Context Navigation

source: trunk/server/source3/smbd/nttrans.c@ 696

Visit:

Last change on this file since 696 was 599, checked in by Herwig Bauernfeind, 14 years ago
Samba 3.5: Update trunk to 3.5.9
File size: 83.2 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-2007
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 3 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program. If not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22	#include "smbd/globals.h"
23
24	extern const struct generic_mapping file_generic_mapping;
25
26	static char nttrans_realloc(char *ptr, size_t size)
27	{
28	if (ptr==NULL) {
29	smb_panic("nttrans_realloc() called with NULL ptr");
30	}
31
32	ptr = (char )SMB_REALLOC(*ptr, size);
33	if(*ptr == NULL) {
34	return NULL;
35	}
36	memset(*ptr,'\0',size);
37	return *ptr;
38	}
39
40	/****************************************************************************
41	Send the required number of replies back.
42	We assume all fields other than the data fields are
43	set correctly for the type of call.
44	HACK ! Always assumes smb_setup field is zero.
45	****************************************************************************/
46
47	void send_nt_replies(connection_struct *conn,
48	struct smb_request *req, NTSTATUS nt_error,
49	char *params, int paramsize,
50	char *pdata, int datasize)
51	{
52	int data_to_send = datasize;
53	int params_to_send = paramsize;
54	int useable_space;
55	char *pp = params;
56	char *pd = pdata;
57	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
58	int alignment_offset = 3;
59	int data_alignment_offset = 0;
60	struct smbd_server_connection *sconn = smbd_server_conn;
61	int max_send = sconn->smb1.sessions.max_send;
62
63	/*
64	* If there genuinely are no parameters or data to send just send
65	* the empty packet.
66	*/
67
68	if(params_to_send == 0 && data_to_send == 0) {
69	reply_outbuf(req, 18, 0);
70	if (NT_STATUS_V(nt_error)) {
71	error_packet_set((char *)req->outbuf,
72	0, 0, nt_error,
73	__LINE__,__FILE__);
74	}
75	show_msg((char *)req->outbuf);
76	if (!srv_send_smb(smbd_server_fd(),
77	(char *)req->outbuf,
78	true, req->seqnum+1,
79	IS_CONN_ENCRYPTED(conn),
80	&req->pcd)) {
81	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
82	}
83	TALLOC_FREE(req->outbuf);
84	return;
85	}
86
87	/*
88	* When sending params and data ensure that both are nicely aligned.
89	* Only do this alignment when there is also data to send - else
90	* can cause NT redirector problems.
91	*/
92
93	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
94	data_alignment_offset = 4 - (params_to_send % 4);
95	}
96
97	/*
98	* Space is bufsize minus Netbios over TCP header minus SMB header.
99	* The alignment_offset is to align the param bytes on a four byte
100	* boundary (2 bytes for data len, one byte pad).
101	* NT needs this to work correctly.
102	*/
103
104	useable_space = max_send - (smb_size
105	+ 2 * 18 /* wct */
106	+ alignment_offset
107	+ data_alignment_offset);
108
109	if (useable_space < 0) {
110	char *msg = talloc_asprintf(
111	talloc_tos(),
112	"send_nt_replies failed sanity useable_space = %d!!!",
113	useable_space);
114	DEBUG(0, ("%s\n", msg));
115	exit_server_cleanly(msg);
116	}
117
118	while (params_to_send \|\| data_to_send) {
119
120	/*
121	* Calculate whether we will totally or partially fill this packet.
122	*/
123
124	total_sent_thistime = params_to_send + data_to_send;
125
126	/*
127	* We can never send more than useable_space.
128	*/
129
130	total_sent_thistime = MIN(total_sent_thistime, useable_space);
131
132	reply_outbuf(req, 18,
133	total_sent_thistime + alignment_offset
134	+ data_alignment_offset);
135
136	/*
137	* We might have had SMBnttranss in req->inbuf, fix that.
138	*/
139	SCVAL(req->outbuf, smb_com, SMBnttrans);
140
141	/*
142	* Set total params and data to be sent.
143	*/
144
145	SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
146	SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
147
148	/*
149	* Calculate how many parameters and data we can fit into
150	* this packet. Parameters get precedence.
151	*/
152
153	params_sent_thistime = MIN(params_to_send,useable_space);
154	data_sent_thistime = useable_space - params_sent_thistime;
155	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
156
157	SIVAL(req->outbuf, smb_ntr_ParameterCount,
158	params_sent_thistime);
159
160	if(params_sent_thistime == 0) {
161	SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
162	SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
163	} else {
164	/*
165	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
166	* parameter bytes, however the first 4 bytes of outbuf are
167	* the Netbios over TCP header. Thus use smb_base() to subtract
168	* them from the calculation.
169	*/
170
171	SIVAL(req->outbuf,smb_ntr_ParameterOffset,
172	((smb_buf(req->outbuf)+alignment_offset)
173	- smb_base(req->outbuf)));
174	/*
175	* Absolute displacement of param bytes sent in this packet.
176	*/
177
178	SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
179	pp - params);
180	}
181
182	/*
183	* Deal with the data portion.
184	*/
185
186	SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
187
188	if(data_sent_thistime == 0) {
189	SIVAL(req->outbuf,smb_ntr_DataOffset,0);
190	SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
191	} else {
192	/*
193	* The offset of the data bytes is the offset of the
194	* parameter bytes plus the number of parameters being sent this time.
195	*/
196
197	SIVAL(req->outbuf, smb_ntr_DataOffset,
198	((smb_buf(req->outbuf)+alignment_offset) -
199	smb_base(req->outbuf))
200	+ params_sent_thistime + data_alignment_offset);
201	SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
202	}
203
204	/*
205	* Copy the param bytes into the packet.
206	*/
207
208	if(params_sent_thistime) {
209	if (alignment_offset != 0) {
210	memset(smb_buf(req->outbuf), 0,
211	alignment_offset);
212	}
213	memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
214	params_sent_thistime);
215	}
216
217	/*
218	* Copy in the data bytes
219	*/
220
221	if(data_sent_thistime) {
222	if (data_alignment_offset != 0) {
223	memset((smb_buf(req->outbuf)+alignment_offset+
224	params_sent_thistime), 0,
225	data_alignment_offset);
226	}
227	memcpy(smb_buf(req->outbuf)+alignment_offset
228	+params_sent_thistime+data_alignment_offset,
229	pd,data_sent_thistime);
230	}
231
232	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
233	params_sent_thistime, data_sent_thistime, useable_space));
234	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
235	params_to_send, data_to_send, paramsize, datasize));
236
237	if (NT_STATUS_V(nt_error)) {
238	error_packet_set((char *)req->outbuf,
239	0, 0, nt_error,
240	__LINE__,__FILE__);
241	}
242
243	/* Send the packet */
244	show_msg((char *)req->outbuf);
245	if (!srv_send_smb(smbd_server_fd(),
246	(char *)req->outbuf,
247	true, req->seqnum+1,
248	IS_CONN_ENCRYPTED(conn),
249	&req->pcd)) {
250	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
251	}
252
253	TALLOC_FREE(req->outbuf);
254
255	pp += params_sent_thistime;
256	pd += data_sent_thistime;
257
258	params_to_send -= params_sent_thistime;
259	data_to_send -= data_sent_thistime;
260
261	/*
262	* Sanity check
263	*/
264
265	if(params_to_send < 0 \|\| data_to_send < 0) {
266	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
267	params_to_send, data_to_send));
268	exit_server_cleanly("send_nt_replies: internal error");
269	}
270	}
271	}
272
273	/****************************************************************************
274	Reply to an NT create and X call on a pipe
275	****************************************************************************/
276
277	static void nt_open_pipe(char fname, connection_struct conn,
278	struct smb_request req, int ppnum)
279	{
280	files_struct *fsp;
281	NTSTATUS status;
282
283	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
284
285	/* Strip \\ off the name. */
286	fname++;
287
288	status = open_np_file(req, fname, &fsp);
289	if (!NT_STATUS_IS_OK(status)) {
290	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
291	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
292	ERRDOS, ERRbadpipe);
293	return;
294	}
295	reply_nterror(req, status);
296	return;
297	}
298
299	*ppnum = fsp->fnum;
300	return;
301	}
302
303	/****************************************************************************
304	Reply to an NT create and X call for pipes.
305	****************************************************************************/
306
307	static void do_ntcreate_pipe_open(connection_struct *conn,
308	struct smb_request *req)
309	{
310	char *fname = NULL;
311	int pnum = -1;
312	char *p = NULL;
313	uint32 flags = IVAL(req->vwv+3, 1);
314	TALLOC_CTX *ctx = talloc_tos();
315
316	srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
317
318	if (!fname) {
319	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
320	ERRDOS, ERRbadpipe);
321	return;
322	}
323	nt_open_pipe(fname, conn, req, &pnum);
324
325	if (req->outbuf) {
326	/* error reply */
327	return;
328	}
329
330	/*
331	* Deal with pipe return.
332	*/
333
334	if (flags & EXTENDED_RESPONSE_REQUIRED) {
335	/* This is very strange. We
336	* return 50 words, but only set
337	* the wcnt to 42 ? It's definately
338	* what happens on the wire....
339	*/
340	reply_outbuf(req, 50, 0);
341	SCVAL(req->outbuf,smb_wct,42);
342	} else {
343	reply_outbuf(req, 34, 0);
344	}
345
346	p = (char *)req->outbuf + smb_vwv2;
347	p++;
348	SSVAL(p,0,pnum);
349	p += 2;
350	SIVAL(p,0,FILE_WAS_OPENED);
351	p += 4;
352	p += 32;
353	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
354	p += 20;
355	/* File type. */
356	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
357	/* Device state. */
358	SSVAL(p,2, 0x5FF); /* ? */
359	p += 4;
360
361	if (flags & EXTENDED_RESPONSE_REQUIRED) {
362	p += 25;
363	SIVAL(p,0,FILE_GENERIC_ALL);
364	/*
365	* For pipes W2K3 seems to return
366	* 0x12019B next.
