source3/libsmb/libsmb_xattr.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    SMB client library implementation
   4    Copyright (C) Andrew Tridgell 1998
   5    Copyright (C) Richard Sharpe 2000, 2002
   6    Copyright (C) John Terpstra 2000
   7    Copyright (C) Tom Jansen (Ninja ISD) 2002
   8    Copyright (C) Derrell Lipman 2003-2008
   9    Copyright (C) Jeremy Allison 2007, 2008
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "libsmb/libsmb.h"
  27 #include "libsmbclient.h"
  28 #include "libsmb_internal.h"
  29 #include "../librpc/gen_ndr/ndr_lsa.h"
  30 #include "rpc_client/rpc_client.h"
  31 #include "rpc_client/cli_lsarpc.h"
  32 #include "../libcli/security/security.h"
  33 #include "lib/util/string_wrappers.h"
  34
  35 /*
  36  * Find an lsa pipe handle associated with a cli struct.
  37  */
  38 static struct rpc_pipe_client *
  39 find_lsa_pipe_hnd(struct cli_state *ipc_cli)
  40 {
  41         struct rpc_pipe_client *pipe_hnd;
  42
  43         for (pipe_hnd = ipc_cli->pipe_list;
  44              pipe_hnd;
  45              pipe_hnd = pipe_hnd->next) {
  46                 if (ndr_syntax_id_equal(&pipe_hnd->abstract_syntax,
  47                                         &ndr_table_lsarpc.syntax_id)) {
  48                         return pipe_hnd;
  49                 }
  50         }
  51         return NULL;
  52 }
  53
  54 /*
  55  * Sort ACEs according to the documentation at
  56  * http://support.microsoft.com/kb/269175, at least as far as it defines the
  57  * order.
  58  */
  59
  60 static int
  61 ace_compare(struct security_ace *ace1,
  62             struct security_ace *ace2)
  63 {
  64         bool b1;
  65         bool b2;
  66
  67         /* If the ACEs are equal, we have nothing more to do. */
  68         if (security_ace_equal(ace1, ace2)) {
  69                 return 0;
  70         }
  71
  72         /* Inherited follow non-inherited */
  73         b1 = ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) != 0);
  74         b2 = ((ace2->flags & SEC_ACE_FLAG_INHERITED_ACE) != 0);
  75         if (b1 != b2) {
  76                 return (b1 ? 1 : -1);
  77         }
  78
  79         /*
  80          * What shall we do with AUDITs and ALARMs?  It's undefined.  We'll
  81          * sort them after DENY and ALLOW.
  82          */
  83         b1 = (ace1->type != SEC_ACE_TYPE_ACCESS_ALLOWED &&
  84               ace1->type != SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT &&
  85               ace1->type != SEC_ACE_TYPE_ACCESS_DENIED &&
  86               ace1->type != SEC_ACE_TYPE_ACCESS_DENIED_OBJECT);
  87         b2 = (ace2->type != SEC_ACE_TYPE_ACCESS_ALLOWED &&
  88               ace2->type != SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT &&
  89               ace2->type != SEC_ACE_TYPE_ACCESS_DENIED &&
  90               ace2->type != SEC_ACE_TYPE_ACCESS_DENIED_OBJECT);
  91         if (b1 != b2) {
  92                 return (b1 ? 1 : -1);
  93         }
  94
  95         /* Allowed ACEs follow denied ACEs */
  96         b1 = (ace1->type == SEC_ACE_TYPE_ACCESS_ALLOWED ||
  97               ace1->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT);
  98         b2 = (ace2->type == SEC_ACE_TYPE_ACCESS_ALLOWED ||
  99               ace2->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT);
 100         if (b1 != b2) {
 101                 return (b1 ? 1 : -1);
 102         }
 103
 104         /*
 105          * ACEs applying to an entity's object follow those applying to the
 106          * entity itself
 107          */
 108         b1 = (ace1->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
 109               ace1->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT);
 110         b2 = (ace2->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
 111               ace2->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT);
 112         if (b1 != b2) {
 113                 return (b1 ? 1 : -1);
 114         }
 115
 116         /*
 117          * If we get this far, the ACEs are similar as far as the
 118          * characteristics we typically care about (those defined by the
 119          * referenced MS document).  We'll now sort by characteristics that
 120          * just seems reasonable.
 121          */
 122
 123         if (ace1->type != ace2->type) {
 124                 /*
 125                  * ace2 and ace1 are reversed here, so that
 126                  * ACCESS_DENIED_ACE_TYPE (1) sorts before
 127                  * ACCESS_ALLOWED_ACE_TYPE (0), which is the order you
 128                  * usually want.
 129                  */
 130                 return NUMERIC_CMP(ace2->type, ace1->type);
 131         }
 132
 133         if (dom_sid_compare(&ace1->trustee, &ace2->trustee)) {
 134                 return dom_sid_compare(&ace1->trustee, &ace2->trustee);
 135         }
 136
 137         if (ace1->flags != ace2->flags) {
 138                 return NUMERIC_CMP(ace1->flags, ace2->flags);
 139         }
 140
 141         if (ace1->access_mask != ace2->access_mask) {
 142                 return NUMERIC_CMP(ace1->access_mask, ace2->access_mask);
 143         }
 144
 145         if (ace1->size != ace2->size) {
 146                 return NUMERIC_CMP(ace1->size, ace2->size);
 147         }
 148
 149         return memcmp(ace1, ace2, sizeof(struct security_ace));
 150 }
 151
 152
 153 static void
 154 sort_acl(struct security_acl *the_acl)
 155 {
 156         uint32_t i;
 157         if (!the_acl) return;
 158
 159         TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
 160
 161         for (i=1;i<the_acl->num_aces;) {
 162                 if (security_ace_equal(&the_acl->aces[i-1],
 163                                        &the_acl->aces[i])) {
 164                         ARRAY_DEL_ELEMENT(
 165                                 the_acl->aces, i, the_acl->num_aces);
 166                         the_acl->num_aces--;
 167                 } else {
 168                         i++;
 169                 }
 170         }
 171 }
 172
 173 /* convert a SID to a string, either numeric or username/group */
 174 static void
 175 convert_sid_to_string(struct cli_state *ipc_cli,
 176                       struct policy_handle *pol,
 177                       fstring str,
 178                       bool numeric,
 179                       struct dom_sid *sid)
 180 {
 181         char **domains = NULL;
 182         char **names = NULL;
 183         enum lsa_SidType *types = NULL;
 184         struct rpc_pipe_client *pipe_hnd = find_lsa_pipe_hnd(ipc_cli);
 185         TALLOC_CTX *ctx;
 186
 187         sid_to_fstring(str, sid);
 188
 189         if (numeric) {
 190                 return;     /* no lookup desired */
 191         }
 192
 193         if (!pipe_hnd) {
 194                 return;
 195         }
 196
 197         /* Ask LSA to convert the sid to a name */
 198
 199         ctx = talloc_stackframe();
 200
 201         if (!NT_STATUS_IS_OK(rpccli_lsa_lookup_sids(pipe_hnd, ctx,
 202                                                     pol, 1, sid, &domains,
 203                                                     &names, &types)) ||
 204             !domains || !domains[0] || !names || !names[0]) {
 205                 TALLOC_FREE(ctx);
 206                 return;
 207         }
 208
 209         /* Converted OK */
 210
 211         fstr_sprintf(str, "%s%s%s",
 212                      domains[0], lp_winbind_separator(), names[0]);
 213
 214         TALLOC_FREE(ctx);
 215 }
 216
 217 /* convert a string to a SID, either numeric or username/group */
 218 static bool
 219 convert_string_to_sid(struct cli_state *ipc_cli,
 220                       struct policy_handle *pol,
 221                       bool numeric,
 222                       struct dom_sid *sid,
 223                       const char *str)
 224 {
 225         enum lsa_SidType *types = NULL;
 226         struct dom_sid *sids = NULL;
 227         bool result = True;
 228         TALLOC_CTX *ctx = NULL;
 229         struct rpc_pipe_client *pipe_hnd = find_lsa_pipe_hnd(ipc_cli);
 230
 231         if (!pipe_hnd) {
 232                 return False;
 233         }
 234
 235         if (numeric) {
 236                 if (strncmp(str, "S-", 2) == 0) {
 237                         return string_to_sid(sid, str);
 238                 }
 239
 240                 result = False;
 241                 goto done;
 242         }
 243
 244         ctx = talloc_stackframe();
 245         if (!NT_STATUS_IS_OK(rpccli_lsa_lookup_names(pipe_hnd, ctx,
 246                                                      pol, 1, &str,
 247                                                      NULL, 1, &sids,
 248                                                      &types))) {
 249                 result = False;
 250                 goto done;
 251         }
 252
 253         sid_copy(sid, &sids[0]);
 254 done:
 255         TALLOC_FREE(ctx);
 256         return result;
 257 }
 258
 259
 260 /* parse an struct security_ace in the same format as print_ace() */
 261 static bool
 262 parse_ace(struct cli_state *ipc_cli,
 263           struct policy_handle *pol,
 264           struct security_ace *ace,
 265           bool numeric,
 266           char *str)
 267 {
 268         char *p;
 269         const char *cp;
 270         char *tok;
 271         unsigned int atype;
 272         unsigned int aflags;
 273         unsigned int amask;
 274         struct dom_sid sid;
 275         uint32_t mask;
 276         struct perm_value {
 277                 const char perm[7];
 278                 uint32_t mask;
 279         };
 280         size_t i;
 281         TALLOC_CTX *frame = talloc_stackframe();
 282
 283         /* These values discovered by inspection */
 284         static const struct perm_value special_values[] = {
 285                 { "R", 0x00120089 },
 286                 { "W", 0x00120116 },
 287                 { "X", 0x001200a0 },
 288                 { "D", 0x00010000 },
 289                 { "P", 0x00040000 },
 290                 { "O", 0x00080000 },
 291         };
 292
 293         static const struct perm_value standard_values[] = {
 294                 { "READ",   0x001200a9 },
 295                 { "CHANGE", 0x001301bf },
 296                 { "FULL",   0x001f01ff },
 297         };
 298
 299         ZERO_STRUCTP(ace);
 300         p = strchr_m(str,':');
 301         if (!p) {
 302                 TALLOC_FREE(frame);
 303                 return False;
 304         }
 305         *p = '\0';
 306         p++;
 307         /* Try to parse numeric form */
 308
 309         if (sscanf(p, "%u/%u/%u", &atype, &aflags, &amask) == 3 &&
 310             convert_string_to_sid(ipc_cli, pol, numeric, &sid, str)) {
 311                 goto done;
 312         }
 313
 314         /* Try to parse text form */
 315
 316         if (!convert_string_to_sid(ipc_cli, pol, numeric, &sid, str)) {
 317                 TALLOC_FREE(frame);
 318                 return false;
 319         }
 320
 321         cp = p;
 322         if (!next_token_talloc(frame, &cp, &tok, "/")) {
 323                 TALLOC_FREE(frame);
 324                 return false;
 325         }
 326
 327         if (strncasecmp_m(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
 328                 atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
 329         } else if (strncasecmp_m(tok, "DENIED", strlen("DENIED")) == 0) {
 330                 atype = SEC_ACE_TYPE_ACCESS_DENIED;
 331         } else {
 332                 TALLOC_FREE(frame);
 333                 return false;
 334         }
 335
 336         /* Only numeric form accepted for flags at present */
 337
 338         if (!(next_token_talloc(frame, &cp, &tok, "/") &&
 339               sscanf(tok, "%u", &aflags))) {
 340                 TALLOC_FREE(frame);
 341                 return false;
 342         }
 343
 344         if (!next_token_talloc(frame, &cp, &tok, "/")) {
 345                 TALLOC_FREE(frame);
 346                 return false;
 347         }
 348
 349         if (strncmp(tok, "0x", 2) == 0) {
 350                 if (sscanf(tok, "%u", &amask) != 1) {
 351                         TALLOC_FREE(frame);
 352                         return false;
 353                 }
 354                 goto done;
 355         }
 356
 357         for (i = 0; i < ARRAY_SIZE(standard_values); i++) {
 358                 const struct perm_value *v = &standard_values[i];
 359                 if (strcmp(tok, v->perm) == 0) {
 360                         amask = v->mask;
 361                         goto done;
 362                 }
 363         }
 364
 365         p = tok;
 366
 367         while(*p) {
 368                 bool found = False;
 369
 370                 for (i = 0; i < ARRAY_SIZE(special_values); i++) {
 371                         const struct perm_value *v = &special_values[i];
