for data len, one byte pad).
121 * NT needs this to work correctly.
122 */
123
124 useable_space = bufsize - ((smb_buf(outbuf)+
125 alignment_offset+data_alignment_offset) -
126 outbuf);
127
128 /*
129 * useable_space can never be more than max_send minus the
130 * alignment offset.
131 */
132
133 useable_space = MIN(useable_space,
134 max_send - (alignment_offset+data_alignment_offset));
135
136
137 while (params_to_send || data_to_send) {
138
139 /*
140 * Calculate whether we will totally or partially fill this packet.
141 */
142
143 total_sent_thistime = params_to_send + data_to_send +
144 alignment_offset + data_alignment_offset;
145
146 /*
147 * We can never send more than useable_space.
148 */
149
150 total_sent_thistime = MIN(total_sent_thistime, useable_space);
151
152 set_message(outbuf, 18, total_sent_thistime, True);
153
154 /*
155 * Set total params and data to be sent.
156 */
157
158 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
159 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
160
161 /*
162 * Calculate how many parameters and data we can fit into
163 * this packet. Parameters get precedence.
164 */
165
166 params_sent_thistime = MIN(params_to_send,useable_space);
167 data_sent_thistime = useable_space - params_sent_thistime;
168 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
169
170 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
171
172 if(params_sent_thistime == 0) {
173 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
174 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
175 } else {
176 /*
177 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
178 * parameter bytes, however the first 4 bytes of outbuf are
179 * the Netbios over TCP header. Thus use smb_base() to subtract
180 * them from the calculation.
181 */
182
183 SIVAL(outbuf,smb_ntr_ParameterOffset,
184 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
185 /*
186 * Absolute displacement of param bytes sent in this packet.
187 */
188
189 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
190 }
191
192 /*
193 * Deal with the data portion.
194 */
195
196 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
197
198 if(data_sent_thistime == 0) {
199 SIVAL(outbuf,smb_ntr_DataOffset,0);
200 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
201 } else {
202 /*
203 * The offset of the data bytes is the offset of the
204 * parameter bytes plus the number of parameters being sent this time.
205 */
206
207 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
208 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
209 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
210 }
211
212 /*
213 * Copy the param bytes into the packet.
214 */
215
216 if(params_sent_thistime) {
217 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
218 }
219
220 /*
221 * Copy in the data bytes
222 */
223
224 if(data_sent_thistime) {
225 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
226 data_alignment_offset,pd,data_sent_thistime);
227 }
228
229 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
230 params_sent_thistime, data_sent_thistime, useable_space));
231 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
232 params_to_send, data_to_send, paramsize, datasize));
233
234 /* Send the packet */
235 show_msg(outbuf);
236 if (!send_smb(smbd_server_fd(),outbuf)) {
237 exit_server_cleanly("send_nt_replies: send_smb failed.");
238 }
239
240 pp += params_sent_thistime;
241 pd += data_sent_thistime;
242
243 params_to_send -= params_sent_thistime;
244 data_to_send -= data_sent_thistime;
245
246 /*
247 * Sanity check
248 */
249
250 if(params_to_send < 0 || data_to_send < 0) {
251 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
252 params_to_send, data_to_send));
253 return -1;
254 }
255 }
256
257 return 0;
258}
259
260/****************************************************************************
261 Is it an NTFS stream name ?
262****************************************************************************/
263
264BOOL is_ntfs_stream_name(const char *fname)
265{
266 if (lp_posix_pathnames()) {
267 return False;
268 }
269 return (strchr_m(fname, ':') != NULL) ? True : False;
270}
271
272/****************************************************************************
273 Save case statics.
274****************************************************************************/
275
276static BOOL saved_case_sensitive;
277static BOOL saved_case_preserve;
278static BOOL saved_short_case_preserve;
279
280/****************************************************************************
281 Save case semantics.
282****************************************************************************/
283
284static uint32 set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
285{
286 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
287 return file_attributes;
288 }
289
290 saved_case_sensitive = conn->case_sensitive;
291 saved_case_preserve = conn->case_preserve;
292 saved_short_case_preserve = conn->short_case_preserve;
293
294 /* Set to POSIX. */
295 conn->case_sensitive = True;
296 conn->case_preserve = True;
297 conn->short_case_preserve = True;
298
299 return (file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
300}
301
302/****************************************************************************
303 Restore case semantics.
304****************************************************************************/
305
306static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
307{
308 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
309 return;
310 }
311
312 conn->case_sensitive = saved_case_sensitive;
313 conn->case_preserve = saved_case_preserve;
314 conn->short_case_preserve = saved_short_case_preserve;
315}
316
317/****************************************************************************
318 Reply to an NT create and X call on a pipe.
319****************************************************************************/
320
321static int nt_open_pipe(char *fname, connection_struct *conn,
322 char *inbuf, char *outbuf, int *ppnum)
323{
324 smb_np_struct *p = NULL;
325 uint16 vuid = SVAL(inbuf, smb_uid);
326 int i;
327
328 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
329
330 /* See if it is one we want to handle. */
331
332 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
333 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
334 }
335
336 for( i = 0; known_nt_pipes[i]; i++ ) {
337 if( strequal(fname,known_nt_pipes[i])) {
338 break;
339 }
340 }
341
342 if ( known_nt_pipes[i] == NULL ) {
343 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
344 }
345
346 /* Strip \\ off the name. */
347 fname++;
348
349 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
350
351 p = open_rpc_pipe_p(fname, conn, vuid);
352 if (!p) {
353 return(ERROR_DOS(ERRSRV,ERRnofids));
354 }
355
356 /* TODO: Add pipe to db */
357
358 if ( !store_pipe_opendb( p ) ) {
359 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
360 }
361
362 *ppnum = p->pnum;
363 return 0;
364}
365
366/****************************************************************************
367 Reply to an NT create and X call for pipes.
368****************************************************************************/
369
370static int do_ntcreate_pipe_open(connection_struct *conn,
371 char *inbuf,char *outbuf,int length,int bufsize)
372{
373 pstring fname;
374 int ret;
375 int pnum = -1;
376 char *p = NULL;
377
378 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
379
380 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
381 return ret;
382 }
383
384 /*
385 * Deal with pipe return.
386 */
387
388 set_message(outbuf,34,0,True);
389
390 p = outbuf + smb_vwv2;
391 p++;
392 SSVAL(p,0,pnum);
393 p += 2;
394 SIVAL(p,0,FILE_WAS_OPENED);
395 p += 4;
396 p += 32;
397 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
398 p += 20;
399 /* File type. */
400 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
401 /* Device state. */
402 SSVAL(p,2, 0x5FF); /* ? */
403
404 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
405
406 return chain_reply(inbuf,outbuf,length,bufsize);
407}
408
409/****************************************************************************
410 Reply to an NT create and X call for a quota file.
411****************************************************************************/
412
413int reply_ntcreate_and_X_quota(connection_struct *conn,
414 char *inbuf,
415 char *outbuf,
416 int length,
417 int bufsize,
418 enum FAKE_FILE_TYPE fake_file_type,
419 const char *fname)
420{
421 int result;
422 char *p;
423 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
424 files_struct *fsp;
425 NTSTATUS status;
426
427 status = open_fake_file(conn, fake_file_type, fname, desired_access,
428 &fsp);
429
430 if (!NT_STATUS_IS_OK(status)) {
431 return ERROR_NT(status);
432 }
433
434 set_message(outbuf,34,0,True);
435
436 p = outbuf + smb_vwv2;
437
438 /* SCVAL(p,0,NO_OPLOCK_RETURN); */
439 p++;
440 SSVAL(p,0,fsp->fnum);
441
442 DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
443
444 result = chain_reply(inbuf,outbuf,length,bufsize);
445 return result;
446}
447
448/****************************************************************************
449 Reply to an NT create and X call.
450****************************************************************************/
451
452int reply_ntcreate_and_X(connection_struct *conn,
453 char *inbuf,char *outbuf,int length,int bufsize)
454{
455 int result;
456 pstring fname;
457 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
458 uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
459 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
460 uint32 new_file_attributes;
461 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
462 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
463 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
464 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
465 /* Breakout the oplock request bits so we can set the
466 reply bits separately. */
467 int oplock_request = 0;
468 uint32 fattr=0;
469 SMB_OFF_T file_len = 0;
470 SMB_STRUCT_STAT sbuf;
471 int info = 0;
472 files_struct *fsp=NULL;
473 char *p = NULL;
474 struct timespec c_timespec;
475 struct timespec a_timespec;
476 struct timespec m_timespec;
477 BOOL extended_oplock_granted = False;
478 NTSTATUS status;
479
480 START_PROFILE(SMBntcreateX);
481
482 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
483 "file_attributes = 0x%x, share_access = 0x%x, "
484 "create_disposition = 0x%x create_options = 0x%x "
485 "root_dir_fid = 0x%x\n",
486 (unsigned int)flags,
487 (unsigned int)access_mask,
488 (unsigned int)file_attributes,
489 (unsigned int)share_access,
490 (unsigned int)create_disposition,
491 (unsigned int)create_options,
492 (unsigned int)root_dir_fid ));
493
494 /* If it's an IPC, use the pipe handler. */
495
496 if (IS_IPC(conn)) {
497 if (lp_nt_pipe_support()) {
498 END_PROFILE(SMBntcreateX);
499 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
500 } else {
501 END_PROFILE(SMBntcreateX);
502 return(ERROR_DOS(ERRDOS,ERRnoaccess));
503 }
504 }
505
506 if (create_options & FILE_OPEN_BY_FILE_ID) {
507 END_PROFILE(SMBntcreateX);
508 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
509 }
510
511 /*
512 * Get the file name.
513 */
514
515 if(root_dir_fid != 0) {
516 /*
517 * This filename is relative to a directory fid.
518 */
519 pstring rel_fname;
520 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
521 size_t dir_name_len;
522
523 if(!dir_fsp) {
524 END_PROFILE(SMBntcreateX);
525 return(ERROR_DOS(ERRDOS,ERRbadfid));
526 }
527
528 if(!dir_fsp->is_directory) {
529
530 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
531 if (!NT_STATUS_IS_OK(status)) {
532 END_PROFILE(SMBntcreateX);
533 return ERROR_NT(status);
534 }
535
536 /*
537 * Check to see if this is a mac fork of some kind.
538 */
539
540 if( is_ntfs_stream_name(fname)) {
541 END_PROFILE(SMBntcreateX);
542 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
543 }
544
545 /*
546 we need to handle the case when we get a
547 relative open relative to a file and the
548 pathname is blank - this is a reopen!