367	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
368	*/
369	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
370	}
371
372	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
373
374	chain_reply(req);
375	}
376
377	struct case_semantics_state {
378	connection_struct *conn;
379	bool case_sensitive;
380	bool case_preserve;
381	bool short_case_preserve;
382	};
383
384	/****************************************************************************
385	Restore case semantics.
386	****************************************************************************/
387
388	static int restore_case_semantics(struct case_semantics_state *state)
389	{
390	state->conn->case_sensitive = state->case_sensitive;
391	state->conn->case_preserve = state->case_preserve;
392	state->conn->short_case_preserve = state->short_case_preserve;
393	return 0;
394	}
395
396	/****************************************************************************
397	Save case semantics.
398	****************************************************************************/
399
400	static struct case_semantics_state set_posix_case_semantics(TALLOC_CTX mem_ctx,
401	connection_struct *conn)
402	{
403	struct case_semantics_state *result;
404
405	if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
406	return NULL;
407	}
408
409	result->conn = conn;
410	result->case_sensitive = conn->case_sensitive;
411	result->case_preserve = conn->case_preserve;
412	result->short_case_preserve = conn->short_case_preserve;
413
414	/* Set to POSIX. */
415	conn->case_sensitive = True;
416	conn->case_preserve = True;
417	conn->short_case_preserve = True;
418
419	talloc_set_destructor(result, restore_case_semantics);
420
421	return result;
422	}
423
424	/****************************************************************************
425	Reply to an NT create and X call.
426	****************************************************************************/
427
428	void reply_ntcreate_and_X(struct smb_request *req)
429	{
430	connection_struct *conn = req->conn;
431	struct smb_filename *smb_fname = NULL;
432	char *fname = NULL;
433	uint32 flags;
434	uint32 access_mask;
435	uint32 file_attributes;
436	uint32 share_access;
437	uint32 create_disposition;
438	uint32 create_options;
439	uint16 root_dir_fid;
440	uint64_t allocation_size;
441	/* Breakout the oplock request bits so we can set the
442	reply bits separately. */
443	uint32 fattr=0;
444	SMB_OFF_T file_len = 0;
445	int info = 0;
446	files_struct *fsp = NULL;
447	char *p = NULL;
448	struct timespec create_timespec;
449	struct timespec c_timespec;
450	struct timespec a_timespec;
451	struct timespec m_timespec;
452	struct timespec write_time_ts;
453	NTSTATUS status;
454	int oplock_request;
455	uint8_t oplock_granted = NO_OPLOCK_RETURN;
456	struct case_semantics_state *case_state = NULL;
457	TALLOC_CTX *ctx = talloc_tos();
458
459	START_PROFILE(SMBntcreateX);
460
461	if (req->wct < 24) {
462	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
463	goto out;
464	}
465
466	flags = IVAL(req->vwv+3, 1);
467	access_mask = IVAL(req->vwv+7, 1);
468	file_attributes = IVAL(req->vwv+13, 1);
469	share_access = IVAL(req->vwv+15, 1);
470	create_disposition = IVAL(req->vwv+17, 1);
471	create_options = IVAL(req->vwv+19, 1);
472	root_dir_fid = (uint16)IVAL(req->vwv+5, 1);
473
474	allocation_size = (uint64_t)IVAL(req->vwv+9, 1);
475	#ifdef LARGE_SMB_OFF_T
476	allocation_size \|= (((uint64_t)IVAL(req->vwv+11, 1)) << 32);
477	#endif
478
479	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
480	STR_TERMINATE, &status);
481
482	if (!NT_STATUS_IS_OK(status)) {
483	reply_nterror(req, status);
484	goto out;
485	}
486
487	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
488	"file_attributes = 0x%x, share_access = 0x%x, "
489	"create_disposition = 0x%x create_options = 0x%x "
490	"root_dir_fid = 0x%x, fname = %s\n",
491	(unsigned int)flags,
492	(unsigned int)access_mask,
493	(unsigned int)file_attributes,
494	(unsigned int)share_access,
495	(unsigned int)create_disposition,
496	(unsigned int)create_options,
497	(unsigned int)root_dir_fid,
498	fname));
499
500	/*
501	* we need to remove ignored bits when they come directly from the client
502	* because we reuse some of them for internal stuff
503	*/
504	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
505
506	/*
507	* If it's an IPC, use the pipe handler.
508	*/
509
510	if (IS_IPC(conn)) {
511	if (lp_nt_pipe_support()) {
512	do_ntcreate_pipe_open(conn, req);
513	goto out;
514	}
515	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
516	goto out;
517	}
518
519	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
520	if (oplock_request) {
521	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
522	? BATCH_OPLOCK : 0;
523	}
524
525	if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
526	case_state = set_posix_case_semantics(ctx, conn);
527	if (!case_state) {
528	reply_nterror(req, NT_STATUS_NO_MEMORY);
529	goto out;
530	}
531	}
532
533	status = filename_convert(ctx,
534	conn,
535	req->flags2 & FLAGS2_DFS_PATHNAMES,
536	fname,
537	0,
538	NULL,
539	&smb_fname);
540
541	TALLOC_FREE(case_state);
542
543	if (!NT_STATUS_IS_OK(status)) {
544	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
545	reply_botherror(req,
546	NT_STATUS_PATH_NOT_COVERED,
547	ERRSRV, ERRbadpath);
548	goto out;
549	}
550	reply_nterror(req, status);
551	goto out;
552	}
553
554	/*
555	* Bug #6898 - clients using Windows opens should
556	* never be able to set this attribute into the
557	* VFS.
558	*/
559	file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
560
561	status = SMB_VFS_CREATE_FILE(
562	conn, /* conn */
563	req, /* req */
564	root_dir_fid, /* root_dir_fid */
565	smb_fname, /* fname */
566	access_mask, /* access_mask */
567	share_access, /* share_access */
568	create_disposition, /* create_disposition*/
569	create_options, /* create_options */
570	file_attributes, /* file_attributes */
571	oplock_request, /* oplock_request */
572	allocation_size, /* allocation_size */
573	NULL, /* sd */
574	NULL, /* ea_list */
575	&fsp, /* result */
576	&info); /* pinfo */
577
578	if (!NT_STATUS_IS_OK(status)) {
579	if (open_was_deferred(req->mid)) {
580	/* We have re-scheduled this call, no error. */
581	goto out;
582	}
583	reply_openerror(req, status);
584	goto out;
585	}
586
587	/* Ensure we're pointing at the correct stat struct. */
588	TALLOC_FREE(smb_fname);
589	smb_fname = fsp->fsp_name;
590
591	/*
592	* If the caller set the extended oplock request bit
593	* and we granted one (by whatever means) - set the
594	* correct bit for extended oplock reply.
595	*/
596
597	if (oplock_request &&
598	(lp_fake_oplocks(SNUM(conn))
599	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
600
601	/*
602	* Exclusive oplock granted
603	*/
604
605	if (flags & REQUEST_BATCH_OPLOCK) {
606	oplock_granted = BATCH_OPLOCK_RETURN;
607	} else {
608	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
609	}
610	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
611	oplock_granted = LEVEL_II_OPLOCK_RETURN;
612	} else {
613	oplock_granted = NO_OPLOCK_RETURN;
614	}
615
616	file_len = smb_fname->st.st_ex_size;
617
618	if (flags & EXTENDED_RESPONSE_REQUIRED) {
619	/* This is very strange. We
620	* return 50 words, but only set
621	* the wcnt to 42 ? It's definately
622	* what happens on the wire....
623	*/
624	reply_outbuf(req, 50, 0);
625	SCVAL(req->outbuf,smb_wct,42);
626	} else {
627	reply_outbuf(req, 34, 0);
628	}
629
630	p = (char *)req->outbuf + smb_vwv2;
631
632	SCVAL(p, 0, oplock_granted);
633
634	p++;
635	SSVAL(p,0,fsp->fnum);
636	p += 2;
637	if ((create_disposition == FILE_SUPERSEDE)
638	&& (info == FILE_WAS_OVERWRITTEN)) {
639	SIVAL(p,0,FILE_WAS_SUPERSEDED);
640	} else {
641	SIVAL(p,0,info);
642	}
643	p += 4;
644
645	fattr = dos_mode(conn, smb_fname);
646	if (fattr == 0) {
647	fattr = FILE_ATTRIBUTE_NORMAL;
648	}
649
650	/* Deal with other possible opens having a modified
651	write time. JRA. */
652	ZERO_STRUCT(write_time_ts);
653	get_file_infos(fsp->file_id, NULL, &write_time_ts);
654	if (!null_timespec(write_time_ts)) {
655	update_stat_ex_mtime(&smb_fname->st, write_time_ts);
656	}
657
658	/* Create time. */
659	create_timespec = get_create_timespec(conn, fsp, smb_fname);
660	a_timespec = smb_fname->st.st_ex_atime;
661	m_timespec = smb_fname->st.st_ex_mtime;
662	c_timespec = get_change_timespec(conn, fsp, smb_fname);
663
664	if (lp_dos_filetime_resolution(SNUM(conn))) {
665	dos_filetime_timespec(&create_timespec);
666	dos_filetime_timespec(&a_timespec);
667	dos_filetime_timespec(&m_timespec);
668	dos_filetime_timespec(&c_timespec);
669	}
670
671	put_long_date_timespec(conn->ts_res, p, create_timespec); /* create time. */
672	p += 8;
673	put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
674	p += 8;
675	put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
676	p += 8;
677	put_long_date_timespec(conn->ts_res, p, c_timespec); /* change time */
678	p += 8;
679	SIVAL(p,0,fattr); /* File Attributes. */
680	p += 4;
681	SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&smb_fname->st));
682	p += 8;
683	SOFF_T(p,0,file_len);
684	p += 8;
685	if (flags & EXTENDED_RESPONSE_REQUIRED) {
686	uint16_t file_status = (NO_EAS\|NO_SUBSTREAMS\|NO_REPARSETAG);
687	size_t num_names = 0;
688	unsigned int num_streams;
689	struct stream_struct *streams = NULL;
690
691	/* Do we have any EA's ? */
692	status = get_ea_names_from_file(ctx, conn, fsp,
693	smb_fname->base_name, NULL, &num_names);
694	if (NT_STATUS_IS_OK(status) && num_names) {
695	file_status &= ~NO_EAS;
696	}
697	status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
698	&num_streams, &streams);
699	/* There is always one stream, ::$DATA. */
700	if (NT_STATUS_IS_OK(status) && num_streams > 1) {
701	file_status &= ~NO_SUBSTREAMS;
702	}
703	TALLOC_FREE(streams);
704	SSVAL(p,2,file_status);
705	}
706	p += 4;
707	SCVAL(p,0,fsp->is_directory ? 1 : 0);
708
709	if (flags & EXTENDED_RESPONSE_REQUIRED) {
710	uint32 perms = 0;
711	p += 25;
712	if (fsp->is_directory \|\|
713	can_write_to_file(conn, smb_fname)) {
714	perms = FILE_GENERIC_ALL;
715	} else {
716	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
717	}
718	SIVAL(p,0,perms);
719	}
720
721	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
722	fsp->fnum, smb_fname_str_dbg(smb_fname)));
723
724	chain_reply(req);
725	out:
726	END_PROFILE(SMBntcreateX);
727	return;
728	}
729
730	/****************************************************************************
731	Reply to a NT_TRANSACT_CREATE call to open a pipe.
732	****************************************************************************/
733
734	static void do_nt_transact_create_pipe(connection_struct *conn,
735	struct smb_request *req,
736	uint16 **ppsetup, uint32 setup_count,
737	char **ppparams, uint32 parameter_count,
738	char **ppdata, uint32 data_count)
739	{
740	char *fname = NULL;
741	char params = ppparams;
742	int pnum = -1;
743	char *p = NULL;
744	NTSTATUS status;
745	size_t param_len;
746	uint32 flags;
747	TALLOC_CTX *ctx = talloc_tos();
748
749	/*
750	* Ensure minimum number of parameters sent.
751	*/
752
753	if(parameter_count < 54) {
754	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
755	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
756	return;
757	}
758
759	flags = IVAL(params,0);
760
761	srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
762	parameter_count-53, STR_TERMINATE,
763	&status);
764	if (!NT_STATUS_IS_OK(status)) {
765	reply_nterror(req, status);
766	return;
767	}
768
769	nt_open_pipe(fname, conn, req, &pnum);
770
771	if (req->outbuf) {
772	/* Error return */
773	return;
774	}
775
776	/* Realloc the size of parameters and data we will return */
777	if (flags & EXTENDED_RESPONSE_REQUIRED) {
778	/* Extended response is 32 more byyes. */
779	param_len = 101;
780	} else {
781	param_len = 69;
782	}
783	params = nttrans_realloc(ppparams, param_len);
784	if(params == NULL) {
785	reply_nterror(req, NT_STATUS_NO_MEMORY);
786	return;
787	}
788
789	p = params;
790	SCVAL(p,0,NO_OPLOCK_RETURN);
791
792	p += 2;
793	SSVAL(p,0,pnum);
794	p += 2;
795	SIVAL(p,0,FILE_WAS_OPENED);
796	p += 8;
797
798	p += 32;
799	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
800	p += 20;
801	/* File type. */
802	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
803	/* Device state. */
804	SSVAL(p,2, 0x5FF); /* ? */
805	p += 4;
806
807	if (flags & EXTENDED_RESPONSE_REQUIRED) {
808	p += 25;
809	SIVAL(p,0,FILE_GENERIC_ALL);
810	/*
811	* For pipes W2K3 seems to return
812	* 0x12019B next.