 372                         if (v->perm[0] == *p) {
 373                                 amask |= v->mask;
 374                                 found = True;
 375                         }
 376                 }
 377
 378                 if (!found) {
 379                         TALLOC_FREE(frame);
 380                         return false;
 381                 }
 382                 p++;
 383         }
 384
 385         if (*p) {
 386                 TALLOC_FREE(frame);
 387                 return false;
 388         }
 389
 390 done:
 391         mask = amask;
 392         init_sec_ace(ace, &sid, atype, mask, aflags);
 393         TALLOC_FREE(frame);
 394         return true;
 395 }
 396
 397 /* add an struct security_ace to a list of struct security_aces in a struct security_acl */
 398 static bool
 399 add_ace(struct security_acl **the_acl,
 400         const struct security_ace *ace,
 401         TALLOC_CTX *ctx)
 402 {
 403         struct security_acl *acl = *the_acl;
 404
 405         if (acl == NULL) {
 406                 acl = make_sec_acl(ctx, 3, 0, NULL);
 407                 if (acl == NULL) {
 408                         return false;
 409                 }
 410         }
 411
 412         if (acl->num_aces == UINT32_MAX) {
 413                 return false;
 414         }
 415         ADD_TO_ARRAY(
 416                 acl, struct security_ace, *ace, &acl->aces, &acl->num_aces);
 417         *the_acl = acl;
 418         return True;
 419 }
 420
 421
 422 /* parse a ascii version of a security descriptor */
 423 static struct security_descriptor *
 424 sec_desc_parse(TALLOC_CTX *ctx,
 425                struct cli_state *ipc_cli,
 426                struct policy_handle *pol,
 427                bool numeric,
 428                const char *str)
 429 {
 430         const char *p = str;
 431         char *tok;
 432         struct security_descriptor *ret = NULL;
 433         size_t sd_size;
 434         struct dom_sid owner_sid = { .num_auths = 0 };
 435         struct dom_sid group_sid = { .num_auths = 0 };
 436         bool have_owner = false, have_group = false;
 437         struct security_acl *dacl=NULL;
 438         int revision=1;
 439
 440         while (next_token_talloc(ctx, &p, &tok, "\t,\r\n")) {
 441
 442                 if (strncasecmp_m(tok,"REVISION:", 9) == 0) {
 443                         revision = strtol(tok+9, NULL, 16);
 444                         continue;
 445                 }
 446
 447                 if (strncasecmp_m(tok,"OWNER:", 6) == 0) {
 448                         if (have_owner) {
 449                                 DEBUG(5,("OWNER specified more than once!\n"));
 450                                 goto done;
 451                         }
 452                         if (!convert_string_to_sid(ipc_cli, pol,
 453                                                    numeric,
 454                                                    &owner_sid, tok+6)) {
 455                                 DEBUG(5, ("Failed to parse owner sid\n"));
 456                                 goto done;
 457                         }
 458                         have_owner = true;
 459                         continue;
 460                 }
 461
 462                 if (strncasecmp_m(tok,"OWNER+:", 7) == 0) {
 463                         if (have_owner) {
 464                                 DEBUG(5,("OWNER specified more than once!\n"));
 465                                 goto done;
 466                         }
 467                         if (!convert_string_to_sid(ipc_cli, pol,
 468                                                    False,
 469                                                    &owner_sid, tok+7)) {
 470                                 DEBUG(5, ("Failed to parse owner sid\n"));
 471                                 goto done;
 472                         }
 473                         have_owner = true;
 474                         continue;
 475                 }
 476
 477                 if (strncasecmp_m(tok,"GROUP:", 6) == 0) {
 478                         if (have_group) {
 479                                 DEBUG(5,("GROUP specified more than once!\n"));
 480                                 goto done;
 481                         }
 482                         if (!convert_string_to_sid(ipc_cli, pol,
 483                                                    numeric,
 484                                                    &group_sid, tok+6)) {
 485                                 DEBUG(5, ("Failed to parse group sid\n"));
 486                                 goto done;
 487                         }
 488                         have_group = true;
 489                         continue;
 490                 }
 491
 492                 if (strncasecmp_m(tok,"GROUP+:", 7) == 0) {
 493                         if (have_group) {
 494                                 DEBUG(5,("GROUP specified more than once!\n"));
 495                                 goto done;
 496                         }
 497                         if (!convert_string_to_sid(ipc_cli, pol,
 498                                                    False,
 499                                                    &group_sid, tok+6)) {
 500                                 DEBUG(5, ("Failed to parse group sid\n"));
 501                                 goto done;
 502                         }
 503                         have_group = true;
 504                         continue;
 505                 }
 506
 507                 if (strncasecmp_m(tok,"ACL:", 4) == 0) {
 508                         struct security_ace ace;
 509                         if (!parse_ace(ipc_cli, pol, &ace, numeric, tok+4)) {
 510                                 DEBUG(5, ("Failed to parse ACL %s\n", tok));
 511                                 goto done;
 512                         }
 513                         if(!add_ace(&dacl, &ace, ctx)) {
 514                                 DEBUG(5, ("Failed to add ACL %s\n", tok));
 515                                 goto done;
 516                         }
 517                         continue;
 518                 }
 519
 520                 if (strncasecmp_m(tok,"ACL+:", 5) == 0) {
 521                         struct security_ace ace;
 522                         if (!parse_ace(ipc_cli, pol, &ace, False, tok+5)) {
 523                                 DEBUG(5, ("Failed to parse ACL %s\n", tok));
 524                                 goto done;
 525                         }
 526                         if(!add_ace(&dacl, &ace, ctx)) {
 527                                 DEBUG(5, ("Failed to add ACL %s\n", tok));
 528                                 goto done;
 529                         }
 530                         continue;
 531                 }
 532
 533                 DEBUG(5, ("Failed to parse security descriptor\n"));
 534                 goto done;
 535         }
 536
 537         ret = make_sec_desc(
 538                 ctx,
 539                 revision,
 540                 SEC_DESC_SELF_RELATIVE,
 541                 have_owner ? &owner_sid : NULL,
 542                 have_group ? &group_sid : NULL,
 543                 NULL,
 544                 dacl,
 545                 &sd_size);
 546
 547 done:
 548         return ret;
 549 }
 550
 551
 552 /* Obtain the current dos attributes */
 553 static struct DOS_ATTR_DESC *
 554 dos_attr_query(SMBCCTX *context,
 555                TALLOC_CTX *ctx,
 556                const char *filename,
 557                SMBCSRV *srv)
 558 {
 559         struct stat sb = {0};
 560         struct DOS_ATTR_DESC *ret = NULL;
 561         NTSTATUS status;
 562
 563         ret = talloc(ctx, struct DOS_ATTR_DESC);
 564         if (!ret) {
 565                 errno = ENOMEM;
 566                 return NULL;
 567         }
 568
 569         /* Obtain the DOS attributes */
 570         status = SMBC_getatr(context, srv, filename, &sb);
 571         if (!NT_STATUS_IS_OK(status)) {
 572                 DEBUG(5, ("dos_attr_query Failed to query old attributes\n"));
 573                 TALLOC_FREE(ret);
 574                 errno = cli_status_to_errno(status);
 575                 return NULL;
 576         }
 577
 578         ret->mode = sb.st_mode;
 579         ret->size = sb.st_size;
 580         ret->create_time = sb.st_ctime;
 581         ret->access_time = sb.st_atime;
 582         ret->write_time = sb.st_mtime;
 583         ret->change_time = sb.st_mtime;
 584         ret->inode = sb.st_ino;
 585
 586         return ret;
 587 }
 588
 589
 590 /* parse a ascii version of a security descriptor */
 591 static void
 592 dos_attr_parse(SMBCCTX *context,
 593                struct DOS_ATTR_DESC *dad,
 594                SMBCSRV *srv,
 595                char *str)
 596 {
 597         int n;
 598         const char *p = str;
 599         char *tok = NULL;
 600         TALLOC_CTX *frame = NULL;
 601         struct {
 602                 const char * create_time_attr;
 603                 const char * access_time_attr;
 604                 const char * write_time_attr;
 605                 const char * change_time_attr;
 606         } attr_strings;
 607
 608         /* Determine whether to use old-style or new-style attribute names */
 609         if (context->internal->full_time_names) {
 610                 /* new-style names */
 611                 attr_strings.create_time_attr = "CREATE_TIME";
 612                 attr_strings.access_time_attr = "ACCESS_TIME";
 613                 attr_strings.write_time_attr = "WRITE_TIME";
 614                 attr_strings.change_time_attr = "CHANGE_TIME";
 615         } else {
 616                 /* old-style names */
 617                 attr_strings.create_time_attr = NULL;
 618                 attr_strings.access_time_attr = "A_TIME";
 619                 attr_strings.write_time_attr = "M_TIME";
 620                 attr_strings.change_time_attr = "C_TIME";
 621         }
 622
 623         /* if this is to set the entire ACL... */
 624         if (*str == '*') {
 625                 /* ... then increment past the first colon if there is one */
 626                 if ((p = strchr(str, ':')) != NULL) {
 627                         ++p;
 628                 } else {
 629                         p = str;
 630                 }
 631         }
 632
 633         frame = talloc_stackframe();
 634         while (next_token_talloc(frame, &p, &tok, "\t,\r\n")) {
 635                 if (strncasecmp_m(tok, "MODE:", 5) == 0) {
 636                         long request = strtol(tok+5, NULL, 16);
 637                         if (request == 0) {
 638                                 dad->mode =
 639                                         (dad->mode & FILE_ATTRIBUTE_DIRECTORY)
 640                                                 ? FILE_ATTRIBUTE_DIRECTORY
 641                                                 : FILE_ATTRIBUTE_NORMAL;
 642                         } else {
 643                                 dad->mode = request;
 644                         }
 645                         continue;
 646                 }
 647
 648                 if (strncasecmp_m(tok, "SIZE:", 5) == 0) {
 649                         dad->size = (off_t)atof(tok+5);
 650                         continue;
 651                 }
 652
 653                 n = strlen(attr_strings.access_time_attr);
 654                 if (strncasecmp_m(tok, attr_strings.access_time_attr, n) == 0) {
 655                         dad->access_time = (time_t)strtol(tok+n+1, NULL, 10);
 656                         continue;
 657                 }
 658
 659                 n = strlen(attr_strings.change_time_attr);
 660                 if (strncasecmp_m(tok, attr_strings.change_time_attr, n) == 0) {
 661                         dad->change_time = (time_t)strtol(tok+n+1, NULL, 10);
 662                         continue;
 663                 }
 664
 665                 n = strlen(attr_strings.write_time_attr);
 666                 if (strncasecmp_m(tok, attr_strings.write_time_attr, n) == 0) {
 667                         dad->write_time = (time_t)strtol(tok+n+1, NULL, 10);
 668                         continue;
 669                 }
 670
 671                 if (attr_strings.create_time_attr != NULL) {
 672                         n = strlen(attr_strings.create_time_attr);
 673                         if (strncasecmp_m(tok, attr_strings.create_time_attr,
 674                                         n) == 0) {
 675                                 dad->create_time = (time_t)strtol(tok+n+1,
 676                                                                   NULL, 10);
 677                                 continue;
 678                         }
 679                 }
 680
 681                 if (strncasecmp_m(tok, "INODE:", 6) == 0) {
 682                         dad->inode = (SMB_INO_T)atof(tok+6);
 683                         continue;
