Context Navigation

source: vendor/3.6.0/source3/smbd/nttrans.c

Visit:

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago
Samba Server: update vendor to 3.6.0
File size: 86.9 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	SMB NT transaction handling
4	Copyright (C) Jeremy Allison 1994-2007
5	Copyright (C) Stefan (metze) Metzmacher 2003
6
7	This program is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 3 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with this program. If not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22	#include "system/filesys.h"
23	#include "smbd/smbd.h"
24	#include "smbd/globals.h"
25	#include "fake_file.h"
26	#include "../libcli/security/security.h"
27	#include "../librpc/gen_ndr/ndr_security.h"
28	#include "passdb/lookup_sid.h"
29	#include "auth.h"
30	#include "ntioctl.h"
31	#include "smbprofile.h"
32	#include "libsmb/libsmb.h"
33
34	extern const struct generic_mapping file_generic_mapping;
35
36	static char nttrans_realloc(char *ptr, size_t size)
37	{
38	if (ptr==NULL) {
39	smb_panic("nttrans_realloc() called with NULL ptr");
40	}
41
42	ptr = (char )SMB_REALLOC(*ptr, size);
43	if(*ptr == NULL) {
44	return NULL;
45	}
46	memset(*ptr,'\0',size);
47	return *ptr;
48	}
49
50	/****************************************************************************
51	Send the required number of replies back.
52	We assume all fields other than the data fields are
53	set correctly for the type of call.
54	HACK ! Always assumes smb_setup field is zero.
55	****************************************************************************/
56
57	void send_nt_replies(connection_struct *conn,
58	struct smb_request *req, NTSTATUS nt_error,
59	char *params, int paramsize,
60	char *pdata, int datasize)
61	{
62	int data_to_send = datasize;
63	int params_to_send = paramsize;
64	int useable_space;
65	char *pp = params;
66	char *pd = pdata;
67	int params_sent_thistime, data_sent_thistime, total_sent_thistime;
68	int alignment_offset = 1;
69	int data_alignment_offset = 0;
70	struct smbd_server_connection *sconn = req->sconn;
71	int max_send = sconn->smb1.sessions.max_send;
72
73	/*
74	* If there genuinely are no parameters or data to send just send
75	* the empty packet.
76	*/
77
78	if(params_to_send == 0 && data_to_send == 0) {
79	reply_outbuf(req, 18, 0);
80	if (NT_STATUS_V(nt_error)) {
81	error_packet_set((char *)req->outbuf,
82	0, 0, nt_error,
83	__LINE__,__FILE__);
84	}
85	show_msg((char *)req->outbuf);
86	if (!srv_send_smb(sconn,
87	(char *)req->outbuf,
88	true, req->seqnum+1,
89	IS_CONN_ENCRYPTED(conn),
90	&req->pcd)) {
91	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
92	}
93	TALLOC_FREE(req->outbuf);
94	return;
95	}
96
97	/*
98	* When sending params and data ensure that both are nicely aligned.
99	* Only do this alignment when there is also data to send - else
100	* can cause NT redirector problems.
101	*/
102
103	if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
104	data_alignment_offset = 4 - (params_to_send % 4);
105	}
106
107	/*
108	* Space is bufsize minus Netbios over TCP header minus SMB header.
109	* The alignment_offset is to align the param bytes on a four byte
110	* boundary (2 bytes for data len, one byte pad).
111	* NT needs this to work correctly.
112	*/
113
114	useable_space = max_send - (smb_size
115	+ 2 * 18 /* wct */
116	+ alignment_offset
117	+ data_alignment_offset);
118
119	if (useable_space < 0) {
120	char *msg = talloc_asprintf(
121	talloc_tos(),
122	"send_nt_replies failed sanity useable_space = %d!!!",
123	useable_space);
124	DEBUG(0, ("%s\n", msg));
125	exit_server_cleanly(msg);
126	}
127
128	while (params_to_send \|\| data_to_send) {
129
130	/*
131	* Calculate whether we will totally or partially fill this packet.
132	*/
133
134	total_sent_thistime = params_to_send + data_to_send;
135
136	/*
137	* We can never send more than useable_space.
138	*/
139
140	total_sent_thistime = MIN(total_sent_thistime, useable_space);
141
142	reply_outbuf(req, 18,
143	total_sent_thistime + alignment_offset
144	+ data_alignment_offset);
145
146	/*
147	* We might have had SMBnttranss in req->inbuf, fix that.
148	*/
149	SCVAL(req->outbuf, smb_com, SMBnttrans);
150
151	/*
152	* Set total params and data to be sent.
153	*/
154
155	SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
156	SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
157
158	/*
159	* Calculate how many parameters and data we can fit into
160	* this packet. Parameters get precedence.
161	*/
162
163	params_sent_thistime = MIN(params_to_send,useable_space);
164	data_sent_thistime = useable_space - params_sent_thistime;
165	data_sent_thistime = MIN(data_sent_thistime,data_to_send);
166
167	SIVAL(req->outbuf, smb_ntr_ParameterCount,
168	params_sent_thistime);
169
170	if(params_sent_thistime == 0) {
171	SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
172	SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
173	} else {
174	/*
175	* smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
176	* parameter bytes, however the first 4 bytes of outbuf are
177	* the Netbios over TCP header. Thus use smb_base() to subtract
178	* them from the calculation.
179	*/
180
181	SIVAL(req->outbuf,smb_ntr_ParameterOffset,
182	((smb_buf(req->outbuf)+alignment_offset)
183	- smb_base(req->outbuf)));
184	/*
185	* Absolute displacement of param bytes sent in this packet.
186	*/
187
188	SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
189	pp - params);
190	}
191
192	/*
193	* Deal with the data portion.
194	*/
195
196	SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
197
198	if(data_sent_thistime == 0) {
199	SIVAL(req->outbuf,smb_ntr_DataOffset,0);
200	SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
201	} else {
202	/*
203	* The offset of the data bytes is the offset of the
204	* parameter bytes plus the number of parameters being sent this time.
205	*/
206
207	SIVAL(req->outbuf, smb_ntr_DataOffset,
208	((smb_buf(req->outbuf)+alignment_offset) -
209	smb_base(req->outbuf))
210	+ params_sent_thistime + data_alignment_offset);
211	SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
212	}
213
214	/*
215	* Copy the param bytes into the packet.
216	*/
217
218	if(params_sent_thistime) {
219	if (alignment_offset != 0) {
220	memset(smb_buf(req->outbuf), 0,
221	alignment_offset);
222	}
223	memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
224	params_sent_thistime);
225	}
226
227	/*
228	* Copy in the data bytes
229	*/
230
231	if(data_sent_thistime) {
232	if (data_alignment_offset != 0) {
233	memset((smb_buf(req->outbuf)+alignment_offset+
234	params_sent_thistime), 0,
235	data_alignment_offset);
236	}
237	memcpy(smb_buf(req->outbuf)+alignment_offset
238	+params_sent_thistime+data_alignment_offset,
239	pd,data_sent_thistime);
240	}
241
242	DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
243	params_sent_thistime, data_sent_thistime, useable_space));
244	DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
245	params_to_send, data_to_send, paramsize, datasize));
246
247	if (NT_STATUS_V(nt_error)) {
248	error_packet_set((char *)req->outbuf,
249	0, 0, nt_error,
250	__LINE__,__FILE__);
251	}
252
253	/* Send the packet */
254	show_msg((char *)req->outbuf);
255	if (!srv_send_smb(sconn,
256	(char *)req->outbuf,
257	true, req->seqnum+1,
258	IS_CONN_ENCRYPTED(conn),
259	&req->pcd)) {
260	exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
261	}
262
263	TALLOC_FREE(req->outbuf);
264
265	pp += params_sent_thistime;
266	pd += data_sent_thistime;
267
268	params_to_send -= params_sent_thistime;
269	data_to_send -= data_sent_thistime;
270
271	/*
272	* Sanity check
273	*/
274
275	if(params_to_send < 0 \|\| data_to_send < 0) {
276	DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
277	params_to_send, data_to_send));
278	exit_server_cleanly("send_nt_replies: internal error");
279	}
280	}
281	}
282
283	/****************************************************************************
284	Reply to an NT create and X call on a pipe
285	****************************************************************************/
286
287	static void nt_open_pipe(char fname, connection_struct conn,
288	struct smb_request req, int ppnum)
289	{
290	files_struct *fsp;
291	NTSTATUS status;
292
293	DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
294
295	/* Strip \\ off the name. */
296	fname++;
297
298	status = open_np_file(req, fname, &fsp);
299	if (!NT_STATUS_IS_OK(status)) {
300	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
301	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
302	ERRDOS, ERRbadpipe);
303	return;
304	}
305	reply_nterror(req, status);
306	return;
307	}
308
309	*ppnum = fsp->fnum;
310	return;
311	}
312
313	/****************************************************************************
314	Reply to an NT create and X call for pipes.
315	****************************************************************************/
316
317	static void do_ntcreate_pipe_open(connection_struct *conn,
318	struct smb_request *req)
319	{
320	char *fname = NULL;
321	int pnum = -1;
322	char *p = NULL;
323	uint32 flags = IVAL(req->vwv+3, 1);
324	TALLOC_CTX *ctx = talloc_tos();
325
326	srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
327
328	if (!fname) {
329	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
330	ERRDOS, ERRbadpipe);
331	return;
332	}
333	nt_open_pipe(fname, conn, req, &pnum);
334
335	if (req->outbuf) {
336	/* error reply */
337	return;
338	}
339
340	/*
341	* Deal with pipe return.
342	*/
343
344	if (flags & EXTENDED_RESPONSE_REQUIRED) {
345	/* This is very strange. We
346	* return 50 words, but only set
347	* the wcnt to 42 ? It's definately
348	* what happens on the wire....
349	*/
350	reply_outbuf(req, 50, 0);
351	SCVAL(req->outbuf,smb_wct,42);
352	} else {
353	reply_outbuf(req, 34, 0);
354	}
355
356	p = (char *)req->outbuf + smb_vwv2;
357	p++;
358	SSVAL(p,0,pnum);
359	p += 2;
360	SIVAL(p,0,FILE_WAS_OPENED);
361	p += 4;
362	p += 32;
363	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
364	p += 20;
365	/* File type. */
366	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
367	/* Device state. */
368	SSVAL(p,2, 0x5FF); /* ? */
369	p += 4;
370
371	if (flags & EXTENDED_RESPONSE_REQUIRED) {
372	p += 25;
373	SIVAL(p,0,FILE_GENERIC_ALL);
374	/*
375	* For pipes W2K3 seems to return
376	* 0x12019B next.
377	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
378	*/
379	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
380	}
381
382	DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
383
384	chain_reply(req);
385	}
386
387	struct case_semantics_state {
388	connection_struct *conn;
389	bool case_sensitive;
390	bool case_preserve;
391	bool short_case_preserve;
392	};
393
394	/****************************************************************************
395	Restore case semantics.
396	****************************************************************************/
397
398	static int restore_case_semantics(struct case_semantics_state *state)
399	{
400	state->conn->case_sensitive = state->case_sensitive;
401	state->conn->case_preserve = state->case_preserve;
402	state->conn->short_case_preserve = state->short_case_preserve;
403	return 0;
404	}
405
406	/****************************************************************************
407	Save case semantics.
408	****************************************************************************/
409
410	static struct case_semantics_state set_posix_case_semantics(TALLOC_CTX mem_ctx,
411	connection_struct *conn)
412	{
413	struct case_semantics_state *result;
414
415	if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
416	return NULL;
417	}
418
419	result->conn = conn;
420	result->case_sensitive = conn->case_sensitive;
421	result->case_preserve = conn->case_preserve;
422	result->short_case_preserve = conn->short_case_preserve;
423
424	/* Set to POSIX. */
425	conn->case_sensitive = True;
426	conn->case_preserve = True;
427	conn->short_case_preserve = True;
428
429	talloc_set_destructor(result, restore_case_semantics);
430
431	return result;
432	}
433
434	/****************************************************************************