813	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
814	*/
815	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
816	}
817
818	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
819
820	/* Send the required number of replies */
821	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
822
823	return;
824	}
825
826	/****************************************************************************
827	Internal fn to set security descriptors.
828	****************************************************************************/
829
830	static NTSTATUS set_sd(files_struct fsp, uint8 data, uint32 sd_len,
831	uint32 security_info_sent)
832	{
833	SEC_DESC *psd = NULL;
834	NTSTATUS status;
835
836	if (sd_len == 0) {
837	return NT_STATUS_INVALID_PARAMETER;
838	}
839
840	if (!CAN_WRITE(fsp->conn)) {
841	return NT_STATUS_ACCESS_DENIED;
842	}
843
844	if (!lp_nt_acl_support(SNUM(fsp->conn))) {
845	return NT_STATUS_OK;
846	}
847
848	status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
849
850	if (!NT_STATUS_IS_OK(status)) {
851	return status;
852	}
853
854	if (psd->owner_sid == NULL) {
855	security_info_sent &= ~OWNER_SECURITY_INFORMATION;
856	}
857	if (psd->group_sid == NULL) {
858	security_info_sent &= ~GROUP_SECURITY_INFORMATION;
859	}
860
861	/* Ensure we have at least one thing set. */
862	if ((security_info_sent & (SECINFO_OWNER\|SECINFO_GROUP\|SECINFO_DACL\|SECINFO_SACL)) == 0) {
863	return NT_STATUS_INVALID_PARAMETER;
864	}
865
866	/* Ensure we have the rights to do this. */
867	if (security_info_sent & SECINFO_OWNER) {
868	if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
869	return NT_STATUS_ACCESS_DENIED;
870	}
871	}
872
873	if (security_info_sent & SECINFO_GROUP) {
874	if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
875	return NT_STATUS_ACCESS_DENIED;
876	}
877	}
878
879	if (security_info_sent & SECINFO_DACL) {
880	if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
881	return NT_STATUS_ACCESS_DENIED;
882	}
883	/* Convert all the generic bits. */
884	if (psd->dacl) {
885	security_acl_map_generic(psd->dacl, &file_generic_mapping);
886	}
887	}
888
889	if (security_info_sent & SECINFO_SACL) {
890	if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
891	return NT_STATUS_ACCESS_DENIED;
892	}
893	/* Convert all the generic bits. */
894	if (psd->sacl) {
895	security_acl_map_generic(psd->sacl, &file_generic_mapping);
896	}
897	}
898
899	if (DEBUGLEVEL >= 10) {
900	DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
901	NDR_PRINT_DEBUG(security_descriptor, psd);
902	}
903
904	status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
905
906	TALLOC_FREE(psd);
907
908	return status;
909	}
910
911	/****************************************************************************
912	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
913	****************************************************************************/
914
915	struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
916	{
917	struct ea_list *ea_list_head = NULL;
918	size_t offset = 0;
919
920	if (data_size < 4) {
921	return NULL;
922	}
923
924	while (offset + 4 <= data_size) {
925	size_t next_offset = IVAL(pdata,offset);
926	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
927
928	if (!eal) {
929	return NULL;
930	}
931
932	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
933	if (next_offset == 0) {
934	break;
935	}
936	offset += next_offset;
937	}
938
939	return ea_list_head;
940	}
941
942	/****************************************************************************
943	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
944	****************************************************************************/
945
946	static void call_nt_transact_create(connection_struct *conn,
947	struct smb_request *req,
948	uint16 **ppsetup, uint32 setup_count,
949	char **ppparams, uint32 parameter_count,
950	char **ppdata, uint32 data_count,
951	uint32 max_data_count)
952	{
953	struct smb_filename *smb_fname = NULL;
954	char *fname = NULL;
955	char params = ppparams;
956	char data = ppdata;
957	/* Breakout the oplock request bits so we can set the reply bits separately. */
958	uint32 fattr=0;
959	SMB_OFF_T file_len = 0;
960	int info = 0;
961	files_struct *fsp = NULL;
962	char *p = NULL;
963	uint32 flags;
964	uint32 access_mask;
965	uint32 file_attributes;
966	uint32 share_access;
967	uint32 create_disposition;
968	uint32 create_options;
969	uint32 sd_len;
970	struct security_descriptor *sd = NULL;
971	uint32 ea_len;
972	uint16 root_dir_fid;
973	struct timespec create_timespec;
974	struct timespec c_timespec;
975	struct timespec a_timespec;
976	struct timespec m_timespec;
977	struct timespec write_time_ts;
978	struct ea_list *ea_list = NULL;
979	NTSTATUS status;
980	size_t param_len;
981	uint64_t allocation_size;
982	int oplock_request;
983	uint8_t oplock_granted;
984	struct case_semantics_state *case_state = NULL;
985	TALLOC_CTX *ctx = talloc_tos();
986
987	DEBUG(5,("call_nt_transact_create\n"));
988
989	/*
990	* If it's an IPC, use the pipe handler.
991	*/
992
993	if (IS_IPC(conn)) {
994	if (lp_nt_pipe_support()) {
995	do_nt_transact_create_pipe(
996	conn, req,
997	ppsetup, setup_count,
998	ppparams, parameter_count,
999	ppdata, data_count);
1000	goto out;
1001	}
1002	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1003	goto out;
1004	}
1005
1006	/*
1007	* Ensure minimum number of parameters sent.
1008	*/
1009
1010	if(parameter_count < 54) {
1011	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1012	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1013	goto out;
1014	}
1015
1016	flags = IVAL(params,0);
1017	access_mask = IVAL(params,8);
1018	file_attributes = IVAL(params,20);
1019	share_access = IVAL(params,24);
1020	create_disposition = IVAL(params,28);
1021	create_options = IVAL(params,32);
1022	sd_len = IVAL(params,36);
1023	ea_len = IVAL(params,40);
1024	root_dir_fid = (uint16)IVAL(params,4);
1025	allocation_size = (uint64_t)IVAL(params,12);
1026	#ifdef LARGE_SMB_OFF_T
1027	allocation_size \|= (((uint64_t)IVAL(params,16)) << 32);
1028	#endif
1029
1030	/*
1031	* we need to remove ignored bits when they come directly from the client
1032	* because we reuse some of them for internal stuff
1033	*/
1034	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
1035
1036	/* Ensure the data_len is correct for the sd and ea values given. */
1037	if ((ea_len + sd_len > data_count)
1038	\|\| (ea_len > data_count) \|\| (sd_len > data_count)
1039	\|\| (ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
1040	DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
1041	"%u, data_count = %u\n", (unsigned int)ea_len,
1042	(unsigned int)sd_len, (unsigned int)data_count));
1043	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1044	goto out;
1045	}
1046
1047	if (sd_len) {
1048	DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
1049	sd_len));
1050
1051	status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
1052	&sd);
1053	if (!NT_STATUS_IS_OK(status)) {
1054	DEBUG(10, ("call_nt_transact_create: "
1055	"unmarshall_sec_desc failed: %s\n",
1056	nt_errstr(status)));
1057	reply_nterror(req, status);
1058	goto out;
1059	}
1060	}
1061
1062	if (ea_len) {
1063	if (!lp_ea_support(SNUM(conn))) {
1064	DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
1065	"EA's not supported.\n",
1066	(unsigned int)ea_len));
1067	reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1068	goto out;
1069	}
1070
1071	if (ea_len < 10) {
1072	DEBUG(10,("call_nt_transact_create - ea_len = %u - "
1073	"too small (should be more than 10)\n",
1074	(unsigned int)ea_len ));
1075	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1076	goto out;
1077	}
1078
1079	/* We have already checked that ea_len <= data_count here. */
1080	ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
1081	ea_len);
1082	if (ea_list == NULL) {
1083	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1084	goto out;
1085	}
1086	}
1087
1088	srvstr_get_path(ctx, params, req->flags2, &fname,
1089	params+53, parameter_count-53,
1090	STR_TERMINATE, &status);
1091	if (!NT_STATUS_IS_OK(status)) {
1092	reply_nterror(req, status);
1093	goto out;
1094	}
1095
1096	if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1097	case_state = set_posix_case_semantics(ctx, conn);
1098	if (!case_state) {
1099	reply_nterror(req, NT_STATUS_NO_MEMORY);
1100	goto out;
1101	}
1102	}
1103
1104	status = filename_convert(ctx,
1105	conn,
1106	req->flags2 & FLAGS2_DFS_PATHNAMES,
1107	fname,
1108	0,
1109	NULL,
1110	&smb_fname);
1111
1112	TALLOC_FREE(case_state);
1113
1114	if (!NT_STATUS_IS_OK(status)) {
1115	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1116	reply_botherror(req,
1117	NT_STATUS_PATH_NOT_COVERED,
1118	ERRSRV, ERRbadpath);
1119	goto out;
1120	}
1121	reply_nterror(req, status);
1122	goto out;
1123	}
1124
1125	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1126	if (oplock_request) {
1127	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
1128	? BATCH_OPLOCK : 0;
1129	}
1130
1131	/*
1132	* Bug #6898 - clients using Windows opens should
1133	* never be able to set this attribute into the
1134	* VFS.
1135	*/
1136	file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1137
1138	status = SMB_VFS_CREATE_FILE(
1139	conn, /* conn */
1140	req, /* req */
1141	root_dir_fid, /* root_dir_fid */
1142	smb_fname, /* fname */
1143	access_mask, /* access_mask */
1144	share_access, /* share_access */
1145	create_disposition, /* create_disposition*/
1146	create_options, /* create_options */
1147	file_attributes, /* file_attributes */
1148	oplock_request, /* oplock_request */
1149	allocation_size, /* allocation_size */
1150	sd, /* sd */
1151	ea_list, /* ea_list */
1152	&fsp, /* result */
1153	&info); /* pinfo */
1154
1155	if(!NT_STATUS_IS_OK(status)) {
1156	if (open_was_deferred(req->mid)) {
1157	/* We have re-scheduled this call, no error. */
1158	return;
1159	}
1160	reply_openerror(req, status);
1161	goto out;
1162	}
1163
1164	/* Ensure we're pointing at the correct stat struct. */
1165	TALLOC_FREE(smb_fname);
1166	smb_fname = fsp->fsp_name;
1167
1168	/*
1169	* If the caller set the extended oplock request bit
1170	* and we granted one (by whatever means) - set the
1171	* correct bit for extended oplock reply.