 684                 }
 685         }
 686         TALLOC_FREE(frame);
 687 }
 688
 689 /*****************************************************
 690  Retrieve the acls for a file.
 691 *******************************************************/
 692
 693 static int
 694 cacl_get(SMBCCTX *context,
 695          TALLOC_CTX *ctx,
 696          SMBCSRV *srv,
 697          struct cli_state *ipc_cli,
 698          struct policy_handle *pol,
 699          const char *filename,
 700          const char *attr_name,
 701          char *buf,
 702          int bufsize)
 703 {
 704         uint32_t i;
 705         int n = 0;
 706         int n_used;
 707         bool all;
 708         bool all_nt;
 709         bool all_nt_acls;
 710         bool all_dos;
 711         bool some_nt;
 712         bool some_dos;
 713         bool exclude_nt_revision = False;
 714         bool exclude_nt_owner = False;
 715         bool exclude_nt_group = False;
 716         bool exclude_nt_acl = False;
 717         bool exclude_dos_mode = False;
 718         bool exclude_dos_size = False;
 719         bool exclude_dos_create_time = False;
 720         bool exclude_dos_access_time = False;
 721         bool exclude_dos_write_time = False;
 722         bool exclude_dos_change_time = False;
 723         bool exclude_dos_inode = False;
 724         bool numeric = True;
 725         bool determine_size = (bufsize == 0);
 726         uint16_t fnum;
 727         struct security_descriptor *sd;
 728         fstring sidstr;
 729         fstring name_sandbox;
 730         char *name;
 731         char *pExclude;
 732         char *p;
 733         struct cli_state *cli = srv->cli;
 734         struct {
 735                 const char * create_time_attr;
 736                 const char * access_time_attr;
 737                 const char * write_time_attr;
 738                 const char * change_time_attr;
 739         } attr_strings;
 740         struct {
 741                 const char * create_time_attr;
 742                 const char * access_time_attr;
 743                 const char * write_time_attr;
 744                 const char * change_time_attr;
 745         } excl_attr_strings;
 746
 747         /* Determine whether to use old-style or new-style attribute names */
 748         if (context->internal->full_time_names) {
 749                 /* new-style names */
 750                 attr_strings.create_time_attr = "CREATE_TIME";
 751                 attr_strings.access_time_attr = "ACCESS_TIME";
 752                 attr_strings.write_time_attr = "WRITE_TIME";
 753                 attr_strings.change_time_attr = "CHANGE_TIME";
 754
 755                 excl_attr_strings.create_time_attr = "CREATE_TIME";
 756                 excl_attr_strings.access_time_attr = "ACCESS_TIME";
 757                 excl_attr_strings.write_time_attr = "WRITE_TIME";
 758                 excl_attr_strings.change_time_attr = "CHANGE_TIME";
 759         } else {
 760                 /* old-style names */
 761                 attr_strings.create_time_attr = NULL;
 762                 attr_strings.access_time_attr = "A_TIME";
 763                 attr_strings.write_time_attr = "M_TIME";
 764                 attr_strings.change_time_attr = "C_TIME";
 765
 766                 excl_attr_strings.create_time_attr = NULL;
 767                 excl_attr_strings.access_time_attr = "dos_attr.A_TIME";
 768                 excl_attr_strings.write_time_attr = "dos_attr.M_TIME";
 769                 excl_attr_strings.change_time_attr = "dos_attr.C_TIME";
 770         }
 771
 772         /* Copy name so we can strip off exclusions (if any are specified) */
 773         fstrcpy(name_sandbox, attr_name);
 774
 775         /* Ensure name is null terminated */
 776         name_sandbox[sizeof(name_sandbox) - 1] = '\0';
 777
 778         /* Play in the sandbox */
 779         name = name_sandbox;
 780
 781         /* If there are any exclusions, point to them and mask them from name */
 782         if ((pExclude = strchr(name, '!')) != NULL)
 783         {
 784                 *pExclude++ = '\0';
 785         }
 786
 787         all = (strncasecmp_m(name, "system.*", 8) == 0);
 788         all_nt = (strncasecmp_m(name, "system.nt_sec_desc.*", 20) == 0);
 789         all_nt_acls = (strncasecmp_m(name, "system.nt_sec_desc.acl.*", 24) == 0);
 790         all_dos = (strncasecmp_m(name, "system.dos_attr.*", 17) == 0);
 791         some_nt = (strncasecmp_m(name, "system.nt_sec_desc.", 19) == 0);
 792         some_dos = (strncasecmp_m(name, "system.dos_attr.", 16) == 0);
 793         numeric = (* (name + strlen(name) - 1) != '+');
 794
 795         /* Look for exclusions from "all" requests */
 796         if (all || all_nt || all_dos) {
 797                 /* Exclusions are delimited by '!' */
 798                 for (;
 799                      pExclude != NULL;
 800                      pExclude = (p == NULL ? NULL : p + 1)) {
 801
 802                         /* Find end of this exclusion name */
 803                         if ((p = strchr(pExclude, '!')) != NULL)
 804                         {
 805                                 *p = '\0';
 806                         }
 807
 808                         /* Which exclusion name is this? */
 809                         if (strcasecmp_m(pExclude,
 810                                        "nt_sec_desc.revision") == 0) {
 811                                 exclude_nt_revision = True;
 812                         }
 813                         else if (strcasecmp_m(pExclude,
 814                                             "nt_sec_desc.owner") == 0) {
 815                                 exclude_nt_owner = True;
 816                         }
 817                         else if (strcasecmp_m(pExclude,
 818                                             "nt_sec_desc.group") == 0) {
 819                                 exclude_nt_group = True;
 820                         }
 821                         else if (strcasecmp_m(pExclude,
 822                                             "nt_sec_desc.acl") == 0) {
 823                                 exclude_nt_acl = True;
 824                         }
 825                         else if (strcasecmp_m(pExclude,
 826                                             "dos_attr.mode") == 0) {
 827                                 exclude_dos_mode = True;
 828                         }
 829                         else if (strcasecmp_m(pExclude,
 830                                             "dos_attr.size") == 0) {
 831                                 exclude_dos_size = True;
 832                         }
 833                         else if (excl_attr_strings.create_time_attr != NULL &&
 834                                  strcasecmp_m(pExclude,
 835                                             excl_attr_strings.change_time_attr) == 0) {
 836                                 exclude_dos_create_time = True;
 837                         }
 838                         else if (strcasecmp_m(pExclude,
 839                                             excl_attr_strings.access_time_attr) == 0) {
 840                                 exclude_dos_access_time = True;
 841                         }
 842                         else if (strcasecmp_m(pExclude,
 843                                             excl_attr_strings.write_time_attr) == 0) {
 844                                 exclude_dos_write_time = True;
 845                         }
 846                         else if (strcasecmp_m(pExclude,
 847                                             excl_attr_strings.change_time_attr) == 0) {
 848                                 exclude_dos_change_time = True;
 849                         }
 850                         else if (strcasecmp_m(pExclude, "dos_attr.inode") == 0) {
 851                                 exclude_dos_inode = True;
 852                         }
 853                         else {
 854                                 DEBUG(5, ("cacl_get received unknown exclusion: %s\n",
 855                                           pExclude));
 856                                 errno = ENOATTR;
 857                                 return -1;
 858                         }
 859                 }
 860         }
 861
 862         n_used = 0;
 863
 864         /*
 865          * If we are (possibly) talking to an NT or new system and some NT
 866          * attributes have been requested...
 867          */
 868         if (ipc_cli && (all || some_nt || all_nt_acls)) {
 869                 char *targetpath = NULL;
 870                 struct cli_state *targetcli = NULL;
 871                 struct cli_credentials *creds = NULL;
 872                 NTSTATUS status;
 873
 874                 /* Point to the portion after "system.nt_sec_desc." */
 875                 name += 19;     /* if (all) this will be invalid but unused */
 876
 877                 creds = context->internal->creds;
 878
 879                 status = cli_resolve_path(
 880                         ctx, "",
 881                         creds,
 882                         cli, filename, &targetcli, &targetpath);
 883                 if (!NT_STATUS_IS_OK(status)) {
 884                         DEBUG(5, ("cacl_get Could not resolve %s\n",
 885                                 filename));
 886                         errno = ENOENT;
 887                         return -1;
 888                 }
 889
 890                 /* ... then obtain any NT attributes which were requested */
 891                 status = cli_ntcreate(
 892                         targetcli,              /* cli */
 893                         targetpath,             /* fname */
 894                         0,                      /* CreatFlags */
 895                         READ_CONTROL_ACCESS,    /* DesiredAccess */
 896                         0,                      /* FileAttributes */
 897                         FILE_SHARE_READ|
 898                         FILE_SHARE_WRITE,       /* ShareAccess */
 899                         FILE_OPEN,              /* CreateDisposition */
 900                         0x0,                    /* CreateOptions */
 901                         0x0,                    /* SecurityFlags */
 902                         &fnum,                  /* pfid */
 903                         NULL);                  /* cr */
 904                 if (!NT_STATUS_IS_OK(status)) {
 905                         DEBUG(5, ("cacl_get failed to open %s: %s\n",
 906                                   targetpath, nt_errstr(status)));
 907                         errno = cli_status_to_errno(status);
 908                         return -1;
 909                 }
 910
 911                 status = cli_query_secdesc(targetcli, fnum, ctx, &sd);
 912                 if (!NT_STATUS_IS_OK(status)) {
 913                         DEBUG(5,("cacl_get Failed to query old descriptor "
 914                                  "of %s: %s\n",
 915                                   targetpath, nt_errstr(status)));
 916                         errno = cli_status_to_errno(status);
 917                         return -1;
 918                 }
 919
 920                 cli_close(targetcli, fnum);
 921
 922                 if (! exclude_nt_revision) {
 923                         if (all || all_nt) {
 924                                 if (determine_size) {
 925                                         p = talloc_asprintf(ctx,
 926                                                             "REVISION:%d",
 927                                                             sd->revision);
 928                                         if (!p) {
 929                                                 errno = ENOMEM;
 930                                                 return -1;
 931                                         }
 932                                         n = strlen(p);
 933                                 } else {
 934                                         n = snprintf(buf, bufsize,
 935                                                      "REVISION:%d",
 936                                                      sd->revision);
 937                                 }
 938                         } else if (strcasecmp_m(name, "revision") == 0) {
 939                                 if (determine_size) {
 940                                         p = talloc_asprintf(ctx, "%d",
 941                                                             sd->revision);
 942                                         if (!p) {
 943                                                 errno = ENOMEM;
 944                                                 return -1;
 945                                         }
 946                                         n = strlen(p);
 947                                 } else {
 948                                         n = snprintf(buf, bufsize, "%d",
 949                                                      sd->revision);
 950                                 }
 951                         }
 952
 953                         if (!determine_size && n > bufsize) {
 954                                 errno = ERANGE;
 955                                 return -1;
 956                         }
 957                         buf += n;
 958                         n_used += n;
 959                         bufsize -= n;
 960                         n = 0;
 961                 }
 962
 963                 if (! exclude_nt_owner) {
 964                         /* Get owner and group sid */
 965                         if (sd->owner_sid) {
 966                                 convert_sid_to_string(ipc_cli, pol,
 967                                                       sidstr,
 968                                                       numeric,
 969                                                       sd->owner_sid);
 970                         } else {
 971                                 fstrcpy(sidstr, "");
 972                         }
 973
 974                         if (all || all_nt) {
 975                                 if (determine_size) {
 976                                         p = talloc_asprintf(ctx, ",OWNER:%s",
 977                                                             sidstr);
 978                                         if (!p) {
 979                                                 errno = ENOMEM;
 980                                                 return -1;
 981                                         }
 982                                         n = strlen(p);
 983                                 } else if (sidstr[0] != '\0') {
 984                                         n = snprintf(buf, bufsize,
 985                                                      ",OWNER:%s", sidstr);
 986                                 }
 987                         } else if (strncasecmp_m(name, "owner", 5) == 0) {
 988                                 if (determine_size) {
 989                                         p = talloc_asprintf(ctx, "%s", sidstr);
 990                                         if (!p) {
 991                                                 errno = ENOMEM;
 992                                                 return -1;
 993                                         }
 994                                         n = strlen(p);
 995                                 } else {
 996                                         n = snprintf(buf, bufsize, "%s",
 997                                                      sidstr);
 998                                 }
 999                         }
1000
1001                         if (!determine_size && n > bufsize) {
1002                                 errno = ERANGE;
1003                                 return -1;
1004                         }
1005                         buf += n;
1006                         n_used += n;
1007                         bufsize -= n;
1008                         n = 0;
1009                 }
1010
1011                 if (! exclude_nt_group) {
1012                         if (sd->group_sid) {
1013                                 convert_sid_to_string(ipc_cli, pol,
1014                                                       sidstr, numeric,
1015                                                       sd->group_sid);
1016                         } else {
1017                                 fstrcpy(sidstr, "");
1018                         }
1019
1020                         if (all || all_nt) {
1021                                 if (determine_size) {
1022                                         p = talloc_asprintf(ctx, ",GROUP:%s",
1023                                                             sidstr);
1024                                         if (!p) {
1025                                                 errno = ENOMEM;
1026                                                 return -1;
1027                                         }
1028                                         n = strlen(p);
1029                                 } else if (sidstr[0] != '\0') {
1030                                         n = snprintf(buf, bufsize,
1031                                                      ",GROUP:%s", sidstr);
1032                                 }
1033                         } else if (strncasecmp_m(name, "group", 5) == 0) {
1034                                 if (determine_size) {
1035                                         p = talloc_asprintf(ctx, "%s", sidstr);
1036                                         if (!p) {
1037                                                 errno = ENOMEM;
1038                                                 return -1;
1039                                         }
1040                                         n = strlen(p);
1041                                 } else {
1042                                         n = snprintf(buf, bufsize,
1043                                                      "%s", sidstr);
1044                                 }
1045                         }
1046
1047                         if (!determine_size && n > bufsize) {
1048                                 errno = ERANGE;
1049                                 return -1;
1050                         }
1051                         buf += n;
1052                         n_used += n;
1053                         bufsize -= n;
1054                         n = 0;
1055                 }
1056
1057                 if (! exclude_nt_acl) {
1058                         /* Add aces to value buffer  */
1059                         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
1060
1061                                 struct security_ace *ace = &sd->dacl->aces[i];
1062                                 convert_sid_to_string(ipc_cli, pol,
1063                                                       sidstr, numeric,
1064                                                       &ace->trustee);
1065
1066                                 if (all || all_nt) {
1067                                         if (determine_size) {
1068                                                 p = talloc_asprintf(
1069                                                         ctx,
1070                                                         ",ACL:"
1071                                                         "%s:%d/%d/0x%08x",
1072                                                         sidstr,
1073                                                         ace->type,
1074                                                         ace->flags,
1075                                                         ace->access_mask);
1076                                                 if (!p) {
1077                                                         errno = ENOMEM;
1078                                                         return -1;
1079                                                 }
1080                                                 n = strlen(p);
1081                                         } else {
1082                                                 n = snprintf(
1083                                                         buf, bufsize,
1084                                                         ",ACL:%s:%d/%d/0x%08x",
1085                                                         sidstr,
1086                                                         ace->type,
1087                                                         ace->flags,
1088                                                         ace->access_mask);
1089                                         }
1090                                 } else if ((strncasecmp_m(name, "acl", 3) == 0 &&
1091                                             strcasecmp_m(name+3, sidstr) == 0) ||
1092                                            (strncasecmp_m(name, "acl+", 4) == 0 &&
1093                                             strcasecmp_m(name+4, sidstr) == 0)) {
1094                                         if (determine_size) {
1095                                                 p = talloc_asprintf(
1096                                                         ctx,
1097                                                         "%d/%d/0x%08x",
1098                                                         ace->type,
1099                                                         ace->flags,
1100                                                         ace->access_mask);
1101                                                 if (!p) {
1102                                                         errno = ENOMEM;
1103                                                         return -1;
1104                                                 }
1105                                                 n = strlen(p);
1106                                         } else {
1107                                                 n = snprintf(buf, bufsize,
1108                                                              "%d/%d/0x%08x",
1109                                                              ace->type,
1110                                                              ace->flags,
1111                                                              ace->access_mask);
1112                                         }
1113                                 } else if (all_nt_acls) {
1114                                         if (determine_size) {
1115                                                 p = talloc_asprintf(
1116                                                         ctx,
1117                                                         "%s%s:%d/%d/0x%08x",
1118                                                         i ? "," : "",
1119                                                         sidstr,
1120                                                         ace->type,
1121                                                         ace->flags,
1122                                                         ace->access_mask);
1123                                                 if (!p) {
1124                                                         errno = ENOMEM;
1125                                                         return -1;
1126                                                 }
1127                                                 n = strlen(p);
1128                                         } else {
1129                                                 n = snprintf(buf, bufsize,
1130                                                              "%s%s:%d/%d/0x%08x",
1131                                                              i ? "," : "",
1132                                                              sidstr,
1133                                                              ace->type,
1134                                                              ace->flags,
1135                                                              ace->access_mask);
1136                                         }
1137                                 }
1138                                 if (!determine_size && n > bufsize) {
1139                                         errno = ERANGE;
1140                                         return -1;
1141                                 }
1142                                 buf += n;
1143                                 n_used += n;
1144                                 bufsize -= n;
1145                                 n = 0;
1146                         }
1147                 }
1148
1149                 /* Restore name pointer to its original value */
1150                 name -= 19;
1151         }
1152
1153         if (all || some_dos) {
1154                 struct stat sb = {0};
1155                 time_t create_time = (time_t)0;
1156                 time_t write_time = (time_t)0;
1157                 time_t access_time = (time_t)0;
1158                 time_t change_time = (time_t)0;
1159                 off_t size = 0;
1160                 uint16_t mode = 0;
1161                 SMB_INO_T ino = 0;
1162                 NTSTATUS status;
1163
1164                 /* Point to the portion after "system.dos_attr." */
1165                 name += 16;     /* if (all) this will be invalid but unused */