549 (hint from demyn plantenberg)
550 */
551
552 END_PROFILE(SMBntcreateX);
553 return(ERROR_DOS(ERRDOS,ERRbadfid));
554 }
555
556 /*
557 * Copy in the base directory name.
558 */
559
560 pstrcpy( fname, dir_fsp->fsp_name );
561 dir_name_len = strlen(fname);
562
563 /*
564 * Ensure it ends in a '\'.
565 */
566
567 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
568 pstrcat(fname, "/");
569 dir_name_len++;
570 }
571
572 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
573 if (!NT_STATUS_IS_OK(status)) {
574 END_PROFILE(SMBntcreateX);
575 return ERROR_NT(status);
576 }
577 pstrcat(fname, rel_fname);
578 } else {
579 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
580 if (!NT_STATUS_IS_OK(status)) {
581 END_PROFILE(SMBntcreateX);
582 return ERROR_NT(status);
583 }
584
585 /*
586 * Check to see if this is a mac fork of some kind.
587 */
588
589 if( is_ntfs_stream_name(fname)) {
590 enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
591 if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
592 /*
593 * Here we go! support for changing the disk quotas --metze
594 *
595 * We need to fake up to open this MAGIC QUOTA file
596 * and return a valid FID.
597 *
598 * w2k close this file directly after openening
599 * xp also tries a QUERY_FILE_INFO on the file and then close it
600 */
601 result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
602 fake_file_type, fname);
603 END_PROFILE(SMBntcreateX);
604 return result;
605 } else {
606 END_PROFILE(SMBntcreateX);
607 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
608 }
609 }
610 }
611
612 /*
613 * Now contruct the smb_open_mode value from the filename,
614 * desired access and the share access.
615 */
616 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
617
618 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
619 if (oplock_request) {
620 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
621 }
622
623 /*
624 * Ordinary file or directory.
625 */
626
627 /*
628 * Check if POSIX semantics are wanted.
629 */
630
631 new_file_attributes = set_posix_case_semantics(conn, file_attributes);
632
633 status = unix_convert(conn, fname, False, NULL, &sbuf);
634 if (!NT_STATUS_IS_OK(status)) {
635 restore_case_semantics(conn, file_attributes);
636 END_PROFILE(SMBntcreateX);
637 return ERROR_NT(status);
638 }
639 /* All file access must go through check_name() */
640 status = check_name(conn, fname);
641 if (!NT_STATUS_IS_OK(status)) {
642 restore_case_semantics(conn, file_attributes);
643 END_PROFILE(SMBntcreateX);
644 return ERROR_NT(status);
645 }
646
647 /* This is the correct thing to do (check every time) but can_delete is
648 expensive (it may have to read the parent directory permissions). So
649 for now we're not doing it unless we have a strong hint the client
650 is really going to delete this file. If the client is forcing FILE_CREATE
651 let the filesystem take care of the permissions. */
652
653 /* Setting FILE_SHARE_DELETE is the hint. */
654
655 if (lp_acl_check_permissions(SNUM(conn))
656 && (create_disposition != FILE_CREATE)
657 && (share_access & FILE_SHARE_DELETE)
658 && (access_mask & DELETE_ACCESS)) {
659 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
660 !can_delete_file_in_directory(conn, fname)) {
661 restore_case_semantics(conn, file_attributes);
662 END_PROFILE(SMBntcreateX);
663 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
664 }
665 }
666
667 /*
668 * If it's a request for a directory open, deal with it separately.
669 */
670
671 if(create_options & FILE_DIRECTORY_FILE) {
672 oplock_request = 0;
673
674 /* Can't open a temp directory. IFS kit test. */
675 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
676 END_PROFILE(SMBntcreateX);
677 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
678 }
679
680 status = open_directory(conn, fname, &sbuf,
681 access_mask,
682 share_access,
683 create_disposition,
684 create_options,
685 new_file_attributes,
686 &info, &fsp);
687
688 restore_case_semantics(conn, file_attributes);
689
690 if(!NT_STATUS_IS_OK(status)) {
691 if (!use_nt_status() && NT_STATUS_EQUAL(
692 status, NT_STATUS_OBJECT_NAME_COLLISION)) {
693 status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
694 }
695 END_PROFILE(SMBntcreateX);
696 return ERROR_NT(status);
697 }
698 } else {
699 /*
700 * Ordinary file case.
701 */
702
703 /* NB. We have a potential bug here. If we
704 * cause an oplock break to ourselves, then we
705 * could end up processing filename related
706 * SMB requests whilst we await the oplock
707 * break response. As we may have changed the
708 * filename case semantics to be POSIX-like,
709 * this could mean a filename request could
710 * fail when it should succeed. This is a rare
711 * condition, but eventually we must arrange
712 * to restore the correct case semantics
713 * before issuing an oplock break request to
714 * our client. JRA. */
715
716 status = open_file_ntcreate(conn,fname,&sbuf,
717 access_mask,
718 share_access,
719 create_disposition,
720 create_options,
721 new_file_attributes,
722 oplock_request,
723 &info, &fsp);
724 if (!NT_STATUS_IS_OK(status)) {
725 /* We cheat here. There are two cases we
726 * care about. One is a directory rename,
727 * where the NT client will attempt to
728 * open the source directory for
729 * DELETE access. Note that when the
730 * NT client does this it does *not*
731 * set the directory bit in the
732 * request packet. This is translated
733 * into a read/write open
734 * request. POSIX states that any open
735 * for write request on a directory
736 * will generate an EISDIR error, so
737 * we can catch this here and open a
738 * pseudo handle that is flagged as a
739 * directory. The second is an open
740 * for a permissions read only, which
741 * we handle in the open_file_stat case. JRA.
742 */
743
744 if (NT_STATUS_EQUAL(status,
745 NT_STATUS_FILE_IS_A_DIRECTORY)) {
746
747 /*
748 * Fail the open if it was explicitly a non-directory file.
749 */
750
751 if (create_options & FILE_NON_DIRECTORY_FILE) {
752 restore_case_semantics(conn, file_attributes);
753 END_PROFILE(SMBntcreateX);
754 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
755 }
756
757 oplock_request = 0;
758 status = open_directory(conn, fname, &sbuf,
759 access_mask,
760 share_access,
761 create_disposition,
762 create_options,
763 new_file_attributes,
764 &info, &fsp);
765
766 if(!NT_STATUS_IS_OK(status)) {
767 restore_case_semantics(conn, file_attributes);
768 if (!use_nt_status() && NT_STATUS_EQUAL(
769 status, NT_STATUS_OBJECT_NAME_COLLISION)) {
770 status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
771 }
772 END_PROFILE(SMBntcreateX);
773 return ERROR_NT(status);
774 }
775 } else {
776
777 restore_case_semantics(conn, file_attributes);
778 END_PROFILE(SMBntcreateX);
779 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
780 /* We have re-scheduled this call. */
781 return -1;
782 }
783 return ERROR_NT(status);
784 }
785 }
786 }
787
788 restore_case_semantics(conn, file_attributes);
789
790 file_len = sbuf.st_size;
791 fattr = dos_mode(conn,fname,&sbuf);
792 if(fattr == 0) {
793 fattr = FILE_ATTRIBUTE_NORMAL;
794 }
795 if (!fsp->is_directory && (fattr & aDIR)) {
796 close_file(fsp,ERROR_CLOSE);
797 END_PROFILE(SMBntcreateX);
798 return ERROR_DOS(ERRDOS,ERRnoaccess);
799 }
800
801 /* Save the requested allocation size. */
802 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
803 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
804#ifdef LARGE_SMB_OFF_T
805 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
806#endif
807 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
808 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
809 if (fsp->is_directory) {
810 close_file(fsp,ERROR_CLOSE);
811 END_PROFILE(SMBntcreateX);
812 /* Can't set allocation size on a directory. */
813 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
814 }
815 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
816 close_file(fsp,ERROR_CLOSE);
817 END_PROFILE(SMBntcreateX);
818 return ERROR_NT(NT_STATUS_DISK_FULL);
819 }
820 } else {
821 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
822 }
823 }
824
825 /*
826 * If the caller set the extended oplock request bit
827 * and we granted one (by whatever means) - set the
828 * correct bit for extended oplock reply.
829 */
830
831 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
832 extended_oplock_granted = True;
833 }
834
835 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
836 extended_oplock_granted = True;
837 }
838
839#if 0
840 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
841 set_message(outbuf,42,0,True);
842#else
843 set_message(outbuf,34,0,True);
844#endif
845
846 p = outbuf + smb_vwv2;
847
848 /*
849 * Currently as we don't support level II oplocks we just report
850 * exclusive & batch here.
851 */
852
853 if (extended_oplock_granted) {
854 if (flags & REQUEST_BATCH_OPLOCK) {
855 SCVAL(p,0, BATCH_OPLOCK_RETURN);
856 } else {
857 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
858 }
859 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
860 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
861 } else {
862 SCVAL(p,0,NO_OPLOCK_RETURN);
863 }
864
865 p++;
866 SSVAL(p,0,fsp->fnum);
867 p += 2;
868 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
869 SIVAL(p,0,FILE_WAS_SUPERSEDED);
870 } else {
871 SIVAL(p,0,info);
872 }
873 p += 4;
874
875 /* Create time. */
876 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
877 a_timespec = get_atimespec(&sbuf);
878 m_timespec = get_mtimespec(&sbuf);
879
880 if (lp_dos_filetime_resolution(SNUM(conn))) {
881 dos_filetime_timespec(&c_timespec);
882 dos_filetime_timespec(&a_timespec);
883 dos_filetime_timespec(&m_timespec);
884 }
885
886 put_long_date_timespec(p, c_timespec);
887 p += 8;
888 put_long_date_timespec(p, a_timespec); /* access time */
889 p += 8;
890 put_long_date_timespec(p, m_timespec); /* write time */
891 p += 8;
892 put_long_date_timespec(p, m_timespec); /* change time */
893 p += 8;
894 SIVAL(p,0,fattr); /* File Attributes. */
895 p += 4;
896 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
897 p += 8;
898 SOFF_T(p,0,file_len);
899 p += 8;
900 if (flags & EXTENDED_RESPONSE_REQUIRED) {
901 SSVAL(p,2,0x7);
902 }
903 p += 4;
904 SCVAL(p,0,fsp->is_directory ? 1 : 0);
905
906 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
907
908 result = chain_reply(inbuf,outbuf,length,bufsize);
909 END_PROFILE(SMBntcreateX);
910 return result;
911}
912
913/****************************************************************************
914 Reply to a NT_TRANSACT_CREATE call to open a pipe.
915****************************************************************************/
916
917static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
918 uint16 **ppsetup, uint32 setup_count,
919 char **ppparams, uint32 parameter_count,
920 char **ppdata, uint32 data_count)
921{
922 pstring fname;
923 char *params = *ppparams;
924 int ret;
925 int pnum = -1;
926 char *p = NULL;
927 NTSTATUS status;
928
929 /*
930 * Ensure minimum number of parameters sent.