435	Reply to an NT create and X call.
436	****************************************************************************/
437
438	void reply_ntcreate_and_X(struct smb_request *req)
439	{
440	connection_struct *conn = req->conn;
441	struct smb_filename *smb_fname = NULL;
442	char *fname = NULL;
443	uint32 flags;
444	uint32 access_mask;
445	uint32 file_attributes;
446	uint32 share_access;
447	uint32 create_disposition;
448	uint32 create_options;
449	uint16 root_dir_fid;
450	uint64_t allocation_size;
451	/* Breakout the oplock request bits so we can set the
452	reply bits separately. */
453	uint32 fattr=0;
454	SMB_OFF_T file_len = 0;
455	int info = 0;
456	files_struct *fsp = NULL;
457	char *p = NULL;
458	struct timespec create_timespec;
459	struct timespec c_timespec;
460	struct timespec a_timespec;
461	struct timespec m_timespec;
462	struct timespec write_time_ts;
463	NTSTATUS status;
464	int oplock_request;
465	uint8_t oplock_granted = NO_OPLOCK_RETURN;
466	struct case_semantics_state *case_state = NULL;
467	TALLOC_CTX *ctx = talloc_tos();
468
469	START_PROFILE(SMBntcreateX);
470
471	if (req->wct < 24) {
472	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
473	goto out;
474	}
475
476	flags = IVAL(req->vwv+3, 1);
477	access_mask = IVAL(req->vwv+7, 1);
478	file_attributes = IVAL(req->vwv+13, 1);
479	share_access = IVAL(req->vwv+15, 1);
480	create_disposition = IVAL(req->vwv+17, 1);
481	create_options = IVAL(req->vwv+19, 1);
482	root_dir_fid = (uint16)IVAL(req->vwv+5, 1);
483
484	allocation_size = BVAL(req->vwv+9, 1);
485
486	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
487	STR_TERMINATE, &status);
488
489	if (!NT_STATUS_IS_OK(status)) {
490	reply_nterror(req, status);
491	goto out;
492	}
493
494	DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
495	"file_attributes = 0x%x, share_access = 0x%x, "
496	"create_disposition = 0x%x create_options = 0x%x "
497	"root_dir_fid = 0x%x, fname = %s\n",
498	(unsigned int)flags,
499	(unsigned int)access_mask,
500	(unsigned int)file_attributes,
501	(unsigned int)share_access,
502	(unsigned int)create_disposition,
503	(unsigned int)create_options,
504	(unsigned int)root_dir_fid,
505	fname));
506
507	/*
508	* we need to remove ignored bits when they come directly from the client
509	* because we reuse some of them for internal stuff
510	*/
511	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
512
513	/*
514	* If it's an IPC, use the pipe handler.
515	*/
516
517	if (IS_IPC(conn)) {
518	if (lp_nt_pipe_support()) {
519	do_ntcreate_pipe_open(conn, req);
520	goto out;
521	}
522	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
523	goto out;
524	}
525
526	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
527	if (oplock_request) {
528	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
529	? BATCH_OPLOCK : 0;
530	}
531
532	if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
533	case_state = set_posix_case_semantics(ctx, conn);
534	if (!case_state) {
535	reply_nterror(req, NT_STATUS_NO_MEMORY);
536	goto out;
537	}
538	}
539
540	status = filename_convert(ctx,
541	conn,
542	req->flags2 & FLAGS2_DFS_PATHNAMES,
543	fname,
544	0,
545	NULL,
546	&smb_fname);
547
548	TALLOC_FREE(case_state);
549
550	if (!NT_STATUS_IS_OK(status)) {
551	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
552	reply_botherror(req,
553	NT_STATUS_PATH_NOT_COVERED,
554	ERRSRV, ERRbadpath);
555	goto out;
556	}
557	reply_nterror(req, status);
558	goto out;
559	}
560
561	/*
562	* Bug #6898 - clients using Windows opens should
563	* never be able to set this attribute into the
564	* VFS.
565	*/
566	file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
567
568	status = SMB_VFS_CREATE_FILE(
569	conn, /* conn */
570	req, /* req */
571	root_dir_fid, /* root_dir_fid */
572	smb_fname, /* fname */
573	access_mask, /* access_mask */
574	share_access, /* share_access */
575	create_disposition, /* create_disposition*/
576	create_options, /* create_options */
577	file_attributes, /* file_attributes */
578	oplock_request, /* oplock_request */
579	allocation_size, /* allocation_size */
580	0, /* private_flags */
581	NULL, /* sd */
582	NULL, /* ea_list */
583	&fsp, /* result */
584	&info); /* pinfo */
585
586	if (!NT_STATUS_IS_OK(status)) {
587	if (open_was_deferred(req->mid)) {
588	/* We have re-scheduled this call, no error. */
589	goto out;
590	}
591	reply_openerror(req, status);
592	goto out;
593	}
594
595	/* Ensure we're pointing at the correct stat struct. */
596	TALLOC_FREE(smb_fname);
597	smb_fname = fsp->fsp_name;
598
599	/*
600	* If the caller set the extended oplock request bit
601	* and we granted one (by whatever means) - set the
602	* correct bit for extended oplock reply.
603	*/
604
605	if (oplock_request &&
606	(lp_fake_oplocks(SNUM(conn))
607	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
608
609	/*
610	* Exclusive oplock granted
611	*/
612
613	if (flags & REQUEST_BATCH_OPLOCK) {
614	oplock_granted = BATCH_OPLOCK_RETURN;
615	} else {
616	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
617	}
618	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
619	oplock_granted = LEVEL_II_OPLOCK_RETURN;
620	} else {
621	oplock_granted = NO_OPLOCK_RETURN;
622	}
623
624	file_len = smb_fname->st.st_ex_size;
625
626	if (flags & EXTENDED_RESPONSE_REQUIRED) {
627	/* This is very strange. We
628	* return 50 words, but only set
629	* the wcnt to 42 ? It's definately
630	* what happens on the wire....
631	*/
632	reply_outbuf(req, 50, 0);
633	SCVAL(req->outbuf,smb_wct,42);
634	} else {
635	reply_outbuf(req, 34, 0);
636	}
637
638	p = (char *)req->outbuf + smb_vwv2;
639
640	SCVAL(p, 0, oplock_granted);
641
642	p++;
643	SSVAL(p,0,fsp->fnum);
644	p += 2;
645	if ((create_disposition == FILE_SUPERSEDE)
646	&& (info == FILE_WAS_OVERWRITTEN)) {
647	SIVAL(p,0,FILE_WAS_SUPERSEDED);
648	} else {
649	SIVAL(p,0,info);
650	}
651	p += 4;
652
653	fattr = dos_mode(conn, smb_fname);
654	if (fattr == 0) {
655	fattr = FILE_ATTRIBUTE_NORMAL;
656	}
657
658	/* Deal with other possible opens having a modified
659	write time. JRA. */
660	ZERO_STRUCT(write_time_ts);
661	get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
662	if (!null_timespec(write_time_ts)) {
663	update_stat_ex_mtime(&smb_fname->st, write_time_ts);
664	}
665
666	/* Create time. */
667	create_timespec = get_create_timespec(conn, fsp, smb_fname);
668	a_timespec = smb_fname->st.st_ex_atime;
669	m_timespec = smb_fname->st.st_ex_mtime;
670	c_timespec = get_change_timespec(conn, fsp, smb_fname);
671
672	if (lp_dos_filetime_resolution(SNUM(conn))) {
673	dos_filetime_timespec(&create_timespec);
674	dos_filetime_timespec(&a_timespec);
675	dos_filetime_timespec(&m_timespec);
676	dos_filetime_timespec(&c_timespec);
677	}
678
679	put_long_date_timespec(conn->ts_res, p, create_timespec); /* create time. */
680	p += 8;
681	put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
682	p += 8;
683	put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
684	p += 8;
685	put_long_date_timespec(conn->ts_res, p, c_timespec); /* change time */
686	p += 8;
687	SIVAL(p,0,fattr); /* File Attributes. */
688	p += 4;
689	SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&smb_fname->st));
690	p += 8;
691	SOFF_T(p,0,file_len);
692	p += 8;
693	if (flags & EXTENDED_RESPONSE_REQUIRED) {
694	uint16_t file_status = (NO_EAS\|NO_SUBSTREAMS\|NO_REPARSETAG);
695	size_t num_names = 0;
696	unsigned int num_streams;
697	struct stream_struct *streams = NULL;
698
699	/* Do we have any EA's ? */
700	status = get_ea_names_from_file(ctx, conn, fsp,
701	smb_fname->base_name, NULL, &num_names);
702	if (NT_STATUS_IS_OK(status) && num_names) {
703	file_status &= ~NO_EAS;
704	}
705	status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
706	&num_streams, &streams);
707	/* There is always one stream, ::$DATA. */
708	if (NT_STATUS_IS_OK(status) && num_streams > 1) {
709	file_status &= ~NO_SUBSTREAMS;
710	}
711	TALLOC_FREE(streams);
712	SSVAL(p,2,file_status);
713	}
714	p += 4;
715	SCVAL(p,0,fsp->is_directory ? 1 : 0);
716
717	if (flags & EXTENDED_RESPONSE_REQUIRED) {
718	uint32 perms = 0;
719	p += 25;
720	if (fsp->is_directory \|\|
721	can_write_to_file(conn, smb_fname)) {
722	perms = FILE_GENERIC_ALL;
723	} else {
724	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
725	}
726	SIVAL(p,0,perms);
727	}
728
729	DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
730	fsp->fnum, smb_fname_str_dbg(smb_fname)));
731
732	chain_reply(req);
733	out:
734	END_PROFILE(SMBntcreateX);
735	return;
736	}
737
738	/****************************************************************************
739	Reply to a NT_TRANSACT_CREATE call to open a pipe.
740	****************************************************************************/
741
742	static void do_nt_transact_create_pipe(connection_struct *conn,
743	struct smb_request *req,
744	uint16 **ppsetup, uint32 setup_count,
745	char **ppparams, uint32 parameter_count,
746	char **ppdata, uint32 data_count)
747	{
748	char *fname = NULL;
749	char params = ppparams;
750	int pnum = -1;
751	char *p = NULL;
752	NTSTATUS status;
753	size_t param_len;
754	uint32 flags;
755	TALLOC_CTX *ctx = talloc_tos();
756
757	/*
758	* Ensure minimum number of parameters sent.
759	*/
760
761	if(parameter_count < 54) {
762	DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
763	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
764	return;
765	}
766
767	flags = IVAL(params,0);
768
769	srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
770	parameter_count-53, STR_TERMINATE,
771	&status);
772	if (!NT_STATUS_IS_OK(status)) {
773	reply_nterror(req, status);
774	return;
775	}
776
777	nt_open_pipe(fname, conn, req, &pnum);
778
779	if (req->outbuf) {
780	/* Error return */
781	return;
782	}
783
784	/* Realloc the size of parameters and data we will return */
785	if (flags & EXTENDED_RESPONSE_REQUIRED) {
786	/* Extended response is 32 more byyes. */
787	param_len = 101;
788	} else {
789	param_len = 69;
790	}
791	params = nttrans_realloc(ppparams, param_len);
792	if(params == NULL) {
793	reply_nterror(req, NT_STATUS_NO_MEMORY);
794	return;
795	}
796
797	p = params;
798	SCVAL(p,0,NO_OPLOCK_RETURN);
799
800	p += 2;
801	SSVAL(p,0,pnum);
802	p += 2;
803	SIVAL(p,0,FILE_WAS_OPENED);
804	p += 8;
805
806	p += 32;
807	SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
808	p += 20;
809	/* File type. */
810	SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
811	/* Device state. */
812	SSVAL(p,2, 0x5FF); /* ? */
813	p += 4;
814
815	if (flags & EXTENDED_RESPONSE_REQUIRED) {
816	p += 25;
817	SIVAL(p,0,FILE_GENERIC_ALL);
818	/*
819	* For pipes W2K3 seems to return
820	* 0x12019B next.