1166
1167                 /* Obtain the DOS attributes */
1168                 status = SMBC_getatr(context, srv, filename, &sb);
1169                 if (!NT_STATUS_IS_OK(status)) {
1170                         errno = cli_status_to_errno(status);
1171                         return -1;
1172                 }
1173
1174                 create_time = sb.st_ctime;
1175                 access_time = sb.st_atime;
1176                 write_time  = sb.st_mtime;
1177                 change_time = sb.st_mtime;
1178                 size        = sb.st_size;
1179                 mode        = sb.st_mode;
1180                 ino         = sb.st_ino;
1181
1182                 if (! exclude_dos_mode) {
1183                         if (all || all_dos) {
1184                                 if (determine_size) {
1185                                         p = talloc_asprintf(ctx,
1186                                                             "%sMODE:0x%x",
1187                                                             (ipc_cli &&
1188                                                              (all || some_nt)
1189                                                              ? ","
1190                                                              : ""),
1191                                                             mode);
1192                                         if (!p) {
1193                                                 errno = ENOMEM;
1194                                                 return -1;
1195                                         }
1196                                         n = strlen(p);
1197                                 } else {
1198                                         n = snprintf(buf, bufsize,
1199                                                      "%sMODE:0x%x",
1200                                                      (ipc_cli &&
1201                                                       (all || some_nt)
1202                                                       ? ","
1203                                                       : ""),
1204                                                      mode);
1205                                 }
1206                         } else if (strcasecmp_m(name, "mode") == 0) {
1207                                 if (determine_size) {
1208                                         p = talloc_asprintf(ctx, "0x%x", mode);
1209                                         if (!p) {
1210                                                 errno = ENOMEM;
1211                                                 return -1;
1212                                         }
1213                                         n = strlen(p);
1214                                 } else {
1215                                         n = snprintf(buf, bufsize,
1216                                                      "0x%x", mode);
1217                                 }
1218                         }
1219
1220                         if (!determine_size && n > bufsize) {
1221                                 errno = ERANGE;
1222                                 return -1;
1223                         }
1224                         buf += n;
1225                         n_used += n;
1226                         bufsize -= n;
1227                         n = 0;
1228                 }
1229
1230                 if (! exclude_dos_size) {
1231                         if (all || all_dos) {
1232                                 if (determine_size) {
1233                                         p = talloc_asprintf(
1234                                                 ctx,
1235                                                 ",SIZE:%.0f",
1236                                                 (double)size);
1237                                         if (!p) {
1238                                                 errno = ENOMEM;
1239                                                 return -1;
1240                                         }
1241                                         n = strlen(p);
1242                                 } else {
1243                                         n = snprintf(buf, bufsize,
1244                                                      ",SIZE:%.0f",
1245                                                      (double)size);
1246                                 }
1247                         } else if (strcasecmp_m(name, "size") == 0) {
1248                                 if (determine_size) {
1249                                         p = talloc_asprintf(
1250                                                 ctx,
1251                                                 "%.0f",
1252                                                 (double)size);
1253                                         if (!p) {
1254                                                 errno = ENOMEM;
1255                                                 return -1;
1256                                         }
1257                                         n = strlen(p);
1258                                 } else {
1259                                         n = snprintf(buf, bufsize,
1260                                                      "%.0f",
1261                                                      (double)size);
1262                                 }
1263                         }
1264
1265                         if (!determine_size && n > bufsize) {
1266                                 errno = ERANGE;
1267                                 return -1;
1268                         }
1269                         buf += n;
1270                         n_used += n;
1271                         bufsize -= n;
1272                         n = 0;
1273                 }
1274
1275                 if (! exclude_dos_create_time &&
1276                     attr_strings.create_time_attr != NULL) {
1277                         if (all || all_dos) {
1278                                 if (determine_size) {
1279                                         p = talloc_asprintf(ctx,
1280                                                             ",%s:%lu",
1281                                                             attr_strings.create_time_attr,
1282                                                             (unsigned long) create_time);
1283                                         if (!p) {
1284                                                 errno = ENOMEM;
1285                                                 return -1;
1286                                         }
1287                                         n = strlen(p);
1288                                 } else {
1289                                         n = snprintf(buf, bufsize,
1290                                                      ",%s:%lu",
1291                                                      attr_strings.create_time_attr,
1292                                                      (unsigned long) create_time);
1293                                 }
1294                         } else if (strcasecmp_m(name, attr_strings.create_time_attr) == 0) {
1295                                 if (determine_size) {
1296                                         p = talloc_asprintf(ctx, "%lu", (unsigned long) create_time);
1297                                         if (!p) {
1298                                                 errno = ENOMEM;
1299                                                 return -1;
1300                                         }
1301                                         n = strlen(p);
1302                                 } else {
1303                                         n = snprintf(buf, bufsize,
1304                                                      "%lu", (unsigned long) create_time);
1305                                 }
1306                         }
1307
1308                         if (!determine_size && n > bufsize) {
1309                                 errno = ERANGE;
1310                                 return -1;
1311                         }
1312                         buf += n;
1313                         n_used += n;
1314                         bufsize -= n;
1315                         n = 0;
1316                 }
1317
1318                 if (! exclude_dos_access_time) {
1319                         if (all || all_dos) {
1320                                 if (determine_size) {
1321                                         p = talloc_asprintf(ctx,
1322                                                             ",%s:%lu",
1323                                                             attr_strings.access_time_attr,
1324                                                             (unsigned long) access_time);
1325                                         if (!p) {
1326                                                 errno = ENOMEM;
1327                                                 return -1;
1328                                         }
1329                                         n = strlen(p);
1330                                 } else {
1331                                         n = snprintf(buf, bufsize,
1332                                                      ",%s:%lu",
1333                                                      attr_strings.access_time_attr,
1334                                                      (unsigned long) access_time);
1335                                 }
1336                         } else if (strcasecmp_m(name, attr_strings.access_time_attr) == 0) {
1337                                 if (determine_size) {
1338                                         p = talloc_asprintf(ctx, "%lu", (unsigned long) access_time);
1339                                         if (!p) {
1340                                                 errno = ENOMEM;
1341                                                 return -1;
1342                                         }
1343                                         n = strlen(p);
1344                                 } else {
1345                                         n = snprintf(buf, bufsize,
1346                                                      "%lu", (unsigned long) access_time);
1347                                 }
1348                         }
1349
1350                         if (!determine_size && n > bufsize) {
1351                                 errno = ERANGE;
1352                                 return -1;
1353                         }
1354                         buf += n;
1355                         n_used += n;
1356                         bufsize -= n;
1357                         n = 0;
1358                 }
1359
1360                 if (! exclude_dos_write_time) {
1361                         if (all || all_dos) {
1362                                 if (determine_size) {
1363                                         p = talloc_asprintf(ctx,
1364                                                             ",%s:%lu",
1365                                                             attr_strings.write_time_attr,
1366                                                             (unsigned long) write_time);
1367                                         if (!p) {
1368                                                 errno = ENOMEM;
1369                                                 return -1;
1370                                         }
1371                                         n = strlen(p);
1372                                 } else {
1373                                         n = snprintf(buf, bufsize,
1374                                                      ",%s:%lu",
1375                                                      attr_strings.write_time_attr,
1376                                                      (unsigned long) write_time);
1377                                 }
1378                         } else if (strcasecmp_m(name, attr_strings.write_time_attr) == 0) {
1379                                 if (determine_size) {
1380                                         p = talloc_asprintf(ctx, "%lu", (unsigned long) write_time);
1381                                         if (!p) {
1382                                                 errno = ENOMEM;
1383                                                 return -1;
1384                                         }
1385                                         n = strlen(p);
1386                                 } else {
1387                                         n = snprintf(buf, bufsize,
1388                                                      "%lu", (unsigned long) write_time);
1389                                 }
1390                         }
1391
1392                         if (!determine_size && n > bufsize) {
1393                                 errno = ERANGE;
1394                                 return -1;
1395                         }
1396                         buf += n;
1397                         n_used += n;
1398                         bufsize -= n;
1399                         n = 0;
1400                 }
1401
1402                 if (! exclude_dos_change_time) {
1403                         if (all || all_dos) {
1404                                 if (determine_size) {
1405                                         p = talloc_asprintf(ctx,
1406                                                             ",%s:%lu",
1407                                                             attr_strings.change_time_attr,
1408                                                             (unsigned long) change_time);
1409                                         if (!p) {
1410                                                 errno = ENOMEM;
1411                                                 return -1;
1412                                         }
1413                                         n = strlen(p);
1414                                 } else {
1415                                         n = snprintf(buf, bufsize,
1416                                                      ",%s:%lu",
1417                                                      attr_strings.change_time_attr,
1418                                                      (unsigned long) change_time);
1419                                 }
1420                         } else if (strcasecmp_m(name, attr_strings.change_time_attr) == 0) {
1421                                 if (determine_size) {
1422                                         p = talloc_asprintf(ctx, "%lu", (unsigned long) change_time);
1423                                         if (!p) {
1424                                                 errno = ENOMEM;
1425                                                 return -1;
1426                                         }
1427                                         n = strlen(p);
1428                                 } else {
1429                                         n = snprintf(buf, bufsize,
1430                                                      "%lu", (unsigned long) change_time);
1431                                 }
1432                         }
1433
1434                         if (!determine_size && n > bufsize) {
1435                                 errno = ERANGE;
1436                                 return -1;
1437                         }
1438                         buf += n;
1439                         n_used += n;
1440                         bufsize -= n;
1441                         n = 0;
1442                 }
1443
1444                 if (! exclude_dos_inode) {
1445                         if (all || all_dos) {
1446                                 if (determine_size) {
1447                                         p = talloc_asprintf(
1448                                                 ctx,
1449                                                 ",INODE:%.0f",
1450                                                 (double)ino);
1451                                         if (!p) {
1452                                                 errno = ENOMEM;
1453                                                 return -1;
1454                                         }
1455                                         n = strlen(p);
1456                                 } else {
1457                                         n = snprintf(buf, bufsize,
1458                                                      ",INODE:%.0f",
1459                                                      (double) ino);
1460                                 }
1461                         } else if (strcasecmp_m(name, "inode") == 0) {
1462                                 if (determine_size) {
1463                                         p = talloc_asprintf(
1464                                                 ctx,
1465                                                 "%.0f",
1466                                                 (double) ino);
1467                                         if (!p) {
1468                                                 errno = ENOMEM;
1469                                                 return -1;
1470                                         }
1471                                         n = strlen(p);
1472                                 } else {
1473                                         n = snprintf(buf, bufsize,
1474                                                      "%.0f",
1475                                                      (double) ino);
1476                                 }
1477                         }
1478
1479                         if (!determine_size && n > bufsize) {
1480                                 errno = ERANGE;
1481                                 return -1;
1482                         }
1483                         buf += n;
1484                         n_used += n;
1485                         bufsize -= n;
1486                         n = 0;
1487                 }
1488
1489                 /* Restore name pointer to its original value */
1490                 name -= 16;
1491         }
1492
1493         if (n_used == 0) {
1494                 errno = ENOATTR;
1495                 return -1;
1496         }
1497
1498         return n_used;
1499 }
1500
1501 /*****************************************************
1502 set the ACLs on a file given an ascii description
1503 *******************************************************/
1504 static int
1505 cacl_set(SMBCCTX *context,
1506         TALLOC_CTX *ctx,
1507         struct cli_state *cli,
1508         struct cli_state *ipc_cli,
1509         struct policy_handle *pol,
1510         const char *filename,
1511         char *the_acl,
1512         int mode,
1513         int flags)
1514 {
1515         uint16_t fnum = (uint16_t)-1;
1516         int err = 0;
1517         struct security_descriptor *sd = NULL, *old;
1518         struct security_acl *dacl = NULL;
1519         struct dom_sid *owner_sid = NULL;
1520         struct dom_sid *group_sid = NULL;
1521         uint32_t i, j;
1522         size_t sd_size;
1523         int ret = 0;
1524         char *p;
1525         bool numeric = True;
1526         char *targetpath = NULL;
1527         struct cli_state *targetcli = NULL;
1528         struct cli_credentials *creds = NULL;
1529         NTSTATUS status;
1530
1531         /* the_acl will be null for REMOVE_ALL operations */
1532         if (the_acl) {
1533                 numeric = ((p = strchr(the_acl, ':')) != NULL &&
1534                            p > the_acl &&
1535                            p[-1] != '+');
1536
1537                 /* if this is to set the entire ACL... */
1538                 if (*the_acl == '*') {
1539                         /* ... then increment past the first colon */
1540                         the_acl = p + 1;
1541                 }
1542
1543                 sd = sec_desc_parse(ctx, ipc_cli, pol, numeric, the_acl);
1544                 if (!sd) {
1545                         errno = EINVAL;
1546                         return -1;
1547                 }
1548         }
1549
1550         /* SMBC_XATTR_MODE_REMOVE_ALL is the only caller
1551            that doesn't deref sd */
1552
1553         if (!sd && (mode != SMBC_XATTR_MODE_REMOVE_ALL)) {
1554                 errno = EINVAL;
1555                 return -1;
1556         }
1557
1558         creds = context->internal->creds;
1559
1560         status = cli_resolve_path(ctx, "",
1561                                   creds,
1562                                   cli, filename, &targetcli, &targetpath);
1563         if (!NT_STATUS_IS_OK(status)) {
1564                 DEBUG(5,("cacl_set: Could not resolve %s\n", filename));
1565                 errno = ENOENT;
1566                 return -1;
1567         }
1568
1569         /* The desired access below is the only one I could find that works
1570            with NT4, W2KP and Samba */
1571
1572         status = cli_ntcreate(
1573                 targetcli,              /* cli */
1574                 targetpath,             /* fname */
1575                 0,                      /* CreatFlags */
1576                 READ_CONTROL_ACCESS,    /* DesiredAccess */
1577                 0,                      /* FileAttributes */
1578                 FILE_SHARE_READ|
1579                 FILE_SHARE_WRITE,       /* ShareAccess */
1580                 FILE_OPEN,              /* CreateDisposition */
1581                 0x0,                    /* CreateOptions */
1582                 0x0,                    /* SecurityFlags */
1583                 &fnum,                  /* pfid */
1584                 NULL);                  /* cr */
1585         if (!NT_STATUS_IS_OK(status)) {
1586                 DEBUG(5, ("cacl_set failed to open %s: %s\n",
1587                           targetpath, nt_errstr(status)));
1588                 errno = 0;
1589                 return -1;
1590         }
1591
1592         status = cli_query_secdesc(targetcli, fnum, ctx, &old);
1593         if (!NT_STATUS_IS_OK(status)) {
1594                 DEBUG(5,("cacl_set Failed to query old descriptor of %s: %s\n",
1595                          targetpath, nt_errstr(status)));
1596                 errno = 0;
1597                 return -1;
1598         }
1599
1600         cli_close(targetcli, fnum);
1601
1602         switch (mode) {
1603         case SMBC_XATTR_MODE_REMOVE_ALL:
1604                 old->dacl->num_aces = 0;
1605                 dacl = old->dacl;
1606                 break;
1607
1608         case SMBC_XATTR_MODE_REMOVE:
1609                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
1610                         bool found = False;
1611
1612                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
1613                                 if (security_ace_equal(&sd->dacl->aces[i],
1614                                                        &old->dacl->aces[j])) {
1615                                         uint32_t k;
1616                                         for (k=j; k<old->dacl->num_aces-1;k++) {
1617                                                 old->dacl->aces[k] =
1618                                                         old->dacl->aces[k+1];
1619                                         }
1620                                         old->dacl->num_aces--;
1621                                         found = True;
1622                                         dacl = old->dacl;
1623                                         break;
1624                                 }
1625                         }
1626
1627                         if (!found) {
1628                                 err = ENOATTR;
1629                                 ret = -1;
1630                                 goto failed;
1631                         }
1632                 }
1633                 break;
1634
1635         case SMBC_XATTR_MODE_ADD:
1636                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
1637                         bool found = False;
1638
1639                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
1640                                 if (dom_sid_equal(&sd->dacl->aces[i].trustee,
1641                                               &old->dacl->aces[j].trustee)) {
1642                                         if (!(flags & SMBC_XATTR_FLAG_CREATE)) {
1643                                                 err = EEXIST;
1644                                                 ret = -1;
1645                                                 goto failed;
1646                                         }
1647                                         old->dacl->aces[j] = sd->dacl->aces[i];
1648                                         ret = -1;
1649                                         found = True;
1650                                 }
1651                         }
1652
1653                         if (!found && (flags & SMBC_XATTR_FLAG_REPLACE)) {
1654                                 err = ENOATTR;
1655                                 ret = -1;
1656                                 goto failed;
1657                         }
1658
1659                         for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
1660                                 add_ace(&old->dacl, &sd->dacl->aces[i], ctx);
1661                         }
1662                 }
1663                 dacl = old->dacl;
1664                 break;
1665
1666         case SMBC_XATTR_MODE_SET:
1667                 old = sd;
1668                 owner_sid = old->owner_sid;
1669                 group_sid = old->group_sid;
1670                 dacl = old->dacl;
1671                 break;
1672
1673         case SMBC_XATTR_MODE_CHOWN:
1674                 owner_sid = sd->owner_sid;
1675                 break;
1676
1677         case SMBC_XATTR_MODE_CHGRP:
1678                 group_sid = sd->group_sid;
1679                 break;
1680         }
1681
1682         /* Denied ACE entries must come before allowed ones */
1683         sort_acl(old->dacl);
1684
1685         /* Create new security descriptor and set it */
1686         sd = make_sec_desc(ctx, old->revision, SEC_DESC_SELF_RELATIVE,
1687                            owner_sid, group_sid, NULL, dacl, &sd_size);
1688
1689         status = cli_ntcreate(targetcli, targetpath, 0,
1690                               WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS, 0,
1691                               FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN,
1692                               0x0, 0x0, &fnum, NULL);
1693         if (!NT_STATUS_IS_OK(status)) {
1694                 DEBUG(5, ("cacl_set failed to open %s: %s\n",
1695                           targetpath, nt_errstr(status)));
1696                 errno = 0;
1697                 return -1;
1698         }
1699
1700         status = cli_set_secdesc(targetcli, fnum, sd);
1701         if (!NT_STATUS_IS_OK(status)) {
1702                 DEBUG(5, ("ERROR: secdesc set failed: %s\n",
1703                           nt_errstr(status)));
1704                 ret = -1;
1705         }
1706
1707         /* Clean up */
1708
1709 failed:
1710         cli_close(targetcli, fnum);
1711
1712         if (err != 0) {
1713                 errno = err;
1714         }
1715
1716         return ret;
1717 }
1718
1719
1720 int
1721 SMBC_setxattr_ctx(SMBCCTX *context,
1722                   const char *fname,
1723                   const char *name,
1724                   const void *value,
1725                   size_t size,
1726                   int flags)
1727 {
1728         int ret;
1729         int ret2;
1730         SMBCSRV *srv = NULL;
1731         SMBCSRV *ipc_srv = NULL;
1732         char *server = NULL;
1733         char *share = NULL;
1734         char *user = NULL;
1735         char *password = NULL;
1736         char *workgroup = NULL;
1737         char *path = NULL;
1738         struct DOS_ATTR_DESC *dad = NULL;
1739         struct {
1740                 const char * create_time_attr;
1741                 const char * access_time_attr;
1742                 const char * write_time_attr;
1743                 const char * change_time_attr;
1744         } attr_strings;
1745         uint16_t port = 0;
1746         TALLOC_CTX *frame = talloc_stackframe();
1747
1748         if (!context || !context->internal->initialized) {
1749                 errno = EINVAL;  /* Best I can think of ... */
1750                 TALLOC_FREE(frame);
1751                 return -1;
1752         }
1753
1754         if (!fname) {
1755                 errno = EINVAL;
1756                 TALLOC_FREE(frame);
1757                 return -1;
1758         }
1759
1760         DEBUG(4, ("smbc_setxattr(%s, %s, %.*s)\n",
1761                   fname, name, (int) size, (const char*)value));
1762
1763         if (SMBC_parse_path(frame,
1764                             context,
1765                             fname,
1766                             &workgroup,
1767                             &server,
1768                             &port,
1769                             &share,
1770                             &path,
1771                             &user,
1772                             &password,
1773                             NULL)) {
1774                 errno = EINVAL;
1775                 TALLOC_FREE(frame);
1776                 return -1;
1777         }
1778
1779         if (!user || user[0] == (char)0) {
1780                 user = talloc_strdup(frame, smbc_getUser(context));
1781                 if (!user) {
1782                         errno = ENOMEM;
1783                         TALLOC_FREE(frame);
1784                         return -1;
1785                 }
1786         }
1787
1788         srv = SMBC_server(frame, context, True,
1789                           server, port, share, &workgroup, &user, &password);
1790         if (!srv) {
1791                 TALLOC_FREE(frame);
1792                 return -1;  /* errno set by SMBC_server */
1793         }
1794
1795         if (! srv->no_nt_session) {
1796                 ipc_srv = SMBC_attr_server(frame, context, server, port, share,
1797                                            &workgroup, &user, &password);
1798                 if (! ipc_srv) {
1799                         srv->no_nt_session = True;
1800                 }
1801         } else {
1802                 ipc_srv = NULL;
1803         }
1804
1805         /*
1806          * Are they asking to set the entire set of known attributes?
1807          */
1808         if (strcasecmp_m(name, "system.*") == 0 ||
1809             strcasecmp_m(name, "system.*+") == 0) {
1810                 /* Yup. */
1811                 char *namevalue =
1812                         talloc_asprintf(talloc_tos(), "%s:%s",
1813                                         name+7, (const char *) value);
1814                 if (! namevalue) {
1815                         errno = ENOMEM;
1816                         ret = -1;
1817                         TALLOC_FREE(frame);
1818                         return -1;
1819                 }
1820
1821                 if (ipc_srv) {
1822                         ret = cacl_set(context, talloc_tos(), srv->cli,
1823                                        ipc_srv->cli, &ipc_srv->pol, path,
1824                                        namevalue,
1825                                        (*namevalue == '*'
1826                                         ? SMBC_XATTR_MODE_SET
1827                                         : SMBC_XATTR_MODE_ADD),
1828                                        flags);
1829                 } else {
1830                         ret = 0;
1831                 }
1832
1833                 /* get a DOS Attribute Descriptor with current attributes */
1834                 dad = dos_attr_query(context, talloc_tos(), path, srv);
1835                 if (dad) {
1836                         bool ok;
1837
1838                         /* Overwrite old with new, using what was provided */
1839                         dos_attr_parse(context, dad, srv, namevalue);
1840
1841                         /* Set the new DOS attributes */
1842                         ok = SMBC_setatr(
1843                                 context,
1844                                 srv,
1845                                 path,
1846                                 (struct timespec) {
1847                                         .tv_sec = dad->create_time },
1848                                 (struct timespec) {
1849                                         .tv_sec = dad->access_time },
1850                                 (struct timespec) {
1851                                         .tv_sec = dad->write_time },
1852                                 (struct timespec) {
1853                                         .tv_sec = dad->change_time },
1854                                 dad->mode);
1855                         if (!ok) {
1856                                 /* cause failure if NT failed too */
1857                                 dad = NULL;
1858                         }
1859                 }
1860
1861                 /* we only fail if both NT and DOS sets failed */
1862                 if (ret < 0 && ! dad) {
1863                         ret = -1; /* in case dad was null */
1864                 }
1865                 else {
1866                         ret = 0;
1867                 }
1868
1869                 TALLOC_FREE(frame);
1870                 return ret;
1871         }
1872
1873         /*
1874          * Are they asking to set an access control element or to set
1875          * the entire access control list?
1876          */
1877         if (strcasecmp_m(name, "system.nt_sec_desc.*") == 0 ||
1878             strcasecmp_m(name, "system.nt_sec_desc.*+") == 0 ||
1879             strcasecmp_m(name, "system.nt_sec_desc.revision") == 0 ||
1880             strncasecmp_m(name, "system.nt_sec_desc.acl", 22) == 0 ||
1881             strncasecmp_m(name, "system.nt_sec_desc.acl+", 23) == 0) {
1882
1883                 /* Yup. */
1884                 char *namevalue =
1885                         talloc_asprintf(talloc_tos(), "%s:%s",
1886                                         name+19, (const char *) value);
1887
1888                 if (! ipc_srv) {
1889                         ret = -1; /* errno set by SMBC_server() */
1890                 }
1891                 else if (! namevalue) {
1892                         errno = ENOMEM;
1893                         ret = -1;
1894                 } else {
1895                         ret = cacl_set(context, talloc_tos(), srv->cli,
1896                                        ipc_srv->cli, &ipc_srv->pol, path,
1897                                        namevalue,
1898                                        (*namevalue == '*'
1899                                         ? SMBC_XATTR_MODE_SET
1900                                         : SMBC_XATTR_MODE_ADD),
1901                                        flags);
1902                 }
1903                 TALLOC_FREE(frame);
1904                 return ret;
1905         }
1906
1907         /*
1908          * Are they asking to set the owner?
1909          */
1910         if (strcasecmp_m(name, "system.nt_sec_desc.owner") == 0 ||
1911             strcasecmp_m(name, "system.nt_sec_desc.owner+") == 0) {
1912
1913                 /* Yup. */
1914                 char *namevalue =
1915                         talloc_asprintf(talloc_tos(), "%s:%s",
1916                                         name+19, (const char *) value);
1917
1918                 if (! ipc_srv) {
1919                         ret = -1; /* errno set by SMBC_server() */
1920                 }
1921                 else if (! namevalue) {
1922                         errno = ENOMEM;
1923                         ret = -1;
1924                 } else {
1925                         ret = cacl_set(context, talloc_tos(), srv->cli,
1926                                        ipc_srv->cli, &ipc_srv->pol, path,
1927                                        namevalue, SMBC_XATTR_MODE_CHOWN, 0);
1928                 }
1929                 TALLOC_FREE(frame);
1930                 return ret;
1931         }
1932
1933         /*
1934          * Are they asking to set the group?
1935          */
1936         if (strcasecmp_m(name, "system.nt_sec_desc.group") == 0 ||
1937             strcasecmp_m(name, "system.nt_sec_desc.group+") == 0) {
1938
1939                 /* Yup. */
1940                 char *namevalue =
1941                         talloc_asprintf(talloc_tos(), "%s:%s",
1942                                         name+19, (const char *) value);
1943
1944                 if (! ipc_srv) {
1945                         /* errno set by SMBC_server() */
1946                         ret = -1;
1947                 }
1948                 else if (! namevalue) {
1949                         errno = ENOMEM;
1950                         ret = -1;
1951                 } else {
1952                         ret = cacl_set(context, talloc_tos(), srv->cli,
1953                                        ipc_srv->cli, &ipc_srv->pol, path,
1954                                        namevalue, SMBC_XATTR_MODE_CHGRP, 0);
1955                 }
1956                 TALLOC_FREE(frame);
1957                 return ret;
1958         }
1959
1960         /* Determine whether to use old-style or new-style attribute names */
1961         if (context->internal->full_time_names) {
1962                 /* new-style names */
1963                 attr_strings.create_time_attr = "system.dos_attr.CREATE_TIME";
1964                 attr_strings.access_time_attr = "system.dos_attr.ACCESS_TIME";
1965                 attr_strings.write_time_attr = "system.dos_attr.WRITE_TIME";
1966                 attr_strings.change_time_attr = "system.dos_attr.CHANGE_TIME";
1967         } else {
1968                 /* old-style names */
1969                 attr_strings.create_time_attr = NULL;
1970                 attr_strings.access_time_attr = "system.dos_attr.A_TIME";
1971                 attr_strings.write_time_attr = "system.dos_attr.M_TIME";
1972                 attr_strings.change_time_attr = "system.dos_attr.C_TIME";
1973         }
1974
1975         /*
1976          * Are they asking to set a DOS attribute?
1977          */
1978         if (strcasecmp_m(name, "system.dos_attr.*") == 0 ||
1979             strcasecmp_m(name, "system.dos_attr.mode") == 0 ||
1980             (attr_strings.create_time_attr != NULL &&
1981              strcasecmp_m(name, attr_strings.create_time_attr) == 0) ||
1982             strcasecmp_m(name, attr_strings.access_time_attr) == 0 ||
1983             strcasecmp_m(name, attr_strings.write_time_attr) == 0 ||
1984             strcasecmp_m(name, attr_strings.change_time_attr) == 0) {
1985
1986                 /* get a DOS Attribute Descriptor with current attributes */
1987                 dad = dos_attr_query(context, talloc_tos(), path, srv);
1988                 if (dad) {
1989                         char *namevalue =
1990                                 talloc_asprintf(talloc_tos(), "%s:%s",
1991                                                 name+16, (const char *) value);
1992                         if (! namevalue) {
1993                                 errno = ENOMEM;
1994                                 ret = -1;
1995                         } else {
1996                                 /* Overwrite old with provided new params */
1997                                 dos_attr_parse(context, dad, srv, namevalue);
1998
1999                                 /* Set the new DOS attributes */
2000                                 ret2 = SMBC_setatr(
2001                                         context,
2002                                         srv,
2003                                         path,
2004                                         (struct timespec) {
2005                                                 .tv_sec = dad->create_time },
2006                                         (struct timespec) {
2007                                                 .tv_sec = dad->access_time },
2008                                         (struct timespec) {
2009                                                 .tv_sec = dad->write_time },
2010                                         (struct timespec) {
2011                                                 .tv_sec = dad->change_time },
2012                                         dad->mode);
2013
2014                                 /* ret2 has True (success) / False (failure) */
2015                                 if (ret2) {
2016                                         ret = 0;
2017                                 } else {
2018                                         ret = -1;
2019                                 }
2020                         }
2021                 } else {
2022                         ret = -1;
2023                 }
2024
2025                 TALLOC_FREE(frame);
2026                 return ret;
2027         }
2028
2029         /* Unsupported attribute name */
2030         errno = EINVAL;
2031         TALLOC_FREE(frame);
2032         return -1;
2033 }
2034
2035 int
2036 SMBC_getxattr_ctx(SMBCCTX *context,
2037                   const char *fname,
2038                   const char *name,
2039                   const void *value,
2040                   size_t size)
2041 {
2042         int ret;
2043         SMBCSRV *srv = NULL;
2044         SMBCSRV *ipc_srv = NULL;
2045         char *server = NULL;
2046         char *share = NULL;
2047         char *user = NULL;
2048         char *password = NULL;
2049         char *workgroup = NULL;
2050         char *path = NULL;
2051         struct {
2052                 const char * create_time_attr;
2053                 const char * access_time_attr;
2054                 const char * write_time_attr;
2055                 const char * change_time_attr;
2056         } attr_strings;
2057         uint16_t port = 0;
2058         TALLOC_CTX *frame = talloc_stackframe();
2059
2060         if (!context || !context->internal->initialized) {
2061                 errno = EINVAL;  /* Best I can think of ... */
2062                 TALLOC_FREE(frame);
2063                 return -1;
2064         }
2065
2066         if (!fname) {
2067                 errno = EINVAL;
2068                 TALLOC_FREE(frame);
2069                 return -1;
2070         }
2071
2072         DEBUG(4, ("smbc_getxattr(%s, %s)\n", fname, name));
2073
2074         if (SMBC_parse_path(frame,
2075                             context,
2076                             fname,
2077                             &workgroup,
2078                             &server,
2079                             &port,
2080                             &share,
2081                             &path,
2082                             &user,
2083                             &password,
2084                             NULL)) {
2085                 errno = EINVAL;
2086                 TALLOC_FREE(frame);
2087                 return -1;
2088         }
2089
2090         if (!user || user[0] == '\0') {
2091                 user = talloc_strdup(frame, smbc_getUser(context));
2092                 if (!user) {
2093                         errno = ENOMEM;
2094                         TALLOC_FREE(frame);
2095                         return -1;
2096                 }
2097         }
2098
2099         srv = SMBC_server(frame, context, True,
2100                           server, port, share, &workgroup, &user, &password);
2101         if (!srv) {
2102                 TALLOC_FREE(frame);
2103                 return -1;  /* errno set by SMBC_server */
2104         }
2105
2106         if (! srv->no_nt_session) {
2107                 ipc_srv = SMBC_attr_server(frame, context, server, port, share,
2108                                            &workgroup, &user, &password);
2109                 /*
2110                  * SMBC_attr_server() can cause the original
2111                  * server to be removed from the cache.
2112                  * If so we must error out here as the srv
2113                  * pointer has been freed.
2114                  */
2115                 if (smbc_getFunctionGetCachedServer(context)(context,
2116                                 server,
2117                                 share,
2118                                 workgroup,
2119                                 user) != srv) {
2120 #if defined(ECONNRESET)
2121                         errno = ECONNRESET;
2122 #else
2123                         errno = ETIMEDOUT;
2124 #endif
2125                         TALLOC_FREE(frame);
2126                         return -1;
2127                 }
2128                 if (! ipc_srv) {
2129                         srv->no_nt_session = True;
2130                 }
2131         } else {
2132                 ipc_srv = NULL;
2133         }
2134
2135         /* Determine whether to use old-style or new-style attribute names */
2136         if (context->internal->full_time_names) {
2137                 /* new-style names */
2138                 attr_strings.create_time_attr = "system.dos_attr.CREATE_TIME";
2139                 attr_strings.access_time_attr = "system.dos_attr.ACCESS_TIME";
2140                 attr_strings.write_time_attr = "system.dos_attr.WRITE_TIME";
2141                 attr_strings.change_time_attr = "system.dos_attr.CHANGE_TIME";
2142         } else {
2143                 /* old-style names */
2144                 attr_strings.create_time_attr = NULL;
2145                 attr_strings.access_time_attr = "system.dos_attr.A_TIME";
2146                 attr_strings.write_time_attr = "system.dos_attr.M_TIME";
2147                 attr_strings.change_time_attr = "system.dos_attr.C_TIME";
2148         }
2149
2150         /* Are they requesting a supported attribute? */
2151         if (strcasecmp_m(name, "system.*") == 0 ||
2152             strncasecmp_m(name, "system.*!", 9) == 0 ||
2153             strcasecmp_m(name, "system.*+") == 0 ||
2154             strncasecmp_m(name, "system.*+!", 10) == 0 ||
2155             strcasecmp_m(name, "system.nt_sec_desc.*") == 0 ||
2156             strncasecmp_m(name, "system.nt_sec_desc.*!", 21) == 0 ||
2157             strcasecmp_m(name, "system.nt_sec_desc.*+") == 0 ||
2158             strncasecmp_m(name, "system.nt_sec_desc.*+!", 22) == 0 ||
2159             strcasecmp_m(name, "system.nt_sec_desc.revision") == 0 ||
2160             strcasecmp_m(name, "system.nt_sec_desc.owner") == 0 ||
2161             strcasecmp_m(name, "system.nt_sec_desc.owner+") == 0 ||
2162             strcasecmp_m(name, "system.nt_sec_desc.group") == 0 ||
2163             strcasecmp_m(name, "system.nt_sec_desc.group+") == 0 ||
2164             strncasecmp_m(name, "system.nt_sec_desc.acl", 22) == 0 ||
2165             strncasecmp_m(name, "system.nt_sec_desc.acl+", 23) == 0 ||
2166             strcasecmp_m(name, "system.dos_attr.*") == 0 ||
2167             strncasecmp_m(name, "system.dos_attr.*!", 18) == 0 ||
2168             strcasecmp_m(name, "system.dos_attr.mode") == 0 ||
2169             strcasecmp_m(name, "system.dos_attr.size") == 0 ||
2170             (attr_strings.create_time_attr != NULL &&
2171              strcasecmp_m(name, attr_strings.create_time_attr) == 0) ||
2172             strcasecmp_m(name, attr_strings.access_time_attr) == 0 ||
2173             strcasecmp_m(name, attr_strings.write_time_attr) == 0 ||
2174             strcasecmp_m(name, attr_strings.change_time_attr) == 0 ||
2175             strcasecmp_m(name, "system.dos_attr.inode") == 0) {
2176
2177                 /* Yup. */
2178                 const char *filename = name;
2179                 ret = cacl_get(context, talloc_tos(), srv,
2180                                ipc_srv == NULL ? NULL : ipc_srv->cli,
2181                                &ipc_srv->pol, path,
2182                                filename,
2183                                discard_const_p(char, value),
2184                                size);
2185                 TALLOC_FREE(frame);
2186                 /*
2187                  * static function cacl_get returns a value greater than zero
2188                  * which is needed buffer size needed when size_t is 0.
2189                  */
2190                 return ret;
2191         }
2192
2193         /* Unsupported attribute name */
2194         errno = EINVAL;
2195         TALLOC_FREE(frame);
2196         return -1;
2197 }
2198
2199
2200 int
2201 SMBC_removexattr_ctx(SMBCCTX *context,
2202                      const char *fname,
2203                      const char *name)
2204 {
2205         int ret;
2206         SMBCSRV *srv = NULL;
2207         SMBCSRV *ipc_srv = NULL;
2208         char *server = NULL;
2209         char *share = NULL;
2210         char *user = NULL;
2211         char *password = NULL;
2212         char *workgroup = NULL;
2213         char *path = NULL;
2214         uint16_t port = 0;
2215         TALLOC_CTX *frame = talloc_stackframe();
2216
2217         if (!context || !context->internal->initialized) {
2218                 errno = EINVAL;  /* Best I can think of ... */
2219                 TALLOC_FREE(frame);
2220                 return -1;
2221         }
2222
2223         if (!fname) {
2224                 errno = EINVAL;
2225                 TALLOC_FREE(frame);
2226                 return -1;
2227         }
2228
2229         DEBUG(4, ("smbc_removexattr(%s, %s)\n", fname, name));
2230
2231         if (SMBC_parse_path(frame,
2232                             context,
2233                             fname,
2234                             &workgroup,
2235                             &server,
2236                             &port,
2237                             &share,
2238                             &path,
2239                             &user,
2240                             &password,
2241                             NULL)) {
2242                 errno = EINVAL;
2243                 TALLOC_FREE(frame);
2244                 return -1;
2245         }
2246
2247         if (!user || user[0] == (char)0) {
2248                 user = talloc_strdup(frame, smbc_getUser(context));
2249                 if (!user) {
2250                         errno = ENOMEM;
2251                         TALLOC_FREE(frame);
2252                         return -1;
2253                 }
2254         }
2255
2256         srv = SMBC_server(frame, context, True,
2257                           server, port, share, &workgroup, &user, &password);
2258         if (!srv) {
2259                 TALLOC_FREE(frame);
2260                 return -1;  /* errno set by SMBC_server */
2261         }
2262
2263         if (! srv->no_nt_session) {
2264                 int saved_errno;
2265                 ipc_srv = SMBC_attr_server(frame, context, server, port, share,
2266                                            &workgroup, &user, &password);
2267                 saved_errno = errno;
2268                 /*
2269                  * SMBC_attr_server() can cause the original
2270                  * server to be removed from the cache.
2271                  * If so we must error out here as the srv
2272                  * pointer has been freed.
2273                  */
2274                 if (smbc_getFunctionGetCachedServer(context)(context,
2275                                 server,
2276                                 share,
2277                                 workgroup,
2278                                 user) != srv) {
2279 #if defined(ECONNRESET)
2280                         errno = ECONNRESET;
2281 #else
2282                         errno = ETIMEDOUT;
2283 #endif
2284                         TALLOC_FREE(frame);
2285                         return -1;
2286                 }
2287                 if (! ipc_srv) {
2288                         errno = saved_errno;
2289                         srv->no_nt_session = True;
2290                 }
2291         } else {
2292                 ipc_srv = NULL;
2293         }
2294
2295         if (! ipc_srv) {
2296                 TALLOC_FREE(frame);
2297                 return -1; /* errno set by SMBC_attr_server */
2298         }
2299
2300         /* Are they asking to set the entire ACL? */
2301         if (strcasecmp_m(name, "system.nt_sec_desc.*") == 0 ||
2302             strcasecmp_m(name, "system.nt_sec_desc.*+") == 0) {
2303
2304                 /* Yup. */
2305                 ret = cacl_set(context, talloc_tos(), srv->cli,
2306                                ipc_srv->cli, &ipc_srv->pol, path,
2307                                NULL, SMBC_XATTR_MODE_REMOVE_ALL, 0);
2308                 TALLOC_FREE(frame);
2309                 return ret;
2310         }
2311
2312         /*
2313          * Are they asking to remove one or more specific security descriptor
2314          * attributes?
2315          */
2316         if (strcasecmp_m(name, "system.nt_sec_desc.revision") == 0 ||
2317             strcasecmp_m(name, "system.nt_sec_desc.owner") == 0 ||
2318             strcasecmp_m(name, "system.nt_sec_desc.owner+") == 0 ||
2319             strcasecmp_m(name, "system.nt_sec_desc.group") == 0 ||
2320             strcasecmp_m(name, "system.nt_sec_desc.group+") == 0 ||
2321             strncasecmp_m(name, "system.nt_sec_desc.acl", 22) == 0 ||
2322             strncasecmp_m(name, "system.nt_sec_desc.acl+", 23) == 0) {
2323
2324                 /* Yup. */
2325                 ret = cacl_set(context, talloc_tos(), srv->cli,
2326                                ipc_srv->cli, &ipc_srv->pol, path,
2327                                discard_const_p(char, name) + 19,
2328                                SMBC_XATTR_MODE_REMOVE, 0);
2329                 TALLOC_FREE(frame);
2330                 return ret;
2331         }
2332
2333         /* Unsupported attribute name */
2334         errno = EINVAL;
2335         TALLOC_FREE(frame);
2336         return -1;
2337 }
2338
2339 int
2340 SMBC_listxattr_ctx(SMBCCTX *context,
2341                    const char *fname,
2342                    char *list,
2343                    size_t size)
2344 {
2345         /*
2346          * This isn't quite what listxattr() is supposed to do.  This returns
2347          * the complete set of attribute names, always, rather than only those
2348          * attribute names which actually exist for a file.  Hmmm...
2349          */
2350         size_t retsize;
2351         static const char supported_old[] =
2352                 "system.*\0"
2353                 "system.*+\0"
2354                 "system.nt_sec_desc.revision\0"
2355                 "system.nt_sec_desc.owner\0"
2356                 "system.nt_sec_desc.owner+\0"
2357                 "system.nt_sec_desc.group\0"
2358                 "system.nt_sec_desc.group+\0"
2359                 "system.nt_sec_desc.acl.*\0"
2360                 "system.nt_sec_desc.acl\0"
2361                 "system.nt_sec_desc.acl+\0"
2362                 "system.nt_sec_desc.*\0"
2363                 "system.nt_sec_desc.*+\0"
2364                 "system.dos_attr.*\0"
2365                 "system.dos_attr.mode\0"
2366                 "system.dos_attr.c_time\0"
2367                 "system.dos_attr.a_time\0"
2368                 "system.dos_attr.m_time\0"
2369                 ;
2370         static const char supported_new[] =
2371                 "system.*\0"
2372                 "system.*+\0"
2373                 "system.nt_sec_desc.revision\0"
2374                 "system.nt_sec_desc.owner\0"
2375                 "system.nt_sec_desc.owner+\0"
2376                 "system.nt_sec_desc.group\0"
2377                 "system.nt_sec_desc.group+\0"
2378                 "system.nt_sec_desc.acl.*\0"
2379                 "system.nt_sec_desc.acl\0"
2380                 "system.nt_sec_desc.acl+\0"
2381                 "system.nt_sec_desc.*\0"
2382                 "system.nt_sec_desc.*+\0"
2383                 "system.dos_attr.*\0"
2384                 "system.dos_attr.mode\0"
2385                 "system.dos_attr.create_time\0"
2386                 "system.dos_attr.access_time\0"
2387                 "system.dos_attr.write_time\0"
2388                 "system.dos_attr.change_time\0"
2389                 ;
2390         const char * supported;
2391
2392         if (context->internal->full_time_names) {
2393                 supported = supported_new;
2394                 retsize = sizeof(supported_new);
2395         } else {
2396                 supported = supported_old;
2397                 retsize = sizeof(supported_old);
2398         }
2399
2400         if (size == 0) {
2401                 return retsize;
2402         }
2403
2404         if (retsize > size) {
2405                 errno = ERANGE;
2406                 return -1;
2407         }
2408
2409         /* this can't be strcpy() because there are embedded null characters */
2410         memcpy(list, supported, retsize);
2411         return retsize;
2412 }