931 */
932
933 if(parameter_count < 54) {
934 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
935 return ERROR_DOS(ERRDOS,ERRnoaccess);
936 }
937
938 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
939 if (!NT_STATUS_IS_OK(status)) {
940 return ERROR_NT(status);
941 }
942
943 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
944 return ret;
945 }
946
947 /* Realloc the size of parameters and data we will return */
948 params = nttrans_realloc(ppparams, 69);
949 if(params == NULL) {
950 return ERROR_DOS(ERRDOS,ERRnomem);
951 }
952
953 p = params;
954 SCVAL(p,0,NO_OPLOCK_RETURN);
955
956 p += 2;
957 SSVAL(p,0,pnum);
958 p += 2;
959 SIVAL(p,0,FILE_WAS_OPENED);
960 p += 8;
961
962 p += 32;
963 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
964 p += 20;
965 /* File type. */
966 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
967 /* Device state. */
968 SSVAL(p,2, 0x5FF); /* ? */
969
970 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
971
972 /* Send the required number of replies */
973 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
974
975 return -1;
976}
977
978/****************************************************************************
979 Internal fn to set security descriptors.
980****************************************************************************/
981
982static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
983{
984 prs_struct pd;
985 SEC_DESC *psd = NULL;
986 TALLOC_CTX *mem_ctx;
987 BOOL ret;
988
989 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
990 return NT_STATUS_OK;
991 }
992
993 /*
994 * Init the parse struct we will unmarshall from.
995 */
996
997 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
998 DEBUG(0,("set_sd: talloc_init failed.\n"));
999 return NT_STATUS_NO_MEMORY;
1000 }
1001
1002 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1003
1004 /*
1005 * Setup the prs_struct to point at the memory we just
1006 * allocated.
1007 */
1008
1009 prs_give_memory( &pd, data, sd_len, False);
1010
1011 /*
1012 * Finally, unmarshall from the data buffer.
1013 */
1014
1015 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1016 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1017 /*
1018 * Return access denied for want of a better error message..
1019 */
1020 talloc_destroy(mem_ctx);
1021 return NT_STATUS_NO_MEMORY;
1022 }
1023
1024 if (psd->owner_sid==0) {
1025 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1026 }
1027 if (psd->group_sid==0) {
1028 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1029 }
1030 if (psd->sacl==0) {
1031 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1032 }
1033 if (psd->dacl==0) {
1034 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1035 }
1036
1037 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1038
1039 if (!ret) {
1040 talloc_destroy(mem_ctx);
1041 return NT_STATUS_ACCESS_DENIED;
1042 }
1043
1044 talloc_destroy(mem_ctx);
1045
1046 return NT_STATUS_OK;
1047}
1048
1049/****************************************************************************
1050 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1051****************************************************************************/
1052
1053static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1054{
1055 struct ea_list *ea_list_head = NULL;
1056 size_t offset = 0;
1057
1058 if (data_size < 4) {
1059 return NULL;
1060 }
1061
1062 while (offset + 4 <= data_size) {
1063 size_t next_offset = IVAL(pdata,offset);
1064 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1065
1066 if (!eal) {
1067 return NULL;
1068 }
1069
1070 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1071 if (next_offset == 0) {
1072 break;
1073 }
1074 offset += next_offset;
1075 }
1076
1077 return ea_list_head;
1078}
1079
1080/****************************************************************************
1081 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1082****************************************************************************/
1083
1084static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1085 uint16 **ppsetup, uint32 setup_count,
1086 char **ppparams, uint32 parameter_count,
1087 char **ppdata, uint32 data_count, uint32 max_data_count)
1088{
1089 pstring fname;
1090 char *params = *ppparams;
1091 char *data = *ppdata;
1092 /* Breakout the oplock request bits so we can set the reply bits separately. */
1093 int oplock_request = 0;
1094 uint32 fattr=0;
1095 SMB_OFF_T file_len = 0;
1096 SMB_STRUCT_STAT sbuf;
1097 int info = 0;
1098 files_struct *fsp = NULL;
1099 char *p = NULL;
1100 BOOL extended_oplock_granted = False;
1101 uint32 flags;
1102 uint32 access_mask;
1103 uint32 file_attributes;
1104 uint32 new_file_attributes;
1105 uint32 share_access;
1106 uint32 create_disposition;
1107 uint32 create_options;
1108 uint32 sd_len;
1109 uint32 ea_len;
1110 uint16 root_dir_fid;
1111 struct timespec c_timespec;
1112 struct timespec a_timespec;
1113 struct timespec m_timespec;
1114 struct ea_list *ea_list = NULL;
1115 TALLOC_CTX *ctx = NULL;
1116 char *pdata = NULL;
1117 NTSTATUS status;
1118
1119 DEBUG(5,("call_nt_transact_create\n"));
1120
1121 /*
1122 * If it's an IPC, use the pipe handler.
1123 */
1124
1125 if (IS_IPC(conn)) {
1126 if (lp_nt_pipe_support()) {
1127 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1128 bufsize,
1129 ppsetup, setup_count,
1130 ppparams, parameter_count,
1131 ppdata, data_count);
1132 } else {
1133 return ERROR_DOS(ERRDOS,ERRnoaccess);
1134 }
1135 }
1136
1137 /*
1138 * Ensure minimum number of parameters sent.
1139 */
1140
1141 if(parameter_count < 54) {
1142 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1143 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1144 }
1145
1146 flags = IVAL(params,0);
1147 access_mask = IVAL(params,8);
1148 file_attributes = IVAL(params,20);
1149 share_access = IVAL(params,24);
1150 create_disposition = IVAL(params,28);
1151 create_options = IVAL(params,32);
1152 sd_len = IVAL(params,36);
1153 ea_len = IVAL(params,40);
1154 root_dir_fid = (uint16)IVAL(params,4);
1155
1156 /* Ensure the data_len is correct for the sd and ea values given. */
1157 if ((ea_len + sd_len > data_count) ||
1158 (ea_len > data_count) || (sd_len > data_count) ||
1159 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1160 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1161 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1162 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1163 }
1164
1165 if (ea_len) {
1166 if (!lp_ea_support(SNUM(conn))) {
1167 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1168 (unsigned int)ea_len ));
1169 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1170 }
1171
1172 if (ea_len < 10) {
1173 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1174 (unsigned int)ea_len ));
1175 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1176 }
1177 }
1178
1179 if (create_options & FILE_OPEN_BY_FILE_ID) {
1180 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1181 }
1182
1183 /*
1184 * Get the file name.
1185 */
1186
1187 if(root_dir_fid != 0) {
1188 /*
1189 * This filename is relative to a directory fid.
1190 */
1191 files_struct *dir_fsp = file_fsp(params,4);
1192 size_t dir_name_len;
1193
1194 if(!dir_fsp) {
1195 return ERROR_DOS(ERRDOS,ERRbadfid);
1196 }
1197
1198 if(!dir_fsp->is_directory) {
1199 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1200 if (!NT_STATUS_IS_OK(status)) {
1201 return ERROR_NT(status);
1202 }
1203
1204 /*
1205 * Check to see if this is a mac fork of some kind.
1206 */
1207
1208 if( is_ntfs_stream_name(fname)) {
1209 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1210 }
1211
1212 return ERROR_DOS(ERRDOS,ERRbadfid);
1213 }
1214
1215 /*
1216 * Copy in the base directory name.
1217 */
1218
1219 pstrcpy( fname, dir_fsp->fsp_name );
1220 dir_name_len = strlen(fname);
1221
1222 /*
1223 * Ensure it ends in a '\'.
1224 */
1225
1226 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1227 pstrcat(fname, "/");
1228 dir_name_len++;
1229 }
1230
1231 {
1232 pstring tmpname;
1233 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1234 if (!NT_STATUS_IS_OK(status)) {
1235 return ERROR_NT(status);
1236 }
1237 pstrcat(fname, tmpname);
1238 }
1239 } else {
1240 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1241 if (!NT_STATUS_IS_OK(status)) {
1242 return ERROR_NT(status);
1243 }
1244
1245 /*
1246 * Check to see if this is a mac fork of some kind.
1247 */
1248
1249 if( is_ntfs_stream_name(fname)) {
1250 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1251 }
1252 }
1253
1254 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1255 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1256
1257 /*
1258 * Check if POSIX semantics are wanted.
1259 */
1260
1261 new_file_attributes = set_posix_case_semantics(conn, file_attributes);
1262
1263 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1264
1265 status = unix_convert(conn, fname, False, NULL, &sbuf);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 restore_case_semantics(conn, file_attributes);
1268 return ERROR_NT(status);
1269 }
1270 /* All file access must go through check_name() */
1271 status = check_name(conn, fname);
1272 if (!NT_STATUS_IS_OK(status)) {
1273 restore_case_semantics(conn, file_attributes);
1274 return ERROR_NT(status);
1275 }
1276
1277 /* This is the correct thing to do (check every time) but can_delete is
1278 expensive (it may have to read the parent directory permissions). So
1279 for now we're not doing it unless we have a strong hint the client
1280 is really going to delete this file. If the client is forcing FILE_CREATE
1281 let the filesystem take care of the permissions. */
1282
1283 /* Setting FILE_SHARE_DELETE is the hint. */
1284
1285 if (lp_acl_check_permissions(SNUM(conn))
1286 && (create_disposition != FILE_CREATE)
1287 && (share_access & FILE_SHARE_DELETE)
1288 && (access_mask & DELETE_ACCESS)) {
1289 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
1290 !can_delete_file_in_directory(conn, fname)) {
1291 restore_case_semantics(conn, file_attributes);
1292 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1293 }
1294 }
1295
1296 if (ea_len) {
1297 pdata = data + sd_len;
1298
1299 /* We have already checked that ea_len <= data_count here. */
1300 ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
1301 ea_len);
1302 if (!ea_list ) {
1303 restore_case_semantics(conn, file_attributes);
1304 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1305 }
1306 }
1307
1308 /*
1309 * If it's a request for a directory open, deal with it separately.
1310 */
1311
1312 if(create_options & FILE_DIRECTORY_FILE) {
1313
1314 /* Can't open a temp directory. IFS kit test. */
1315 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1316 restore_case_semantics(conn, file_attributes);
1317 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1318 }
1319
1320 oplock_request = 0;
1321
1322 /*
1323 * We will get a create directory here if the Win32
1324 * app specified a security descriptor in the
1325 * CreateDirectory() call.