821	* This is ((FILE_GENERIC_READ\|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
822	*/
823	SIVAL(p,4,(FILE_GENERIC_READ\|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
824	}
825
826	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
827
828	/* Send the required number of replies */
829	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
830
831	return;
832	}
833
834	/****************************************************************************
835	Internal fn to set security descriptors.
836	****************************************************************************/
837
838	NTSTATUS set_sd(files_struct fsp, uint8_t data, uint32_t sd_len,
839	uint32_t security_info_sent)
840	{
841	struct security_descriptor *psd = NULL;
842	NTSTATUS status;
843
844	if (sd_len == 0) {
845	return NT_STATUS_INVALID_PARAMETER;
846	}
847
848	if (!CAN_WRITE(fsp->conn)) {
849	return NT_STATUS_ACCESS_DENIED;
850	}
851
852	if (!lp_nt_acl_support(SNUM(fsp->conn))) {
853	return NT_STATUS_OK;
854	}
855
856	status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
857
858	if (!NT_STATUS_IS_OK(status)) {
859	return status;
860	}
861
862	if (psd->owner_sid == NULL) {
863	security_info_sent &= ~SECINFO_OWNER;
864	}
865	if (psd->group_sid == NULL) {
866	security_info_sent &= ~SECINFO_GROUP;
867	}
868
869	/* Ensure we have at least one thing set. */
870	if ((security_info_sent & (SECINFO_OWNER\|SECINFO_GROUP\|SECINFO_DACL\|SECINFO_SACL)) == 0) {
871	return NT_STATUS_INVALID_PARAMETER;
872	}
873
874	/* Ensure we have the rights to do this. */
875	if (security_info_sent & SECINFO_OWNER) {
876	if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
877	return NT_STATUS_ACCESS_DENIED;
878	}
879	}
880
881	if (security_info_sent & SECINFO_GROUP) {
882	if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
883	return NT_STATUS_ACCESS_DENIED;
884	}
885	}
886
887	if (security_info_sent & SECINFO_DACL) {
888	if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
889	return NT_STATUS_ACCESS_DENIED;
890	}
891	/* Convert all the generic bits. */
892	if (psd->dacl) {
893	security_acl_map_generic(psd->dacl, &file_generic_mapping);
894	}
895	}
896
897	if (security_info_sent & SECINFO_SACL) {
898	if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
899	return NT_STATUS_ACCESS_DENIED;
900	}
901	/* Convert all the generic bits. */
902	if (psd->sacl) {
903	security_acl_map_generic(psd->sacl, &file_generic_mapping);
904	}
905	}
906
907	if (DEBUGLEVEL >= 10) {
908	DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
909	NDR_PRINT_DEBUG(security_descriptor, psd);
910	}
911
912	status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
913
914	TALLOC_FREE(psd);
915
916	return status;
917	}
918
919	/****************************************************************************
920	Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
921	****************************************************************************/
922
923	struct ea_list read_nttrans_ea_list(TALLOC_CTX ctx, const char *pdata, size_t data_size)
924	{
925	struct ea_list *ea_list_head = NULL;
926	size_t offset = 0;
927
928	if (data_size < 4) {
929	return NULL;
930	}
931
932	while (offset + 4 <= data_size) {
933	size_t next_offset = IVAL(pdata,offset);
934	struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
935
936	if (!eal) {
937	return NULL;
938	}
939
940	DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
941	if (next_offset == 0) {
942	break;
943	}
944	offset += next_offset;
945	}
946
947	return ea_list_head;
948	}
949
950	/****************************************************************************
951	Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
952	****************************************************************************/
953
954	static void call_nt_transact_create(connection_struct *conn,
955	struct smb_request *req,
956	uint16 **ppsetup, uint32 setup_count,
957	char **ppparams, uint32 parameter_count,
958	char **ppdata, uint32 data_count,
959	uint32 max_data_count)
960	{
961	struct smb_filename *smb_fname = NULL;
962	char *fname = NULL;
963	char params = ppparams;
964	char data = ppdata;
965	/* Breakout the oplock request bits so we can set the reply bits separately. */
966	uint32 fattr=0;
967	SMB_OFF_T file_len = 0;
968	int info = 0;
969	files_struct *fsp = NULL;
970	char *p = NULL;
971	uint32 flags;
972	uint32 access_mask;
973	uint32 file_attributes;
974	uint32 share_access;
975	uint32 create_disposition;
976	uint32 create_options;
977	uint32 sd_len;
978	struct security_descriptor *sd = NULL;
979	uint32 ea_len;
980	uint16 root_dir_fid;
981	struct timespec create_timespec;
982	struct timespec c_timespec;
983	struct timespec a_timespec;
984	struct timespec m_timespec;
985	struct timespec write_time_ts;
986	struct ea_list *ea_list = NULL;
987	NTSTATUS status;
988	size_t param_len;
989	uint64_t allocation_size;
990	int oplock_request;
991	uint8_t oplock_granted;
992	struct case_semantics_state *case_state = NULL;
993	TALLOC_CTX *ctx = talloc_tos();
994
995	DEBUG(5,("call_nt_transact_create\n"));
996
997	/*
998	* If it's an IPC, use the pipe handler.
999	*/
1000
1001	if (IS_IPC(conn)) {
1002	if (lp_nt_pipe_support()) {
1003	do_nt_transact_create_pipe(
1004	conn, req,
1005	ppsetup, setup_count,
1006	ppparams, parameter_count,
1007	ppdata, data_count);
1008	goto out;
1009	}
1010	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1011	goto out;
1012	}
1013
1014	/*
1015	* Ensure minimum number of parameters sent.
1016	*/
1017
1018	if(parameter_count < 54) {
1019	DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1020	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1021	goto out;
1022	}
1023
1024	flags = IVAL(params,0);
1025	access_mask = IVAL(params,8);
1026	file_attributes = IVAL(params,20);
1027	share_access = IVAL(params,24);
1028	create_disposition = IVAL(params,28);
1029	create_options = IVAL(params,32);
1030	sd_len = IVAL(params,36);
1031	ea_len = IVAL(params,40);
1032	root_dir_fid = (uint16)IVAL(params,4);
1033	allocation_size = BVAL(params,12);
1034
1035	/*
1036	* we need to remove ignored bits when they come directly from the client
1037	* because we reuse some of them for internal stuff
1038	*/
1039	create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
1040
1041	/* Ensure the data_len is correct for the sd and ea values given. */
1042	if ((ea_len + sd_len > data_count)
1043	\|\| (ea_len > data_count) \|\| (sd_len > data_count)
1044	\|\| (ea_len + sd_len < ea_len) \|\| (ea_len + sd_len < sd_len)) {
1045	DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
1046	"%u, data_count = %u\n", (unsigned int)ea_len,
1047	(unsigned int)sd_len, (unsigned int)data_count));
1048	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1049	goto out;
1050	}
1051
1052	if (sd_len) {
1053	DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
1054	sd_len));
1055
1056	status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
1057	&sd);
1058	if (!NT_STATUS_IS_OK(status)) {
1059	DEBUG(10, ("call_nt_transact_create: "
1060	"unmarshall_sec_desc failed: %s\n",
1061	nt_errstr(status)));
1062	reply_nterror(req, status);
1063	goto out;
1064	}
1065	}
1066
1067	if (ea_len) {
1068	if (!lp_ea_support(SNUM(conn))) {
1069	DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
1070	"EA's not supported.\n",
1071	(unsigned int)ea_len));
1072	reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1073	goto out;
1074	}
1075
1076	if (ea_len < 10) {
1077	DEBUG(10,("call_nt_transact_create - ea_len = %u - "
1078	"too small (should be more than 10)\n",
1079	(unsigned int)ea_len ));
1080	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1081	goto out;
1082	}
1083
1084	/* We have already checked that ea_len <= data_count here. */
1085	ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
1086	ea_len);
1087	if (ea_list == NULL) {
1088	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1089	goto out;
1090	}
1091	}
1092
1093	srvstr_get_path(ctx, params, req->flags2, &fname,
1094	params+53, parameter_count-53,
1095	STR_TERMINATE, &status);
1096	if (!NT_STATUS_IS_OK(status)) {
1097	reply_nterror(req, status);
1098	goto out;
1099	}
1100
1101	if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1102	case_state = set_posix_case_semantics(ctx, conn);
1103	if (!case_state) {
1104	reply_nterror(req, NT_STATUS_NO_MEMORY);
1105	goto out;
1106	}
1107	}
1108
1109	status = filename_convert(ctx,
1110	conn,
1111	req->flags2 & FLAGS2_DFS_PATHNAMES,
1112	fname,
1113	0,
1114	NULL,
1115	&smb_fname);
1116
1117	TALLOC_FREE(case_state);
1118
1119	if (!NT_STATUS_IS_OK(status)) {
1120	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1121	reply_botherror(req,
1122	NT_STATUS_PATH_NOT_COVERED,
1123	ERRSRV, ERRbadpath);
1124	goto out;
1125	}
1126	reply_nterror(req, status);
1127	goto out;
1128	}
1129
1130	oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1131	if (oplock_request) {
1132	oplock_request \|= (flags & REQUEST_BATCH_OPLOCK)
1133	? BATCH_OPLOCK : 0;
1134	}
1135
1136	/*
1137	* Bug #6898 - clients using Windows opens should
1138	* never be able to set this attribute into the
1139	* VFS.
1140	*/
1141	file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1142
1143	status = SMB_VFS_CREATE_FILE(
1144	conn, /* conn */
1145	req, /* req */
1146	root_dir_fid, /* root_dir_fid */
1147	smb_fname, /* fname */
1148	access_mask, /* access_mask */
1149	share_access, /* share_access */
1150	create_disposition, /* create_disposition*/
1151	create_options, /* create_options */
1152	file_attributes, /* file_attributes */
1153	oplock_request, /* oplock_request */
1154	allocation_size, /* allocation_size */
1155	0, /* private_flags */
1156	sd, /* sd */
1157	ea_list, /* ea_list */
1158	&fsp, /* result */
1159	&info); /* pinfo */
1160
1161	if(!NT_STATUS_IS_OK(status)) {
1162	if (open_was_deferred(req->mid)) {
1163	/* We have re-scheduled this call, no error. */
1164	return;
1165	}
1166	reply_openerror(req, status);
1167	goto out;
1168	}
1169
1170	/* Ensure we're pointing at the correct stat struct. */
1171	TALLOC_FREE(smb_fname);
1172	smb_fname = fsp->fsp_name;
1173
1174	/*
1175	* If the caller set the extended oplock request bit
1176	* and we granted one (by whatever means) - set the
1177	* correct bit for extended oplock reply.
1178	*/
1179
1180	if (oplock_request &&
1181	(lp_fake_oplocks(SNUM(conn))
1182	\|\| EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1183
1184	/*
1185	* Exclusive oplock granted
1186	*/
1187
1188	if (flags & REQUEST_BATCH_OPLOCK) {
1189	oplock_granted = BATCH_OPLOCK_RETURN;
1190	} else {
1191	oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1192	}
1193	} else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1194	oplock_granted = LEVEL_II_OPLOCK_RETURN;
1195	} else {
1196	oplock_granted = NO_OPLOCK_RETURN;
1197	}
1198
1199	file_len = smb_fname->st.st_ex_size;
1200
1201	/* Realloc the size of parameters and data we will return */
1202	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1203	/* Extended response is 32 more byyes. */
1204	param_len = 101;
1205	} else {
1206	param_len = 69;
1207	}
1208	params = nttrans_realloc(ppparams, param_len);
1209	if(params == NULL) {
1210	reply_nterror(req, NT_STATUS_NO_MEMORY);
1211	goto out;
1212	}
1213
1214	p = params;
1215	SCVAL(p, 0, oplock_granted);
1216
1217	p += 2;
1218	SSVAL(p,0,fsp->fnum);
1219	p += 2;
1220	if ((create_disposition == FILE_SUPERSEDE)
1221	&& (info == FILE_WAS_OVERWRITTEN)) {
1222	SIVAL(p,0,FILE_WAS_SUPERSEDED);
1223	} else {
1224	SIVAL(p,0,info);
1225	}
1226	p += 8;
1227
1228	fattr = dos_mode(conn, smb_fname);
1229	if (fattr == 0) {
1230	fattr = FILE_ATTRIBUTE_NORMAL;
1231	}
1232
1233	/* Deal with other possible opens having a modified
1234	write time. JRA. */
1235	ZERO_STRUCT(write_time_ts);
1236	get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1237	if (!null_timespec(write_time_ts)) {
1238	update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1239	}
1240
1241	/* Create time. */
1242	create_timespec = get_create_timespec(conn, fsp, smb_fname);
1243	a_timespec = smb_fname->st.st_ex_atime;
1244	m_timespec = smb_fname->st.st_ex_mtime;
1245	c_timespec = get_change_timespec(conn, fsp, smb_fname);
1246
1247	if (lp_dos_filetime_resolution(SNUM(conn))) {
1248	dos_filetime_timespec(&create_timespec);
1249	dos_filetime_timespec(&a_timespec);
1250	dos_filetime_timespec(&m_timespec);
1251	dos_filetime_timespec(&c_timespec);
1252	}
1253
1254	put_long_date_timespec(conn->ts_res, p, create_timespec); /* create time. */
1255	p += 8;
1256	put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
1257	p += 8;
1258	put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
1259	p += 8;
1260	put_long_date_timespec(conn->ts_res, p, c_timespec); /* change time */
1261	p += 8;
1262	SIVAL(p,0,fattr); /* File Attributes. */
1263	p += 4;
1264	SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st));
1265	p += 8;
1266	SOFF_T(p,0,file_len);
1267	p += 8;
1268	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1269	uint16_t file_status = (NO_EAS\|NO_SUBSTREAMS\|NO_REPARSETAG);
1270	size_t num_names = 0;
1271	unsigned int num_streams;
1272	struct stream_struct *streams = NULL;
1273
1274	/* Do we have any EA's ? */
1275	status = get_ea_names_from_file(ctx, conn, fsp,
1276	smb_fname->base_name, NULL, &num_names);
1277	if (NT_STATUS_IS_OK(status) && num_names) {
1278	file_status &= ~NO_EAS;
1279	}
1280	status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
1281	&num_streams, &streams);
1282	/* There is always one stream, ::$DATA. */
1283	if (NT_STATUS_IS_OK(status) && num_streams > 1) {
1284	file_status &= ~NO_SUBSTREAMS;
1285	}
1286	TALLOC_FREE(streams);
1287	SSVAL(p,2,file_status);
1288	}
1289	p += 4;
1290	SCVAL(p,0,fsp->is_directory ? 1 : 0);
1291
1292	if (flags & EXTENDED_RESPONSE_REQUIRED) {
1293	uint32 perms = 0;
1294	p += 25;
1295	if (fsp->is_directory \|\|
1296	can_write_to_file(conn, smb_fname)) {
1297	perms = FILE_GENERIC_ALL;
1298	} else {
1299	perms = FILE_GENERIC_READ\|FILE_EXECUTE;
1300	}
1301	SIVAL(p,0,perms);
1302	}
1303
1304	DEBUG(5,("call_nt_transact_create: open name = %s\n",
1305	smb_fname_str_dbg(smb_fname)));
1306
1307	/* Send the required number of replies */
1308	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1309	out:
1310	return;
1311	}
1312
1313	/****************************************************************************
1314	Reply to a NT CANCEL request.
1315	conn POINTER CAN BE NULL HERE !
1316	****************************************************************************/
1317
1318	void reply_ntcancel(struct smb_request *req)
1319	{
1320	/*
1321	* Go through and cancel any pending change notifies.
1322	*/
1323
1324	START_PROFILE(SMBntcancel);
1325	srv_cancel_sign_response(req->sconn);
1326	remove_pending_change_notify_requests_by_mid(req->sconn, req->mid);
1327	remove_pending_lock_requests_by_mid_smb1(req->sconn, req->mid);
1328
1329	DEBUG(3,("reply_ntcancel: cancel called on mid = %llu.\n",
1330	(unsigned long long)req->mid));
1331
1332	END_PROFILE(SMBntcancel);
1333	return;
1334	}
1335
1336	/****************************************************************************
1337	Copy a file.
1338	****************************************************************************/
1339
1340	static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1341	connection_struct *conn,
1342	struct smb_request *req,
1343	struct smb_filename *smb_fname_src,
1344	struct smb_filename *smb_fname_dst,
1345	uint32 attrs)
1346	{
1347	files_struct fsp1,fsp2;
1348	uint32 fattr;
1349	int info;
1350	SMB_OFF_T ret=-1;
1351	NTSTATUS status = NT_STATUS_OK;
1352	char *parent;
1353
1354	if (!CAN_WRITE(conn)) {
1355	status = NT_STATUS_MEDIA_WRITE_PROTECTED;
1356	goto out;
1357	}
1358
1359	/* Source must already exist. */
1360	if (!VALID_STAT(smb_fname_src->st)) {
1361	status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1362	goto out;
1363	}
1364
1365	/* Ensure attributes match. */
1366	fattr = dos_mode(conn, smb_fname_src);
1367	if ((fattr & ~attrs) & (FILE_ATTRIBUTE_HIDDEN \| FILE_ATTRIBUTE_SYSTEM)) {
1368	status = NT_STATUS_NO_SUCH_FILE;
1369	goto out;
1370	}
1371
1372	/* Disallow if dst file already exists. */
1373	if (VALID_STAT(smb_fname_dst->st)) {
1374	status = NT_STATUS_OBJECT_NAME_COLLISION;
1375	goto out;
1376	}
1377
1378	/* No links from a directory. */
1379	if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
1380	status = NT_STATUS_FILE_IS_A_DIRECTORY;
1381	goto out;
1382	}
1383
1384	DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1385	smb_fname_str_dbg(smb_fname_src),
1386	smb_fname_str_dbg(smb_fname_dst)));
1387
1388	status = SMB_VFS_CREATE_FILE(
1389	conn, /* conn */
1390	req, /* req */
1391	0, /* root_dir_fid */
1392	smb_fname_src, /* fname */
1393	FILE_READ_DATA\|FILE_READ_ATTRIBUTES\|
1394	FILE_READ_EA, /* access_mask */
1395	(FILE_SHARE_READ \| FILE_SHARE_WRITE \| /* share_access */
1396	FILE_SHARE_DELETE),
1397	FILE_OPEN, /* create_disposition*/
1398	0, /* create_options */
1399	FILE_ATTRIBUTE_NORMAL, /* file_attributes */
1400	NO_OPLOCK, /* oplock_request */
1401	0, /* allocation_size */
1402	0, /* private_flags */
1403	NULL, /* sd */
1404	NULL, /* ea_list */
1405	&fsp1, /* result */
1406	&info); /* pinfo */
1407
1408	if (!NT_STATUS_IS_OK(status)) {
1409	goto out;
1410	}
1411
1412	status = SMB_VFS_CREATE_FILE(
1413	conn, /* conn */
1414	req, /* req */
1415	0, /* root_dir_fid */
1416	smb_fname_dst, /* fname */
1417	FILE_WRITE_DATA\|FILE_WRITE_ATTRIBUTES\|
1418	FILE_WRITE_EA, /* access_mask */
1419	(FILE_SHARE_READ \| FILE_SHARE_WRITE \| /* share_access */
1420	FILE_SHARE_DELETE),
1421	FILE_CREATE, /* create_disposition*/
1422	0, /* create_options */
1423	fattr, /* file_attributes */
1424	NO_OPLOCK, /* oplock_request */
1425	0, /* allocation_size */
1426	0, /* private_flags */
1427	NULL, /* sd */
1428	NULL, /* ea_list */
1429	&fsp2, /* result */
1430	&info); /* pinfo */
1431
1432	if (!NT_STATUS_IS_OK(status)) {
1433	close_file(NULL, fsp1, ERROR_CLOSE);
1434	goto out;
1435	}
1436
1437	if (smb_fname_src->st.st_ex_size) {
1438	ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
1439	}
1440
1441	/*
1442	* As we are opening fsp1 read-only we only expect
1443	* an error on close on fsp2 if we are out of space.
1444	* Thus we don't look at the error return from the
1445	* close of fsp1.
1446	*/
1447	close_file(NULL, fsp1, NORMAL_CLOSE);
1448
1449	/* Ensure the modtime is set correctly on the destination file. */
1450	set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
1451
1452	status = close_file(NULL, fsp2, NORMAL_CLOSE);
1453
1454	/* Grrr. We have to do this as open_file_ntcreate adds FILE_ATTRIBUTE_ARCHIVE when it
1455	creates the file. This isn't the correct thing to do in the copy
1456	case. JRA */
1457	if (!parent_dirname(talloc_tos(), smb_fname_dst->base_name, &parent,
1458	NULL)) {
1459	status = NT_STATUS_NO_MEMORY;
1460	goto out;
1461	}
1462	file_set_dosmode(conn, smb_fname_dst, fattr, parent, false);
1463	TALLOC_FREE(parent);
1464
1465	if (ret < (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
1466	status = NT_STATUS_DISK_FULL;
1467	goto out;
1468	}
1469	out:
1470	if (!NT_STATUS_IS_OK(status)) {
1471	DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1472	nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
1473	smb_fname_str_dbg(smb_fname_dst)));
1474	}
1475
1476	return status;
1477	}
1478
1479	/****************************************************************************
1480	Reply to a NT rename request.
1481	****************************************************************************/
1482
1483	void reply_ntrename(struct smb_request *req)
1484	{
1485	connection_struct *conn = req->conn;
1486	struct smb_filename *smb_fname_old = NULL;
1487	struct smb_filename *smb_fname_new = NULL;
1488	char *oldname = NULL;
1489	char *newname = NULL;
1490	const char *p;
1491	NTSTATUS status;
1492	bool src_has_wcard = False;
1493	bool dest_has_wcard = False;
1494	uint32 attrs;
1495	uint32_t ucf_flags_src = 0;
1496	uint32_t ucf_flags_dst = 0;
1497	uint16 rename_type;
1498	TALLOC_CTX *ctx = talloc_tos();
1499	bool stream_rename = false;
1500
1501	START_PROFILE(SMBntrename);
1502
1503	if (req->wct < 4) {
1504	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1505	goto out;
1506	}
1507
1508	attrs = SVAL(req->vwv+0, 0);
1509	rename_type = SVAL(req->vwv+1, 0);
1510
1511	p = (const char *)req->buf + 1;
1512	p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE,
1513	&status, &src_has_wcard);
1514	if (!NT_STATUS_IS_OK(status)) {
1515	reply_nterror(req, status);
1516	goto out;
1517	}
1518
1519	if (ms_has_wild(oldname)) {
1520	reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1521	goto out;
1522	}
1523
1524	p++;
1525	p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
1526	&status, &dest_has_wcard);
1527	if (!NT_STATUS_IS_OK(status)) {
1528	reply_nterror(req, status);
1529	goto out;
1530	}
1531
1532	if (!lp_posix_pathnames()) {
1533	/* The newname must begin with a ':' if the
1534	oldname contains a ':'. */
1535	if (strchr_m(oldname, ':')) {
1536	if (newname[0] != ':') {
1537	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1538	goto out;
1539	}
1540	stream_rename = true;
1541	}
1542	}
1543
1544	/*
1545	* If this is a rename operation, allow wildcards and save the
1546	* destination's last component.
1547	*/
1548	if (rename_type == RENAME_FLAG_RENAME) {
1549	ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP;
1550	ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP \| UCF_SAVE_LCOMP;
1551	}
1552
1553	/* rename_internals() calls unix_convert(), so don't call it here. */
1554	status = filename_convert(ctx, conn,
1555	req->flags2 & FLAGS2_DFS_PATHNAMES,
1556	oldname,
1557	ucf_flags_src,
1558	NULL,
1559	&smb_fname_old);
1560	if (!NT_STATUS_IS_OK(status)) {
1561	if (NT_STATUS_EQUAL(status,
1562	NT_STATUS_PATH_NOT_COVERED)) {
1563	reply_botherror(req,
1564	NT_STATUS_PATH_NOT_COVERED,
1565	ERRSRV, ERRbadpath);
1566	goto out;
1567	}
1568	reply_nterror(req, status);
1569	goto out;
1570	}
1571
1572	status = filename_convert(ctx, conn,
1573	req->flags2 & FLAGS2_DFS_PATHNAMES,
1574	newname,
1575	ucf_flags_dst,
1576	&dest_has_wcard,
1577	&smb_fname_new);
1578	if (!NT_STATUS_IS_OK(status)) {
1579	if (NT_STATUS_EQUAL(status,
1580	NT_STATUS_PATH_NOT_COVERED)) {
1581	reply_botherror(req,
1582	NT_STATUS_PATH_NOT_COVERED,
1583	ERRSRV, ERRbadpath);
1584	goto out;
1585	}
1586	reply_nterror(req, status);
1587	goto out;
1588	}
1589
1590	if (stream_rename) {
1591	/* smb_fname_new must be the same as smb_fname_old. */
1592	TALLOC_FREE(smb_fname_new->base_name);
1593	smb_fname_new->base_name = talloc_strdup(smb_fname_new,
1594	smb_fname_old->base_name);
1595	if (!smb_fname_new->base_name) {
1596	reply_nterror(req, NT_STATUS_NO_MEMORY);
1597	goto out;
1598	}
1599	}
1600
1601	DEBUG(3,("reply_ntrename: %s -> %s\n",
1602	smb_fname_str_dbg(smb_fname_old),
1603	smb_fname_str_dbg(smb_fname_new)));
1604
1605	switch(rename_type) {
1606	case RENAME_FLAG_RENAME:
1607	status = rename_internals(ctx, conn, req,
1608	smb_fname_old, smb_fname_new,
1609	attrs, False, src_has_wcard,
1610	dest_has_wcard,
1611	DELETE_ACCESS);
1612	break;
1613	case RENAME_FLAG_HARD_LINK:
1614	if (src_has_wcard \|\| dest_has_wcard) {
1615	/* No wildcards. */
1616	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1617	} else {
1618	status = hardlink_internals(ctx, conn,
1619	req,
1620	false,
1621	smb_fname_old,
1622	smb_fname_new);
1623	}
1624	break;
1625	case RENAME_FLAG_COPY:
1626	if (src_has_wcard \|\| dest_has_wcard) {
1627	/* No wildcards. */
1628	status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1629	} else {
1630	status = copy_internals(ctx, conn, req,
1631	smb_fname_old,
1632	smb_fname_new,
1633	attrs);
1634	}
1635	break;
1636	case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1637	status = NT_STATUS_INVALID_PARAMETER;
1638	break;
1639	default:
1640	status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1641	break;
1642	}
1643
1644	if (!NT_STATUS_IS_OK(status)) {
1645	if (open_was_deferred(req->mid)) {
1646	/* We have re-scheduled this call. */
1647	goto out;
1648	}
1649
1650	reply_nterror(req, status);
1651	goto out;
1652	}
1653
1654	reply_outbuf(req, 0, 0);
1655	out:
1656	END_PROFILE(SMBntrename);
1657	return;
1658	}
1659
1660	/****************************************************************************
1661	Reply to a notify change - queue the request and
1662	don't allow a directory to be opened.
1663	****************************************************************************/
1664
1665	static void smbd_smb1_notify_reply(struct smb_request *req,
1666	NTSTATUS error_code,
1667	uint8_t *buf, size_t len)
1668	{
1669	send_nt_replies(req->conn, req, error_code, (char *)buf, len, NULL, 0);
1670	}
1671
1672	static void call_nt_transact_notify_change(connection_struct *conn,
1673	struct smb_request *req,
1674	uint16 **ppsetup,
1675	uint32 setup_count,
1676	char **ppparams,
1677	uint32 parameter_count,
1678	char **ppdata, uint32 data_count,
1679	uint32 max_data_count,
1680	uint32 max_param_count)
1681	{
1682	uint16 setup = ppsetup;
1683	files_struct *fsp;
1684	uint32 filter;
1685	NTSTATUS status;
1686	bool recursive;
1687
1688	if(setup_count < 6) {
1689	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1690	return;
1691	}
1692
1693	fsp = file_fsp(req, SVAL(setup,4));
1694	filter = IVAL(setup, 0);
1695	recursive = (SVAL(setup, 6) != 0) ? True : False;
1696
1697	DEBUG(3,("call_nt_transact_notify_change\n"));
1698
1699	if(!fsp) {
1700	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1701	return;
1702	}
1703
1704	{
1705	char *filter_string;
1706
1707	if (!(filter_string = notify_filter_string(NULL, filter))) {
1708	reply_nterror(req,NT_STATUS_NO_MEMORY);
1709	return;
1710	}
1711
1712	DEBUG(3,("call_nt_transact_notify_change: notify change "
1713	"called on %s, filter = %s, recursive = %d\n",
1714	fsp_str_dbg(fsp), filter_string, recursive));
1715
1716	TALLOC_FREE(filter_string);
1717	}
1718
1719	if((!fsp->is_directory) \|\| (conn != fsp->conn)) {
1720	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1721	return;
1722	}
1723
1724	if (fsp->notify == NULL) {
1725
1726	status = change_notify_create(fsp, filter, recursive);
1727
1728	if (!NT_STATUS_IS_OK(status)) {
1729	DEBUG(10, ("change_notify_create returned %s\n",
1730	nt_errstr(status)));
1731	reply_nterror(req, status);
1732	return;
1733	}
1734	}
1735
1736	if (fsp->notify->num_changes != 0) {
1737
1738	/*
1739	* We've got changes pending, respond immediately
1740	*/
1741
1742	/*
1743	* TODO: write a torture test to check the filtering behaviour
1744	* here.
1745	*/
1746
1747	change_notify_reply(req,
1748	NT_STATUS_OK,
1749	max_param_count,
1750	fsp->notify,
1751	smbd_smb1_notify_reply);
1752
1753	/*
1754	* change_notify_reply() above has independently sent its
1755	* results
1756	*/
1757	return;
1758	}
1759
1760	/*
1761	* No changes pending, queue the request
1762	*/
1763
1764	status = change_notify_add_request(req,
1765	max_param_count,
1766	filter,
1767	recursive, fsp,
1768	smbd_smb1_notify_reply);
1769	if (!NT_STATUS_IS_OK(status)) {
1770	reply_nterror(req, status);
1771	}
1772	return;
1773	}
1774
1775	/****************************************************************************
1776	Reply to an NT transact rename command.
1777	****************************************************************************/
1778
1779	static void call_nt_transact_rename(connection_struct *conn,
1780	struct smb_request *req,
1781	uint16 **ppsetup, uint32 setup_count,
1782	char **ppparams, uint32 parameter_count,
1783	char **ppdata, uint32 data_count,
1784	uint32 max_data_count)
1785	{
1786	char params = ppparams;
1787	char *new_name = NULL;
1788	files_struct *fsp = NULL;
1789	bool dest_has_wcard = False;
1790	NTSTATUS status;
1791	TALLOC_CTX *ctx = talloc_tos();
1792
1793	if(parameter_count < 5) {
1794	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1795	return;
1796	}
1797
1798	fsp = file_fsp(req, SVAL(params, 0));
1799	if (!check_fsp(conn, req, fsp)) {
1800	return;
1801	}
1802	srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1803	parameter_count - 4,
1804	STR_TERMINATE, &status, &dest_has_wcard);
1805	if (!NT_STATUS_IS_OK(status)) {
1806	reply_nterror(req, status);
1807	return;
1808	}
1809
1810	/*
1811	* W2K3 ignores this request as the RAW-RENAME test
1812	* demonstrates, so we do.
1813	*/
1814	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1815
1816	DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1817	fsp_str_dbg(fsp), new_name));
1818
1819	return;
1820	}
1821
1822	/******************************************************************************
1823	Fake up a completely empty SD.
1824	*******************************************************************************/
1825
1826	static NTSTATUS get_null_nt_acl(TALLOC_CTX mem_ctx, struct security_descriptor *ppsd)
1827	{
1828	size_t sd_size;
1829
1830	*ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1831	if(!*ppsd) {
1832	DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1833	return NT_STATUS_NO_MEMORY;
1834	}
1835
1836	return NT_STATUS_OK;
1837	}
1838
1839	/****************************************************************************
1840	Reply to query a security descriptor.
1841	Callable from SMB2 and SMB2.
1842	If it returns NT_STATUS_BUFFER_TOO_SMALL, pdata_size is initialized with
1843	the required size.
1844	****************************************************************************/
1845
1846	NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
1847	TALLOC_CTX *mem_ctx,
1848	files_struct *fsp,
1849	uint32_t security_info_wanted,
1850	uint32_t max_data_count,
1851	uint8_t **ppmarshalled_sd,
1852	size_t *psd_size)
1853	{
1854	NTSTATUS status;
1855	struct security_descriptor *psd = NULL;
1856
1857	/*
1858	* Get the permissions to return.
1859	*/
1860
1861	if ((security_info_wanted & SECINFO_SACL) &&
1862	!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
1863	return NT_STATUS_ACCESS_DENIED;
1864	}
1865
1866	if ((security_info_wanted & (SECINFO_DACL\|SECINFO_OWNER\|SECINFO_GROUP)) &&
1867	!(fsp->access_mask & SEC_STD_READ_CONTROL)) {
1868	return NT_STATUS_ACCESS_DENIED;
1869	}
1870
1871	if (!lp_nt_acl_support(SNUM(conn))) {
1872	status = get_null_nt_acl(mem_ctx, &psd);
1873	} else {
1874	status = SMB_VFS_FGET_NT_ACL(
1875	fsp, security_info_wanted, &psd);
1876	}
1877	if (!NT_STATUS_IS_OK(status)) {
1878	return status;
1879	}
1880
1881	if (!(security_info_wanted & SECINFO_OWNER)) {
1882	psd->owner_sid = NULL;
1883	}
1884	if (!(security_info_wanted & SECINFO_GROUP)) {
1885	psd->group_sid = NULL;
1886	}
1887	if (!(security_info_wanted & SECINFO_DACL)) {
1888	psd->dacl = NULL;
1889	}
1890	if (!(security_info_wanted & SECINFO_SACL)) {
1891	psd->sacl = NULL;
1892	}
1893
1894	/* If the SACL/DACL is NULL, but was requested, we mark that it is
1895	* present in the reply to match Windows behavior */
1896	if (psd->sacl == NULL &&
1897	security_info_wanted & SECINFO_SACL)
1898	psd->type \|= SEC_DESC_SACL_PRESENT;
1899	if (psd->dacl == NULL &&
1900	security_info_wanted & SECINFO_DACL)
1901	psd->type \|= SEC_DESC_DACL_PRESENT;
1902
1903	*psd_size = ndr_size_security_descriptor(psd, 0);
1904
1905	DEBUG(3,("smbd_do_query_security_desc: sd_size = %lu.\n",
1906	(unsigned long)*psd_size));
1907
1908	if (DEBUGLEVEL >= 10) {
1909	DEBUG(10,("smbd_do_query_security_desc for file %s\n",
1910	fsp_str_dbg(fsp)));
1911	NDR_PRINT_DEBUG(security_descriptor, psd);
1912	}
1913
1914	if (max_data_count < *psd_size) {
1915	TALLOC_FREE(psd);
1916	return NT_STATUS_BUFFER_TOO_SMALL;
1917	}
1918
1919	status = marshall_sec_desc(mem_ctx, psd,
1920	ppmarshalled_sd, psd_size);
1921
1922	if (!NT_STATUS_IS_OK(status)) {
1923	TALLOC_FREE(psd);
1924	return status;
1925	}
1926
1927	TALLOC_FREE(psd);
1928	return NT_STATUS_OK;
1929	}
1930
1931	/****************************************************************************
1932	SMB1 reply to query a security descriptor.
1933	****************************************************************************/
1934
1935	static void call_nt_transact_query_security_desc(connection_struct *conn,
1936	struct smb_request *req,
1937	uint16 **ppsetup,
1938	uint32 setup_count,
1939	char **ppparams,
1940	uint32 parameter_count,
1941	char **ppdata,
1942	uint32 data_count,
1943	uint32 max_data_count)
1944	{
1945	char params = ppparams;
1946	char data = ppdata;
1947	size_t sd_size = 0;
1948	uint32 security_info_wanted;
1949	files_struct *fsp = NULL;
1950	NTSTATUS status;
1951	uint8_t *marshalled_sd = NULL;
1952
1953	if(parameter_count < 8) {
1954	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1955	return;
1956	}
1957
1958	fsp = file_fsp(req, SVAL(params,0));
1959	if(!fsp) {
1960	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1961	return;
1962	}
1963
1964	security_info_wanted = IVAL(params,4);
1965
1966	DEBUG(3,("call_nt_transact_query_security_desc: file = %s, "
1967	"info_wanted = 0x%x\n", fsp_str_dbg(fsp),
1968	(unsigned int)security_info_wanted));
1969
1970	params = nttrans_realloc(ppparams, 4);
1971	if(params == NULL) {
1972	reply_nterror(req, NT_STATUS_NO_MEMORY);
1973	return;
1974	}
1975
1976	/*
1977	* Get the permissions to return.
1978	*/
1979
1980	status = smbd_do_query_security_desc(conn,
1981	talloc_tos(),
1982	fsp,
1983	security_info_wanted,
1984	max_data_count,
1985	&marshalled_sd,
1986	&sd_size);
1987
1988	if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
1989	SIVAL(params,0,(uint32_t)sd_size);
1990	send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1991	params, 4, NULL, 0);
1992	return;
1993	}
1994
1995	if (!NT_STATUS_IS_OK(status)) {
1996	reply_nterror(req, status);
1997	return;
1998	}
1999
2000	SMB_ASSERT(sd_size > 0);
2001
2002	SIVAL(params,0,(uint32_t)sd_size);
2003
2004	if (max_data_count < sd_size) {
2005	send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
2006	params, 4, NULL, 0);
2007	return;
2008	}
2009
2010	/*
2011	* Allocate the data we will return.
2012	*/
2013
2014	data = nttrans_realloc(ppdata, sd_size);
2015	if(data == NULL) {
2016	reply_nterror(req, NT_STATUS_NO_MEMORY);
2017	return;
2018	}
2019
2020	memcpy(data, marshalled_sd, sd_size);
2021
2022	send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
2023
2024	return;
2025	}
2026
2027	/****************************************************************************
2028	Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2029	****************************************************************************/
2030
2031	static void call_nt_transact_set_security_desc(connection_struct *conn,
2032	struct smb_request *req,
2033	uint16 **ppsetup,
2034	uint32 setup_count,
2035	char **ppparams,
2036	uint32 parameter_count,
2037	char **ppdata,
2038	uint32 data_count,
2039	uint32 max_data_count)
2040	{
2041	char params= ppparams;
2042	char data = ppdata;
2043	files_struct *fsp = NULL;
2044	uint32 security_info_sent = 0;
2045	NTSTATUS status;
2046
2047	if(parameter_count < 8) {
2048	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2049	return;
2050	}
2051
2052	if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
2053	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2054	return;
2055	}
2056
2057	if (!CAN_WRITE(fsp->conn)) {
2058	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2059	return;
2060	}
2061
2062	if(!lp_nt_acl_support(SNUM(conn))) {
2063	goto done;
2064	}
2065
2066	security_info_sent = IVAL(params,4);
2067
2068	DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n",
2069	fsp_str_dbg(fsp), (unsigned int)security_info_sent));
2070
2071	if (data_count == 0) {
2072	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2073	return;
2074	}
2075
2076	status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
2077
2078	if (!NT_STATUS_IS_OK(status)) {
2079	reply_nterror(req, status);
2080	return;
2081	}
2082
2083	done:
2084	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2085	return;
2086	}
2087
2088	/****************************************************************************
2089	Reply to NT IOCTL
2090	****************************************************************************/
2091
2092	static void call_nt_transact_ioctl(connection_struct *conn,
2093	struct smb_request *req,
2094	uint16 **ppsetup, uint32 setup_count,
2095	char **ppparams, uint32 parameter_count,
2096	char **ppdata, uint32 data_count,
2097	uint32 max_data_count)
2098	{
2099	uint32 function;
2100	uint16 fidnum;
2101	files_struct *fsp;
2102	uint8 isFSctl;
2103	uint8 compfilter;
2104	char pdata = ppdata;
2105
2106	if (setup_count != 8) {
2107	DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2108	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2109	return;
2110	}
2111
2112	function = IVAL(*ppsetup, 0);
2113	fidnum = SVAL(*ppsetup, 4);
2114	isFSctl = CVAL(*ppsetup, 6);
2115	compfilter = CVAL(*ppsetup, 7);
2116
2117	DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2118	function, fidnum, isFSctl, compfilter));
2119
2120	fsp=file_fsp(req, fidnum);
2121	/* this check is done in each implemented function case for now
2122	because I don't want to break anything... --metze
2123	FSP_BELONGS_CONN(fsp,conn);*/
2124
2125	SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
2126
2127	switch (function) {
2128	case FSCTL_SET_SPARSE:
2129	{
2130	bool set_sparse = true;
2131	NTSTATUS status;
2132
2133	if (data_count >= 1 && pdata[0] == 0) {
2134	set_sparse = false;
2135	}
2136
2137	DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X]set[%u]\n",
2138	fidnum, set_sparse));
2139
2140	if (!check_fsp_open(conn, req, fsp)) {
2141	return;
2142	}
2143
2144	status = file_set_sparse(conn, fsp, set_sparse);
2145	if (!NT_STATUS_IS_OK(status)) {
2146	DEBUG(9,("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
2147	smb_fname_str_dbg(fsp->fsp_name), set_sparse, nt_errstr(status)));
2148	reply_nterror(req, status);
2149	return;
2150	}
2151
2152	DEBUG(10,("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
2153	smb_fname_str_dbg(fsp->fsp_name), set_sparse, nt_errstr(status)));
2154	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2155	return;
2156	}
2157	case FSCTL_CREATE_OR_GET_OBJECT_ID:
2158	{
2159	unsigned char objid[16];
2160
2161	/* This should return the object-id on this file.
2162	* I think I'll make this be the inode+dev. JRA.
2163	*/
2164
2165	DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
2166
2167	if (!check_fsp_open(conn, req, fsp)) {
2168	return;
2169	}
2170
2171	data_count = 64;
2172	pdata = nttrans_realloc(ppdata, data_count);
2173	if (pdata == NULL) {
2174	reply_nterror(req, NT_STATUS_NO_MEMORY);
2175	return;
2176	}
2177
2178	/* For backwards compatibility only store the dev/inode. */
2179	push_file_id_16(pdata, &fsp->file_id);
2180	memcpy(pdata+16,create_volume_objectid(conn,objid),16);
2181	push_file_id_16(pdata+32, &fsp->file_id);
2182	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2183	pdata, data_count);
2184	return;
2185	}
2186
2187	case FSCTL_GET_REPARSE_POINT:
2188	/* pretend this fail - my winXP does it like this
2189	* --metze
2190	*/
2191
2192	DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2193	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2194	return;
2195
2196	case FSCTL_SET_REPARSE_POINT:
2197	/* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2198	* --metze
2199	*/
2200
2201	DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2202	reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2203	return;
2204
2205	case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2206	{
2207	/*
2208	* This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2209	* and return their volume names. If max_data_count is 16, then it is just
2210	* asking for the number of volumes and length of the combined names.
2211	*
2212	* pdata is the data allocated by our caller, but that uses
2213	* total_data_count (which is 0 in our case) rather than max_data_count.
2214	* Allocate the correct amount and return the pointer to let
2215	* it be deallocated when we return.
2216	*/
2217	struct shadow_copy_data *shadow_data = NULL;
2218	bool labels = False;
2219	uint32 labels_data_count = 0;
2220	uint32 i;
2221	char *cur_pdata;
2222
2223	if (!check_fsp_open(conn, req, fsp)) {
2224	return;
2225	}
2226
2227	if (max_data_count < 16) {
2228	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2229	max_data_count));
2230	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2231	return;
2232	}
2233
2234	if (max_data_count > 16) {
2235	labels = True;
2236	}
2237
2238	shadow_data = TALLOC_ZERO_P(talloc_tos(),
2239	struct shadow_copy_data);
2240	if (shadow_data == NULL) {
2241	DEBUG(0,("TALLOC_ZERO() failed!\n"));
2242	reply_nterror(req, NT_STATUS_NO_MEMORY);
2243	return;
2244	}
2245
2246	/*
2247	* Call the VFS routine to actually do the work.
2248	*/
2249	if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2250	TALLOC_FREE(shadow_data);
2251	if (errno == ENOSYS) {
2252	DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2253	conn->connectpath));
2254	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2255	return;
2256	} else {
2257	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2258	conn->connectpath));
2259	reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
2260	return;
2261	}
2262	}
2263
2264	labels_data_count = (shadow_data->num_volumes2sizeof(SHADOW_COPY_LABEL))+2;
2265
2266	if (!labels) {
2267	data_count = 16;
2268	} else {
2269	data_count = 12+labels_data_count+4;
2270	}
2271
2272	if (max_data_count<data_count) {
2273	DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2274	max_data_count,data_count));
2275	TALLOC_FREE(shadow_data);
2276	reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2277	return;
2278	}
2279
2280	pdata = nttrans_realloc(ppdata, data_count);
2281	if (pdata == NULL) {
2282	TALLOC_FREE(shadow_data);
2283	reply_nterror(req, NT_STATUS_NO_MEMORY);
2284	return;
2285	}
2286
2287	cur_pdata = pdata;
2288
2289	/* num_volumes 4 bytes */
2290	SIVAL(pdata,0,shadow_data->num_volumes);
2291
2292	if (labels) {
2293	/* num_labels 4 bytes */
2294	SIVAL(pdata,4,shadow_data->num_volumes);
2295	}
2296
2297	/* needed_data_count 4 bytes */
2298	SIVAL(pdata, 8, labels_data_count+4);
2299
2300	cur_pdata+=12;
2301
2302	DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2303	shadow_data->num_volumes, fsp_str_dbg(fsp)));
2304	if (labels && shadow_data->labels) {
2305	for (i=0;i<shadow_data->num_volumes;i++) {
2306	srvstr_push(pdata, req->flags2,
2307	cur_pdata, shadow_data->labels[i],
2308	2*sizeof(SHADOW_COPY_LABEL),
2309	STR_UNICODE\|STR_TERMINATE);
2310	cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2311	DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2312	}
2313	}
2314
2315	TALLOC_FREE(shadow_data);
2316
2317	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2318	pdata, data_count);
2319
2320	return;
2321	}
2322
2323	case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2324	{
2325	/* pretend this succeeded -
2326	*
2327	* we have to send back a list with all files owned by this SID
2328	*
2329	* but I have to check that --metze
2330	*/
2331	struct dom_sid sid;
2332	uid_t uid;
2333	size_t sid_len;
2334
2335	DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2336
2337	if (!check_fsp_open(conn, req, fsp)) {
2338	return;
2339	}
2340
2341	if (data_count < 8) {
2342	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2343	return;
2344	}
2345
2346	sid_len = MIN(data_count-4,SID_MAX_SIZE);
2347
2348	/* unknown 4 bytes: this is not the length of the sid :-( */
2349	/unknown = IVAL(pdata,0);/
2350
2351	if (!sid_parse(pdata+4,sid_len,&sid)) {
2352	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2353	return;
2354	}
2355	DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
2356
2357	if (!sid_to_uid(&sid, &uid)) {
2358	DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2359	sid_string_dbg(&sid),
2360	(unsigned long)sid_len));
2361	uid = (-1);
2362	}
2363
2364	/* we can take a look at the find source :-)
2365	*
2366	* find ./ -uid $uid -name '*' is what we need here
2367	*
2368	*
2369	* and send 4bytes len and then NULL terminated unicode strings
2370	* for each file
2371	*
2372	* but I don't know how to deal with the paged results
2373	* (maybe we can hang the result anywhere in the fsp struct)
2374	*
2375	* we don't send all files at once
2376	* and at the next we should not start from the beginning,
2377	* so we have to cache the result
2378	*
2379	* --metze
2380	*/
2381
2382	/* this works for now... */
2383	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2384	return;
2385	}
2386	case FSCTL_QUERY_ALLOCATED_RANGES:
2387	{
2388	/* FIXME: This is just a dummy reply, telling that all of the
2389	* file is allocated. MKS cp needs that.
2390	* Adding the real allocated ranges via FIEMAP on Linux
2391	* and SEEK_DATA/SEEK_HOLE on Solaris is needed to make
2392	* this FSCTL correct for sparse files.
2393	*/
2394	NTSTATUS status;
2395	uint64_t offset, length;
2396
2397	if (!check_fsp_open(conn, req, fsp)) {
2398	return;
2399	}
2400
2401	if (data_count != 16) {
2402	DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: data_count(%u) != 16 is invalid!\n",
2403	data_count));
2404	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2405	return;
2406	}
2407
2408	if (max_data_count < 16) {
2409	DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: max_data_count(%u) < 16 is invalid!\n",
2410	max_data_count));
2411	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2412	return;
2413	}
2414
2415	offset = BVAL(pdata,0);
2416	length = BVAL(pdata,8);
2417
2418	if (offset + length < offset) {
2419	/* No 64-bit integer wrap. */
2420	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2421	return;
2422	}
2423
2424	status = vfs_stat_fsp(fsp);
2425	if (!NT_STATUS_IS_OK(status)) {
2426	reply_nterror(req, status);
2427	return;
2428	}
2429
2430	if (offset > fsp->fsp_name->st.st_ex_size \|\|
2431	fsp->fsp_name->st.st_ex_size == 0 \|\|
2432	length == 0) {
2433	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2434	} else {
2435	uint64_t end = offset + length;
2436	end = MIN(end, fsp->fsp_name->st.st_ex_size);
2437	SBVAL(pdata,0,0);
2438	SBVAL(pdata,8,end);
2439	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2440	pdata, 16);
2441	}
2442	return;
2443	}
2444	case FSCTL_IS_VOLUME_DIRTY:
2445	DEBUG(10,("FSCTL_IS_VOLUME_DIRTY: called on FID[0x%04X] "
2446	"(but not implemented)\n", (int)fidnum));
2447	/*
2448	* http://msdn.microsoft.com/en-us/library/cc232128%28PROT.10%29.aspx
2449	* says we have to respond with NT_STATUS_INVALID_PARAMETER
2450	*/
2451	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2452	return;
2453	default:
2454	/* Only print this once... */
2455	if (!logged_ioctl_message) {
2456	logged_ioctl_message = true;
2457	DEBUG(2,("call_nt_transact_ioctl(0x%x): "
2458	"Currently not implemented.\n",
2459	function));
2460	}
2461	}
2462
2463	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2464	}
2465
2466
2467	#ifdef HAVE_SYS_QUOTAS
2468	/****************************************************************************
2469	Reply to get user quota
2470	****************************************************************************/
2471
2472	static void call_nt_transact_get_user_quota(connection_struct *conn,
2473	struct smb_request *req,
2474	uint16 **ppsetup,
2475	uint32 setup_count,
2476	char **ppparams,
2477	uint32 parameter_count,
2478	char **ppdata,
2479	uint32 data_count,
2480	uint32 max_data_count)
2481	{
2482	NTSTATUS nt_status = NT_STATUS_OK;
2483	char params = ppparams;
2484	char pdata = ppdata;
2485	char *entry;
2486	int data_len=0,param_len=0;
2487	int qt_len=0;
2488	int entry_len = 0;
2489	files_struct *fsp = NULL;
2490	uint16 level = 0;
2491	size_t sid_len;
2492	struct dom_sid sid;
2493	bool start_enum = True;
2494	SMB_NTQUOTA_STRUCT qt;
2495	SMB_NTQUOTA_LIST *tmp_list;
2496	SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2497
2498	ZERO_STRUCT(qt);
2499
2500	/* access check */
2501	if (get_current_uid(conn) != 0) {
2502	DEBUG(1,("get_user_quota: access_denied service [%s] user "
2503	"[%s]\n", lp_servicename(SNUM(conn)),
2504	conn->session_info->unix_name));
2505	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2506	return;
2507	}
2508
2509	/*
2510	* Ensure minimum number of parameters sent.
2511	*/
2512
2513	if (parameter_count < 4) {
2514	DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2515	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2516	return;
2517	}
2518
2519	/* maybe we can check the quota_fnum */
2520	fsp = file_fsp(req, SVAL(params,0));
2521	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2522	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2523	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2524	return;
2525	}
2526
2527	/* the NULL pointer checking for fsp->fake_file_handle->pd
2528	* is done by CHECK_NTQUOTA_HANDLE_OK()
2529	*/
2530	qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2531
2532	level = SVAL(params,2);
2533
2534	/* unknown 12 bytes leading in params */
2535
2536	switch (level) {
2537	case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2538	/* seems that we should continue with the enum here --metze */
2539
2540	if (qt_handle->quota_list!=NULL &&
2541	qt_handle->tmp_list==NULL) {
2542
2543	/* free the list */
2544	free_ntquota_list(&(qt_handle->quota_list));
2545
2546	/* Realloc the size of parameters and data we will return */
2547	param_len = 4;
2548	params = nttrans_realloc(ppparams, param_len);
2549	if(params == NULL) {
2550	reply_nterror(req, NT_STATUS_NO_MEMORY);
2551	return;
2552	}
2553
2554	data_len = 0;
2555	SIVAL(params,0,data_len);
2556
2557	break;
2558	}
2559
2560	start_enum = False;
2561
2562	case TRANSACT_GET_USER_QUOTA_LIST_START:
2563
2564	if (qt_handle->quota_list==NULL &&
2565	qt_handle->tmp_list==NULL) {
2566	start_enum = True;
2567	}
2568
2569	if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2570	reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
2571	return;
2572	}
2573
2574	/* Realloc the size of parameters and data we will return */
2575	param_len = 4;
2576	params = nttrans_realloc(ppparams, param_len);
2577	if(params == NULL) {
2578	reply_nterror(req, NT_STATUS_NO_MEMORY);
2579	return;
2580	}
2581
2582	/* we should not trust the value in max_data_count*/
2583	max_data_count = MIN(max_data_count,2048);
2584
2585	pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2586	if(pdata == NULL) {
2587	reply_nterror(req, NT_STATUS_NO_MEMORY);
2588	return;
2589	}
2590
2591	entry = pdata;
2592
2593	/* set params Size of returned Quota Data 4 bytes*/
2594	/* but set it later when we know it */
2595
2596	/* for each entry push the data */
2597
2598	if (start_enum) {
2599	qt_handle->tmp_list = qt_handle->quota_list;
2600	}
2601
2602	tmp_list = qt_handle->tmp_list;
2603
2604	for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2605	tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2606
2607	sid_len = ndr_size_dom_sid(
2608	&tmp_list->quotas->sid, 0);
2609	entry_len = 40 + sid_len;
2610
2611	/* nextoffset entry 4 bytes */
2612	SIVAL(entry,0,entry_len);
2613
2614	/* then the len of the SID 4 bytes */
2615	SIVAL(entry,4,sid_len);
2616
2617	/* unknown data 8 bytes uint64_t */
2618	SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/
2619
2620	/* the used disk space 8 bytes uint64_t */
2621	SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2622
2623	/* the soft quotas 8 bytes uint64_t */
2624	SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2625
2626	/* the hard quotas 8 bytes uint64_t */
2627	SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2628
2629	/* and now the SID */
2630	sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2631	}
2632
2633	qt_handle->tmp_list = tmp_list;
2634
2635	/* overwrite the offset of the last entry */
2636	SIVAL(entry-entry_len,0,0);
2637
2638	data_len = 4+qt_len;
2639	/* overwrite the params quota_data_len */
2640	SIVAL(params,0,data_len);
2641
2642	break;
2643
2644	case TRANSACT_GET_USER_QUOTA_FOR_SID:
2645
2646	/* unknown 4 bytes IVAL(pdata,0) */
2647
2648	if (data_count < 8) {
2649	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2650	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2651	return;
2652	}
2653
2654	sid_len = IVAL(pdata,4);
2655	/* Ensure this is less than 1mb. */
2656	if (sid_len > (1024*1024)) {
2657	reply_nterror(req, NT_STATUS_NO_MEMORY);
2658	return;
2659	}
2660
2661	if (data_count < 8+sid_len) {
2662	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2663	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2664	return;
2665	}
2666
2667	data_len = 4+40+sid_len;
2668
2669	if (max_data_count < data_len) {
2670	DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2671	max_data_count, data_len));
2672	param_len = 4;
2673	SIVAL(params,0,data_len);
2674	data_len = 0;
2675	nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2676	break;
2677	}
2678
2679	if (!sid_parse(pdata+8,sid_len,&sid)) {
2680	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2681	return;
2682	}
2683
2684	if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2685	ZERO_STRUCT(qt);
2686	/*
2687	* we have to return zero's in all fields
2688	* instead of returning an error here
2689	* --metze
2690	*/
2691	}
2692
2693	/* Realloc the size of parameters and data we will return */
2694	param_len = 4;
2695	params = nttrans_realloc(ppparams, param_len);
2696	if(params == NULL) {
2697	reply_nterror(req, NT_STATUS_NO_MEMORY);
2698	return;
2699	}
2700
2701	pdata = nttrans_realloc(ppdata, data_len);
2702	if(pdata == NULL) {
2703	reply_nterror(req, NT_STATUS_NO_MEMORY);
2704	return;
2705	}
2706
2707	entry = pdata;
2708
2709	/* set params Size of returned Quota Data 4 bytes*/
2710	SIVAL(params,0,data_len);
2711
2712	/* nextoffset entry 4 bytes */
2713	SIVAL(entry,0,0);
2714
2715	/* then the len of the SID 4 bytes */
2716	SIVAL(entry,4,sid_len);
2717
2718	/* unknown data 8 bytes uint64_t */
2719	SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/
2720
2721	/* the used disk space 8 bytes uint64_t */
2722	SBIG_UINT(entry,16,qt.usedspace);
2723
2724	/* the soft quotas 8 bytes uint64_t */
2725	SBIG_UINT(entry,24,qt.softlim);
2726
2727	/* the hard quotas 8 bytes uint64_t */
2728	SBIG_UINT(entry,32,qt.hardlim);
2729
2730	/* and now the SID */
2731	sid_linearize(entry+40, sid_len, &sid);
2732
2733	break;
2734
2735	default:
2736	DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2737	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2738	return;
2739	break;
2740	}
2741
2742	send_nt_replies(conn, req, nt_status, params, param_len,
2743	pdata, data_len);
2744	}
2745
2746	/****************************************************************************
2747	Reply to set user quota
2748	****************************************************************************/
2749
2750	static void call_nt_transact_set_user_quota(connection_struct *conn,
2751	struct smb_request *req,
2752	uint16 **ppsetup,
2753	uint32 setup_count,
2754	char **ppparams,
2755	uint32 parameter_count,
2756	char **ppdata,
2757	uint32 data_count,
2758	uint32 max_data_count)
2759	{
2760	char params = ppparams;
2761	char pdata = ppdata;
2762	int data_len=0,param_len=0;
2763	SMB_NTQUOTA_STRUCT qt;
2764	size_t sid_len;
2765	struct dom_sid sid;
2766	files_struct *fsp = NULL;
2767
2768	ZERO_STRUCT(qt);
2769
2770	/* access check */
2771	if (get_current_uid(conn) != 0) {
2772	DEBUG(1,("set_user_quota: access_denied service [%s] user "
2773	"[%s]\n", lp_servicename(SNUM(conn)),
2774	conn->session_info->unix_name));
2775	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2776	return;
2777	}
2778
2779	/*
2780	* Ensure minimum number of parameters sent.
2781	*/
2782
2783	if (parameter_count < 2) {
2784	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2785	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2786	return;
2787	}
2788
2789	/* maybe we can check the quota_fnum */
2790	fsp = file_fsp(req, SVAL(params,0));
2791	if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2792	DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2793	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2794	return;
2795	}
2796
2797	if (data_count < 40) {
2798	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2799	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2800	return;
2801	}
2802
2803	/* offset to next quota record.
2804	* 4 bytes IVAL(pdata,0)
2805	* unused here...
2806	*/
2807
2808	/* sid len */
2809	sid_len = IVAL(pdata,4);
2810
2811	if (data_count < 40+sid_len \|\| (40+sid_len < sid_len)) {
2812	DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2813	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2814	return;
2815	}
2816
2817	/* unknown 8 bytes in pdata
2818	* maybe its the change time in NTTIME
2819	*/
2820
2821	/* the used space 8 bytes (uint64_t)*/
2822	qt.usedspace = BVAL(pdata,16);
2823
2824	/* the soft quotas 8 bytes (uint64_t)*/
2825	qt.softlim = BVAL(pdata,24);
2826
2827	/* the hard quotas 8 bytes (uint64_t)*/
2828	qt.hardlim = BVAL(pdata,32);
2829
2830	if (!sid_parse(pdata+40,sid_len,&sid)) {
2831	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2832	return;
2833	}
2834
2835	DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2836
2837	/* 44 unknown bytes left... */
2838
2839	if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2840	reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
2841	return;
2842	}
2843
2844	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2845	pdata, data_len);
2846	}
2847	#endif /* HAVE_SYS_QUOTAS */
2848
2849	static void handle_nttrans(connection_struct *conn,
2850	struct trans_state *state,
2851	struct smb_request *req)
2852	{
2853	if (get_Protocol() >= PROTOCOL_NT1) {
2854	req->flags2 \|= 0x40; /* IS_LONG_NAME */
2855	SSVAL(req->inbuf,smb_flg2,req->flags2);
2856	}
2857
2858
2859	SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2860
2861	/* Now we must call the relevant NT_TRANS function */
2862	switch(state->call) {
2863	case NT_TRANSACT_CREATE:
2864	{
2865	START_PROFILE(NT_transact_create);
2866	call_nt_transact_create(
2867	conn, req,
2868	&state->setup, state->setup_count,
2869	&state->param, state->total_param,
2870	&state->data, state->total_data,
2871	state->max_data_return);
2872	END_PROFILE(NT_transact_create);
2873	break;
2874	}
2875
2876	case NT_TRANSACT_IOCTL:
2877	{
2878	START_PROFILE(NT_transact_ioctl);
2879	call_nt_transact_ioctl(
2880	conn, req,
2881	&state->setup, state->setup_count,
2882	&state->param, state->total_param,
2883	&state->data, state->total_data,
2884	state->max_data_return);
2885	END_PROFILE(NT_transact_ioctl);
2886	break;
2887	}
2888
2889	case NT_TRANSACT_SET_SECURITY_DESC:
2890	{
2891	START_PROFILE(NT_transact_set_security_desc);
2892	call_nt_transact_set_security_desc(
2893	conn, req,
2894	&state->setup, state->setup_count,
2895	&state->param, state->total_param,
2896	&state->data, state->total_data,
2897	state->max_data_return);
2898	END_PROFILE(NT_transact_set_security_desc);
2899	break;
2900	}
2901
2902	case NT_TRANSACT_NOTIFY_CHANGE:
2903	{
2904	START_PROFILE(NT_transact_notify_change);
2905	call_nt_transact_notify_change(
2906	conn, req,
2907	&state->setup, state->setup_count,
2908	&state->param, state->total_param,
2909	&state->data, state->total_data,
2910	state->max_data_return,
2911	state->max_param_return);
2912	END_PROFILE(NT_transact_notify_change);
2913	break;
2914	}
2915
2916	case NT_TRANSACT_RENAME:
2917	{
2918	START_PROFILE(NT_transact_rename);
2919	call_nt_transact_rename(
2920	conn, req,
2921	&state->setup, state->setup_count,
2922	&state->param, state->total_param,
2923	&state->data, state->total_data,
2924	state->max_data_return);
2925	END_PROFILE(NT_transact_rename);
2926	break;
2927	}
2928
2929	case NT_TRANSACT_QUERY_SECURITY_DESC:
2930	{
2931	START_PROFILE(NT_transact_query_security_desc);
2932	call_nt_transact_query_security_desc(
2933	conn, req,
2934	&state->setup, state->setup_count,
2935	&state->param, state->total_param,
2936	&state->data, state->total_data,
2937	state->max_data_return);
2938	END_PROFILE(NT_transact_query_security_desc);
2939	break;
2940	}
2941
2942	#ifdef HAVE_SYS_QUOTAS
2943	case NT_TRANSACT_GET_USER_QUOTA:
2944	{
2945	START_PROFILE(NT_transact_get_user_quota);
2946	call_nt_transact_get_user_quota(
2947	conn, req,
2948	&state->setup, state->setup_count,
2949	&state->param, state->total_param,
2950	&state->data, state->total_data,
2951	state->max_data_return);
2952	END_PROFILE(NT_transact_get_user_quota);
2953	break;
2954	}
2955
2956	case NT_TRANSACT_SET_USER_QUOTA:
2957	{
2958	START_PROFILE(NT_transact_set_user_quota);
2959	call_nt_transact_set_user_quota(
2960	conn, req,
2961	&state->setup, state->setup_count,
2962	&state->param, state->total_param,
2963	&state->data, state->total_data,
2964	state->max_data_return);
2965	END_PROFILE(NT_transact_set_user_quota);
2966	break;
2967	}
2968	#endif /* HAVE_SYS_QUOTAS */
2969
2970	default:
2971	/* Error in request */
2972	DEBUG(0,("handle_nttrans: Unknown request %d in "
2973	"nttrans call\n", state->call));
2974	reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2975	return;
2976	}
2977	return;
2978	}
2979
2980	/****************************************************************************
2981	Reply to a SMBNTtrans.
2982	****************************************************************************/
2983
2984	void reply_nttrans(struct smb_request *req)
2985	{
2986	connection_struct *conn = req->conn;
2987	uint32_t pscnt;
2988	uint32_t psoff;
2989	uint32_t dscnt;
2990	uint32_t dsoff;
2991	uint16 function_code;
2992	NTSTATUS result;
2993	struct trans_state *state;
2994
2995	START_PROFILE(SMBnttrans);
2996
2997	if (req->wct < 19) {
2998	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2999	END_PROFILE(SMBnttrans);
3000	return;
3001	}
3002
3003	pscnt = IVAL(req->vwv+9, 1);
3004	psoff = IVAL(req->vwv+11, 1);
3005	dscnt = IVAL(req->vwv+13, 1);
3006	dsoff = IVAL(req->vwv+15, 1);
3007	function_code = SVAL(req->vwv+18, 0);
3008
3009	if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
3010	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3011	END_PROFILE(SMBnttrans);
3012	return;
3013	}
3014
3015	result = allow_new_trans(conn->pending_trans, req->mid);
3016	if (!NT_STATUS_IS_OK(result)) {
3017	DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
3018	reply_nterror(req, result);
3019	END_PROFILE(SMBnttrans);
3020	return;
3021	}
3022
3023	if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
3024	reply_nterror(req, NT_STATUS_NO_MEMORY);
3025	END_PROFILE(SMBnttrans);
3026	return;
3027	}
3028
3029	state->cmd = SMBnttrans;
3030
3031	state->mid = req->mid;
3032	state->vuid = req->vuid;
3033	state->total_data = IVAL(req->vwv+3, 1);
3034	state->data = NULL;
3035	state->total_param = IVAL(req->vwv+1, 1);
3036	state->param = NULL;
3037	state->max_data_return = IVAL(req->vwv+7, 1);
3038	state->max_param_return = IVAL(req->vwv+5, 1);
3039
3040	/* setup count is in words */
3041	state->setup_count = 2*CVAL(req->vwv+17, 1);
3042	state->setup = NULL;
3043	state->call = function_code;
3044
3045	DEBUG(10, ("num_setup=%u, "
3046	"param_total=%u, this_param=%u, max_param=%u, "
3047	"data_total=%u, this_data=%u, max_data=%u, "
3048	"param_offset=%u, data_offset=%u\n",
3049	(unsigned)state->setup_count,
3050	(unsigned)state->total_param, (unsigned)pscnt,
3051	(unsigned)state->max_param_return,
3052	(unsigned)state->total_data, (unsigned)dscnt,
3053	(unsigned)state->max_data_return,
3054	(unsigned)psoff, (unsigned)dsoff));
3055
3056	/*
3057	* All nttrans messages we handle have smb_wct == 19 +
3058	* state->setup_count. Ensure this is so as a sanity check.
3059	*/
3060
3061	if(req->wct != 19 + (state->setup_count/2)) {
3062	DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3063	req->wct, 19 + (state->setup_count/2)));
3064	goto bad_param;
3065	}
3066
3067	/* Don't allow more than 128mb for each value. */
3068	if ((state->total_data > (10241024128)) \|\|
3069	(state->total_param > (10241024128))) {
3070	reply_nterror(req, NT_STATUS_NO_MEMORY);
3071	END_PROFILE(SMBnttrans);
3072	return;
3073	}
3074
3075	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param))
3076	goto bad_param;
3077
3078	if (state->total_data) {
3079
3080	if (trans_oob(state->total_data, 0, dscnt)
3081	\|\| trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
3082	goto bad_param;
3083	}
3084
3085	/* Can't use talloc here, the core routines do realloc on the
3086	* params and data. */
3087	if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3088	DEBUG(0,("reply_nttrans: data malloc fail for %u "
3089	"bytes !\n", (unsigned int)state->total_data));
3090	TALLOC_FREE(state);
3091	reply_nterror(req, NT_STATUS_NO_MEMORY);
3092	END_PROFILE(SMBnttrans);
3093	return;
3094	}
3095
3096	memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
3097	}
3098
3099	if (state->total_param) {
3100
3101	if (trans_oob(state->total_param, 0, pscnt)
3102	\|\| trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
3103	goto bad_param;
3104	}
3105
3106	/* Can't use talloc here, the core routines do realloc on the
3107	* params and data. */
3108	if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3109	DEBUG(0,("reply_nttrans: param malloc fail for %u "
3110	"bytes !\n", (unsigned int)state->total_param));
3111	SAFE_FREE(state->data);
3112	TALLOC_FREE(state);
3113	reply_nterror(req, NT_STATUS_NO_MEMORY);
3114	END_PROFILE(SMBnttrans);
3115	return;
3116	}
3117
3118	memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
3119	}
3120
3121	state->received_data = dscnt;
3122	state->received_param = pscnt;
3123
3124	if(state->setup_count > 0) {
3125	DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3126	state->setup_count));
3127
3128	/*
3129	* No overflow possible here, state->setup_count is an
3130	* unsigned int, being filled by a single byte from
3131	* CVAL(req->vwv+13, 0) above. The cast in the comparison
3132	* below is not necessary, it's here to clarify things. The
3133	* validity of req->vwv and req->wct has been checked in
3134	* init_smb_request already.
3135	*/
3136	if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
3137	goto bad_param;
3138	}
3139
3140	state->setup = (uint16 *)TALLOC(state, state->setup_count);
3141	if (state->setup == NULL) {
3142	DEBUG(0,("reply_nttrans : Out of memory\n"));
3143	SAFE_FREE(state->data);
3144	SAFE_FREE(state->param);
3145	TALLOC_FREE(state);
3146	reply_nterror(req, NT_STATUS_NO_MEMORY);
3147	END_PROFILE(SMBnttrans);
3148	return;
3149	}
3150
3151	memcpy(state->setup, req->vwv+19, state->setup_count);
3152	dump_data(10, (uint8 *)state->setup, state->setup_count);
3153	}
3154
3155	if ((state->received_data == state->total_data) &&
3156	(state->received_param == state->total_param)) {
3157	handle_nttrans(conn, state, req);
3158	SAFE_FREE(state->param);
3159	SAFE_FREE(state->data);
3160	TALLOC_FREE(state);
3161	END_PROFILE(SMBnttrans);
3162	return;
3163	}
3164
3165	DLIST_ADD(conn->pending_trans, state);
3166
3167	/* We need to send an interim response then receive the rest
3168	of the parameter/data bytes */
3169	reply_outbuf(req, 0, 0);
3170	show_msg((char *)req->outbuf);
3171	END_PROFILE(SMBnttrans);
3172	return;
3173
3174	bad_param:
3175
3176	DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3177	SAFE_FREE(state->data);
3178	SAFE_FREE(state->param);
3179	TALLOC_FREE(state);
3180	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3181	END_PROFILE(SMBnttrans);
3182	return;
3183	}
3184
3185	/****************************************************************************
3186	Reply to a SMBnttranss
3187	****************************************************************************/
3188
3189	void reply_nttranss(struct smb_request *req)
3190	{
3191	connection_struct *conn = req->conn;
3192	uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
3193	struct trans_state *state;
3194
3195	START_PROFILE(SMBnttranss);
3196
3197	show_msg((char *)req->inbuf);
3198
3199	if (req->wct < 18) {
3200	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3201	END_PROFILE(SMBnttranss);
3202	return;
3203	}
3204
3205	for (state = conn->pending_trans; state != NULL;
3206	state = state->next) {
3207	if (state->mid == req->mid) {
3208	break;
3209	}
3210	}
3211
3212	if ((state == NULL) \|\| (state->cmd != SMBnttrans)) {
3213	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3214	END_PROFILE(SMBnttranss);
3215	return;
3216	}
3217
3218	/* Revise state->total_param and state->total_data in case they have
3219	changed downwards */
3220	if (IVAL(req->vwv+1, 1) < state->total_param) {
3221	state->total_param = IVAL(req->vwv+1, 1);
3222	}
3223	if (IVAL(req->vwv+3, 1) < state->total_data) {
3224	state->total_data = IVAL(req->vwv+3, 1);
3225	}
3226
3227	pcnt = IVAL(req->vwv+5, 1);
3228	poff = IVAL(req->vwv+7, 1);
3229	pdisp = IVAL(req->vwv+9, 1);
3230
3231	dcnt = IVAL(req->vwv+11, 1);
3232	doff = IVAL(req->vwv+13, 1);
3233	ddisp = IVAL(req->vwv+15, 1);
3234
3235	state->received_param += pcnt;
3236	state->received_data += dcnt;
3237
3238	if ((state->received_data > state->total_data) \|\|
3239	(state->received_param > state->total_param))
3240	goto bad_param;
3241
3242	if (pcnt) {
3243	if (trans_oob(state->total_param, pdisp, pcnt)
3244	\|\| trans_oob(smb_len(req->inbuf), poff, pcnt)) {
3245	goto bad_param;
3246	}
3247	memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
3248	}
3249
3250	if (dcnt) {
3251	if (trans_oob(state->total_data, ddisp, dcnt)
3252	\|\| trans_oob(smb_len(req->inbuf), doff, dcnt)) {
3253	goto bad_param;
3254	}
3255	memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
3256	}
3257
3258	if ((state->received_param < state->total_param) \|\|
3259	(state->received_data < state->total_data)) {
3260	END_PROFILE(SMBnttranss);
3261	return;
3262	}
3263
3264	handle_nttrans(conn, state, req);
3265
3266	DLIST_REMOVE(conn->pending_trans, state);
3267	SAFE_FREE(state->data);
3268	SAFE_FREE(state->param);
3269	TALLOC_FREE(state);
3270	END_PROFILE(SMBnttranss);
3271	return;
3272
3273	bad_param:
3274
3275	DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3276	DLIST_REMOVE(conn->pending_trans, state);
3277	SAFE_FREE(state->data);
3278	SAFE_FREE(state->param);
3279	TALLOC_FREE(state);
3280	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3281	END_PROFILE(SMBnttranss);
3282	return;
3283	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: