Changeset 862 for trunk/server/source3/smbd/trans2.c

Timestamp:

May 13, 2014, 11:39:04 AM (11 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update trunk to 3.6.23

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/smbd/trans2.c (modified) (55 diffs)

trunk/server/source3/smbd/trans2.c

@@ -25 +25 @@
 
 #include "includes.h"
+#include "ntioctl.h"
 #include "system/filesys.h"
 #include "version.h"
@@ -337 +338 @@
                 }
 
+                if (listp->ea.value.length == 0) {
+                        /*
+                         * We can never return a zero length EA.
+                         * Windows reports the EA's as corrupted.
+                         */
+                        TALLOC_FREE(listp);
+                        continue;
+                }
+
                 push_ascii_fstring(dos_ea_name, listp->ea.name);
 
@@ -420 +430 @@
         uint8_t *p = (uint8_t *)pdata;
         uint8_t *last_start = NULL;
+        bool store_data = (pdata != NULL);
 
         *ret_data_size = 0;
@@ -431 +442 @@
                 fstring dos_ea_name;
                 size_t this_size;
-
-                if (last_start) {
+                size_t pad = 0;
+
+                if (last_start && store_data) {
                         SIVAL(last_start, 0, PTR_DIFF(p, last_start));
                 }
@@ -449 +461 @@
 
                 if (ea_list->next) {
-                        size_t pad = 4 - (this_size % 4);
+                        pad = (4 - (this_size % 4)) % 4;
                         this_size += pad;
                 }
@@ -458 +470 @@
 
                 /* We know we have room. */
-                SIVAL(p, 0x00, 0); /* next offset */
-                SCVAL(p, 0x04, ea_list->ea.flags);
-                SCVAL(p, 0x05, dos_namelen);
-                SSVAL(p, 0x06, ea_list->ea.value.length);
-                fstrcpy((char *)(p+0x08), dos_ea_name);
-                memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
+                if (store_data) {
+                        SIVAL(p, 0x00, 0); /* next offset */
+                        SCVAL(p, 0x04, ea_list->ea.flags);
+                        SCVAL(p, 0x05, dos_namelen);
+                        SSVAL(p, 0x06, ea_list->ea.value.length);
+                        fstrcpy((char *)(p+0x08), dos_ea_name);
+                        memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
+                        if (pad) {
+                                memset(p + 0x08 + dos_namelen + 1 + ea_list->ea.value.length,
+                                        '\0',
+                                        pad);
+                        }
+                }
 
                 total_data_size -= this_size;
@@ -477 +496 @@
 {
         size_t total_ea_len = 0;
+        struct ea_list *ea_list = NULL;
         TALLOC_CTX *mem_ctx = NULL;
 
@@ -483 +503 @@
         }
         mem_ctx = talloc_tos();
-        (void)get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
+        ea_list = get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
+        if (ea_list == NULL) {
+                return 0;
+        }
+        if(conn->sconn->using_smb2) {
+                NTSTATUS status;
+                unsigned int ret_data_size;
+                /*
+                 * We're going to be using fill_ea_chained_buffer() to
+                 * marshall EA's - this size is significantly larger
+                 * than the SMB1 buffer. Re-calculate the size without
+                 * marshalling.
+                 */
+                status = fill_ea_chained_buffer(mem_ctx,
+                                                NULL,
+                                                65535,
+                                                &ret_data_size,
+                                                conn,
+                                                ea_list);
+                if (!NT_STATUS_IS_OK(status)) {
+                        ret_data_size = 0;
+                }
+                total_ea_len = ret_data_size;
+        }
+
         return total_ea_len;
 }
@@ -1744 +1788 @@
                 SIVAL(p,0,mode); p += 4;
                 q = p; p += 4; /* q is placeholder for name length. */
-                {
+                if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
+                        SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
                                                                 smb_fname->base_name);
                         SIVAL(p,0,ea_size); /* Extended attributes */
-                        p += 4;
-                }
+                }
+                p += 4;
                 /* Clear the short name buffer. This is
                  * IMPORTANT as not doing so will trigger
@@ -1921 +1967 @@
                 SIVAL(p,0,mode); p += 4;
                 q = p; p += 4; /* q is placeholder for name length. */
-                {
+                if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
+                        SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
                                                                 smb_fname->base_name);
                         SIVAL(p,0,ea_size); /* Extended attributes */
-                        p +=4;
-                }
+                }
+                p +=4;
                 SIVAL(p,0,0); p += 4; /* Unknown - reserved ? */
                 SBVAL(p,0,file_index); p += 8;
@@ -1967 +2015 @@
                 SIVAL(p,0,mode); p += 4;
                 q = p; p += 4; /* q is placeholder for name length */
-                {
+                if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
+                        SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
                                                                 smb_fname->base_name);
                         SIVAL(p,0,ea_size); /* Extended attributes */
-                        p +=4;
-                }
+                }
+                p +=4;
                 /* Clear the short name buffer. This is
                  * IMPORTANT as not doing so will trigger
@@ -2935 +2985 @@
                          uint16_t flags2,
                          unsigned int max_data_bytes,
+                         size_t *fixed_portion,
+                         struct smb_filename *fname,
                          char **ppdata,
                          int *ret_data_len)
@@ -2943 +2995 @@
         int snum = SNUM(conn);
         char *fstype = lp_fstype(SNUM(conn));
+        const char *filename = NULL;
         uint32 additional_flags = 0;
-        struct smb_filename smb_fname_dot;
+        struct smb_filename smb_fname;
         SMB_STRUCT_STAT st;
+        NTSTATUS status = NT_STATUS_OK;
+
+        if (fname == NULL || fname->base_name == NULL) {
+                filename = ".";
+        } else {
+                filename = fname->base_name;
+        }
 
         if (IS_IPC(conn)) {
@@ -2958 +3018 @@
         DEBUG(3,("smbd_do_qfsinfo: level = %d\n", info_level));
 
-        ZERO_STRUCT(smb_fname_dot);
-        smb_fname_dot.base_name = discard_const_p(char, ".");
-
-        if(SMB_VFS_STAT(conn, &smb_fname_dot) != 0) {
+        ZERO_STRUCT(smb_fname);
+        smb_fname.base_name = discard_const_p(char, filename);
+
+        if(SMB_VFS_STAT(conn, &smb_fname) != 0) {
                 DEBUG(2,("stat of . failed (%s)\n", strerror(errno)));
                 return map_nt_error_from_unix(errno);
         }
 
-        st = smb_fname_dot.st;
+        st = smb_fname.st;
 
         *ppdata = (char *)SMB_REALLOC(
@@ -2977 +3037 @@
         memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
         end_data = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
+
+        *fixed_portion = 0;
 
         switch (info_level) {
@@ -2983 +3045 @@
                         uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                         data_len = 18;
-                        if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3070 +3132 @@
                         SIVAL(pdata,8,len);
                         data_len = 12 + len;
+                        if (max_data_bytes >= 16 && data_len > max_data_bytes) {
+                                /* the client only requested a portion of the
+                                   file system name */
+                                data_len = max_data_bytes;
+                                status = STATUS_BUFFER_OVERFLOW;
+                        }
+                        *fixed_portion = 16;
                         break;
 
@@ -3099 +3168 @@
                         DEBUG(5,("smbd_do_qfsinfo : SMB_QUERY_FS_VOLUME_INFO namelen = %d, vol=%s serv=%s\n",
                                 (int)strlen(vname),vname, lp_servicename(snum)));
+                        if (max_data_bytes >= 24 && data_len > max_data_bytes) {
+                                /* the client only requested a portion of the
+                                   volume label */
+                                data_len = max_data_bytes;
+                                status = STATUS_BUFFER_OVERFLOW;
+                        }
+
                         break;
 
@@ -3106 +3182 @@
                         uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                         data_len = 24;
-                        if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3131 +3207 @@
                         SIVAL(pdata,16,sectors_per_unit);
                         SIVAL(pdata,20,bytes_per_sector);
+                        *fixed_portion = 24;
                         break;
                 }
@@ -3138 +3215 @@
                         uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                         data_len = 32;
-                        if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3164 +3241 @@
                         SIVAL(pdata,24,sectors_per_unit); /* Sectors per allocation unit. */
                         SIVAL(pdata,28,bytes_per_sector); /* Bytes per sector. */
+                        *fixed_portion = 32;
                         break;
                 }
@@ -3178 +3256 @@
                         SIVAL(pdata,0,FILE_DEVICE_DISK); /* dev type */
                         SIVAL(pdata,4,characteristics);
+                        *fixed_portion = 8;
                         break;
                 }
@@ -3331 +3410 @@
                         }
 
-                        rc = SMB_VFS_STATVFS(conn, ".", &svfs);
+                        rc = SMB_VFS_STATVFS(conn, filename, &svfs);
 
                         if (!rc) {
@@ -3352 +3431 @@
                                 return NT_STATUS_DOS(ERRSRV, ERRerror);
                         }
+                        *fixed_portion = 24;
                         break;
                 }
@@ -3482 +3562 @@
 
         *ret_data_len = data_len;
-        return NT_STATUS_OK;
+        return status;
 }
 
@@ -3498 +3578 @@
         uint16_t info_level;
         int data_len = 0;
+        size_t fixed_portion;
         NTSTATUS status;
 
@@ -3524 +3605 @@
                                  req->flags2,
                                  max_data_bytes,
+                                 &fixed_portion,
+                                 NULL,
                                  ppdata, &data_len);
         if (!NT_STATUS_IS_OK(status)) {
@@ -4076 +4159 @@
         unsigned int ofs = 0;
 
-        for (i = 0; i < num_streams && ofs <= max_data_bytes; i++) {
+        if (max_data_bytes < 32) {
+                return NT_STATUS_INFO_LENGTH_MISMATCH;
+        }
+
+        for (i = 0; i < num_streams; i++) {
                 unsigned int next_offset;
                 size_t namelen;
@@ -4095 +4182 @@
                 namelen -= 2;
 
+                /*
+                 * We cannot overflow ...
+                 */
+                if ((ofs + 24 + namelen) > max_data_bytes) {
+                        DEBUG(10, ("refusing to overflow reply at stream %u\n",
+                                i));
+                        TALLOC_FREE(namebuf);
+                        return STATUS_BUFFER_OVERFLOW;
+                }
+
                 SIVAL(data, ofs+4, namelen);
                 SOFF_T(data, ofs+8, streams[i].size);
@@ -4109 +4206 @@
                         unsigned int align = ndr_align_size(next_offset, 8);
 
+                        if ((next_offset + align) > max_data_bytes) {
+                                DEBUG(10, ("refusing to overflow align "
+                                        "reply at stream %u\n",
+                                        i));
+                                TALLOC_FREE(namebuf);
+                                return STATUS_BUFFER_OVERFLOW;
+                        }
+
                         memset(data+next_offset, 0, align);
                         next_offset += align;
@@ -4118 +4223 @@
                 ofs = next_offset;
         }
+
+        DEBUG(10, ("max_data: %u, data_size: %u\n", max_data_bytes, ofs));
 
         *data_size = ofs;
@@ -4207 +4314 @@
                                uint16_t flags2,
                                unsigned int max_data_bytes,
+                               size_t *fixed_portion,
                                char **ppdata,
                                unsigned int *pdata_size)
@@ -4342 +4450 @@
         file_index = get_FileIndex(conn, psbuf);
 
+        *fixed_portion = 0;
+
         switch (info_level) {
                 case SMB_INFO_STANDARD:
@@ -4479 +4589 @@
                         DEBUG(5,("change: %s ", ctime(&c_time)));
                         DEBUG(5,("mode: %x\n", mode));
+                        *fixed_portion = data_size;
                         break;
 
@@ -4492 +4603 @@
                         SCVAL(pdata,21,(mode&FILE_ATTRIBUTE_DIRECTORY)?1:0);
                         SSVAL(pdata,22,0); /* Padding. */
+                        *fixed_portion = 24;
                         break;
 
@@ -4501 +4613 @@
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_FILE_EA_INFORMATION\n"));
                         data_size = 4;
+                        *fixed_portion = 4;
                         SIVAL(pdata,0,ea_size);
                         break;
@@ -4522 +4635 @@
                         data_size = 4 + len;
                         SIVAL(pdata,0,len);
+                        *fixed_portion = 8;
                         break;
                 }
@@ -4585 +4699 @@
                         pdata += 4 + len;
                         data_size = PTR_DIFF(pdata,(*ppdata));
+                        *fixed_portion = 10;
                         break;
                 }
@@ -4622 +4737 @@
                         pdata += 4 + len;
                         data_size = PTR_DIFF(pdata,(*ppdata));
+                        *fixed_portion = 104;
                         break;
                 }
@@ -4629 +4745 @@
                         SBVAL(pdata, 0, file_index);
                         data_size = 8;
+                        *fixed_portion = 8;
                         break;
 
@@ -4635 +4752 @@
                         SIVAL(pdata, 0, access_mask);
                         data_size = 4;
+                        *fixed_portion = 4;
                         break;
 
@@ -4652 +4770 @@
                         data_size = 1;
                         SCVAL(pdata,0,delete_pending);
+                        *fixed_portion = 1;
                         break;
 
@@ -4658 +4777 @@
                         data_size = 8;
                         SOFF_T(pdata,0,pos);
+                        *fixed_portion = 8;
                         break;
 
@@ -4664 +4784 @@
                         SIVAL(pdata,0,mode);
                         data_size = 4;
+                        *fixed_portion = 4;
                         break;
 
@@ -4670 +4791 @@
                         SIVAL(pdata,0,0); /* No alignment needed. */
                         data_size = 4;
+                        *fixed_portion = 4;
                         break;
 
@@ -4708 +4830 @@
                                 DEBUG(10, ("marshall_stream_info failed: %s\n",
                                            nt_errstr(status)));
+                                TALLOC_FREE(streams);
                                 return status;
                         }
 
                         TALLOC_FREE(streams);
+
+                        *fixed_portion = 32;
 
                         break;
@@ -4722 +4847 @@
                         SIVAL(pdata,12,0); /* ??? */
                         data_size = 16;
+                        *fixed_portion = 16;
                         break;
 
@@ -4735 +4861 @@
                         SIVAL(pdata,52,0); /* ??? */
                         data_size = 56;
+                        *fixed_portion = 56;
                         break;
 
@@ -4742 +4869 @@
                         SIVAL(pdata,4,0);
                         data_size = 8;
+                        *fixed_portion = 8;
                         break;
 
@@ -5011 +5139 @@
         int lock_data_count = 0;
         char *lock_data = NULL;
+        size_t fixed_portion;
         NTSTATUS status = NT_STATUS_OK;
 
@@ -5372 +5501 @@
                                        lock_data_count, lock_data,
                                        req->flags2, max_data_bytes,
+                                       &fixed_portion,
                                        ppdata, &data_size);
         if (!NT_STATUS_IS_OK(status)) {
                 reply_nterror(req, status);
+                return;
+        }
+        if (fixed_portion > max_data_bytes) {
+                reply_nterror(req, NT_STATUS_INFO_LENGTH_MISMATCH);
                 return;
         }
@@ -7325 +7459 @@
                         create_disp = FILE_OPEN_IF;
                         break;
+                case SMB_O_EXCL:
+                        /* O_EXCL on its own without O_CREAT is undefined.
+                           We deliberately ignore it as some versions of
+                           Linux CIFSFS can send a bare O_EXCL on the
+                           wire which other filesystems in the kernel
+                           ignore. See bug 9519 for details. */
+
+                        /* Fallthrough. */
+
                 case 0:
                         /* File exists open. File not exist fail. */
                         create_disp = FILE_OPEN;
                         break;
-                case SMB_O_EXCL:
-                        /* O_EXCL on its own without O_CREAT is undefined. */
                 default:
                         DEBUG(5,("smb_posix_open: invalid create mode 0x%x\n",
@@ -7583 +7724 @@
                         }
                         /* Fail with sharing violation. */
+                        TALLOC_FREE(lck);
                         close_file(req, fsp, NORMAL_CLOSE);
-                        TALLOC_FREE(lck);
                         return NT_STATUS_SHARING_VIOLATION;
                 }
@@ -7598 +7739 @@
                                                 smb_fname);
 
+        TALLOC_FREE(lck);
+
         if (!NT_STATUS_IS_OK(status)) {
                 close_file(req, fsp, NORMAL_CLOSE);
-                TALLOC_FREE(lck);
                 return status;
         }
-        TALLOC_FREE(lck);
         return close_file(req, fsp, NORMAL_CLOSE);
 }