1326 */
1327
1328 status = open_directory(conn, fname, &sbuf,
1329 access_mask,
1330 share_access,
1331 create_disposition,
1332 create_options,
1333 new_file_attributes,
1334 &info, &fsp);
1335 if(!NT_STATUS_IS_OK(status)) {
1336 restore_case_semantics(conn, file_attributes);
1337 return ERROR_NT(status);
1338 }
1339
1340 } else {
1341
1342 /*
1343 * Ordinary file case.
1344 */
1345
1346 status = open_file_ntcreate(conn,fname,&sbuf,
1347 access_mask,
1348 share_access,
1349 create_disposition,
1350 create_options,
1351 new_file_attributes,
1352 oplock_request,
1353 &info, &fsp);
1354
1355 if (!NT_STATUS_IS_OK(status)) {
1356 if (NT_STATUS_EQUAL(status,
1357 NT_STATUS_FILE_IS_A_DIRECTORY)) {
1358
1359 /*
1360 * Fail the open if it was explicitly a non-directory file.
1361 */
1362
1363 if (create_options & FILE_NON_DIRECTORY_FILE) {
1364 restore_case_semantics(conn, file_attributes);
1365 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1366 }
1367
1368 oplock_request = 0;
1369 status = open_directory(conn, fname, &sbuf,
1370 access_mask,
1371 share_access,
1372 create_disposition,
1373 create_options,
1374 new_file_attributes,
1375 &info, &fsp);
1376 if(!NT_STATUS_IS_OK(status)) {
1377 restore_case_semantics(conn, file_attributes);
1378 return ERROR_NT(status);
1379 }
1380 } else {
1381 restore_case_semantics(conn, file_attributes);
1382 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1383 /* We have re-scheduled this call. */
1384 return -1;
1385 }
1386 return ERROR_NT(status);
1387 }
1388 }
1389 }
1390
1391 /*
1392 * According to the MS documentation, the only time the security
1393 * descriptor is applied to the opened file is iff we *created* the
1394 * file; an existing file stays the same.
1395 *
1396 * Also, it seems (from observation) that you can open the file with
1397 * any access mask but you can still write the sd. We need to override
1398 * the granted access before we call set_sd
1399 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1400 */
1401
1402 if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1403 uint32 saved_access_mask = fsp->access_mask;
1404
1405 /* We have already checked that sd_len <= data_count here. */
1406
1407 fsp->access_mask = FILE_GENERIC_ALL;
1408
1409 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1410 if (!NT_STATUS_IS_OK(status)) {
1411 talloc_destroy(ctx);
1412 close_file(fsp,ERROR_CLOSE);
1413 restore_case_semantics(conn, file_attributes);
1414 return ERROR_NT(status);
1415 }
1416 fsp->access_mask = saved_access_mask;
1417 }
1418
1419 if (ea_len && (info == FILE_WAS_CREATED)) {
1420 status = set_ea(conn, fsp, fname, ea_list);
1421 if (!NT_STATUS_IS_OK(status)) {
1422 close_file(fsp,ERROR_CLOSE);
1423 restore_case_semantics(conn, file_attributes);
1424 return ERROR_NT(status);
1425 }
1426 }
1427
1428 restore_case_semantics(conn, file_attributes);
1429
1430 file_len = sbuf.st_size;
1431 fattr = dos_mode(conn,fname,&sbuf);
1432 if(fattr == 0) {
1433 fattr = FILE_ATTRIBUTE_NORMAL;
1434 }
1435 if (!fsp->is_directory && (fattr & aDIR)) {
1436 close_file(fsp,ERROR_CLOSE);
1437 return ERROR_DOS(ERRDOS,ERRnoaccess);
1438 }
1439
1440 /* Save the requested allocation size. */
1441 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
1442 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1443#ifdef LARGE_SMB_OFF_T
1444 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1445#endif
1446 if (allocation_size && (allocation_size > file_len)) {
1447 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1448 if (fsp->is_directory) {
1449 close_file(fsp,ERROR_CLOSE);
1450 /* Can't set allocation size on a directory. */
1451 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1452 }
1453 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1454 close_file(fsp,ERROR_CLOSE);
1455 return ERROR_NT(NT_STATUS_DISK_FULL);
1456 }
1457 } else {
1458 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1459 }
1460 }
1461
1462 /*
1463 * If the caller set the extended oplock request bit
1464 * and we granted one (by whatever means) - set the
1465 * correct bit for extended oplock reply.
1466 */
1467
1468 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1469 extended_oplock_granted = True;
1470 }
1471
1472 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1473 extended_oplock_granted = True;
1474 }
1475
1476 /* Realloc the size of parameters and data we will return */
1477 params = nttrans_realloc(ppparams, 69);
1478 if(params == NULL) {
1479 return ERROR_DOS(ERRDOS,ERRnomem);
1480 }
1481
1482 p = params;
1483 if (extended_oplock_granted) {
1484 if (flags & REQUEST_BATCH_OPLOCK) {
1485 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1486 } else {
1487 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1488 }
1489 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1490 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1491 } else {
1492 SCVAL(p,0,NO_OPLOCK_RETURN);
1493 }
1494
1495 p += 2;
1496 SSVAL(p,0,fsp->fnum);
1497 p += 2;
1498 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1499 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1500 } else {
1501 SIVAL(p,0,info);
1502 }
1503 p += 8;
1504
1505 /* Create time. */
1506 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1507 a_timespec = get_atimespec(&sbuf);
1508 m_timespec = get_mtimespec(&sbuf);
1509
1510 if (lp_dos_filetime_resolution(SNUM(conn))) {
1511 dos_filetime_timespec(&c_timespec);
1512 dos_filetime_timespec(&a_timespec);
1513 dos_filetime_timespec(&m_timespec);
1514 }
1515
1516 put_long_date_timespec(p, c_timespec); /* create time. */
1517 p += 8;
1518 put_long_date_timespec(p, a_timespec); /* access time */
1519 p += 8;
1520 put_long_date_timespec(p, m_timespec); /* write time */
1521 p += 8;
1522 put_long_date_timespec(p, m_timespec); /* change time */
1523 p += 8;
1524 SIVAL(p,0,fattr); /* File Attributes. */
1525 p += 4;
1526 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1527 p += 8;
1528 SOFF_T(p,0,file_len);
1529 p += 8;
1530 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1531 SSVAL(p,2,0x7);
1532 }
1533 p += 4;
1534 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1535
1536 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1537
1538 /* Send the required number of replies */
1539 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1540
1541 return -1;
1542}
1543
1544/****************************************************************************
1545 Reply to a NT CANCEL request.
1546 conn POINTER CAN BE NULL HERE !
1547****************************************************************************/
1548
1549int reply_ntcancel(connection_struct *conn,
1550 char *inbuf,char *outbuf,int length,int bufsize)
1551{
1552 /*
1553 * Go through and cancel any pending change notifies.
1554 */
1555
1556 int mid = SVAL(inbuf,smb_mid);
1557 START_PROFILE(SMBntcancel);
1558 remove_pending_change_notify_requests_by_mid(mid);
1559 remove_pending_lock_requests_by_mid(mid);
1560 srv_cancel_sign_response(mid);
1561
1562 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1563
1564 END_PROFILE(SMBntcancel);
1565 return(-1);
1566}
1567
1568/****************************************************************************
1569 Copy a file.
1570****************************************************************************/
1571
1572static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint32 attrs)
1573{
1574 SMB_STRUCT_STAT sbuf1, sbuf2;
1575 pstring last_component_oldname;
1576 pstring last_component_newname;
1577 files_struct *fsp1,*fsp2;
1578 uint32 fattr;
1579 int info;
1580 SMB_OFF_T ret=-1;
1581 NTSTATUS status = NT_STATUS_OK;
1582
1583 ZERO_STRUCT(sbuf1);
1584 ZERO_STRUCT(sbuf2);
1585
1586 if (!CAN_WRITE(conn)) {
1587 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1588 }
1589
1590 status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
1591 if (!NT_STATUS_IS_OK(status)) {
1592 return status;
1593 }
1594
1595 /* Source must already exist. */
1596 if (!VALID_STAT(sbuf1)) {
1597 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1598 }
1599 status = check_name(conn, oldname);
1600 if (!NT_STATUS_IS_OK(status)) {
1601 return status;
1602 }
1603
1604 /* Ensure attributes match. */
1605 fattr = dos_mode(conn,oldname,&sbuf1);
1606 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1607 return NT_STATUS_NO_SUCH_FILE;
1608 }
1609
1610 status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
1611 if (!NT_STATUS_IS_OK(status)) {
1612 return status;
1613 }
1614
1615 /* Disallow if newname already exists. */
1616 if (VALID_STAT(sbuf2)) {
1617 return NT_STATUS_OBJECT_NAME_COLLISION;
1618 }
1619
1620 status = check_name(conn, newname);
1621 if (!NT_STATUS_IS_OK(status)) {
1622 return status;
1623 }
1624
1625 /* No links from a directory. */
1626 if (S_ISDIR(sbuf1.st_mode)) {
1627 return NT_STATUS_FILE_IS_A_DIRECTORY;
1628 }
1629
1630 /* Ensure this is within the share. */
1631 status = reduce_name(conn, oldname);
1632 if (!NT_STATUS_IS_OK(status)) {
1633 return status;
1634 }
1635
1636 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1637
1638 status = open_file_ntcreate(conn,oldname,&sbuf1,
1639 FILE_READ_DATA, /* Read-only. */
1640 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1641 FILE_OPEN,
1642 0, /* No create options. */
1643 FILE_ATTRIBUTE_NORMAL,
1644 NO_OPLOCK,
1645 &info, &fsp1);
1646
1647 if (!NT_STATUS_IS_OK(status)) {
1648 return status;
1649 }
1650
1651 status = open_file_ntcreate(conn,newname,&sbuf2,
1652 FILE_WRITE_DATA, /* Read-only. */
1653 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1654 FILE_CREATE,
1655 0, /* No create options. */
1656 fattr,
1657 NO_OPLOCK,
1658 &info, &fsp2);
1659
1660 if (!NT_STATUS_IS_OK(status)) {
1661 close_file(fsp1,ERROR_CLOSE);
1662 return status;
1663 }
1664
1665 if (sbuf1.st_size) {
1666 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1667 }
1668
1669 /*
1670 * As we are opening fsp1 read-only we only expect
1671 * an error on close on fsp2 if we are out of space.
1672 * Thus we don't look at the error return from the
1673 * close of fsp1.