1172	*/
1173
1174	if (oplock_request &&
1175	(lp_fake_oplocks(SNUM(conn))
1176	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1177
1178	/*
1179	* Exclusive oplock granted
1180	*/
1181
1182	if (flags & REQUEST_BATCH_OPLOCK) {
1183	oplock_granted = BATCH_OPLOCK_RETURN;
1184	} else {
1185	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1186	}
1187	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1188	oplock_granted = LEVEL_II_OPLOCK_RETURN;
1189	} else {
1190	oplock_granted = NO_OPLOCK_RETURN;
1191	}
1192
1193	file_len = smb_fname->st.st_ex_size;
1194
1195	/* Realloc the size of parameters and data we will return */
1196	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1197	/* Extended response is 32 more byyes. */
1198	param_len = 101;
1199	} else {
1200	param_len = 69;
1201	}
1202	params = nttrans_realloc(ppparams, param_len);
1203	if(params == NULL) {
1204	reply_nterror(req, NT_STATUS_NO_MEMORY);
1205	goto out;
1206	}
1207
1208	p = params;
1209	SCVAL(p, 0, oplock_granted);
1210
1211	p += 2;
1212	SSVAL(p,0,fsp->fnum);
1213	p += 2;
1214	if ((create_disposition == FILE_SUPERSEDE)
1215	&& (info == FILE_WAS_OVERWRITTEN)) {
1216	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1217	} else {
1218	SIVAL(p,0,info);
1219	}
1220	p += 8;
1221
1222	fattr = dos_mode(conn, smb_fname);
1223	if (fattr == 0) {
1224	fattr = FILE_ATTRIBUTE_NORMAL;
1225	}
1226
1227	/* Deal with other possible opens having a modified
1228	write time. JRA. */
1229	ZERO_STRUCT(write_time_ts);
1230	get_file_infos(fsp->file_id, NULL, &write_time_ts);
1231	if (!null_timespec(write_time_ts)) {
1232	update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1233	}
1234
1235	/* Create time. */
1236	create_timespec = get_create_timespec(conn, fsp, smb_fname);
1237	a_timespec = smb_fname->st.st_ex_atime;
1238	m_timespec = smb_fname->st.st_ex_mtime;
1239	c_timespec = get_change_timespec(conn, fsp, smb_fname);
1240
1241	if (lp_dos_filetime_resolution(SNUM(conn))) {
1242	dos_filetime_timespec(&create_timespec);
1243	dos_filetime_timespec(&a_timespec);
1244	dos_filetime_timespec(&m_timespec);
1245	dos_filetime_timespec(&c_timespec);
1246	}
1247
1248	put_long_date_timespec(conn->ts_res, p, create_timespec); /* create time. */
1249	p += 8;
1250	put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
1251	p += 8;
1252	put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
1253	p += 8;
1254	put_long_date_timespec(conn->ts_res, p, c_timespec); /* change time */
1255	p += 8;
1256	SIVAL(p,0,fattr); /* File Attributes. */
1257	p += 4;
1258	SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st));
1259	p += 8;
1260	SOFF_T(p,0,file_len);
1261	p += 8;
1262	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1263	SSVAL(p,2,0x7);
1264	}
1265	p += 4;
1266	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1267
1268	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1269	uint32 perms = 0;
1270	p += 25;
1271	if (fsp->is_directory \|\|
1272	can_write_to_file(conn, smb_fname)) {
1273	perms = FILE_GENERIC_ALL;
1274	} else {
1275	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
1276	}
1277	SIVAL(p,0,perms);
1278	}
1279
1280	DEBUG(5,("call_nt_transact_create: open name = %s\n",
1281	smb_fname_str_dbg(smb_fname)));
1282
1283	/* Send the required number of replies */
1284	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1285	out:
1286	return;
1287	}
1288
1289	/****************************************************************************
1290	Reply to a NT CANCEL request.
1291	conn POINTER CAN BE NULL HERE !
1292	****************************************************************************/
1293
1294	void reply_ntcancel(struct smb_request *req)
1295	{
1296	/*
1297	* Go through and cancel any pending change notifies.
1298	*/
1299
1300	START_PROFILE(SMBntcancel);
1301	srv_cancel_sign_response(smbd_server_conn);
1302	remove_pending_change_notify_requests_by_mid(req->mid);
1303	remove_pending_lock_requests_by_mid(req->mid);
1304
1305	DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1306
1307	END_PROFILE(SMBntcancel);
1308	return;
1309	}
1310
1311	/****************************************************************************
1312	Copy a file.
1313	****************************************************************************/
1314
1315	static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1316	connection_struct *conn,
1317	struct smb_request *req,
1318	struct smb_filename *smb_fname_src,
1319	struct smb_filename *smb_fname_dst,
1320	uint32 attrs)
1321	{
1322	files_struct fsp1,fsp2;
1323	uint32 fattr;
1324	int info;
1325	SMB_OFF_T ret=-1;
1326	NTSTATUS status = NT_STATUS_OK;
1327	char *parent;
1328
1329	if (!CAN_WRITE(conn)) {
1330	status = NT_STATUS_MEDIA_WRITE_PROTECTED;
1331	goto out;
1332	}
1333
1334	/* Source must already exist. */
1335	if (!VALID_STAT(smb_fname_src->st)) {
1336	status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1337	goto out;
1338	}
1339
1340	/* Ensure attributes match. */
1341	fattr = dos_mode(conn, smb_fname_src);
1342	if ((fattr & ~attrs) & (aHIDDEN \| aSYSTEM)) {
1343	status = NT_STATUS_NO_SUCH_FILE;
1344	goto out;
1345	}
1346
1347	/* Disallow if dst file already exists. */
1348	if (VALID_STAT(smb_fname_dst->st)) {
1349	status = NT_STATUS_OBJECT_NAME_COLLISION;
1350	goto out;
1351	}
1352
1353	/* No links from a directory. */
1354	if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
1355	status = NT_STATUS_FILE_IS_A_DIRECTORY;
1356	goto out;
1357	}
1358
1359	DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1360	smb_fname_str_dbg(smb_fname_src),
1361	smb_fname_str_dbg(smb_fname_dst)));
1362
1363	status = SMB_VFS_CREATE_FILE(
1364	conn, /* conn */
1365	req, /* req */
1366	0, /* root_dir_fid */
1367	smb_fname_src, /* fname */
1368	FILE_READ_DATA, /* access_mask */
1369	(FILE_SHARE_READ \| FILE_SHARE_WRITE \| /* share_access */
1370	FILE_SHARE_DELETE),
1371	FILE_OPEN, /* create_disposition*/
1372	0, /* create_options */
1373	FILE_ATTRIBUTE_NORMAL, /* file_attributes */
1374	NO_OPLOCK, /* oplock_request */
1375	0, /* allocation_size */
1376	NULL, /* sd */
1377	NULL, /* ea_list */
1378	&fsp1, /* result */
1379	&info); /* pinfo */
1380
1381	if (!NT_STATUS_IS_OK(status)) {
1382	goto out;
1383	}
1384
1385	status = SMB_VFS_CREATE_FILE(
1386	conn, /* conn */
1387	req, /* req */
1388	0, /* root_dir_fid */
1389	smb_fname_dst, /* fname */
1390	FILE_WRITE_DATA, /* access_mask */
1391	(FILE_SHARE_READ \| FILE_SHARE_WRITE \| /* share_access */
1392	FILE_SHARE_DELETE),
1393	FILE_CREATE, /* create_disposition*/
1394	0, /* create_options */
1395	fattr, /* file_attributes */
1396	NO_OPLOCK, /* oplock_request */
1397	0, /* allocation_size */
1398	NULL, /* sd */
1399	NULL, /* ea_list */
1400	&fsp2, /* result */
1401	&info); /* pinfo */
1402
1403	if (!NT_STATUS_IS_OK(status)) {
1404	close_file(NULL, fsp1, ERROR_CLOSE);
1405	goto out;
1406	}
1407
1408	if (smb_fname_src->st.st_ex_size) {
1409	ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
1410	}
1411
1412	/*
1413	* As we are opening fsp1 read-only we only expect
1414	* an error on close on fsp2 if we are out of space.
1415	* Thus we don't look at the error return from the
1416	* close of fsp1.
1417	*/
1418	close_file(NULL, fsp1, NORMAL_CLOSE);
1419
1420	/* Ensure the modtime is set correctly on the destination file. */
1421	set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
1422
1423	status = close_file(NULL, fsp2, NORMAL_CLOSE);
1424
1425	/* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1426	creates the file. This isn't the correct thing to do in the copy
1427	case. JRA */
1428	if (!parent_dirname(talloc_tos(), smb_fname_dst->base_name, &parent,
1429	NULL)) {
1430	status = NT_STATUS_NO_MEMORY;
1431	goto out;
1432	}
1433	file_set_dosmode(conn, smb_fname_dst, fattr, parent, false);
1434	TALLOC_FREE(parent);
1435
1436	if (ret < (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
1437	status = NT_STATUS_DISK_FULL;
1438	goto out;
1439	}
1440	out:
1441	if (!NT_STATUS_IS_OK(status)) {
1442	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1443	nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
1444	smb_fname_str_dbg(smb_fname_dst)));
1445	}
1446
1447	return status;
1448	}
1449
1450	/****************************************************************************
1451	Reply to a NT rename request.
1452	****************************************************************************/
1453
1454	void reply_ntrename(struct smb_request *req)
1455	{
1456	connection_struct *conn = req->conn;
1457	struct smb_filename *smb_fname_old = NULL;
1458	struct smb_filename *smb_fname_new = NULL;
1459	char *oldname = NULL;
1460	char *newname = NULL;
1461	const char *p;
1462	NTSTATUS status;
1463	bool src_has_wcard = False;
1464	bool dest_has_wcard = False;
1465	uint32 attrs;
1466	uint32_t ucf_flags_src = 0;
1467	uint32_t ucf_flags_dst = 0;
1468	uint16 rename_type;
1469	TALLOC_CTX *ctx = talloc_tos();
1470
1471	START_PROFILE(SMBntrename);
1472
1473	if (req->wct < 4) {
1474	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1475	goto out;
1476	}
1477
1478	attrs = SVAL(req->vwv+0, 0);
1479	rename_type = SVAL(req->vwv+1, 0);
1480
1481	p = (const char *)req->buf + 1;
1482	p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE,
1483	&status, &src_has_wcard);
1484	if (!NT_STATUS_IS_OK(status)) {
1485	reply_nterror(req, status);
1486	goto out;
1487	}
1488
1489	if (ms_has_wild(oldname)) {
1490	reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1491	goto out;
1492	}
1493
1494	p++;
1495	p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
1496	&status, &dest_has_wcard);
1497	if (!NT_STATUS_IS_OK(status)) {
1498	reply_nterror(req, status);
1499	goto out;
1500	}
1501
1502	/* The newname must begin with a ':' if the oldname contains a ':'. */
1503	if (strchr_m(oldname, ':') && (newname[0] != ':')) {
1504	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1505	goto out;
1506	}
1507
1508	/*
1509	* If this is a rename operation, allow wildcards and save the
1510	* destination's last component.
1511	*/
1512	if (rename_type == RENAME_FLAG_RENAME) {
1513	ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP;
1514	ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP \| UCF_SAVE_LCOMP;
1515	}
1516
1517	/* rename_internals() calls unix_convert(), so don't call it here. */
1518	status = filename_convert(ctx, conn,
1519	req->flags2 & FLAGS2_DFS_PATHNAMES,
1520	oldname,
1521	ucf_flags_src,
1522	NULL,
1523	&smb_fname_old);
1524	if (!NT_STATUS_IS_OK(status)) {
1525	if (NT_STATUS_EQUAL(status,
1526	NT_STATUS_PATH_NOT_COVERED)) {
1527	reply_botherror(req,
1528	NT_STATUS_PATH_NOT_COVERED,
1529	ERRSRV, ERRbadpath);
1530	goto out;
1531	}
1532	reply_nterror(req, status);
1533	goto out;
1534	}
1535
1536	status = filename_convert(ctx, conn,
1537	req->flags2 & FLAGS2_DFS_PATHNAMES,
1538	newname,
1539	ucf_flags_dst,
1540	&dest_has_wcard,
1541	&smb_fname_new);
1542	if (!NT_STATUS_IS_OK(status)) {
1543	if (NT_STATUS_EQUAL(status,
1544	NT_STATUS_PATH_NOT_COVERED)) {
1545	reply_botherror(req,
1546	NT_STATUS_PATH_NOT_COVERED,
1547	ERRSRV, ERRbadpath);
1548	goto out;
1549	}
1550	reply_nterror(req, status);
1551	goto out;
1552	}
1553
1554	DEBUG(3,("reply_ntrename: %s -> %s\n",
1555	smb_fname_str_dbg(smb_fname_old),
1556	smb_fname_str_dbg(smb_fname_new)));
1557
1558	switch(rename_type) {
1559	case RENAME_FLAG_RENAME:
1560	status = rename_internals(ctx, conn, req,
1561	smb_fname_old, smb_fname_new,
1562	attrs, False, src_has_wcard,
1563	dest_has_wcard,
1564	DELETE_ACCESS);
1565	break;
1566	case RENAME_FLAG_HARD_LINK:
1567	if (src_has_wcard \|\| dest_has_wcard) {
1568	/* No wildcards. */
1569	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1570	} else {
1571	status = hardlink_internals(ctx, conn,
1572	smb_fname_old,
1573	smb_fname_new);
1574	}
1575	break;
1576	case RENAME_FLAG_COPY:
1577	if (src_has_wcard \|\| dest_has_wcard) {
1578	/* No wildcards. */
1579	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1580	} else {
1581	status = copy_internals(ctx, conn, req,
1582	smb_fname_old,
1583	smb_fname_new,
1584	attrs);
1585	}
1586	break;
1587	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1588	status = NT_STATUS_INVALID_PARAMETER;
1589	break;
1590	default:
1591	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1592	break;
1593	}
1594
1595	if (!NT_STATUS_IS_OK(status)) {
1596	if (open_was_deferred(req->mid)) {
1597	/* We have re-scheduled this call. */
1598	goto out;
1599	}
1600
1601	reply_nterror(req, status);
1602	goto out;
1603	}
1604
1605	reply_outbuf(req, 0, 0);
1606	out:
1607	END_PROFILE(SMBntrename);
1608	return;
1609	}
1610
1611	/****************************************************************************
1612	Reply to a notify change - queue the request and
1613	don't allow a directory to be opened.
1614	****************************************************************************/
1615
1616	static void smbd_smb1_notify_reply(struct smb_request *req,
1617	NTSTATUS error_code,
1618	uint8_t *buf, size_t len)
1619	{
1620	send_nt_replies(req->conn, req, error_code, (char *)buf, len, NULL, 0);
1621	}
1622
1623	static void call_nt_transact_notify_change(connection_struct *conn,
1624	struct smb_request *req,
1625	uint16 **ppsetup,
1626	uint32 setup_count,
1627	char **ppparams,
1628	uint32 parameter_count,
1629	char **ppdata, uint32 data_count,
1630	uint32 max_data_count,
1631	uint32 max_param_count)
1632	{
1633	uint16 setup = ppsetup;
1634	files_struct *fsp;
1635	uint32 filter;
1636	NTSTATUS status;
1637	bool recursive;
1638
1639	if(setup_count < 6) {
1640	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1641	return;
1642	}
1643
1644	fsp = file_fsp(req, SVAL(setup,4));
1645	filter = IVAL(setup, 0);
1646	recursive = (SVAL(setup, 6) != 0) ? True : False;
1647
1648	DEBUG(3,("call_nt_transact_notify_change\n"));
1649
1650	if(!fsp) {
1651	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1652	return;
1653	}
1654
1655	{
1656	char *filter_string;
1657
1658	if (!(filter_string = notify_filter_string(NULL, filter))) {
1659	reply_nterror(req,NT_STATUS_NO_MEMORY);
1660	return;
1661	}
1662
1663	DEBUG(3,("call_nt_transact_notify_change: notify change "
1664	"called on %s, filter = %s, recursive = %d\n",
1665	fsp_str_dbg(fsp), filter_string, recursive));
1666
1667	TALLOC_FREE(filter_string);
1668	}
1669
1670	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1671	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1672	return;
1673	}
1674
1675	if (fsp->notify == NULL) {
1676
1677	status = change_notify_create(fsp, filter, recursive);
1678
1679	if (!NT_STATUS_IS_OK(status)) {
1680	DEBUG(10, ("change_notify_create returned %s\n",
1681	nt_errstr(status)));
1682	reply_nterror(req, status);
1683	return;
1684	}
1685	}
1686
1687	if (fsp->notify->num_changes != 0) {
1688
1689	/*
1690	* We've got changes pending, respond immediately
1691	*/
1692
1693	/*
1694	* TODO: write a torture test to check the filtering behaviour
1695	* here.
1696	*/
1697
1698	change_notify_reply(fsp->conn, req,
1699	NT_STATUS_OK,
1700	max_param_count,
1701	fsp->notify,
1702	smbd_smb1_notify_reply);
1703
1704	/*
1705	* change_notify_reply() above has independently sent its
1706	* results
1707	*/
1708	return;
1709	}
1710
1711	/*
1712	* No changes pending, queue the request
1713	*/
1714
1715	status = change_notify_add_request(req,
1716	max_param_count,
1717	filter,
1718	recursive, fsp,
1719	smbd_smb1_notify_reply);
1720	if (!NT_STATUS_IS_OK(status)) {
1721	reply_nterror(req, status);
1722	}
1723	return;
1724	}
1725
1726	/****************************************************************************
1727	Reply to an NT transact rename command.
1728	****************************************************************************/
1729
1730	static void call_nt_transact_rename(connection_struct *conn,
1731	struct smb_request *req,
1732	uint16 **ppsetup, uint32 setup_count,
1733	char **ppparams, uint32 parameter_count,
1734	char **ppdata, uint32 data_count,
1735	uint32 max_data_count)
1736	{
1737	char params = ppparams;
1738	char *new_name = NULL;
1739	files_struct *fsp = NULL;
1740	bool dest_has_wcard = False;
1741	NTSTATUS status;
1742	TALLOC_CTX *ctx = talloc_tos();
1743
1744	if(parameter_count < 5) {
1745	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1746	return;
1747	}
1748
1749	fsp = file_fsp(req, SVAL(params, 0));
1750	if (!check_fsp(conn, req, fsp)) {
1751	return;
1752	}
1753	srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1754	parameter_count - 4,
1755	STR_TERMINATE, &status, &dest_has_wcard);
1756	if (!NT_STATUS_IS_OK(status)) {
1757	reply_nterror(req, status);
1758	return;
1759	}
1760
1761	/*
1762	* W2K3 ignores this request as the RAW-RENAME test
1763	* demonstrates, so we do.
1764	*/
1765	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1766
1767	DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1768	fsp_str_dbg(fsp), new_name));
1769
1770	return;
1771	}
1772
1773	/******************************************************************************
1774	Fake up a completely empty SD.
1775	*******************************************************************************/
1776
1777	static NTSTATUS get_null_nt_acl(TALLOC_CTX mem_ctx, SEC_DESC *ppsd)
1778	{
1779	size_t sd_size;
1780
1781	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1782	if(!*ppsd) {
1783	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1784	return NT_STATUS_NO_MEMORY;
1785	}
1786
1787	return NT_STATUS_OK;
1788	}
1789
1790	/****************************************************************************
1791	Reply to query a security descriptor.
1792	****************************************************************************/
1793
1794	static void call_nt_transact_query_security_desc(connection_struct *conn,
1795	struct smb_request *req,
1796	uint16 **ppsetup,
1797	uint32 setup_count,
1798	char **ppparams,
1799	uint32 parameter_count,
1800	char **ppdata,
1801	uint32 data_count,
1802	uint32 max_data_count)
1803	{
1804	char params = ppparams;
1805	char data = ppdata;
1806	SEC_DESC *psd = NULL;
1807	size_t sd_size;
1808	uint32 security_info_wanted;
1809	files_struct *fsp = NULL;
1810	NTSTATUS status;
1811	DATA_BLOB blob;
1812
1813	if(parameter_count < 8) {
1814	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1815	return;
1816	}
1817
1818	fsp = file_fsp(req, SVAL(params,0));
1819	if(!fsp) {
1820	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1821	return;
1822	}
1823
1824	security_info_wanted = IVAL(params,4);
1825
1826	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, "
1827	"info_wanted = 0x%x\n", fsp_str_dbg(fsp),
1828	(unsigned int)security_info_wanted));
1829
1830	params = nttrans_realloc(ppparams, 4);
1831	if(params == NULL) {
1832	reply_nterror(req, NT_STATUS_NO_MEMORY);
1833	return;
1834	}
1835
1836	/*
1837	* Get the permissions to return.
1838	*/
1839
1840	if ((security_info_wanted & SECINFO_SACL) &&
1841	!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
1842	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1843	return;
1844	}
1845
1846	if ((security_info_wanted & (SECINFO_DACL\|SECINFO_OWNER\|SECINFO_GROUP)) &&
1847	!(fsp->access_mask & SEC_STD_READ_CONTROL)) {
1848	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1849	return;
1850	}
1851
1852	if (!lp_nt_acl_support(SNUM(conn))) {
1853	status = get_null_nt_acl(talloc_tos(), &psd);
1854	} else {
1855	status = SMB_VFS_FGET_NT_ACL(
1856	fsp, security_info_wanted, &psd);
1857	}
1858	if (!NT_STATUS_IS_OK(status)) {
1859	reply_nterror(req, status);
1860	return;
1861	}
1862
1863	if (!(security_info_wanted & SECINFO_OWNER)) {
1864	psd->owner_sid = NULL;
1865	}
1866	if (!(security_info_wanted & SECINFO_GROUP)) {
1867	psd->group_sid = NULL;
1868	}
1869	if (!(security_info_wanted & SECINFO_DACL)) {
1870	psd->dacl = NULL;
1871	}
1872	if (!(security_info_wanted & SECINFO_SACL)) {
1873	psd->sacl = NULL;
1874	}
1875
1876	/* If the SACL/DACL is NULL, but was requested, we mark that it is
1877	* present in the reply to match Windows behavior */
1878	if (psd->sacl == NULL &&
1879	security_info_wanted & SACL_SECURITY_INFORMATION)
1880	psd->type \|= SEC_DESC_SACL_PRESENT;
1881	if (psd->dacl == NULL &&
1882	security_info_wanted & DACL_SECURITY_INFORMATION)
1883	psd->type \|= SEC_DESC_DACL_PRESENT;
1884
1885	sd_size = ndr_size_security_descriptor(psd, NULL, 0);
1886
1887	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1888
1889	if (DEBUGLEVEL >= 10) {
1890	DEBUG(10,("call_nt_transact_query_security_desc for file %s\n",
1891	fsp_str_dbg(fsp)));
1892	NDR_PRINT_DEBUG(security_descriptor, psd);
1893	}
1894
1895	SIVAL(params,0,(uint32)sd_size);
1896
1897	if (max_data_count < sd_size) {
1898	send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1899	params, 4, *ppdata, 0);
1900	return;
1901	}
1902
1903	/*
1904	* Allocate the data we will point this at.
1905	*/
1906
1907	data = nttrans_realloc(ppdata, sd_size);
1908	if(data == NULL) {
1909	reply_nterror(req, NT_STATUS_NO_MEMORY);
1910	return;
1911	}
1912
1913	status = marshall_sec_desc(talloc_tos(), psd,
1914	&blob.data, &blob.length);
1915
1916	if (!NT_STATUS_IS_OK(status)) {
1917	reply_nterror(req, status);
1918	return;
1919	}
1920
1921	SMB_ASSERT(sd_size == blob.length);
1922	memcpy(data, blob.data, sd_size);
1923
1924	send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1925
1926	return;
1927	}
1928
1929	/****************************************************************************
1930	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1931	****************************************************************************/
1932
1933	static void call_nt_transact_set_security_desc(connection_struct *conn,
1934	struct smb_request *req,
1935	uint16 **ppsetup,
1936	uint32 setup_count,
1937	char **ppparams,
1938	uint32 parameter_count,
1939	char **ppdata,
1940	uint32 data_count,
1941	uint32 max_data_count)
1942	{
1943	char params= ppparams;
1944	char data = ppdata;
1945	files_struct *fsp = NULL;
1946	uint32 security_info_sent = 0;
1947	NTSTATUS status;
1948
1949	if(parameter_count < 8) {
1950	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1951	return;
1952	}
1953
1954	if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
1955	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1956	return;
1957	}
1958
1959	if(!lp_nt_acl_support(SNUM(conn))) {
1960	goto done;
1961	}
1962
1963	security_info_sent = IVAL(params,4);
1964
1965	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n",
1966	fsp_str_dbg(fsp), (unsigned int)security_info_sent));
1967
1968	if (data_count == 0) {
1969	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1970	return;
1971	}
1972
1973	status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1974
1975	if (!NT_STATUS_IS_OK(status)) {
1976	reply_nterror(req, status);
1977	return;
1978	}
1979
1980	done:
1981	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1982	return;
1983	}
1984
1985	/****************************************************************************
1986	Reply to NT IOCTL
1987	****************************************************************************/
1988
1989	static void call_nt_transact_ioctl(connection_struct *conn,
1990	struct smb_request *req,
1991	uint16 **ppsetup, uint32 setup_count,
1992	char **ppparams, uint32 parameter_count,
1993	char **ppdata, uint32 data_count,
1994	uint32 max_data_count)
1995	{
1996	uint32 function;
1997	uint16 fidnum;
1998	files_struct *fsp;
1999	uint8 isFSctl;
2000	uint8 compfilter;
2001	char pdata = ppdata;
2002
2003	if (setup_count != 8) {
2004	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2005	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2006	return;
2007	}
2008
2009	function = IVAL(*ppsetup, 0);
2010	fidnum = SVAL(*ppsetup, 4);
2011	isFSctl = CVAL(*ppsetup, 6);
2012	compfilter = CVAL(*ppsetup, 7);
2013
2014	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2015	function, fidnum, isFSctl, compfilter));
2016
2017	fsp=file_fsp(req, fidnum);
2018	/* this check is done in each implemented function case for now
2019	because I don't want to break anything... --metze
2020	FSP_BELONGS_CONN(fsp,conn);*/
2021
2022	SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
2023
2024	switch (function) {
2025	case FSCTL_SET_SPARSE:
2026	/* pretend this succeeded - tho strictly we should
2027	mark the file sparse (if the local fs supports it)
2028	so we can know if we need to pre-allocate or not */
2029
2030	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2031	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2032	return;
2033
2034	case FSCTL_CREATE_OR_GET_OBJECT_ID:
2035	{
2036	unsigned char objid[16];
2037
2038	/* This should return the object-id on this file.
2039	* I think I'll make this be the inode+dev. JRA.
2040	*/
2041
2042	DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
2043
2044	if (!fsp_belongs_conn(conn, req, fsp)) {
2045	return;
2046	}
2047
2048	data_count = 64;
2049	pdata = nttrans_realloc(ppdata, data_count);
2050	if (pdata == NULL) {
2051	reply_nterror(req, NT_STATUS_NO_MEMORY);
2052	return;
2053	}
2054
2055	/* For backwards compatibility only store the dev/inode. */
2056	push_file_id_16(pdata, &fsp->file_id);
2057	memcpy(pdata+16,create_volume_objectid(conn,objid),16);
2058	push_file_id_16(pdata+32, &fsp->file_id);
2059	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2060	pdata, data_count);
2061	return;
2062	}
2063
2064	case FSCTL_GET_REPARSE_POINT:
2065	/* pretend this fail - my winXP does it like this
2066	* --metze
2067	*/
2068
2069	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2070	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2071	return;
2072
2073	case FSCTL_SET_REPARSE_POINT:
2074	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2075	* --metze
2076	*/
2077
2078	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2079	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2080	return;
2081
2082	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2083	{
2084	/*
2085	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2086	* and return their volume names. If max_data_count is 16, then it is just
2087	* asking for the number of volumes and length of the combined names.
2088	*
2089	* pdata is the data allocated by our caller, but that uses
2090	* total_data_count (which is 0 in our case) rather than max_data_count.
2091	* Allocate the correct amount and return the pointer to let
2092	* it be deallocated when we return.
2093	*/
2094	SHADOW_COPY_DATA *shadow_data = NULL;
2095	TALLOC_CTX *shadow_mem_ctx = NULL;
2096	bool labels = False;
2097	uint32 labels_data_count = 0;
2098	uint32 i;
2099	char *cur_pdata;
2100
2101	if (!fsp_belongs_conn(conn, req, fsp)) {
2102	return;
2103	}
2104
2105	if (max_data_count < 16) {
2106	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2107	max_data_count));
2108	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2109	return;
2110	}
2111
2112	if (max_data_count > 16) {
2113	labels = True;
2114	}
2115
2116	shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2117	if (shadow_mem_ctx == NULL) {
2118	DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2119	reply_nterror(req, NT_STATUS_NO_MEMORY);
2120	return;
2121	}
2122
2123	shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2124	if (shadow_data == NULL) {
2125	DEBUG(0,("TALLOC_ZERO() failed!\n"));
2126	talloc_destroy(shadow_mem_ctx);
2127	reply_nterror(req, NT_STATUS_NO_MEMORY);
2128	return;
2129	}
2130
2131	shadow_data->mem_ctx = shadow_mem_ctx;
2132
2133	/*
2134	* Call the VFS routine to actually do the work.
2135	*/
2136	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2137	talloc_destroy(shadow_data->mem_ctx);
2138	if (errno == ENOSYS) {
2139	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2140	conn->connectpath));
2141	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2142	return;
2143	} else {
2144	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2145	conn->connectpath));
2146	reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
2147	return;
2148	}
2149	}
2150
2151	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
2152
2153	if (!labels) {
2154	data_count = 16;
2155	} else {
2156	data_count = 12+labels_data_count+4;
2157	}
2158
2159	if (max_data_count<data_count) {
2160	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2161	max_data_count,data_count));
2162	talloc_destroy(shadow_data->mem_ctx);
2163	reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2164	return;
2165	}
2166
2167	pdata = nttrans_realloc(ppdata, data_count);
2168	if (pdata == NULL) {
2169	talloc_destroy(shadow_data->mem_ctx);
2170	reply_nterror(req, NT_STATUS_NO_MEMORY);
2171	return;
2172	}
2173
2174	cur_pdata = pdata;
2175
2176	/* num_volumes 4 bytes */
2177	SIVAL(pdata,0,shadow_data->num_volumes);
2178
2179	if (labels) {
2180	/* num_labels 4 bytes */
2181	SIVAL(pdata,4,shadow_data->num_volumes);
2182	}
2183
2184	/* needed_data_count 4 bytes */
2185	SIVAL(pdata, 8, labels_data_count+4);
2186
2187	cur_pdata+=12;
2188
2189	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2190	shadow_data->num_volumes, fsp_str_dbg(fsp)));
2191	if (labels && shadow_data->labels) {
2192	for (i=0;i<shadow_data->num_volumes;i++) {
2193	srvstr_push(pdata, req->flags2,
2194	cur_pdata, shadow_data->labels[i],
2195	2*sizeof(SHADOW_COPY_LABEL),
2196	STR_UNICODE\|STR_TERMINATE);
2197	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2198	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2199	}
2200	}
2201
2202	talloc_destroy(shadow_data->mem_ctx);
2203
2204	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2205	pdata, data_count);
2206
2207	return;
2208	}
2209
2210	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2211	{
2212	/* pretend this succeeded -
2213	*
2214	* we have to send back a list with all files owned by this SID
2215	*
2216	* but I have to check that --metze
2217	*/
2218	DOM_SID sid;
2219	uid_t uid;
2220	size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2221
2222	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2223
2224	if (!fsp_belongs_conn(conn, req, fsp)) {
2225	return;
2226	}
2227
2228	/* unknown 4 bytes: this is not the length of the sid :-( */
2229	/unknown = IVAL(pdata,0);/
2230
2231	if (!sid_parse(pdata+4,sid_len,&sid)) {
2232	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2233	return;
2234	}
2235
2236	DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
2237
2238	if (!sid_to_uid(&sid, &uid)) {
2239	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2240	sid_string_dbg(&sid),
2241	(unsigned long)sid_len));
2242	uid = (-1);
2243	}
2244
2245	/* we can take a look at the find source :-)
2246	*
2247	* find ./ -uid $uid -name '*' is what we need here
2248	*
2249	*
2250	* and send 4bytes len and then NULL terminated unicode strings
2251	* for each file
2252	*
2253	* but I don't know how to deal with the paged results
2254	* (maybe we can hang the result anywhere in the fsp struct)
2255	*
2256	* we don't send all files at once
2257	* and at the next we should not start from the beginning,
2258	* so we have to cache the result
2259	*
2260	* --metze
2261	*/
2262
2263	/* this works for now... */
2264	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2265	return;
2266	}
2267	default:
2268	if (!logged_ioctl_message) {
2269	logged_ioctl_message = true; /* Only print this once... */
2270	DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2271	function));
2272	}
2273	}
2274
2275	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2276	}
2277
2278
2279	#ifdef HAVE_SYS_QUOTAS
2280	/****************************************************************************
2281	Reply to get user quota
2282	****************************************************************************/
2283
2284	static void call_nt_transact_get_user_quota(connection_struct *conn,
2285	struct smb_request *req,
2286	uint16 **ppsetup,
2287	uint32 setup_count,
2288	char **ppparams,
2289	uint32 parameter_count,
2290	char **ppdata,
2291	uint32 data_count,
2292	uint32 max_data_count)
2293	{
2294	NTSTATUS nt_status = NT_STATUS_OK;
2295	char params = ppparams;
2296	char pdata = ppdata;
2297	char *entry;
2298	int data_len=0,param_len=0;
2299	int qt_len=0;
2300	int entry_len = 0;
2301	files_struct *fsp = NULL;
2302	uint16 level = 0;
2303	size_t sid_len;
2304	DOM_SID sid;
2305	bool start_enum = True;
2306	SMB_NTQUOTA_STRUCT qt;
2307	SMB_NTQUOTA_LIST *tmp_list;
2308	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2309
2310	ZERO_STRUCT(qt);
2311
2312	/* access check */
2313	if (conn->server_info->utok.uid != 0 && !conn->admin_user) {
2314	DEBUG(1,("get_user_quota: access_denied service [%s] user "
2315	"[%s]\n", lp_servicename(SNUM(conn)),
2316	conn->server_info->unix_name));
2317	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2318	return;
2319	}
2320
2321	/*
2322	* Ensure minimum number of parameters sent.
2323	*/
2324
2325	if (parameter_count < 4) {
2326	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2327	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2328	return;
2329	}
2330
2331	/* maybe we can check the quota_fnum */
2332	fsp = file_fsp(req, SVAL(params,0));
2333	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2334	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2335	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2336	return;
2337	}
2338
2339	/* the NULL pointer checking for fsp->fake_file_handle->pd
2340	* is done by CHECK_NTQUOTA_HANDLE_OK()
2341	*/
2342	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2343
2344	level = SVAL(params,2);
2345
2346	/* unknown 12 bytes leading in params */
2347
2348	switch (level) {
2349	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2350	/* seems that we should continue with the enum here --metze */
2351
2352	if (qt_handle->quota_list!=NULL &&
2353	qt_handle->tmp_list==NULL) {
2354
2355	/* free the list */
2356	free_ntquota_list(&(qt_handle->quota_list));
2357
2358	/* Realloc the size of parameters and data we will return */
2359	param_len = 4;
2360	params = nttrans_realloc(ppparams, param_len);
2361	if(params == NULL) {
2362	reply_nterror(req, NT_STATUS_NO_MEMORY);
2363	return;
2364	}
2365
2366	data_len = 0;
2367	SIVAL(params,0,data_len);
2368
2369	break;
2370	}
2371
2372	start_enum = False;
2373
2374	case TRANSACT_GET_USER_QUOTA_LIST_START:
2375
2376	if (qt_handle->quota_list==NULL &&
2377	qt_handle->tmp_list==NULL) {
2378	start_enum = True;
2379	}
2380
2381	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2382	reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
2383	return;
2384	}
2385
2386	/* Realloc the size of parameters and data we will return */
2387	param_len = 4;
2388	params = nttrans_realloc(ppparams, param_len);
2389	if(params == NULL) {
2390	reply_nterror(req, NT_STATUS_NO_MEMORY);
2391	return;
2392	}
2393
2394	/* we should not trust the value in max_data_count*/
2395	max_data_count = MIN(max_data_count,2048);
2396
2397	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2398	if(pdata == NULL) {
2399	reply_nterror(req, NT_STATUS_NO_MEMORY);
2400	return;
2401	}
2402
2403	entry = pdata;
2404
2405	/* set params Size of returned Quota Data 4 bytes*/
2406	/* but set it later when we know it */
2407
2408	/* for each entry push the data */
2409
2410	if (start_enum) {
2411	qt_handle->tmp_list = qt_handle->quota_list;
2412	}
2413
2414	tmp_list = qt_handle->tmp_list;
2415
2416	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2417	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2418
2419	sid_len = ndr_size_dom_sid(
2420	&tmp_list->quotas->sid, NULL, 0);
2421	entry_len = 40 + sid_len;
2422
2423	/* nextoffset entry 4 bytes */
2424	SIVAL(entry,0,entry_len);
2425
2426	/* then the len of the SID 4 bytes */
2427	SIVAL(entry,4,sid_len);
2428
2429	/* unknown data 8 bytes uint64_t */
2430	SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/
2431
2432	/* the used disk space 8 bytes uint64_t */
2433	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2434
2435	/* the soft quotas 8 bytes uint64_t */
2436	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2437
2438	/* the hard quotas 8 bytes uint64_t */
2439	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2440
2441	/* and now the SID */
2442	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2443	}
2444
2445	qt_handle->tmp_list = tmp_list;
2446
2447	/* overwrite the offset of the last entry */
2448	SIVAL(entry-entry_len,0,0);
2449
2450	data_len = 4+qt_len;
2451	/* overwrite the params quota_data_len */
2452	SIVAL(params,0,data_len);
2453
2454	break;
2455
2456	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2457
2458	/* unknown 4 bytes IVAL(pdata,0) */
2459
2460	if (data_count < 8) {
2461	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2462	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2463	return;
2464	}
2465
2466	sid_len = IVAL(pdata,4);
2467	/* Ensure this is less than 1mb. */
2468	if (sid_len > (1024*1024)) {
2469	reply_nterror(req, NT_STATUS_NO_MEMORY);
2470	return;
2471	}
2472
2473	if (data_count < 8+sid_len) {
2474	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2475	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2476	return;
2477	}
2478
2479	data_len = 4+40+sid_len;
2480
2481	if (max_data_count < data_len) {
2482	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2483	max_data_count, data_len));
2484	param_len = 4;
2485	SIVAL(params,0,data_len);
2486	data_len = 0;
2487	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2488	break;
2489	}
2490
2491	if (!sid_parse(pdata+8,sid_len,&sid)) {
2492	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2493	return;
2494	}
2495
2496	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2497	ZERO_STRUCT(qt);
2498	/*
2499	* we have to return zero's in all fields
2500	* instead of returning an error here
2501	* --metze
2502	*/
2503	}
2504
2505	/* Realloc the size of parameters and data we will return */
2506	param_len = 4;
2507	params = nttrans_realloc(ppparams, param_len);
2508	if(params == NULL) {
2509	reply_nterror(req, NT_STATUS_NO_MEMORY);
2510	return;
2511	}
2512
2513	pdata = nttrans_realloc(ppdata, data_len);
2514	if(pdata == NULL) {
2515	reply_nterror(req, NT_STATUS_NO_MEMORY);
2516	return;
2517	}
2518
2519	entry = pdata;
2520
2521	/* set params Size of returned Quota Data 4 bytes*/
2522	SIVAL(params,0,data_len);
2523
2524	/* nextoffset entry 4 bytes */
2525	SIVAL(entry,0,0);
2526
2527	/* then the len of the SID 4 bytes */
2528	SIVAL(entry,4,sid_len);
2529
2530	/* unknown data 8 bytes uint64_t */
2531	SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/
2532
2533	/* the used disk space 8 bytes uint64_t */
2534	SBIG_UINT(entry,16,qt.usedspace);
2535
2536	/* the soft quotas 8 bytes uint64_t */
2537	SBIG_UINT(entry,24,qt.softlim);
2538
2539	/* the hard quotas 8 bytes uint64_t */
2540	SBIG_UINT(entry,32,qt.hardlim);
2541
2542	/* and now the SID */
2543	sid_linearize(entry+40, sid_len, &sid);
2544
2545	break;
2546
2547	default:
2548	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2549	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2550	return;
2551	break;
2552	}
2553
2554	send_nt_replies(conn, req, nt_status, params, param_len,
2555	pdata, data_len);
2556	}
2557
2558	/****************************************************************************
2559	Reply to set user quota
2560	****************************************************************************/
2561
2562	static void call_nt_transact_set_user_quota(connection_struct *conn,
2563	struct smb_request *req,
2564	uint16 **ppsetup,
2565	uint32 setup_count,
2566	char **ppparams,
2567	uint32 parameter_count,
2568	char **ppdata,
2569	uint32 data_count,
2570	uint32 max_data_count)
2571	{
2572	char params = ppparams;
2573	char pdata = ppdata;
2574	int data_len=0,param_len=0;
2575	SMB_NTQUOTA_STRUCT qt;
2576	size_t sid_len;
2577	DOM_SID sid;
2578	files_struct *fsp = NULL;
2579
2580	ZERO_STRUCT(qt);
2581
2582	/* access check */
2583	if (conn->server_info->utok.uid != 0 && !conn->admin_user) {
2584	DEBUG(1,("set_user_quota: access_denied service [%s] user "
2585	"[%s]\n", lp_servicename(SNUM(conn)),
2586	conn->server_info->unix_name));
2587	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2588	return;
2589	}
2590
2591	/*
2592	* Ensure minimum number of parameters sent.
2593	*/
2594
2595	if (parameter_count < 2) {
2596	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2597	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2598	return;
2599	}
2600
2601	/* maybe we can check the quota_fnum */
2602	fsp = file_fsp(req, SVAL(params,0));
2603	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2604	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2605	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2606	return;
2607	}
2608
2609	if (data_count < 40) {
2610	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2611	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2612	return;
2613	}
2614
2615	/* offset to next quota record.
2616	* 4 bytes IVAL(pdata,0)
2617	* unused here...
2618	*/
2619
2620	/* sid len */
2621	sid_len = IVAL(pdata,4);
2622
2623	if (data_count < 40+sid_len) {
2624	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2625	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2626	return;
2627	}
2628
2629	/* unknown 8 bytes in pdata
2630	* maybe its the change time in NTTIME
2631	*/
2632
2633	/* the used space 8 bytes (uint64_t)*/
2634	qt.usedspace = (uint64_t)IVAL(pdata,16);
2635	#ifdef LARGE_SMB_OFF_T
2636	qt.usedspace \|= (((uint64_t)IVAL(pdata,20)) << 32);
2637	#else /* LARGE_SMB_OFF_T */
2638	if ((IVAL(pdata,20) != 0)&&
2639	((qt.usedspace != 0xFFFFFFFF)\|\|
2640	(IVAL(pdata,20)!=0xFFFFFFFF))) {
2641	/* more than 32 bits? */
2642	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2643	return;
2644	}
2645	#endif /* LARGE_SMB_OFF_T */
2646
2647	/* the soft quotas 8 bytes (uint64_t)*/
2648	qt.softlim = (uint64_t)IVAL(pdata,24);
2649	#ifdef LARGE_SMB_OFF_T
2650	qt.softlim \|= (((uint64_t)IVAL(pdata,28)) << 32);
2651	#else /* LARGE_SMB_OFF_T */
2652	if ((IVAL(pdata,28) != 0)&&
2653	((qt.softlim != 0xFFFFFFFF)\|\|
2654	(IVAL(pdata,28)!=0xFFFFFFFF))) {
2655	/* more than 32 bits? */
2656	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2657	return;
2658	}
2659	#endif /* LARGE_SMB_OFF_T */
2660
2661	/* the hard quotas 8 bytes (uint64_t)*/
2662	qt.hardlim = (uint64_t)IVAL(pdata,32);
2663	#ifdef LARGE_SMB_OFF_T
2664	qt.hardlim \|= (((uint64_t)IVAL(pdata,36)) << 32);
2665	#else /* LARGE_SMB_OFF_T */
2666	if ((IVAL(pdata,36) != 0)&&
2667	((qt.hardlim != 0xFFFFFFFF)\|\|
2668	(IVAL(pdata,36)!=0xFFFFFFFF))) {
2669	/* more than 32 bits? */
2670	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2671	return;
2672	}
2673	#endif /* LARGE_SMB_OFF_T */
2674
2675	if (!sid_parse(pdata+40,sid_len,&sid)) {
2676	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2677	return;
2678	}
2679
2680	DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2681
2682	/* 44 unknown bytes left... */
2683
2684	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2685	reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
2686	return;
2687	}
2688
2689	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2690	pdata, data_len);
2691	}
2692	#endif /* HAVE_SYS_QUOTAS */
2693
2694	static void handle_nttrans(connection_struct *conn,
2695	struct trans_state *state,
2696	struct smb_request *req)
2697	{
2698	if (get_Protocol() >= PROTOCOL_NT1) {
2699	req->flags2 \|= 0x40; /* IS_LONG_NAME */
2700	SSVAL(req->inbuf,smb_flg2,req->flags2);
2701	}
2702
2703
2704	SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2705
2706	/* Now we must call the relevant NT_TRANS function */
2707	switch(state->call) {
2708	case NT_TRANSACT_CREATE:
2709	{
2710	START_PROFILE(NT_transact_create);
2711	call_nt_transact_create(
2712	conn, req,
2713	&state->setup, state->setup_count,
2714	&state->param, state->total_param,
2715	&state->data, state->total_data,
2716	state->max_data_return);
2717	END_PROFILE(NT_transact_create);
2718	break;
2719	}
2720
2721	case NT_TRANSACT_IOCTL:
2722	{
2723	START_PROFILE(NT_transact_ioctl);
2724	call_nt_transact_ioctl(
2725	conn, req,
2726	&state->setup, state->setup_count,
2727	&state->param, state->total_param,
2728	&state->data, state->total_data,
2729	state->max_data_return);
2730	END_PROFILE(NT_transact_ioctl);
2731	break;
2732	}
2733
2734	case NT_TRANSACT_SET_SECURITY_DESC:
2735	{
2736	START_PROFILE(NT_transact_set_security_desc);
2737	call_nt_transact_set_security_desc(
2738	conn, req,
2739	&state->setup, state->setup_count,
2740	&state->param, state->total_param,
2741	&state->data, state->total_data,
2742	state->max_data_return);
2743	END_PROFILE(NT_transact_set_security_desc);
2744	break;
2745	}
2746
2747	case NT_TRANSACT_NOTIFY_CHANGE:
2748	{
2749	START_PROFILE(NT_transact_notify_change);
2750	call_nt_transact_notify_change(
2751	conn, req,
2752	&state->setup, state->setup_count,
2753	&state->param, state->total_param,
2754	&state->data, state->total_data,
2755	state->max_data_return,
2756	state->max_param_return);
2757	END_PROFILE(NT_transact_notify_change);
2758	break;
2759	}
2760
2761	case NT_TRANSACT_RENAME:
2762	{
2763	START_PROFILE(NT_transact_rename);
2764	call_nt_transact_rename(
2765	conn, req,
2766	&state->setup, state->setup_count,
2767	&state->param, state->total_param,
2768	&state->data, state->total_data,
2769	state->max_data_return);
2770	END_PROFILE(NT_transact_rename);
2771	break;
2772	}
2773
2774	case NT_TRANSACT_QUERY_SECURITY_DESC:
2775	{
2776	START_PROFILE(NT_transact_query_security_desc);
2777	call_nt_transact_query_security_desc(
2778	conn, req,
2779	&state->setup, state->setup_count,
2780	&state->param, state->total_param,
2781	&state->data, state->total_data,
2782	state->max_data_return);
2783	END_PROFILE(NT_transact_query_security_desc);
2784	break;
2785	}
2786
2787	#ifdef HAVE_SYS_QUOTAS
2788	case NT_TRANSACT_GET_USER_QUOTA:
2789	{
2790	START_PROFILE(NT_transact_get_user_quota);
2791	call_nt_transact_get_user_quota(
2792	conn, req,
2793	&state->setup, state->setup_count,
2794	&state->param, state->total_param,
2795	&state->data, state->total_data,
2796	state->max_data_return);
2797	END_PROFILE(NT_transact_get_user_quota);
2798	break;
2799	}
2800
2801	case NT_TRANSACT_SET_USER_QUOTA:
2802	{
2803	START_PROFILE(NT_transact_set_user_quota);
2804	call_nt_transact_set_user_quota(
2805	conn, req,
2806	&state->setup, state->setup_count,
2807	&state->param, state->total_param,
2808	&state->data, state->total_data,
2809	state->max_data_return);
2810	END_PROFILE(NT_transact_set_user_quota);
2811	break;
2812	}
2813	#endif /* HAVE_SYS_QUOTAS */
2814
2815	default:
2816	/* Error in request */
2817	DEBUG(0,("handle_nttrans: Unknown request %d in "
2818	"nttrans call\n", state->call));
2819	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2820	return;
2821	}
2822	return;
2823	}
2824
2825	/****************************************************************************
2826	Reply to a SMBNTtrans.
2827	****************************************************************************/
2828
2829	void reply_nttrans(struct smb_request *req)
2830	{
2831	connection_struct *conn = req->conn;
2832	uint32_t pscnt;
2833	uint32_t psoff;
2834	uint32_t dscnt;
2835	uint32_t dsoff;
2836	uint16 function_code;
2837	NTSTATUS result;
2838	struct trans_state *state;
2839
2840	START_PROFILE(SMBnttrans);
2841
2842	if (req->wct < 19) {
2843	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2844	END_PROFILE(SMBnttrans);
2845	return;
2846	}
2847
2848	pscnt = IVAL(req->vwv+9, 1);
2849	psoff = IVAL(req->vwv+11, 1);
2850	dscnt = IVAL(req->vwv+13, 1);
2851	dsoff = IVAL(req->vwv+15, 1);
2852	function_code = SVAL(req->vwv+18, 0);
2853
2854	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2855	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2856	END_PROFILE(SMBnttrans);
2857	return;
2858	}
2859
2860	result = allow_new_trans(conn->pending_trans, req->mid);
2861	if (!NT_STATUS_IS_OK(result)) {
2862	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2863	reply_nterror(req, result);
2864	END_PROFILE(SMBnttrans);
2865	return;
2866	}
2867
2868	if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2869	reply_nterror(req, NT_STATUS_NO_MEMORY);
2870	END_PROFILE(SMBnttrans);
2871	return;
2872	}
2873
2874	state->cmd = SMBnttrans;
2875
2876	state->mid = req->mid;
2877	state->vuid = req->vuid;
2878	state->total_data = IVAL(req->vwv+3, 1);
2879	state->data = NULL;
2880	state->total_param = IVAL(req->vwv+1, 1);
2881	state->param = NULL;
2882	state->max_data_return = IVAL(req->vwv+7, 1);
2883	state->max_param_return = IVAL(req->vwv+5, 1);
2884
2885	/* setup count is in words */
2886	state->setup_count = 2*CVAL(req->vwv+17, 1);
2887	state->setup = NULL;
2888	state->call = function_code;
2889
2890	DEBUG(10, ("num_setup=%u, "
2891	"param_total=%u, this_param=%u, max_param=%u, "
2892	"data_total=%u, this_data=%u, max_data=%u, "
2893	"param_offset=%u, data_offset=%u\n",
2894	(unsigned)state->setup_count,
2895	(unsigned)state->total_param, (unsigned)pscnt,
2896	(unsigned)state->max_param_return,
2897	(unsigned)state->total_data, (unsigned)dscnt,
2898	(unsigned)state->max_data_return,
2899	(unsigned)psoff, (unsigned)dsoff));
2900
2901	/*
2902	* All nttrans messages we handle have smb_wct == 19 +
2903	* state->setup_count. Ensure this is so as a sanity check.
2904	*/
2905
2906	if(req->wct != 19 + (state->setup_count/2)) {
2907	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2908	req->wct, 19 + (state->setup_count/2)));
2909	goto bad_param;
2910	}
2911
2912	/* Don't allow more than 128mb for each value. */
2913	if ((state->total_data > (10241024128)) \|\|
2914	(state->total_param > (10241024128))) {
2915	reply_nterror(req, NT_STATUS_NO_MEMORY);
2916	END_PROFILE(SMBnttrans);
2917	return;
2918	}
2919
2920	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
2921	goto bad_param;
2922
2923	if (state->total_data) {
2924
2925	if (trans_oob(state->total_data, 0, dscnt)
2926	\|\| trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
2927	goto bad_param;
2928	}
2929
2930	/* Can't use talloc here, the core routines do realloc on the
2931	* params and data. */
2932	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2933	DEBUG(0,("reply_nttrans: data malloc fail for %u "
2934	"bytes !\n", (unsigned int)state->total_data));
2935	TALLOC_FREE(state);
2936	reply_nterror(req, NT_STATUS_NO_MEMORY);
2937	END_PROFILE(SMBnttrans);
2938	return;
2939	}
2940
2941	memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2942	}
2943
2944	if (state->total_param) {
2945
2946	if (trans_oob(state->total_param, 0, pscnt)
2947	\|\| trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
2948	goto bad_param;
2949	}
2950
2951	/* Can't use talloc here, the core routines do realloc on the
2952	* params and data. */
2953	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2954	DEBUG(0,("reply_nttrans: param malloc fail for %u "
2955	"bytes !\n", (unsigned int)state->total_param));
2956	SAFE_FREE(state->data);
2957	TALLOC_FREE(state);
2958	reply_nterror(req, NT_STATUS_NO_MEMORY);
2959	END_PROFILE(SMBnttrans);
2960	return;
2961	}
2962
2963	memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2964	}
2965
2966	state->received_data = dscnt;
2967	state->received_param = pscnt;
2968
2969	if(state->setup_count > 0) {
2970	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2971	state->setup_count));
2972
2973	/*
2974	* No overflow possible here, state->setup_count is an
2975	* unsigned int, being filled by a single byte from
2976	* CVAL(req->vwv+13, 0) above. The cast in the comparison
2977	* below is not necessary, it's here to clarify things. The
2978	* validity of req->vwv and req->wct has been checked in
2979	* init_smb_request already.
2980	*/
2981	if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
2982	goto bad_param;
2983	}
2984
2985	state->setup = (uint16 *)TALLOC(state, state->setup_count);
2986	if (state->setup == NULL) {
2987	DEBUG(0,("reply_nttrans : Out of memory\n"));
2988	SAFE_FREE(state->data);
2989	SAFE_FREE(state->param);
2990	TALLOC_FREE(state);
2991	reply_nterror(req, NT_STATUS_NO_MEMORY);
2992	END_PROFILE(SMBnttrans);
2993	return;
2994	}
2995
2996	memcpy(state->setup, req->vwv+19, state->setup_count);
2997	dump_data(10, (uint8 *)state->setup, state->setup_count);
2998	}
2999
3000	if ((state->received_data == state->total_data) &&
3001	(state->received_param == state->total_param)) {
3002	handle_nttrans(conn, state, req);
3003	SAFE_FREE(state->param);
3004	SAFE_FREE(state->data);
3005	TALLOC_FREE(state);
3006	END_PROFILE(SMBnttrans);
3007	return;
3008	}
3009
3010	DLIST_ADD(conn->pending_trans, state);
3011
3012	/* We need to send an interim response then receive the rest
3013	of the parameter/data bytes */
3014	reply_outbuf(req, 0, 0);
3015	show_msg((char *)req->outbuf);
3016	END_PROFILE(SMBnttrans);
3017	return;
3018
3019	bad_param:
3020
3021	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3022	SAFE_FREE(state->data);
3023	SAFE_FREE(state->param);
3024	TALLOC_FREE(state);
3025	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3026	END_PROFILE(SMBnttrans);
3027	return;
3028	}
3029
3030	/****************************************************************************
3031	Reply to a SMBnttranss
3032	****************************************************************************/
3033
3034	void reply_nttranss(struct smb_request *req)
3035	{
3036	connection_struct *conn = req->conn;
3037	uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
3038	struct trans_state *state;
3039
3040	START_PROFILE(SMBnttranss);
3041
3042	show_msg((char *)req->inbuf);
3043
3044	if (req->wct < 18) {
3045	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3046	END_PROFILE(SMBnttranss);
3047	return;
3048	}
3049
3050	for (state = conn->pending_trans; state != NULL;
3051	state = state->next) {
3052	if (state->mid == req->mid) {
3053	break;
3054	}
3055	}
3056
3057	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
3058	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3059	END_PROFILE(SMBnttranss);
3060	return;
3061	}
3062
3063	/* Revise state->total_param and state->total_data in case they have
3064	changed downwards */
3065	if (IVAL(req->vwv+1, 1) < state->total_param) {
3066	state->total_param = IVAL(req->vwv+1, 1);
3067	}
3068	if (IVAL(req->vwv+3, 1) < state->total_data) {
3069	state->total_data = IVAL(req->vwv+3, 1);
3070	}
3071
3072	pcnt = IVAL(req->vwv+5, 1);
3073	poff = IVAL(req->vwv+7, 1);
3074	pdisp = IVAL(req->vwv+9, 1);
3075
3076	dcnt = IVAL(req->vwv+11, 1);
3077	doff = IVAL(req->vwv+13, 1);
3078	ddisp = IVAL(req->vwv+15, 1);
3079
3080	state->received_param += pcnt;
3081	state->received_data += dcnt;
3082
3083	if ((state->received_data > state->total_data) \|\|
3084	(state->received_param > state->total_param))
3085	goto bad_param;
3086
3087	if (pcnt) {
3088	if (trans_oob(state->total_param, pdisp, pcnt)
3089	\|\| trans_oob(smb_len(req->inbuf), poff, pcnt)) {
3090	goto bad_param;
3091	}
3092	memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
3093	}
3094
3095	if (dcnt) {
3096	if (trans_oob(state->total_data, ddisp, dcnt)
3097	\|\| trans_oob(smb_len(req->inbuf), doff, dcnt)) {
3098	goto bad_param;
3099	}
3100	memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
3101	}
3102
3103	if ((state->received_param < state->total_param) \|\|
3104	(state->received_data < state->total_data)) {
3105	END_PROFILE(SMBnttranss);
3106	return;
3107	}
3108
3109	handle_nttrans(conn, state, req);
3110
3111	DLIST_REMOVE(conn->pending_trans, state);
3112	SAFE_FREE(state->data);
3113	SAFE_FREE(state->param);
3114	TALLOC_FREE(state);
3115	END_PROFILE(SMBnttranss);
3116	return;
3117
3118	bad_param:
3119
3120	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3121	DLIST_REMOVE(conn->pending_trans, state);
3122	SAFE_FREE(state->data);
3123	SAFE_FREE(state->param);
3124	TALLOC_FREE(state);
3125	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3126	END_PROFILE(SMBnttranss);
3127	return;
3128	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: