Changeset 746 for vendor/current/source3/smbd/nttrans.c

Timestamp:

Nov 27, 2012, 4:56:06 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated vendor to 3.6.9

File:

• vendor/current/source3/smbd/nttrans.c (modified) (24 diffs)

vendor/current/source3/smbd/nttrans.c

@@ -143 +143 @@
                              total_sent_thistime + alignment_offset
                              + data_alignment_offset);
-
-                /*
-                 * We might have had SMBnttranss in req->inbuf, fix that.
-                 */
-                SCVAL(req->outbuf, smb_com, SMBnttrans);
 
                 /*
@@ -694 +689 @@
                 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
                 size_t num_names = 0;
-                unsigned int num_streams;
+                unsigned int num_streams = 0;
                 struct stream_struct *streams = NULL;
 
@@ -703 +698 @@
                         file_status &= ~NO_EAS;
                 }
-                status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
+                status = vfs_streaminfo(conn, NULL, smb_fname->base_name, ctx,
                         &num_streams, &streams);
                 /* There is always one stream, ::$DATA. */
@@ -832 +827 @@
 }
 
+/*********************************************************************
+ Windows seems to do canonicalization of inheritance bits. Do the
+ same.
+*********************************************************************/
+
+static void canonicalize_inheritance_bits(struct security_descriptor *psd)
+{
+        bool set_auto_inherited = false;
+
+        /*
+         * We need to filter out the
+         * SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ
+         * bits. If both are set we store SEC_DESC_DACL_AUTO_INHERITED
+         * as this alters whether SEC_ACE_FLAG_INHERITED_ACE is set
+         * when an ACE is inherited. Otherwise we zero these bits out.
+         * See:
+         *
+         * http://social.msdn.microsoft.com/Forums/eu/os_fileservices/thread/11f77b68-731e-407d-b1b3-064750716531
+         *
+         * for details.
+         */
+
+        if ((psd->type & (SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ))
+                        == (SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ)) {
+                set_auto_inherited = true;
+        }
+
+        psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ);
+        if (set_auto_inherited) {
+                psd->type |= SEC_DESC_DACL_AUTO_INHERITED;
+        }
+}
+
 /****************************************************************************
  Internal fn to set security descriptors.
 ****************************************************************************/
 
-NTSTATUS set_sd(files_struct *fsp, uint8_t *data, uint32_t sd_len,
+NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd,
+                       uint32_t security_info_sent)
+{
+        NTSTATUS status;
+
+        if (!CAN_WRITE(fsp->conn)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        if (!lp_nt_acl_support(SNUM(fsp->conn))) {
+                return NT_STATUS_OK;
+        }
+
+        if (psd->owner_sid == NULL) {
+                security_info_sent &= ~SECINFO_OWNER;
+        }
+        if (psd->group_sid == NULL) {
+                security_info_sent &= ~SECINFO_GROUP;
+        }
+
+        /* Ensure we have at least one thing set. */
+        if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
+                if (security_info_sent & SECINFO_LABEL) {
+                        /* Only consider SECINFO_LABEL if no other
+                           bits are set. Just like W2K3 we don't
+                           store this. */
+                        return NT_STATUS_OK;
+                }
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        /* Ensure we have the rights to do this. */
+        if (security_info_sent & SECINFO_OWNER) {
+                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        }
+
+        if (security_info_sent & SECINFO_GROUP) {
+                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        }
+
+        if (security_info_sent & SECINFO_DACL) {
+                if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                /* Convert all the generic bits. */
+                if (psd->dacl) {
+                        security_acl_map_generic(psd->dacl, &file_generic_mapping);
+                }
+        }
+
+        if (security_info_sent & SECINFO_SACL) {
+                if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                /* Convert all the generic bits. */
+                if (psd->sacl) {
+                        security_acl_map_generic(psd->sacl, &file_generic_mapping);
+                }
+        }
+
+        canonicalize_inheritance_bits(psd);
+
+        if (DEBUGLEVEL >= 10) {
+                DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
+                NDR_PRINT_DEBUG(security_descriptor, psd);
+        }
+
+        status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
+
+        TALLOC_FREE(psd);
+
+        return status;
+}
+
+/****************************************************************************
+ Internal fn to set security descriptors from a data blob.
+****************************************************************************/
+
+NTSTATUS set_sd_blob(files_struct *fsp, uint8_t *data, uint32_t sd_len,
                        uint32_t security_info_sent)
 {
@@ -846 +956 @@
         }
 
-        if (!CAN_WRITE(fsp->conn)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (!lp_nt_acl_support(SNUM(fsp->conn))) {
-                return NT_STATUS_OK;
-        }
-
         status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
 
@@ -860 +962 @@
         }
 
-        if (psd->owner_sid == NULL) {
-                security_info_sent &= ~SECINFO_OWNER;
-        }
-        if (psd->group_sid == NULL) {
-                security_info_sent &= ~SECINFO_GROUP;
-        }
-
-        /* Ensure we have at least one thing set. */
-        if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Ensure we have the rights to do this. */
-        if (security_info_sent & SECINFO_OWNER) {
-                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        if (security_info_sent & SECINFO_GROUP) {
-                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        if (security_info_sent & SECINFO_DACL) {
-                if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-                /* Convert all the generic bits. */
-                if (psd->dacl) {
-                        security_acl_map_generic(psd->dacl, &file_generic_mapping);
-                }
-        }
-
-        if (security_info_sent & SECINFO_SACL) {
-                if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-                /* Convert all the generic bits. */
-                if (psd->sacl) {
-                        security_acl_map_generic(psd->sacl, &file_generic_mapping);
-                }
-        }
-
-        if (DEBUGLEVEL >= 10) {
-                DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
-                NDR_PRINT_DEBUG(security_descriptor, psd);
-        }
-
-        status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
-
-        TALLOC_FREE(psd);
-
-        return status;
+        return set_sd(fsp, psd, security_info_sent);
 }
 
@@ -1269 +1317 @@
                 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
                 size_t num_names = 0;
-                unsigned int num_streams;
+                unsigned int num_streams = 0;
                 struct stream_struct *streams = NULL;
 
@@ -1278 +1326 @@
                         file_status &= ~NO_EAS;
                 }
-                status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
+                status = vfs_streaminfo(conn, NULL, smb_fname->base_name, ctx,
                         &num_streams, &streams);
                 /* There is always one stream, ::$DATA. */
@@ -1869 +1917 @@
         }
 
+        if (security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|
+                        SECINFO_GROUP|SECINFO_SACL)) {
+                /* Don't return SECINFO_LABEL if anything else was
+                   requested. See bug #8458. */
+                security_info_wanted &= ~SECINFO_LABEL;
+        }
+
         if (!lp_nt_acl_support(SNUM(conn))) {
+                status = get_null_nt_acl(mem_ctx, &psd);
+        } else if (security_info_wanted & SECINFO_LABEL) {
+                /* Like W2K3 return a null object. */
                 status = get_null_nt_acl(mem_ctx, &psd);
         } else {
@@ -1886 +1944 @@
         }
         if (!(security_info_wanted & SECINFO_DACL)) {
+                psd->type &= ~SEC_DESC_DACL_PRESENT;
                 psd->dacl = NULL;
         }
         if (!(security_info_wanted & SECINFO_SACL)) {
+                psd->type &= ~SEC_DESC_SACL_PRESENT;
                 psd->sacl = NULL;
         }
@@ -1900 +1960 @@
             security_info_wanted & SECINFO_DACL)
                 psd->type |= SEC_DESC_DACL_PRESENT;
+
+        if (security_info_wanted & SECINFO_LABEL) {
+                /* Like W2K3 return a null object. */
+                psd->owner_sid = NULL;
+                psd->group_sid = NULL;
+                psd->dacl = NULL;
+                psd->sacl = NULL;
+                psd->type &= ~(SEC_DESC_DACL_PRESENT|SEC_DESC_SACL_PRESENT);
+        }
 
         *psd_size = ndr_size_security_descriptor(psd, 0);
@@ -2074 +2143 @@
         }
 
-        status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
+        status = set_sd_blob(fsp, (uint8 *)data, data_count, security_info_sent);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2086 +2155 @@
 }
 
-/****************************************************************************
- Reply to NT IOCTL
-****************************************************************************/
-
-static void call_nt_transact_ioctl(connection_struct *conn,
-                                   struct smb_request *req,
-                                   uint16 **ppsetup, uint32 setup_count,
-                                   char **ppparams, uint32 parameter_count,
-                                   char **ppdata, uint32 data_count,
-                                   uint32 max_data_count)
+/*
+ * Implement the default fsctl operation.
+ */
+
+static bool vfswrap_logged_ioctl_message = false;
+
+/*
+ * In 3.6 we do not have a SMB_VFS_FSCTL() function
+ * it's just faked to make it more look like
+ * master (4.0)
+ */
+NTSTATUS smb_fsctl(struct files_struct *fsp,
+                       TALLOC_CTX *ctx,
+                       uint32_t function,
+                       uint16_t req_flags,  /* Needed for UNICODE ... */
+                       const uint8_t *_in_data,
+                       uint32_t in_len,
+                       uint8_t **_out_data,
+                       uint32_t max_out_len,
+                       uint32_t *out_len)
 {
-        uint32 function;
-        uint16 fidnum;
-        files_struct *fsp;
-        uint8 isFSctl;
-        uint8 compfilter;
-        char *pdata = *ppdata;
-
-        if (setup_count != 8) {
-                DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
-                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-                return;
-        }
-
-        function = IVAL(*ppsetup, 0);
-        fidnum = SVAL(*ppsetup, 4);
-        isFSctl = CVAL(*ppsetup, 6);
-        compfilter = CVAL(*ppsetup, 7);
-
-        DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", 
-                 function, fidnum, isFSctl, compfilter));
-
-        fsp=file_fsp(req, fidnum);
-        /* this check is done in each implemented function case for now
-           because I don't want to break anything... --metze
-        FSP_BELONGS_CONN(fsp,conn);*/
-
-        SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
+        const char *in_data = (const char *)_in_data;
+        char **out_data = (char **)_out_data;
 
         switch (function) {
@@ -2131 +2185 @@
                 NTSTATUS status;
 
-                if (data_count >= 1 && pdata[0] == 0) {
+                if (in_len >= 1 && in_data[0] == 0) {
                         set_sparse = false;
                 }
 
-                DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X]set[%u]\n",
-                         fidnum, set_sparse));
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                status = file_set_sparse(conn, fsp, set_sparse);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(9,("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
-                                 smb_fname_str_dbg(fsp->fsp_name), set_sparse, nt_errstr(status)));
-                        reply_nterror(req, status);
-                        return;
-                }
-
-                DEBUG(10,("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
-                         smb_fname_str_dbg(fsp->fsp_name), set_sparse, nt_errstr(status)));
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
-                return;
-        }
+                status = file_set_sparse(fsp->conn, fsp, set_sparse);
+
+                DEBUG(NT_STATUS_IS_OK(status) ? 10 : 9,
+                      ("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
+                       smb_fname_str_dbg(fsp->fsp_name), set_sparse,
+                       nt_errstr(status)));
+
+                return status;
+        }
+
         case FSCTL_CREATE_OR_GET_OBJECT_ID:
         {
                 unsigned char objid[16];
+                char *return_data = NULL;
 
                 /* This should return the object-id on this file.
@@ -2163 +2208 @@
                  */
 
-                DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                data_count = 64;
-                pdata = nttrans_realloc(ppdata, data_count);
-                if (pdata == NULL) {
-                        reply_nterror(req, NT_STATUS_NO_MEMORY);
-                        return;
+                DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fsp->fnum));
+
+                *out_len = (max_out_len >= 64) ? 64 : max_out_len;
+                /* Hmmm, will this cause problems if less data asked for? */
+                return_data = talloc_array(ctx, char, 64);
+                if (return_data == NULL) {
+                        return NT_STATUS_NO_MEMORY;
                 }
 
                 /* For backwards compatibility only store the dev/inode. */
-                push_file_id_16(pdata, &fsp->file_id);
-                memcpy(pdata+16,create_volume_objectid(conn,objid),16);
-                push_file_id_16(pdata+32, &fsp->file_id);
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
-                                pdata, data_count);
-                return;
+                push_file_id_16(return_data, &fsp->file_id);
+                memcpy(return_data+16,create_volume_objectid(fsp->conn,objid),16);
+                push_file_id_16(return_data+32, &fsp->file_id);
+                *out_data = return_data;
+                return NT_STATUS_OK;
         }
 
         case FSCTL_GET_REPARSE_POINT:
-                /* pretend this fail - my winXP does it like this
-                 * --metze
-                 */
-
-                DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
-                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
-                return;
+        {
+                /* Fail it with STATUS_NOT_A_REPARSE_POINT */
+                DEBUG(10, ("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X] Status: NOT_IMPLEMENTED\n", fsp->fnum));
+                return NT_STATUS_NOT_A_REPARSE_POINT;
+        }
 
         case FSCTL_SET_REPARSE_POINT:
-                /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
-                 * --metze
-                 */
-
-                DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
-                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
-                return;
-
-        case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
+        {
+                /* Fail it with STATUS_NOT_A_REPARSE_POINT */
+                DEBUG(10, ("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X] Status: NOT_IMPLEMENTED\n", fsp->fnum));
+                return NT_STATUS_NOT_A_REPARSE_POINT;
+        }
+
+        case FSCTL_GET_SHADOW_COPY_DATA:
         {
                 /*
@@ -2219 +2255 @@
                 uint32 labels_data_count = 0;
                 uint32 i;
-                char *cur_pdata;
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                if (max_data_count < 16) {
+                char *cur_pdata = NULL;
+
+                if (max_out_len < 16) {
                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
-                                max_data_count));
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                if (max_data_count > 16) {
+                                max_out_len));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                if (max_out_len > 16) {
                         labels = True;
                 }
 
-                shadow_data = TALLOC_ZERO_P(talloc_tos(),
-                                            struct shadow_copy_data);
+                shadow_data = talloc_zero(ctx, struct shadow_copy_data);
                 if (shadow_data == NULL) {
                         DEBUG(0,("TALLOC_ZERO() failed!\n"));
-                        reply_nterror(req, NT_STATUS_NO_MEMORY);
-                        return;
+                        return NT_STATUS_NO_MEMORY;
                 }
 
@@ -2251 +2280 @@
                         if (errno == ENOSYS) {
                                 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", 
-                                        conn->connectpath));
-                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-                                return;
+                                        fsp->conn->connectpath));
+                                return NT_STATUS_NOT_SUPPORTED;
                         } else {
                                 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", 
-                                        conn->connectpath));
-                                reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
-                                return;
+                                        fsp->conn->connectpath));
+                                return NT_STATUS_UNSUCCESSFUL;
                         }
                 }
 
-                labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
+                labels_data_count = (shadow_data->num_volumes * 2 *
+                                        sizeof(SHADOW_COPY_LABEL)) + 2;
 
                 if (!labels) {
-                        data_count = 16;
+                        *out_len = 16;
                 } else {
-                        data_count = 12+labels_data_count+4;
-                }
-
-                if (max_data_count<data_count) {
+                        *out_len = 12 + labels_data_count + 4;
+                }
+
+                if (max_out_len < *out_len) {
                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
-                                max_data_count,data_count));
+                                max_out_len, *out_len));
                         TALLOC_FREE(shadow_data);
-                        reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
-                        return;
-                }
-
-                pdata = nttrans_realloc(ppdata, data_count);
-                if (pdata == NULL) {
+                        return NT_STATUS_BUFFER_TOO_SMALL;
+                }
+
+                cur_pdata = talloc_array(ctx, char, *out_len);
+                if (cur_pdata == NULL) {
                         TALLOC_FREE(shadow_data);
-                        reply_nterror(req, NT_STATUS_NO_MEMORY);
-                        return;
-                }
-
-                cur_pdata = pdata;
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                *out_data = cur_pdata;
 
                 /* num_volumes 4 bytes */
-                SIVAL(pdata,0,shadow_data->num_volumes);
+                SIVAL(cur_pdata, 0, shadow_data->num_volumes);
 
                 if (labels) {
                         /* num_labels 4 bytes */
-                        SIVAL(pdata,4,shadow_data->num_volumes);
+                        SIVAL(cur_pdata, 4, shadow_data->num_volumes);
                 }
 
                 /* needed_data_count 4 bytes */
-                SIVAL(pdata, 8, labels_data_count+4);
-
-                cur_pdata+=12;
+                SIVAL(cur_pdata, 8, labels_data_count + 4);
+
+                cur_pdata += 12;
 
                 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
                           shadow_data->num_volumes, fsp_str_dbg(fsp)));
                 if (labels && shadow_data->labels) {
-                        for (i=0;i<shadow_data->num_volumes;i++) {
-                                srvstr_push(pdata, req->flags2,
+                        for (i=0; i<shadow_data->num_volumes; i++) {
+                                srvstr_push(cur_pdata, req_flags,
                                             cur_pdata, shadow_data->labels[i],
-                                            2*sizeof(SHADOW_COPY_LABEL),
+                                            2 * sizeof(SHADOW_COPY_LABEL),
                                             STR_UNICODE|STR_TERMINATE);
-                                cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
+                                cur_pdata += 2 * sizeof(SHADOW_COPY_LABEL);
                                 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
                         }
@@ -2315 +2341 @@
                 TALLOC_FREE(shadow_data);
 
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
-                                pdata, data_count);
-
-                return;
-        }
-
-        case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
+                return NT_STATUS_OK;
+        }
+
+        case FSCTL_FIND_FILES_BY_SID:
         {
                 /* pretend this succeeded -
@@ -2333 +2356 @@
                 size_t sid_len;
 
-                DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                if (data_count < 8) {
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                sid_len = MIN(data_count-4,SID_MAX_SIZE);
+                DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n", fsp->fnum));
+
+                if (in_len < 8) {
+                        /* NT_STATUS_BUFFER_TOO_SMALL maybe? */
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                sid_len = MIN(in_len - 4,SID_MAX_SIZE);
 
                 /* unknown 4 bytes: this is not the length of the sid :-(  */
                 /*unknown = IVAL(pdata,0);*/
 
-                if (!sid_parse(pdata+4,sid_len,&sid)) {
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
+                if (!sid_parse(in_data + 4, sid_len, &sid)) {
+                        return NT_STATUS_INVALID_PARAMETER;
                 }
                 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
@@ -2373 +2391 @@
                  * (maybe we can hang the result anywhere in the fsp struct)
                  *
+                 * but I don't know how to deal with the paged results
+                 * (maybe we can hang the result anywhere in the fsp struct)
+                 *
                  * we don't send all files at once
                  * and at the next we should *not* start from the beginning,
@@ -2381 +2402 @@
 
                 /* this works for now... */
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
-                return;
-        }
+                return NT_STATUS_OK;
+        }
+
         case FSCTL_QUERY_ALLOCATED_RANGES:
         {
@@ -2394 +2415 @@
                 NTSTATUS status;
                 uint64_t offset, length;
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                if (data_count != 16) {
+                char *out_data_tmp = NULL;
+
+                if (in_len != 16) {
                         DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: data_count(%u) != 16 is invalid!\n",
-                                data_count));
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                if (max_data_count < 16) {
-                        DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: max_data_count(%u) < 16 is invalid!\n",
-                                max_data_count));
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                offset = BVAL(pdata,0);
-                length = BVAL(pdata,8);
+                                in_len));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                if (max_out_len < 16) {
+                        DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: max_out_len (%u) < 16 is invalid!\n",
+                                max_out_len));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                offset = BVAL(in_data,0);
+                length = BVAL(in_data,8);
 
                 if (offset + length < offset) {
                         /* No 64-bit integer wrap. */
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                /* Shouldn't this be SMB_VFS_STAT ... ? */
                 status = vfs_stat_fsp(fsp);
                 if (!NT_STATUS_IS_OK(status)) {
-                        reply_nterror(req, status);
-                        return;
+                        return status;
+                }
+
+                *out_len = 16;
+                out_data_tmp = talloc_array(ctx, char, *out_len);
+                if (out_data_tmp == NULL) {
+                        DEBUG(10, ("unable to allocate memory for response\n"));
+                        return NT_STATUS_NO_MEMORY;
                 }
 
@@ -2431 +2453 @@
                                 fsp->fsp_name->st.st_ex_size == 0 ||
                                 length == 0) {
-                        send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
+                        memset(out_data_tmp, 0, *out_len);
                 } else {
                         uint64_t end = offset + length;
                         end = MIN(end, fsp->fsp_name->st.st_ex_size);
-                        SBVAL(pdata,0,0);
-                        SBVAL(pdata,8,end);
-                        send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
-                                pdata, 16);
-                }
-                return;
-        }
+                        SBVAL(out_data_tmp, 0, 0);
+                        SBVAL(out_data_tmp, 8, end);
+                }
+
+                *out_data = out_data_tmp;
+
+                return NT_STATUS_OK;
+        }
+
         case FSCTL_IS_VOLUME_DIRTY:
+        {
                 DEBUG(10,("FSCTL_IS_VOLUME_DIRTY: called on FID[0x%04X] "
-                          "(but not implemented)\n", (int)fidnum));
+                          "(but not implemented)\n", fsp->fnum));
                 /*
                  * http://msdn.microsoft.com/en-us/library/cc232128%28PROT.10%29.aspx
                  * says we have to respond with NT_STATUS_INVALID_PARAMETER
                  */
-                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                return;
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         default:
-                /* Only print this once... */
-                if (!logged_ioctl_message) {
-                        logged_ioctl_message = true;
-                        DEBUG(2,("call_nt_transact_ioctl(0x%x): "
-                                 "Currently not implemented.\n",
-                                 function));
-                }
-        }
-
-        reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                /*
+                 * Only print once ... unfortunately there could be lots of
+                 * different FSCTLs that are called.
+                 */
+                if (!vfswrap_logged_ioctl_message) {
+                        vfswrap_logged_ioctl_message = true;
+                        DEBUG(2, ("%s (0x%x): Currently not implemented.\n",
+                        __FUNCTION__, function));
+                }
+        }
+
+        return NT_STATUS_NOT_SUPPORTED;
+}
+
+/****************************************************************************
+ Reply to NT IOCTL
+****************************************************************************/
+
+static void call_nt_transact_ioctl(connection_struct *conn,
+                                   struct smb_request *req,
+                                   uint16 **ppsetup, uint32 setup_count,
+                                   char **ppparams, uint32 parameter_count,
+                                   char **ppdata, uint32 data_count,
+                                   uint32 max_data_count)
+{
+        NTSTATUS status;
+        uint32 function;
+        uint16 fidnum;
+        files_struct *fsp;
+        uint8 isFSctl;
+        uint8 compfilter;
+        char *out_data = NULL;
+        uint32 out_data_len = 0;
+        char *pdata = *ppdata;
+        TALLOC_CTX *ctx = talloc_tos();
+
+        if (setup_count != 8) {
+                DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                return;
+        }
+
+        function = IVAL(*ppsetup, 0);
+        fidnum = SVAL(*ppsetup, 4);
+        isFSctl = CVAL(*ppsetup, 6);
+        compfilter = CVAL(*ppsetup, 7);
+
+        DEBUG(10, ("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
+                 function, fidnum, isFSctl, compfilter));
+
+        fsp=file_fsp(req, fidnum);
+
+        /*
+         * We don't really implement IOCTLs, especially on files.
+         */
+        if (!isFSctl) {
+                DEBUG(10, ("isFSctl: 0x%02X indicates IOCTL, not FSCTL!\n",
+                        isFSctl));
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                return;
+        }
+
+        /* Has to be for an open file! */
+        if (!check_fsp_open(conn, req, fsp)) {
+                return;
+        }
+
+        /*
+         * out_data might be allocated by the VFS module, but talloc should be
+         * used, and should be cleaned up when the request ends.
+         */
+        status = smb_fsctl(fsp,
+                               ctx,
+                               function,
+                               req->flags2,
+                               (uint8_t *)pdata,
+                               data_count,
+                               (uint8_t **)&out_data,
+                               max_data_count,
+                               &out_data_len);
+        if (!NT_STATUS_IS_OK(status)) {
+                reply_nterror(req, status);
+        } else {
+                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, out_data, out_data_len);
+        }
 }
 
@@ -3197 +3298 @@
         show_msg((char *)req->inbuf);
 
+        /* Windows clients expect all replies to
+           an NT transact secondary (SMBnttranss 0xA1)
+           to have a command code of NT transact
+           (SMBnttrans 0xA0). See bug #8989 for details. */
+        req->cmd = SMBnttrans;
+
         if (req->wct < 18) {
                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);