1674 */
1675 close_file(fsp1,NORMAL_CLOSE);
1676
1677 /* Ensure the modtime is set correctly on the destination file. */
1678 fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1679
1680 status = close_file(fsp2,NORMAL_CLOSE);
1681
1682 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1683 creates the file. This isn't the correct thing to do in the copy
1684 case. JRA */
1685 file_set_dosmode(conn, newname, fattr, &sbuf2,
1686 parent_dirname(newname));
1687
1688 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1689 return NT_STATUS_DISK_FULL;
1690 }
1691
1692 if (!NT_STATUS_IS_OK(status)) {
1693 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1694 nt_errstr(status), oldname, newname));
1695 }
1696 return status;
1697}
1698
1699/****************************************************************************
1700 Reply to a NT rename request.
1701****************************************************************************/
1702
1703int reply_ntrename(connection_struct *conn,
1704 char *inbuf,char *outbuf,int length,int bufsize)
1705{
1706 int outsize = 0;
1707 pstring oldname;
1708 pstring newname;
1709 char *p;
1710 NTSTATUS status;
1711 BOOL path1_contains_wcard = False;
1712 BOOL path2_contains_wcard = False;
1713 uint32 attrs = SVAL(inbuf,smb_vwv0);
1714 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1715
1716 START_PROFILE(SMBntrename);
1717
1718 p = smb_buf(inbuf) + 1;
1719 p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &path1_contains_wcard);
1720 if (!NT_STATUS_IS_OK(status)) {
1721 END_PROFILE(SMBntrename);
1722 return ERROR_NT(status);
1723 }
1724
1725 if( is_ntfs_stream_name(oldname)) {
1726 /* Can't rename a stream. */
1727 END_PROFILE(SMBntrename);
1728 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1729 }
1730
1731 if (ms_has_wild(oldname)) {
1732 END_PROFILE(SMBntrename);
1733 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1734 }
1735
1736 p++;
1737 p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path2_contains_wcard);
1738 if (!NT_STATUS_IS_OK(status)) {
1739 END_PROFILE(SMBntrename);
1740 return ERROR_NT(status);
1741 }
1742
1743 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1744 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1745
1746 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1747
1748 switch(rename_type) {
1749 case RENAME_FLAG_RENAME:
1750 status = rename_internals(conn, oldname, newname, attrs, False, path1_contains_wcard);
1751 break;
1752 case RENAME_FLAG_HARD_LINK:
1753 if (path1_contains_wcard || path2_contains_wcard) {
1754 /* No wildcards. */
1755 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1756 } else {
1757 status = hardlink_internals(conn, oldname, newname);
1758 }
1759 break;
1760 case RENAME_FLAG_COPY:
1761 if (path1_contains_wcard || path2_contains_wcard) {
1762 /* No wildcards. */
1763 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1764 } else {
1765 status = copy_internals(conn, oldname, newname, attrs);
1766 }
1767 break;
1768 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1769 status = NT_STATUS_INVALID_PARAMETER;
1770 break;
1771 default:
1772 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1773 break;
1774 }
1775
1776 if (!NT_STATUS_IS_OK(status)) {
1777 END_PROFILE(SMBntrename);
1778 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1779 /* We have re-scheduled this call. */
1780 return -1;
1781 }
1782 return ERROR_NT(status);
1783 }
1784
1785 outsize = set_message(outbuf,0,0,False);
1786
1787 END_PROFILE(SMBntrename);
1788 return(outsize);
1789}
1790
1791/****************************************************************************
1792 Reply to a notify change - queue the request and
1793 don't allow a directory to be opened.
1794****************************************************************************/
1795
1796static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
1797 char *outbuf, int length,
1798 int bufsize,
1799 uint16 **ppsetup, uint32 setup_count,
1800 char **ppparams,
1801 uint32 parameter_count,
1802 char **ppdata, uint32 data_count,
1803 uint32 max_data_count,
1804 uint32 max_param_count)
1805{
1806 uint16 *setup = *ppsetup;
1807 files_struct *fsp;
1808 uint32 filter;
1809 NTSTATUS status;
1810 BOOL recursive;
1811
1812 if(setup_count < 6) {
1813 return ERROR_DOS(ERRDOS,ERRbadfunc);
1814 }
1815
1816 fsp = file_fsp((char *)setup,4);
1817 filter = IVAL(setup, 0);
1818 recursive = (SVAL(setup, 6) != 0) ? True : False;
1819
1820 DEBUG(3,("call_nt_transact_notify_change\n"));
1821
1822 if(!fsp) {
1823 return ERROR_DOS(ERRDOS,ERRbadfid);
1824 }
1825
1826 {
1827 char *filter_string;
1828
1829 if (!(filter_string = notify_filter_string(NULL, filter))) {
1830 return ERROR_NT(NT_STATUS_NO_MEMORY);
1831 }
1832
1833 DEBUG(3,("call_nt_transact_notify_change: notify change "
1834 "called on %s, filter = %s, recursive = %d\n",
1835 fsp->fsp_name, filter_string, recursive));
1836
1837 TALLOC_FREE(filter_string);
1838 }
1839
1840 if((!fsp->is_directory) || (conn != fsp->conn)) {
1841 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1842 }
1843
1844 if (fsp->notify == NULL) {
1845
1846 status = change_notify_create(fsp, filter, recursive);
1847
1848 if (!NT_STATUS_IS_OK(status)) {
1849 DEBUG(10, ("change_notify_create returned %s\n",
1850 nt_errstr(status)));
1851 return ERROR_NT(status);
1852 }
1853 }
1854
1855 if (fsp->notify->num_changes != 0) {
1856
1857 /*
1858 * We've got changes pending, respond immediately
1859 */
1860
1861 /*
1862 * TODO: write a torture test to check the filtering behaviour
1863 * here.
1864 */
1865
1866 change_notify_reply(inbuf, max_param_count,
1867 fsp->notify);
1868
1869 /*
1870 * change_notify_reply() above has independently sent its
1871 * results
1872 */
1873 return -1;
1874 }
1875
1876 /*
1877 * No changes pending, queue the request
1878 */
1879
1880 status = change_notify_add_request(inbuf, max_param_count, filter,
1881 recursive, fsp);
1882 if (!NT_STATUS_IS_OK(status)) {
1883 return ERROR_NT(status);
1884 }
1885
1886 return -1;
1887}
1888
1889/****************************************************************************
1890 Reply to an NT transact rename command.
1891****************************************************************************/
1892
1893static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1894 uint16 **ppsetup, uint32 setup_count,
1895 char **ppparams, uint32 parameter_count,
1896 char **ppdata, uint32 data_count, uint32 max_data_count)
1897{
1898 char *params = *ppparams;
1899 pstring new_name;
1900 files_struct *fsp = NULL;
1901 BOOL replace_if_exists = False;
1902 BOOL path_contains_wcard = False;
1903 NTSTATUS status;
1904
1905 if(parameter_count < 5) {
1906 return ERROR_DOS(ERRDOS,ERRbadfunc);
1907 }
1908
1909 fsp = file_fsp(params, 0);
1910 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1911 CHECK_FSP(fsp, conn);
1912 srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), parameter_count - 4, STR_TERMINATE, &status, &path_contains_wcard);
1913 if (!NT_STATUS_IS_OK(status)) {
1914 return ERROR_NT(status);
1915 }
1916
1917 status = rename_internals(conn, fsp->fsp_name,
1918 new_name, 0, replace_if_exists, path_contains_wcard);
1919
1920 if (!NT_STATUS_IS_OK(status)) {
1921 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1922 /* We have re-scheduled this call. */
1923 return -1;
1924 }
1925 return ERROR_NT(status);
1926 }
1927
1928 /*
1929 * Rename was successful.
1930 */
1931 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1932
1933 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1934 fsp->fsp_name, new_name));
1935
1936 return -1;
1937}
1938
1939/******************************************************************************
1940 Fake up a completely empty SD.
1941*******************************************************************************/
1942
1943static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1944{
1945 size_t sd_size;
1946
1947 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1948 if(!*ppsd) {
1949 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1950 sd_size = 0;
1951 }
1952
1953 return sd_size;
1954}
1955
1956/****************************************************************************
1957 Reply to query a security descriptor.
1958****************************************************************************/
1959
1960static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1961 uint16 **ppsetup, uint32 setup_count,
1962 char **ppparams, uint32 parameter_count,
1963 char **ppdata, uint32 data_count, uint32 max_data_count)
1964{
1965 char *params = *ppparams;
1966 char *data = *ppdata;
1967 prs_struct pd;
1968 SEC_DESC *psd = NULL;
1969 size_t sd_size;
1970 uint32 security_info_wanted;
1971 TALLOC_CTX *mem_ctx;
1972 files_struct *fsp = NULL;
1973
1974 if(parameter_count < 8) {
1975 return ERROR_DOS(ERRDOS,ERRbadfunc);
1976 }
1977
1978 fsp = file_fsp(params,0);
1979 if(!fsp) {
1980 return ERROR_DOS(ERRDOS,ERRbadfid);
1981 }
1982
1983 security_info_wanted = IVAL(params,4);
1984
1985 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1986 (unsigned int)security_info_wanted ));
1987
1988 params = nttrans_realloc(ppparams, 4);
1989 if(params == NULL) {
1990 return ERROR_DOS(ERRDOS,ERRnomem);
1991 }
1992
1993 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
1994 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1995 return ERROR_DOS(ERRDOS,ERRnomem);
1996 }
1997
1998 /*
1999 * Get the permissions to return.
2000 */
2001
2002 if (!lp_nt_acl_support(SNUM(conn))) {
2003 sd_size = get_null_nt_acl(mem_ctx, &psd);
2004 } else {
2005 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
2006 }
2007
2008 if (sd_size == 0) {
2009 talloc_destroy(mem_ctx);
2010 return(UNIXERROR(ERRDOS,ERRnoaccess));
2011 }
2012
2013 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2014
2015 SIVAL(params,0,(uint32)sd_size);
2016
2017 if(max_data_count < sd_size) {
2018
2019 send_nt_replies(outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2020 params, 4, *ppdata, 0);
2021 talloc_destroy(mem_ctx);
2022 return -1;
2023 }
2024
2025 /*
2026 * Allocate the data we will point this at.
2027 */
2028
2029 data = nttrans_realloc(ppdata, sd_size);
2030 if(data == NULL) {
2031 talloc_destroy(mem_ctx);
2032 return ERROR_DOS(ERRDOS,ERRnomem);
2033 }
2034
2035 /*
2036 * Init the parse struct we will marshall into.
2037 */
2038
2039 prs_init(&pd, 0, mem_ctx, MARSHALL);
2040
2041 /*
2042 * Setup the prs_struct to point at the memory we just
2043 * allocated.
2044 */
2045
2046 prs_give_memory( &pd, data, (uint32)sd_size, False);
2047
2048 /*
2049 * Finally, linearize into the outgoing buffer.
2050 */
2051
2052 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2053 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2054security descriptor.\n"));
2055 /*
2056 * Return access denied for want of a better error message..
2057 */
2058 talloc_destroy(mem_ctx);
2059 return(UNIXERROR(ERRDOS,ERRnoaccess));
2060 }
2061
2062 /*
2063 * Now we can delete the security descriptor.
2064 */
2065
2066 talloc_destroy(mem_ctx);
2067
2068 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 4, data,
2069 (int)sd_size);
2070 return -1;
2071}
2072
2073/****************************************************************************
2074 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2075****************************************************************************/
2076
2077static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2078 uint16 **ppsetup, uint32 setup_count,
2079 char **ppparams, uint32 parameter_count,
2080 char **ppdata, uint32 data_count, uint32 max_data_count)
2081{
2082 char *params= *ppparams;
2083 char *data = *ppdata;
2084 files_struct *fsp = NULL;
2085 uint32 security_info_sent = 0;
2086 NTSTATUS nt_status;
2087
2088 if(parameter_count < 8) {
2089 return ERROR_DOS(ERRDOS,ERRbadfunc);
2090 }
2091
2092 if((fsp = file_fsp(params,0)) == NULL) {
2093 return ERROR_DOS(ERRDOS,ERRbadfid);
2094 }
2095
2096 if(!lp_nt_acl_support(SNUM(conn))) {
2097 goto done;
2098 }
2099
2100 security_info_sent = IVAL(params,4);
2101
2102 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2103 (unsigned int)security_info_sent ));
2104
2105 if (data_count == 0) {
2106 return ERROR_DOS(ERRDOS, ERRnoaccess);
2107 }
2108
2109 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2110 return ERROR_NT(nt_status);
2111 }
2112
2113 done:
2114
2115 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2116 return -1;
2117}
2118
2119/****************************************************************************
2120 Reply to NT IOCTL
2121****************************************************************************/
2122
2123static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2124 uint16 **ppsetup, uint32 setup_count,
2125 char **ppparams, uint32 parameter_count,
2126 char **ppdata, uint32 data_count, uint32 max_data_count)
2127{
2128 uint32 function;
2129 uint16 fidnum;
2130 files_struct *fsp;
2131 uint8 isFSctl;
2132 uint8 compfilter;
2133 static BOOL logged_message;
2134 char *pdata = *ppdata;
2135
2136 if (setup_count != 8) {
2137 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2138 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2139 }
2140
2141 function = IVAL(*ppsetup, 0);
2142 fidnum = SVAL(*ppsetup, 4);
2143 isFSctl = CVAL(*ppsetup, 6);
2144 compfilter = CVAL(*ppsetup, 7);
2145
2146 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2147 function, fidnum, isFSctl, compfilter));
2148
2149 fsp=file_fsp((char *)*ppsetup, 4);
2150 /* this check is done in each implemented function case for now
2151 because I don't want to break anything... --metze
2152 FSP_BELONGS_CONN(fsp,conn);*/
2153
2154 switch (function) {
2155 case FSCTL_SET_SPARSE:
2156 /* pretend this succeeded - tho strictly we should
2157 mark the file sparse (if the local fs supports it)
2158 so we can know if we need to pre-allocate or not */
2159
2160 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2161 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2162 0);
2163 return -1;
2164
2165 case FSCTL_0x000900C0:
2166 /* pretend this succeeded - don't know what this really is
2167 but works ok like this --metze
2168 */
2169
2170 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2171 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2172 0);
2173 return -1;
2174
2175 case FSCTL_GET_REPARSE_POINT:
2176 /* pretend this fail - my winXP does it like this
2177 * --metze
2178 */
2179
2180 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2181 send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2182 NULL, 0, NULL, 0);
2183 return -1;
2184
2185 case FSCTL_SET_REPARSE_POINT:
2186 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2187 * --metze
2188 */
2189
2190 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2191 send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2192 NULL, 0, NULL, 0);
2193 return -1;
2194
2195 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2196 {
2197 /*
2198 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2199 * and return their volume names. If max_data_count is 16, then it is just
2200 * asking for the number of volumes and length of the combined names.
2201 *
2202 * pdata is the data allocated by our caller, but that uses
2203 * total_data_count (which is 0 in our case) rather than max_data_count.
2204 * Allocate the correct amount and return the pointer to let
2205 * it be deallocated when we return.
2206 */
2207 SHADOW_COPY_DATA *shadow_data = NULL;
2208 TALLOC_CTX *shadow_mem_ctx = NULL;
2209 BOOL labels = False;
2210 uint32 labels_data_count = 0;
2211 uint32 i;
2212 char *cur_pdata;
2213
2214 FSP_BELONGS_CONN(fsp,conn);
2215
2216 if (max_data_count < 16) {
2217 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2218 max_data_count));
2219 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2220 }
2221
2222 if (max_data_count > 16) {
2223 labels = True;
2224 }
2225
2226 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2227 if (shadow_mem_ctx == NULL) {
2228 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2229 return ERROR_NT(NT_STATUS_NO_MEMORY);
2230 }
2231
2232 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2233 if (shadow_data == NULL) {
2234 DEBUG(0,("talloc_zero() failed!\n"));
2235 talloc_destroy(shadow_mem_ctx);
2236 return ERROR_NT(NT_STATUS_NO_MEMORY);
2237 }
2238
2239 shadow_data->mem_ctx = shadow_mem_ctx;
2240
2241 /*
2242 * Call the VFS routine to actually do the work.
2243 */
2244 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2245 talloc_destroy(shadow_data->mem_ctx);
2246 if (errno == ENOSYS) {
2247 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2248 conn->connectpath));
2249 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2250 } else {
2251 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2252 conn->connectpath));
2253 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2254 }
2255 }
2256
2257 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2258
2259 if (!labels) {
2260 data_count = 16;
2261 } else {
2262 data_count = 12+labels_data_count+4;
2263 }
2264
2265 if (max_data_count<data_count) {
2266 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2267 max_data_count,data_count));
2268 talloc_destroy(shadow_data->mem_ctx);
2269 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2270 }
2271
2272 pdata = nttrans_realloc(ppdata, data_count);
2273 if (pdata == NULL) {
2274 talloc_destroy(shadow_data->mem_ctx);
2275 return ERROR_NT(NT_STATUS_NO_MEMORY);
2276 }
2277
2278 cur_pdata = pdata;
2279
2280 /* num_volumes 4 bytes */
2281 SIVAL(pdata,0,shadow_data->num_volumes);
2282
2283 if (labels) {
2284 /* num_labels 4 bytes */
2285 SIVAL(pdata,4,shadow_data->num_volumes);
2286 }
2287
2288 /* needed_data_count 4 bytes */
2289 SIVAL(pdata,8,labels_data_count);
2290
2291 cur_pdata+=12;
2292
2293 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2294 shadow_data->num_volumes,fsp->fsp_name));
2295 if (labels && shadow_data->labels) {
2296 for (i=0;i<shadow_data->num_volumes;i++) {
2297 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2298 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2299 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2300 }
2301 }
2302
2303 talloc_destroy(shadow_data->mem_ctx);
2304
2305 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2306 pdata, data_count);
2307
2308 return -1;
2309 }
2310
2311 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2312 {
2313 /* pretend this succeeded -
2314 *
2315 * we have to send back a list with all files owned by this SID
2316 *
2317 * but I have to check that --metze
2318 */
2319 DOM_SID sid;
2320 uid_t uid;
2321 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2322
2323 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2324
2325 FSP_BELONGS_CONN(fsp,conn);
2326
2327 /* unknown 4 bytes: this is not the length of the sid :-( */
2328 /*unknown = IVAL(pdata,0);*/
2329
2330 sid_parse(pdata+4,sid_len,&sid);
2331 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2332
2333 if (!sid_to_uid(&sid, &uid)) {
2334 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2335 sid_string_static(&sid),(unsigned long)sid_len));
2336 uid = (-1);
2337 }
2338
2339 /* we can take a look at the find source :-)
2340 *
2341 * find ./ -uid $uid -name '*' is what we need here
2342 *
2343 *
2344 * and send 4bytes len and then NULL terminated unicode strings
2345 * for each file
2346 *
2347 * but I don't know how to deal with the paged results
2348 * (maybe we can hang the result anywhere in the fsp struct)
2349 *
2350 * we don't send all files at once
2351 * and at the next we should *not* start from the beginning,
2352 * so we have to cache the result
2353 *
2354 * --metze
2355 */
2356
2357 /* this works for now... */
2358 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2359 NULL, 0);
2360 return -1;
2361 }
2362 default:
2363 if (!logged_message) {
2364 logged_message = True; /* Only print this once... */
2365 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2366 function));
2367 }
2368 }
2369
2370 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2371}
2372
2373
2374#ifdef HAVE_SYS_QUOTAS
2375/****************************************************************************
2376 Reply to get user quota
2377****************************************************************************/
2378
2379static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2380 uint16 **ppsetup, uint32 setup_count,
2381 char **ppparams, uint32 parameter_count,
2382 char **ppdata, uint32 data_count, uint32 max_data_count)
2383{
2384 NTSTATUS nt_status = NT_STATUS_OK;
2385 char *params = *ppparams;
2386 char *pdata = *ppdata;
2387 char *entry;
2388 int data_len=0,param_len=0;
2389 int qt_len=0;
2390 int entry_len = 0;
2391 files_struct *fsp = NULL;
2392 uint16 level = 0;
2393 size_t sid_len;
2394 DOM_SID sid;
2395 BOOL start_enum = True;
2396 SMB_NTQUOTA_STRUCT qt;
2397 SMB_NTQUOTA_LIST *tmp_list;
2398 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2399
2400 ZERO_STRUCT(qt);
2401
2402 /* access check */
2403 if (current_user.ut.uid != 0) {
2404 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2405 lp_servicename(SNUM(conn)),conn->user));
2406 return ERROR_DOS(ERRDOS,ERRnoaccess);
2407 }
2408
2409 /*
2410 * Ensure minimum number of parameters sent.
2411 */
2412
2413 if (parameter_count < 4) {
2414 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2415 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2416 }
2417
2418 /* maybe we can check the quota_fnum */
2419 fsp = file_fsp(params,0);
2420 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2421 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2422 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2423 }
2424
2425 /* the NULL pointer checking for fsp->fake_file_handle->pd
2426 * is done by CHECK_NTQUOTA_HANDLE_OK()
2427 */
2428 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2429
2430 level = SVAL(params,2);
2431
2432 /* unknown 12 bytes leading in params */
2433
2434 switch (level) {
2435 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2436 /* seems that we should continue with the enum here --metze */
2437
2438 if (qt_handle->quota_list!=NULL &&
2439 qt_handle->tmp_list==NULL) {
2440
2441 /* free the list */
2442 free_ntquota_list(&(qt_handle->quota_list));
2443
2444 /* Realloc the size of parameters and data we will return */
2445 param_len = 4;
2446 params = nttrans_realloc(ppparams, param_len);
2447 if(params == NULL) {
2448 return ERROR_DOS(ERRDOS,ERRnomem);
2449 }
2450
2451 data_len = 0;
2452 SIVAL(params,0,data_len);
2453
2454 break;
2455 }
2456
2457 start_enum = False;
2458
2459 case TRANSACT_GET_USER_QUOTA_LIST_START:
2460
2461 if (qt_handle->quota_list==NULL &&
2462 qt_handle->tmp_list==NULL) {
2463 start_enum = True;
2464 }
2465
2466 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2467 return ERROR_DOS(ERRSRV,ERRerror);
2468
2469 /* Realloc the size of parameters and data we will return */
2470 param_len = 4;
2471 params = nttrans_realloc(ppparams, param_len);
2472 if(params == NULL) {
2473 return ERROR_DOS(ERRDOS,ERRnomem);
2474 }
2475
2476 /* we should not trust the value in max_data_count*/
2477 max_data_count = MIN(max_data_count,2048);
2478
2479 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2480 if(pdata == NULL) {
2481 return ERROR_DOS(ERRDOS,ERRnomem);
2482 }
2483
2484 entry = pdata;
2485
2486 /* set params Size of returned Quota Data 4 bytes*/
2487 /* but set it later when we know it */
2488
2489 /* for each entry push the data */
2490
2491 if (start_enum) {
2492 qt_handle->tmp_list = qt_handle->quota_list;
2493 }
2494
2495 tmp_list = qt_handle->tmp_list;
2496
2497 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2498 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2499
2500 sid_len = sid_size(&tmp_list->quotas->sid);
2501 entry_len = 40 + sid_len;
2502
2503 /* nextoffset entry 4 bytes */
2504 SIVAL(entry,0,entry_len);
2505
2506 /* then the len of the SID 4 bytes */
2507 SIVAL(entry,4,sid_len);
2508
2509 /* unknown data 8 bytes SMB_BIG_UINT */
2510 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2511
2512 /* the used disk space 8 bytes SMB_BIG_UINT */
2513 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2514
2515 /* the soft quotas 8 bytes SMB_BIG_UINT */
2516 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2517
2518 /* the hard quotas 8 bytes SMB_BIG_UINT */
2519 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2520
2521 /* and now the SID */
2522 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2523 }
2524
2525 qt_handle->tmp_list = tmp_list;
2526
2527 /* overwrite the offset of the last entry */
2528 SIVAL(entry-entry_len,0,0);
2529
2530 data_len = 4+qt_len;
2531 /* overwrite the params quota_data_len */
2532 SIVAL(params,0,data_len);
2533
2534 break;
2535
2536 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2537
2538 /* unknown 4 bytes IVAL(pdata,0) */
2539
2540 if (data_count < 8) {
2541 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2542 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2543 }
2544
2545 sid_len = IVAL(pdata,4);
2546 /* Ensure this is less than 1mb. */
2547 if (sid_len > (1024*1024)) {
2548 return ERROR_DOS(ERRDOS,ERRnomem);
2549 }
2550
2551 if (data_count < 8+sid_len) {
2552 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2553 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2554 }
2555
2556 data_len = 4+40+sid_len;
2557
2558 if (max_data_count < data_len) {
2559 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2560 max_data_count, data_len));
2561 param_len = 4;
2562 SIVAL(params,0,data_len);
2563 data_len = 0;
2564 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2565 break;
2566 }
2567
2568 sid_parse(pdata+8,sid_len,&sid);
2569
2570 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2571 ZERO_STRUCT(qt);
2572 /*
2573 * we have to return zero's in all fields
2574 * instead of returning an error here
2575 * --metze
2576 */
2577 }
2578
2579 /* Realloc the size of parameters and data we will return */
2580 param_len = 4;
2581 params = nttrans_realloc(ppparams, param_len);
2582 if(params == NULL) {
2583 return ERROR_DOS(ERRDOS,ERRnomem);
2584 }
2585
2586 pdata = nttrans_realloc(ppdata, data_len);
2587 if(pdata == NULL) {
2588 return ERROR_DOS(ERRDOS,ERRnomem);
2589 }
2590
2591 entry = pdata;
2592
2593 /* set params Size of returned Quota Data 4 bytes*/
2594 SIVAL(params,0,data_len);
2595
2596 /* nextoffset entry 4 bytes */
2597 SIVAL(entry,0,0);
2598
2599 /* then the len of the SID 4 bytes */
2600 SIVAL(entry,4,sid_len);
2601
2602 /* unknown data 8 bytes SMB_BIG_UINT */
2603 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2604
2605 /* the used disk space 8 bytes SMB_BIG_UINT */
2606 SBIG_UINT(entry,16,qt.usedspace);
2607
2608 /* the soft quotas 8 bytes SMB_BIG_UINT */
2609 SBIG_UINT(entry,24,qt.softlim);
2610
2611 /* the hard quotas 8 bytes SMB_BIG_UINT */
2612 SBIG_UINT(entry,32,qt.hardlim);
2613
2614 /* and now the SID */
2615 sid_linearize(entry+40, sid_len, &sid);
2616
2617 break;
2618
2619 default:
2620 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2621 return ERROR_DOS(ERRSRV,ERRerror);
2622 break;
2623 }
2624
2625 send_nt_replies(outbuf, bufsize, nt_status, params, param_len,
2626 pdata, data_len);
2627
2628 return -1;
2629}
2630
2631/****************************************************************************
2632 Reply to set user quota
2633****************************************************************************/
2634
2635static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2636 uint16 **ppsetup, uint32 setup_count,
2637 char **ppparams, uint32 parameter_count,
2638 char **ppdata, uint32 data_count, uint32 max_data_count)
2639{
2640 char *params = *ppparams;
2641 char *pdata = *ppdata;
2642 int data_len=0,param_len=0;
2643 SMB_NTQUOTA_STRUCT qt;
2644 size_t sid_len;
2645 DOM_SID sid;
2646 files_struct *fsp = NULL;
2647
2648 ZERO_STRUCT(qt);
2649
2650 /* access check */
2651 if (current_user.ut.uid != 0) {
2652 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2653 lp_servicename(SNUM(conn)),conn->user));
2654 return ERROR_DOS(ERRDOS,ERRnoaccess);
2655 }
2656
2657 /*
2658 * Ensure minimum number of parameters sent.
2659 */
2660
2661 if (parameter_count < 2) {
2662 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2663 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2664 }
2665
2666 /* maybe we can check the quota_fnum */
2667 fsp = file_fsp(params,0);
2668 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2669 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2670 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2671 }
2672
2673 if (data_count < 40) {
2674 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2675 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2676 }
2677
2678 /* offset to next quota record.
2679 * 4 bytes IVAL(pdata,0)
2680 * unused here...
2681 */
2682
2683 /* sid len */
2684 sid_len = IVAL(pdata,4);
2685
2686 if (data_count < 40+sid_len) {
2687 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2688 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2689 }
2690
2691 /* unknown 8 bytes in pdata
2692 * maybe its the change time in NTTIME
2693 */
2694
2695 /* the used space 8 bytes (SMB_BIG_UINT)*/
2696 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2697#ifdef LARGE_SMB_OFF_T
2698 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2699#else /* LARGE_SMB_OFF_T */
2700 if ((IVAL(pdata,20) != 0)&&
2701 ((qt.usedspace != 0xFFFFFFFF)||
2702 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2703 /* more than 32 bits? */
2704 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2705 }
2706#endif /* LARGE_SMB_OFF_T */
2707
2708 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2709 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2710#ifdef LARGE_SMB_OFF_T
2711 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2712#else /* LARGE_SMB_OFF_T */
2713 if ((IVAL(pdata,28) != 0)&&
2714 ((qt.softlim != 0xFFFFFFFF)||
2715 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2716 /* more than 32 bits? */
2717 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2718 }
2719#endif /* LARGE_SMB_OFF_T */
2720
2721 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2722 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2723#ifdef LARGE_SMB_OFF_T
2724 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2725#else /* LARGE_SMB_OFF_T */
2726 if ((IVAL(pdata,36) != 0)&&
2727 ((qt.hardlim != 0xFFFFFFFF)||
2728 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2729 /* more than 32 bits? */
2730 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2731 }
2732#endif /* LARGE_SMB_OFF_T */
2733
2734 sid_parse(pdata+40,sid_len,&sid);
2735 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2736
2737 /* 44 unknown bytes left... */
2738
2739 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2740 return ERROR_DOS(ERRSRV,ERRerror);
2741 }
2742
2743 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len,
2744 pdata, data_len);
2745
2746 return -1;
2747}
2748#endif /* HAVE_SYS_QUOTAS */
2749
2750static int handle_nttrans(connection_struct *conn,
2751 struct trans_state *state,
2752 char *inbuf, char *outbuf, int size, int bufsize)
2753{
2754 int outsize;
2755
2756 if (Protocol >= PROTOCOL_NT1) {
2757 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
2758 }
2759
2760 /* Now we must call the relevant NT_TRANS function */
2761 switch(state->call) {
2762 case NT_TRANSACT_CREATE:
2763 {
2764 START_PROFILE(NT_transact_create);
2765 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2766 size, bufsize,
2767 &state->setup, state->setup_count,
2768 &state->param, state->total_param,
2769 &state->data, state->total_data,
2770 state->max_data_return);
2771 END_PROFILE(NT_transact_create);
2772 break;
2773 }
2774
2775 case NT_TRANSACT_IOCTL:
2776 {
2777 START_PROFILE(NT_transact_ioctl);
2778 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2779 size, bufsize,
2780 &state->setup, state->setup_count,
2781 &state->param, state->total_param,
2782 &state->data, state->total_data, state->max_data_return);
2783 END_PROFILE(NT_transact_ioctl);
2784 break;
2785 }
2786
2787 case NT_TRANSACT_SET_SECURITY_DESC:
2788 {
2789 START_PROFILE(NT_transact_set_security_desc);
2790 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2791 size, bufsize,
2792 &state->setup, state->setup_count,
2793 &state->param, state->total_param,
2794 &state->data, state->total_data, state->max_data_return);
2795 END_PROFILE(NT_transact_set_security_desc);
2796 break;
2797 }
2798
2799 case NT_TRANSACT_NOTIFY_CHANGE:
2800 {
2801 START_PROFILE(NT_transact_notify_change);
2802 outsize = call_nt_transact_notify_change(
2803 conn, inbuf, outbuf, size, bufsize,
2804 &state->setup, state->setup_count,
2805 &state->param, state->total_param,
2806 &state->data, state->total_data,
2807 state->max_data_return,
2808 state->max_param_return);
2809 END_PROFILE(NT_transact_notify_change);
2810 break;
2811 }
2812
2813 case NT_TRANSACT_RENAME:
2814 {
2815 START_PROFILE(NT_transact_rename);
2816 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2817 size, bufsize,
2818 &state->setup, state->setup_count,
2819 &state->param, state->total_param,
2820 &state->data, state->total_data, state->max_data_return);
2821 END_PROFILE(NT_transact_rename);
2822 break;
2823 }
2824
2825 case NT_TRANSACT_QUERY_SECURITY_DESC:
2826 {
2827 START_PROFILE(NT_transact_query_security_desc);
2828 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2829 size, bufsize,
2830 &state->setup, state->setup_count,
2831 &state->param, state->total_param,
2832 &state->data, state->total_data, state->max_data_return);
2833 END_PROFILE(NT_transact_query_security_desc);
2834 break;
2835 }
2836
2837#ifdef HAVE_SYS_QUOTAS
2838 case NT_TRANSACT_GET_USER_QUOTA:
2839 {
2840 START_PROFILE(NT_transact_get_user_quota);
2841 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2842 size, bufsize,
2843 &state->setup, state->setup_count,
2844 &state->param, state->total_param,
2845 &state->data, state->total_data, state->max_data_return);
2846 END_PROFILE(NT_transact_get_user_quota);
2847 break;
2848 }
2849
2850 case NT_TRANSACT_SET_USER_QUOTA:
2851 {
2852 START_PROFILE(NT_transact_set_user_quota);
2853 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2854 size, bufsize,
2855 &state->setup, state->setup_count,
2856 &state->param, state->total_param,
2857 &state->data, state->total_data, state->max_data_return);
2858 END_PROFILE(NT_transact_set_user_quota);
2859 break;
2860 }
2861#endif /* HAVE_SYS_QUOTAS */
2862
2863 default:
2864 /* Error in request */
2865 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2866 state->call));
2867 return ERROR_DOS(ERRSRV,ERRerror);
2868 }
2869 return outsize;
2870}
2871
2872/****************************************************************************
2873 Reply to a SMBNTtrans.
2874****************************************************************************/
2875
2876int reply_nttrans(connection_struct *conn,
2877 char *inbuf,char *outbuf,int size,int bufsize)
2878{
2879 int outsize = 0;
2880 uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2881 uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2882 uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2883 uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2884
2885 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2886 NTSTATUS result;
2887 struct trans_state *state;
2888
2889 START_PROFILE(SMBnttrans);
2890
2891 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2892 END_PROFILE(SMBnttrans);
2893 return ERROR_DOS(ERRSRV,ERRaccess);
2894 }
2895
2896 result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2897 if (!NT_STATUS_IS_OK(result)) {
2898 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2899 END_PROFILE(SMBnttrans);
2900 return ERROR_NT(result);
2901 }
2902
2903 if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
2904 END_PROFILE(SMBnttrans);
2905 return ERROR_DOS(ERRSRV,ERRaccess);
2906 }
2907
2908 state->cmd = SMBnttrans;
2909
2910 state->mid = SVAL(inbuf,smb_mid);
2911 state->vuid = SVAL(inbuf,smb_uid);
2912 state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
2913 state->data = NULL;
2914 state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
2915 state->param = NULL;
2916 state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
2917 state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
2918
2919 /* setup count is in *words* */
2920 state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
2921 state->setup = NULL;
2922 state->call = function_code;
2923
2924 /*
2925 * All nttrans messages we handle have smb_wct == 19 +
2926 * state->setup_count. Ensure this is so as a sanity check.
2927 */
2928
2929 if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
2930 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2931 CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
2932 goto bad_param;
2933 }
2934
2935 /* Don't allow more than 128mb for each value. */
2936 if ((state->total_data > (1024*1024*128)) ||
2937 (state->total_param > (1024*1024*128))) {
2938 END_PROFILE(SMBnttrans);
2939 return ERROR_DOS(ERRDOS,ERRnomem);
2940 }
2941
2942 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2943 goto bad_param;
2944
2945 if (state->total_data) {
2946 /* Can't use talloc here, the core routines do realloc on the
2947 * params and data. */
2948 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2949 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2950 "bytes !\n", (unsigned int)state->total_data));
2951 TALLOC_FREE(state);
2952 END_PROFILE(SMBnttrans);
2953 return(ERROR_DOS(ERRDOS,ERRnomem));
2954 }
2955 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
2956 goto bad_param;
2957 if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
2958 (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
2959 goto bad_param;
2960
2961 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
2962 }
2963
2964 if (state->total_param) {
2965 /* Can't use talloc here, the core routines do realloc on the
2966 * params and data. */
2967 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2968 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2969 "bytes !\n", (unsigned int)state->total_param));
2970 SAFE_FREE(state->data);
2971 TALLOC_FREE(state);
2972 END_PROFILE(SMBnttrans);
2973 return(ERROR_DOS(ERRDOS,ERRnomem));
2974 }
2975 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
2976 goto bad_param;
2977 if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
2978 (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
2979 goto bad_param;
2980
2981 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
2982 }
2983
2984 state->received_data = dscnt;
2985 state->received_param = pscnt;
2986
2987 if(state->setup_count > 0) {
2988 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2989 state->setup_count));
2990 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2991 if (state->setup == NULL) {
2992 DEBUG(0,("reply_nttrans : Out of memory\n"));
2993 SAFE_FREE(state->data);
2994 SAFE_FREE(state->param);
2995 TALLOC_FREE(state);
2996 END_PROFILE(SMBnttrans);
2997 return ERROR_DOS(ERRDOS,ERRnomem);
2998 }
2999
3000 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
3001 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3002 goto bad_param;
3003 }
3004 if (smb_nt_SetupStart + state->setup_count > size) {
3005 goto bad_param;
3006 }
3007
3008 memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
3009 dump_data(10, (char *)state->setup, state->setup_count);
3010 }
3011
3012 if ((state->received_data == state->total_data) &&
3013 (state->received_param == state->total_param)) {
3014 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3015 size, bufsize);
3016 SAFE_FREE(state->param);
3017 SAFE_FREE(state->data);
3018 TALLOC_FREE(state);
3019 END_PROFILE(SMBnttrans);
3020 return outsize;
3021 }
3022
3023 DLIST_ADD(conn->pending_trans, state);
3024
3025 /* We need to send an interim response then receive the rest
3026 of the parameter/data bytes */
3027 outsize = set_message(outbuf,0,0,False);
3028 show_msg(outbuf);
3029 END_PROFILE(SMBnttrans);
3030 return outsize;
3031
3032 bad_param:
3033
3034 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3035 SAFE_FREE(state->data);
3036 SAFE_FREE(state->param);
3037 TALLOC_FREE(state);
3038 END_PROFILE(SMBnttrans);
3039 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3040}
3041
3042/****************************************************************************
3043 Reply to a SMBnttranss
3044 ****************************************************************************/
3045
3046int reply_nttranss(connection_struct *conn, char *inbuf,char *outbuf,
3047 int size,int bufsize)
3048{
3049 int outsize = 0;
3050 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3051 struct trans_state *state;
3052
3053 START_PROFILE(SMBnttranss);
3054
3055 show_msg(inbuf);
3056
3057 for (state = conn->pending_trans; state != NULL;
3058 state = state->next) {
3059 if (state->mid == SVAL(inbuf,smb_mid)) {
3060 break;
3061 }
3062 }
3063
3064 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3065 END_PROFILE(SMBnttranss);
3066 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3067 }
3068
3069 /* Revise state->total_param and state->total_data in case they have
3070 changed downwards */
3071 if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3072 state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3073 }
3074 if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3075 state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3076 }
3077
3078 pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3079 poff = IVAL(inbuf, smb_nts_ParameterOffset);
3080 pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3081
3082 dcnt = IVAL(inbuf, smb_nts_DataCount);
3083 ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3084 doff = IVAL(inbuf, smb_nts_DataOffset);
3085
3086 state->received_param += pcnt;
3087 state->received_data += dcnt;
3088
3089 if ((state->received_data > state->total_data) ||
3090 (state->received_param > state->total_param))
3091 goto bad_param;
3092
3093 if (pcnt) {
3094 if (pdisp+pcnt > state->total_param)
3095 goto bad_param;
3096 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3097 goto bad_param;
3098 if (pdisp > state->total_param)
3099 goto bad_param;
3100 if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
3101 (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3102 goto bad_param;
3103 if (state->param + pdisp < state->param)
3104 goto bad_param;
3105
3106 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3107 pcnt);
3108 }
3109
3110 if (dcnt) {
3111 if (ddisp+dcnt > state->total_data)
3112 goto bad_param;
3113 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3114 goto bad_param;
3115 if (ddisp > state->total_data)
3116 goto bad_param;
3117 if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
3118 (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3119 goto bad_param;
3120 if (state->data + ddisp < state->data)
3121 goto bad_param;
3122
3123 memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3124 dcnt);
3125 }
3126
3127 if ((state->received_param < state->total_param) ||
3128 (state->received_data < state->total_data)) {
3129 END_PROFILE(SMBnttranss);
3130 return -1;
3131 }
3132
3133 /* construct_reply_common has done us the favor to pre-fill the
3134 * command field with SMBnttranss which is wrong :-)
3135 */
3136 SCVAL(outbuf,smb_com,SMBnttrans);
3137
3138 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3139 size, bufsize);
3140
3141 DLIST_REMOVE(conn->pending_trans, state);
3142 SAFE_FREE(state->data);
3143 SAFE_FREE(state->param);
3144 TALLOC_FREE(state);
3145
3146 if (outsize == 0) {
3147 END_PROFILE(SMBnttranss);
3148 return(ERROR_DOS(ERRSRV,ERRnosupport));
3149 }
3150
3151 END_PROFILE(SMBnttranss);
3152 return(outsize);
3153
3154 bad_param:
3155
3156 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3157 DLIST_REMOVE(conn->pending_trans, state);
3158 SAFE_FREE(state->data);
3159 SAFE_FREE(state->param);
3160 TALLOC_FREE(state);
3161 END_PROFILE(SMBnttranss);
3162 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3163}
Note: See TracBrowser for help on using the repository browser.