X-Git-Url: http://git.samba.org/?p=samba.git;a=blobdiff_plain;f=source3%2Fsmbd%2Fnttrans.c;h=a7b2cb6c3123adfc2eaa350cd21b47f05da8ab80;hp=9381174af0c542baaa51dfc7659ce01effa7f86a;hb=08ce0604757315367f26a2c0869d59dd229c3ffe;hpb=eba5fbff749b84a3e1bcd1f849c3454417532454 diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 9381174af0c..a7b2cb6c312 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -22,28 +22,7 @@ extern int max_send; extern enum protocol_types Protocol; -extern struct current_user current_user; - -static const char *known_nt_pipes[] = { - "\\LANMAN", - "\\srvsvc", - "\\samr", - "\\wkssvc", - "\\NETLOGON", - "\\ntlsa", - "\\ntsvcs", - "\\lsass", - "\\lsarpc", - "\\winreg", - "\\initshutdown", - "\\spoolss", - "\\netdfs", - "\\rpcecho", - "\\svcctl", - "\\eventlog", - "\\unixinfo", - NULL -}; +extern const struct generic_mapping file_generic_mapping; static char *nttrans_realloc(char **ptr, size_t size) { @@ -113,14 +92,14 @@ void send_nt_replies(connection_struct *conn, + alignment_offset + data_alignment_offset); - /* - * useable_space can never be more than max_send minus the - * alignment offset. - */ - - useable_space = MIN(useable_space, - max_send - (alignment_offset+data_alignment_offset)); - + if (useable_space < 0) { + char *msg = talloc_asprintf( + talloc_tos(), + "send_nt_replies failed sanity useable_space = %d!!!", + useable_space); + DEBUG(0, ("%s\n", msg)); + exit_server_cleanly(msg); + } while (params_to_send || data_to_send) { @@ -128,8 +107,7 @@ void send_nt_replies(connection_struct *conn, * Calculate whether we will totally or partially fill this packet. */ - total_sent_thistime = params_to_send + data_to_send + - alignment_offset + data_alignment_offset; + total_sent_thistime = params_to_send + data_to_send; /* * We can never send more than useable_space. @@ -137,7 +115,14 @@ void send_nt_replies(connection_struct *conn, total_sent_thistime = MIN(total_sent_thistime, useable_space); - reply_outbuf(req, 18, total_sent_thistime); + reply_outbuf(req, 18, + total_sent_thistime + alignment_offset + + data_alignment_offset); + + /* + * We might have had SMBnttranss in req->inbuf, fix that. + */ + SCVAL(req->outbuf, smb_com, SMBnttrans); /* * Set total params and data to be sent. @@ -264,7 +249,7 @@ void send_nt_replies(connection_struct *conn, if(params_to_send < 0 || data_to_send < 0) { DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!", params_to_send, data_to_send)); - return; + exit_server_cleanly("send_nt_replies: internal error"); } } } @@ -291,49 +276,26 @@ bool is_ntfs_stream_name(const char *fname) static void nt_open_pipe(char *fname, connection_struct *conn, struct smb_request *req, int *ppnum) { - smb_np_struct *p = NULL; - int i; + files_struct *fsp; + NTSTATUS status; DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname)); - /* See if it is one we want to handle. */ - - if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) { - reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND, - ERRDOS, ERRbadpipe); - return; - } - - for( i = 0; known_nt_pipes[i]; i++ ) { - if( strequal(fname,known_nt_pipes[i])) { - break; - } - } - - if ( known_nt_pipes[i] == NULL ) { - reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND, - ERRDOS, ERRbadpipe); - return; - } - /* Strip \\ off the name. */ fname++; - DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname)); - - p = open_rpc_pipe_p(fname, conn, req->vuid); - if (!p) { - reply_doserror(req, ERRSRV, ERRnofids); + status = np_open(req, fname, &fsp); + if (!NT_STATUS_IS_OK(status)) { + if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) { + reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND, + ERRDOS, ERRbadpipe); + return; + } + reply_nterror(req, status); return; } - /* TODO: Add pipe to db */ - - if ( !store_pipe_opendb( p ) ) { - DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname)); - } - - *ppnum = p->pnum; + *ppnum = fsp->fnum; return; } @@ -347,11 +309,10 @@ static void do_ntcreate_pipe_open(connection_struct *conn, char *fname = NULL; int pnum = -1; char *p = NULL; - uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags); + uint32 flags = IVAL(req->vwv+3, 1); TALLOC_CTX *ctx = talloc_tos(); - srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname, - smb_buf(req->inbuf), STR_TERMINATE); + srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE); if (!fname) { reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND, @@ -427,7 +388,7 @@ void reply_ntcreate_and_X(struct smb_request *req) uint32 create_disposition; uint32 create_options; uint16 root_dir_fid; - SMB_BIG_UINT allocation_size; + uint64_t allocation_size; /* Breakout the oplock request bits so we can set the reply bits separately. */ uint32 fattr=0; @@ -451,24 +412,21 @@ void reply_ntcreate_and_X(struct smb_request *req) return; } - flags = IVAL(req->inbuf,smb_ntcreate_Flags); - access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess); - file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes); - share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess); - create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition); - create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions); - root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid); + flags = IVAL(req->vwv+3, 1); + access_mask = IVAL(req->vwv+7, 1); + file_attributes = IVAL(req->vwv+13, 1); + share_access = IVAL(req->vwv+15, 1); + create_disposition = IVAL(req->vwv+17, 1); + create_options = IVAL(req->vwv+19, 1); + root_dir_fid = (uint16)IVAL(req->vwv+5, 1); - allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf, - smb_ntcreate_AllocationSize); + allocation_size = (uint64_t)IVAL(req->vwv+9, 1); #ifdef LARGE_SMB_OFF_T - allocation_size |= (((SMB_BIG_UINT)IVAL( - req->inbuf, - smb_ntcreate_AllocationSize + 4)) << 32); + allocation_size |= (((uint64_t)IVAL(req->vwv+11, 1)) << 32); #endif - srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, - smb_buf(req->inbuf), 0, STR_TERMINATE, &status); + srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf, + STR_TERMINATE, &status); if (!NT_STATUS_IS_OK(status)) { reply_nterror(req, status); @@ -489,6 +447,12 @@ void reply_ntcreate_and_X(struct smb_request *req) (unsigned int)root_dir_fid, fname)); + /* + * we need to remove ignored bits when they come directly from the client + * because we reuse some of them for internal stuff + */ + create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK; + /* * If it's an IPC, use the pipe handler. */ @@ -498,11 +462,10 @@ void reply_ntcreate_and_X(struct smb_request *req) do_ntcreate_pipe_open(conn, req); END_PROFILE(SMBntcreateX); return; - } else { - reply_doserror(req, ERRDOS, ERRnoaccess); - END_PROFILE(SMBntcreateX); - return; } + reply_doserror(req, ERRDOS, ERRnoaccess); + END_PROFILE(SMBntcreateX); + return; } oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0; @@ -511,10 +474,24 @@ void reply_ntcreate_and_X(struct smb_request *req) ? BATCH_OPLOCK : 0; } - status = create_file(conn, req, root_dir_fid, fname, - access_mask, share_access, create_disposition, - create_options, file_attributes, oplock_request, - allocation_size, NULL, NULL, &fsp, &info, &sbuf); + status = SMB_VFS_CREATE_FILE( + conn, /* conn */ + req, /* req */ + root_dir_fid, /* root_dir_fid */ + fname, /* fname */ + true, /* is_dos_path */ + access_mask, /* access_mask */ + share_access, /* share_access */ + create_disposition, /* create_disposition*/ + create_options, /* create_options */ + file_attributes, /* file_attributes */ + oplock_request, /* oplock_request */ + allocation_size, /* allocation_size */ + NULL, /* sd */ + NULL, /* ea_list */ + &fsp, /* result */ + &info, /* pinfo */ + &sbuf); /* psbuf */ if (!NT_STATUS_IS_OK(status)) { if (open_was_deferred(req->mid)) { @@ -558,7 +535,7 @@ void reply_ntcreate_and_X(struct smb_request *req) } file_len = sbuf.st_size; - fattr = dos_mode(conn,fname,&sbuf); + fattr = dos_mode(conn,fsp->fsp_name,&sbuf); if (fattr == 0) { fattr = FILE_ATTRIBUTE_NORMAL; } @@ -626,7 +603,7 @@ void reply_ntcreate_and_X(struct smb_request *req) uint32 perms = 0; p += 25; if (fsp->is_directory - || can_write_to_file(conn, fname, &sbuf)) { + || can_write_to_file(conn, fsp->fsp_name, &sbuf)) { perms = FILE_GENERIC_ALL; } else { perms = FILE_GENERIC_READ|FILE_EXECUTE; @@ -758,27 +735,24 @@ static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len, return status; } - if (psd->owner_sid==0) { + if (psd->owner_sid == NULL) { security_info_sent &= ~OWNER_SECURITY_INFORMATION; } - if (psd->group_sid==0) { + if (psd->group_sid == NULL) { security_info_sent &= ~GROUP_SECURITY_INFORMATION; } - if (psd->sacl==0) { - security_info_sent &= ~SACL_SECURITY_INFORMATION; - } - if (psd->dacl==0) { - security_info_sent &= ~DACL_SECURITY_INFORMATION; - } - if (fsp->fh->fd != -1) { - status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd); - } - else { - status = SMB_VFS_SET_NT_ACL(fsp, fsp->fsp_name, - security_info_sent, psd); + /* Convert all the generic bits. */ + security_acl_map_generic(psd->dacl, &file_generic_mapping); + security_acl_map_generic(psd->sacl, &file_generic_mapping); + + if (DEBUGLEVEL >= 10) { + DEBUG(10,("set_sd for file %s\n", fsp->fsp_name )); + NDR_PRINT_DEBUG(security_descriptor, psd); } + status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd); + TALLOC_FREE(psd); return status; @@ -852,7 +826,7 @@ static void call_nt_transact_create(connection_struct *conn, struct ea_list *ea_list = NULL; NTSTATUS status; size_t param_len; - SMB_BIG_UINT allocation_size; + uint64_t allocation_size; int oplock_request; uint8_t oplock_granted; TALLOC_CTX *ctx = talloc_tos(); @@ -871,10 +845,9 @@ static void call_nt_transact_create(connection_struct *conn, ppparams, parameter_count, ppdata, data_count); return; - } else { - reply_doserror(req, ERRDOS, ERRnoaccess); - return; } + reply_doserror(req, ERRDOS, ERRnoaccess); + return; } /* @@ -896,11 +869,17 @@ static void call_nt_transact_create(connection_struct *conn, sd_len = IVAL(params,36); ea_len = IVAL(params,40); root_dir_fid = (uint16)IVAL(params,4); - allocation_size = (SMB_BIG_UINT)IVAL(params,12); + allocation_size = (uint64_t)IVAL(params,12); #ifdef LARGE_SMB_OFF_T - allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32); + allocation_size |= (((uint64_t)IVAL(params,16)) << 32); #endif + /* + * we need to remove ignored bits when they come directly from the client + * because we reuse some of them for internal stuff + */ + create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK; + /* Ensure the data_len is correct for the sd and ea values given. */ if ((ea_len + sd_len > data_count) || (ea_len > data_count) || (sd_len > data_count) @@ -967,10 +946,24 @@ static void call_nt_transact_create(connection_struct *conn, ? BATCH_OPLOCK : 0; } - status = create_file(conn, req, root_dir_fid, fname, - access_mask, share_access, create_disposition, - create_options, file_attributes, oplock_request, - allocation_size, sd, ea_list, &fsp, &info, &sbuf); + status = SMB_VFS_CREATE_FILE( + conn, /* conn */ + req, /* req */ + root_dir_fid, /* root_dir_fid */ + fname, /* fname */ + true, /* is_dos_path */ + access_mask, /* access_mask */ + share_access, /* share_access */ + create_disposition, /* create_disposition*/ + create_options, /* create_options */ + file_attributes, /* file_attributes */ + oplock_request, /* oplock_request */ + allocation_size, /* allocation_size */ + sd, /* sd */ + ea_list, /* ea_list */ + &fsp, /* result */ + &info, /* pinfo */ + &sbuf); /* psbuf */ if(!NT_STATUS_IS_OK(status)) { if (open_was_deferred(req->mid)) { @@ -1007,7 +1000,7 @@ static void call_nt_transact_create(connection_struct *conn, } file_len = sbuf.st_size; - fattr = dos_mode(conn,fname,&sbuf); + fattr = dos_mode(conn,fsp->fsp_name,&sbuf); if (fattr == 0) { fattr = FILE_ATTRIBUTE_NORMAL; } @@ -1075,7 +1068,7 @@ static void call_nt_transact_create(connection_struct *conn, uint32 perms = 0; p += 25; if (fsp->is_directory - || can_write_to_file(conn, fname, &sbuf)) { + || can_write_to_file(conn, fsp->fsp_name, &sbuf)) { perms = FILE_GENERIC_ALL; } else { perms = FILE_GENERIC_READ|FILE_EXECUTE; @@ -1083,7 +1076,7 @@ static void call_nt_transact_create(connection_struct *conn, SIVAL(p,0,perms); } - DEBUG(5,("call_nt_transact_create: open name = %s\n", fname)); + DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name)); /* Send the required number of replies */ send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0); @@ -1193,30 +1186,52 @@ static NTSTATUS copy_internals(TALLOC_CTX *ctx, DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname)); - status = open_file_ntcreate(conn, req, oldname, &sbuf1, - FILE_READ_DATA, /* Read-only. */ - FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, - FILE_OPEN, - 0, /* No create options. */ - FILE_ATTRIBUTE_NORMAL, - NO_OPLOCK, - &info, &fsp1); + status = SMB_VFS_CREATE_FILE( + conn, /* conn */ + req, /* req */ + 0, /* root_dir_fid */ + oldname, /* fname */ + false, /* is_dos_path */ + FILE_READ_DATA, /* access_mask */ + (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */ + FILE_SHARE_DELETE), + FILE_OPEN, /* create_disposition*/ + 0, /* create_options */ + FILE_ATTRIBUTE_NORMAL, /* file_attributes */ + NO_OPLOCK, /* oplock_request */ + 0, /* allocation_size */ + NULL, /* sd */ + NULL, /* ea_list */ + &fsp1, /* result */ + &info, /* pinfo */ + &sbuf1); /* psbuf */ if (!NT_STATUS_IS_OK(status)) { return status; } - status = open_file_ntcreate(conn, req, newname, &sbuf2, - FILE_WRITE_DATA, /* Read-only. */ - FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, - FILE_CREATE, - 0, /* No create options. */ - fattr, - NO_OPLOCK, - &info, &fsp2); + status = SMB_VFS_CREATE_FILE( + conn, /* conn */ + req, /* req */ + 0, /* root_dir_fid */ + newname, /* fname */ + false, /* is_dos_path */ + FILE_WRITE_DATA, /* access_mask */ + (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */ + FILE_SHARE_DELETE), + FILE_CREATE, /* create_disposition*/ + 0, /* create_options */ + fattr, /* file_attributes */ + NO_OPLOCK, /* oplock_request */ + 0, /* allocation_size */ + NULL, /* sd */ + NULL, /* ea_list */ + &fsp2, /* result */ + &info, /* pinfo */ + &sbuf2); /* psbuf */ if (!NT_STATUS_IS_OK(status)) { - close_file(fsp1,ERROR_CLOSE); + close_file(NULL, fsp1, ERROR_CLOSE); return status; } @@ -1230,12 +1245,12 @@ static NTSTATUS copy_internals(TALLOC_CTX *ctx, * Thus we don't look at the error return from the * close of fsp1. */ - close_file(fsp1,NORMAL_CLOSE); + close_file(NULL, fsp1, NORMAL_CLOSE); /* Ensure the modtime is set correctly on the destination file. */ - fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1)); + set_close_write_time(fsp2, get_mtimespec(&sbuf1)); - status = close_file(fsp2,NORMAL_CLOSE); + status = close_file(NULL, fsp2, NORMAL_CLOSE); /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it creates the file. This isn't the correct thing to do in the copy @@ -1263,7 +1278,7 @@ void reply_ntrename(struct smb_request *req) connection_struct *conn = req->conn; char *oldname = NULL; char *newname = NULL; - char *p; + const char *p; NTSTATUS status; bool src_has_wcard = False; bool dest_has_wcard = False; @@ -1279,13 +1294,12 @@ void reply_ntrename(struct smb_request *req) return; } - attrs = SVAL(req->inbuf,smb_vwv0); - rename_type = SVAL(req->inbuf,smb_vwv1); + attrs = SVAL(req->vwv+0, 0); + rename_type = SVAL(req->vwv+1, 0); - p = smb_buf(req->inbuf) + 1; - p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p, - 0, STR_TERMINATE, &status, - &src_has_wcard); + p = (const char *)req->buf + 1; + p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE, + &status, &src_has_wcard); if (!NT_STATUS_IS_OK(status)) { reply_nterror(req, status); END_PROFILE(SMBntrename); @@ -1306,9 +1320,8 @@ void reply_ntrename(struct smb_request *req) } p++; - p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p, - 0, STR_TERMINATE, &status, - &dest_has_wcard); + p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE, + &status, &dest_has_wcard); if (!NT_STATUS_IS_OK(status)) { reply_nterror(req, status); END_PROFILE(SMBntrename); @@ -1353,7 +1366,7 @@ void reply_ntrename(struct smb_request *req) case RENAME_FLAG_RENAME: status = rename_internals(ctx, conn, req, oldname, newname, attrs, False, src_has_wcard, - dest_has_wcard); + dest_has_wcard, DELETE_ACCESS); break; case RENAME_FLAG_HARD_LINK: if (src_has_wcard || dest_has_wcard) { @@ -1427,7 +1440,7 @@ static void call_nt_transact_notify_change(connection_struct *conn, return; } - fsp = file_fsp(SVAL(setup,4)); + fsp = file_fsp(req, SVAL(setup,4)); filter = IVAL(setup, 0); recursive = (SVAL(setup, 6) != 0) ? True : False; @@ -1481,7 +1494,8 @@ static void call_nt_transact_notify_change(connection_struct *conn, * here. */ - change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify); + change_notify_reply(fsp->conn, req, max_param_count, + fsp->notify); /* * change_notify_reply() above has independently sent its @@ -1518,7 +1532,6 @@ static void call_nt_transact_rename(connection_struct *conn, char *params = *ppparams; char *new_name = NULL; files_struct *fsp = NULL; - bool replace_if_exists = False; bool dest_has_wcard = False; NTSTATUS status; TALLOC_CTX *ctx = talloc_tos(); @@ -1528,9 +1541,8 @@ static void call_nt_transact_rename(connection_struct *conn, return; } - fsp = file_fsp(SVAL(params, 0)); - replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False; - if (!check_fsp(conn, req, fsp, ¤t_user)) { + fsp = file_fsp(req, SVAL(params, 0)); + if (!check_fsp(conn, req, fsp)) { return; } srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4, @@ -1541,31 +1553,13 @@ static void call_nt_transact_rename(connection_struct *conn, return; } - status = rename_internals(ctx, - conn, - req, - fsp->fsp_name, - new_name, - 0, - replace_if_exists, - False, - dest_has_wcard); - - if (!NT_STATUS_IS_OK(status)) { - if (open_was_deferred(req->mid)) { - /* We have re-scheduled this call. */ - return; - } - reply_nterror(req, status); - return; - } - /* - * Rename was successful. + * W2K3 ignores this request as the RAW-RENAME test + * demonstrates, so we do. */ send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0); - DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n", + DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n", fsp->fsp_name, new_name)); return; @@ -1616,7 +1610,7 @@ static void call_nt_transact_query_security_desc(connection_struct *conn, return; } - fsp = file_fsp(SVAL(params,0)); + fsp = file_fsp(req, SVAL(params,0)); if(!fsp) { reply_doserror(req, ERRDOS, ERRbadfid); return; @@ -1640,25 +1634,32 @@ static void call_nt_transact_query_security_desc(connection_struct *conn, if (!lp_nt_acl_support(SNUM(conn))) { status = get_null_nt_acl(talloc_tos(), &psd); } else { - if (fsp->fh->fd != -1) { - status = SMB_VFS_FGET_NT_ACL( - fsp, security_info_wanted, &psd); - } - else { - status = SMB_VFS_GET_NT_ACL( - conn, fsp->fsp_name, security_info_wanted, &psd); - } + status = SMB_VFS_FGET_NT_ACL( + fsp, security_info_wanted, &psd); } - if (!NT_STATUS_IS_OK(status)) { reply_nterror(req, status); return; } + /* If the SACL/DACL is NULL, but was requested, we mark that it is + * present in the reply to match Windows behavior */ + if (psd->sacl == NULL && + security_info_wanted & SACL_SECURITY_INFORMATION) + psd->type |= SEC_DESC_SACL_PRESENT; + if (psd->dacl == NULL && + security_info_wanted & DACL_SECURITY_INFORMATION) + psd->type |= SEC_DESC_DACL_PRESENT; + sd_size = ndr_size_security_descriptor(psd, 0); DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size)); + if (DEBUGLEVEL >= 10) { + DEBUG(10,("call_nt_transact_query_security_desc for file %s\n", fsp->fsp_name)); + NDR_PRINT_DEBUG(security_descriptor, psd); + } + SIVAL(params,0,(uint32)sd_size); if (max_data_count < sd_size) { @@ -1718,7 +1719,7 @@ static void call_nt_transact_set_security_desc(connection_struct *conn, return; } - if((fsp = file_fsp(SVAL(params,0))) == NULL) { + if((fsp = file_fsp(req, SVAL(params,0))) == NULL) { reply_doserror(req, ERRDOS, ERRbadfid); return; } @@ -1782,7 +1783,7 @@ static void call_nt_transact_ioctl(connection_struct *conn, DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", function, fidnum, isFSctl, compfilter)); - fsp=file_fsp(fidnum); + fsp=file_fsp(req, fidnum); /* this check is done in each implemented function case for now because I don't want to break anything... --metze FSP_BELONGS_CONN(fsp,conn);*/ @@ -1807,7 +1808,7 @@ static void call_nt_transact_ioctl(connection_struct *conn, DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum)); - if (!fsp_belongs_conn(conn, req, fsp, ¤t_user)) { + if (!fsp_belongs_conn(conn, req, fsp)) { return; } @@ -1862,7 +1863,7 @@ static void call_nt_transact_ioctl(connection_struct *conn, uint32 i; char *cur_pdata; - if (!fsp_belongs_conn(conn, req, fsp, ¤t_user)) { + if (!fsp_belongs_conn(conn, req, fsp)) { return; } @@ -1985,7 +1986,7 @@ static void call_nt_transact_ioctl(connection_struct *conn, DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum)); - if (!fsp_belongs_conn(conn, req, fsp, ¤t_user)) { + if (!fsp_belongs_conn(conn, req, fsp)) { return; } @@ -2070,9 +2071,10 @@ static void call_nt_transact_get_user_quota(connection_struct *conn, ZERO_STRUCT(qt); /* access check */ - if (current_user.ut.uid != 0) { - DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n", - lp_servicename(SNUM(conn)),conn->user)); + if (conn->server_info->utok.uid != 0) { + DEBUG(1,("get_user_quota: access_denied service [%s] user " + "[%s]\n", lp_servicename(SNUM(conn)), + conn->server_info->unix_name)); reply_doserror(req, ERRDOS, ERRnoaccess); return; } @@ -2088,8 +2090,8 @@ static void call_nt_transact_get_user_quota(connection_struct *conn, } /* maybe we can check the quota_fnum */ - fsp = file_fsp(SVAL(params,0)); - if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) { + fsp = file_fsp(req, SVAL(params,0)); + if (!check_fsp_ntquota_handle(conn, req, fsp)) { DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n")); reply_nterror(req, NT_STATUS_INVALID_HANDLE); return; @@ -2098,7 +2100,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn, /* the NULL pointer checking for fsp->fake_file_handle->pd * is done by CHECK_NTQUOTA_HANDLE_OK() */ - qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd; + qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data; level = SVAL(params,2); @@ -2185,16 +2187,16 @@ static void call_nt_transact_get_user_quota(connection_struct *conn, /* then the len of the SID 4 bytes */ SIVAL(entry,4,sid_len); - /* unknown data 8 bytes SMB_BIG_UINT */ - SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/ + /* unknown data 8 bytes uint64_t */ + SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/ - /* the used disk space 8 bytes SMB_BIG_UINT */ + /* the used disk space 8 bytes uint64_t */ SBIG_UINT(entry,16,tmp_list->quotas->usedspace); - /* the soft quotas 8 bytes SMB_BIG_UINT */ + /* the soft quotas 8 bytes uint64_t */ SBIG_UINT(entry,24,tmp_list->quotas->softlim); - /* the hard quotas 8 bytes SMB_BIG_UINT */ + /* the hard quotas 8 bytes uint64_t */ SBIG_UINT(entry,32,tmp_list->quotas->hardlim); /* and now the SID */ @@ -2283,16 +2285,16 @@ static void call_nt_transact_get_user_quota(connection_struct *conn, /* then the len of the SID 4 bytes */ SIVAL(entry,4,sid_len); - /* unknown data 8 bytes SMB_BIG_UINT */ - SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/ + /* unknown data 8 bytes uint64_t */ + SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/ - /* the used disk space 8 bytes SMB_BIG_UINT */ + /* the used disk space 8 bytes uint64_t */ SBIG_UINT(entry,16,qt.usedspace); - /* the soft quotas 8 bytes SMB_BIG_UINT */ + /* the soft quotas 8 bytes uint64_t */ SBIG_UINT(entry,24,qt.softlim); - /* the hard quotas 8 bytes SMB_BIG_UINT */ + /* the hard quotas 8 bytes uint64_t */ SBIG_UINT(entry,32,qt.hardlim); /* and now the SID */ @@ -2336,9 +2338,10 @@ static void call_nt_transact_set_user_quota(connection_struct *conn, ZERO_STRUCT(qt); /* access check */ - if (current_user.ut.uid != 0) { - DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n", - lp_servicename(SNUM(conn)),conn->user)); + if (conn->server_info->utok.uid != 0) { + DEBUG(1,("set_user_quota: access_denied service [%s] user " + "[%s]\n", lp_servicename(SNUM(conn)), + conn->server_info->unix_name)); reply_doserror(req, ERRDOS, ERRnoaccess); return; } @@ -2354,8 +2357,8 @@ static void call_nt_transact_set_user_quota(connection_struct *conn, } /* maybe we can check the quota_fnum */ - fsp = file_fsp(SVAL(params,0)); - if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) { + fsp = file_fsp(req, SVAL(params,0)); + if (!check_fsp_ntquota_handle(conn, req, fsp)) { DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n")); reply_nterror(req, NT_STATUS_INVALID_HANDLE); return; @@ -2385,10 +2388,10 @@ static void call_nt_transact_set_user_quota(connection_struct *conn, * maybe its the change time in NTTIME */ - /* the used space 8 bytes (SMB_BIG_UINT)*/ - qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16); + /* the used space 8 bytes (uint64_t)*/ + qt.usedspace = (uint64_t)IVAL(pdata,16); #ifdef LARGE_SMB_OFF_T - qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32); + qt.usedspace |= (((uint64_t)IVAL(pdata,20)) << 32); #else /* LARGE_SMB_OFF_T */ if ((IVAL(pdata,20) != 0)&& ((qt.usedspace != 0xFFFFFFFF)|| @@ -2399,10 +2402,10 @@ static void call_nt_transact_set_user_quota(connection_struct *conn, } #endif /* LARGE_SMB_OFF_T */ - /* the soft quotas 8 bytes (SMB_BIG_UINT)*/ - qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24); + /* the soft quotas 8 bytes (uint64_t)*/ + qt.softlim = (uint64_t)IVAL(pdata,24); #ifdef LARGE_SMB_OFF_T - qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32); + qt.softlim |= (((uint64_t)IVAL(pdata,28)) << 32); #else /* LARGE_SMB_OFF_T */ if ((IVAL(pdata,28) != 0)&& ((qt.softlim != 0xFFFFFFFF)|| @@ -2413,10 +2416,10 @@ static void call_nt_transact_set_user_quota(connection_struct *conn, } #endif /* LARGE_SMB_OFF_T */ - /* the hard quotas 8 bytes (SMB_BIG_UINT)*/ - qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32); + /* the hard quotas 8 bytes (uint64_t)*/ + qt.hardlim = (uint64_t)IVAL(pdata,32); #ifdef LARGE_SMB_OFF_T - qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32); + qt.hardlim |= (((uint64_t)IVAL(pdata,36)) << 32); #else /* LARGE_SMB_OFF_T */ if ((IVAL(pdata,36) != 0)&& ((qt.hardlim != 0xFFFFFFFF)|| @@ -2577,14 +2580,13 @@ static void handle_nttrans(connection_struct *conn, void reply_nttrans(struct smb_request *req) { connection_struct *conn = req->conn; - uint32 pscnt; - uint32 psoff; - uint32 dscnt; - uint32 dsoff; + uint32_t pscnt; + uint32_t psoff; + uint32_t dscnt; + uint32_t dsoff; uint16 function_code; NTSTATUS result; struct trans_state *state; - int size; START_PROFILE(SMBnttrans); @@ -2594,12 +2596,11 @@ void reply_nttrans(struct smb_request *req) return; } - size = smb_len(req->inbuf) + 4; - pscnt = IVAL(req->inbuf,smb_nt_ParameterCount); - psoff = IVAL(req->inbuf,smb_nt_ParameterOffset); - dscnt = IVAL(req->inbuf,smb_nt_DataCount); - dsoff = IVAL(req->inbuf,smb_nt_DataOffset); - function_code = SVAL(req->inbuf, smb_nt_Function); + pscnt = IVAL(req->vwv+9, 1); + psoff = IVAL(req->vwv+11, 1); + dscnt = IVAL(req->vwv+13, 1); + dsoff = IVAL(req->vwv+15, 1); + function_code = SVAL(req->vwv+18, 0); if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) { reply_doserror(req, ERRSRV, ERRaccess); @@ -2615,7 +2616,7 @@ void reply_nttrans(struct smb_request *req) return; } - if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) { + if ((state = TALLOC_P(conn, struct trans_state)) == NULL) { reply_doserror(req, ERRSRV, ERRaccess); END_PROFILE(SMBnttrans); return; @@ -2625,18 +2626,29 @@ void reply_nttrans(struct smb_request *req) state->mid = req->mid; state->vuid = req->vuid; - state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount); + state->total_data = IVAL(req->vwv+3, 1); state->data = NULL; - state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount); + state->total_param = IVAL(req->vwv+1, 1); state->param = NULL; - state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount); - state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount); + state->max_data_return = IVAL(req->vwv+7, 1); + state->max_param_return = IVAL(req->vwv+5, 1); /* setup count is in *words* */ - state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount); + state->setup_count = 2*CVAL(req->vwv+17, 1); state->setup = NULL; state->call = function_code; + DEBUG(10, ("num_setup=%u, " + "param_total=%u, this_param=%u, max_param=%u, " + "data_total=%u, this_data=%u, max_data=%u, " + "param_offset=%u, data_offset=%u\n", + (unsigned)state->setup_count, + (unsigned)state->total_param, (unsigned)pscnt, + (unsigned)state->max_param_return, + (unsigned)state->total_data, (unsigned)dscnt, + (unsigned)state->max_data_return, + (unsigned)psoff, (unsigned)dsoff)); + /* * All nttrans messages we handle have smb_wct == 19 + * state->setup_count. Ensure this is so as a sanity check. @@ -2660,6 +2672,12 @@ void reply_nttrans(struct smb_request *req) goto bad_param; if (state->total_data) { + + if (trans_oob(state->total_data, 0, dscnt) + || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) { + goto bad_param; + } + /* Can't use talloc here, the core routines do realloc on the * params and data. */ if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) { @@ -2670,17 +2688,17 @@ void reply_nttrans(struct smb_request *req) END_PROFILE(SMBnttrans); return; } - if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt)) - goto bad_param; - if ((smb_base(req->inbuf)+dsoff+dscnt - > (char *)req->inbuf + size) || - (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf))) - goto bad_param; memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt); } if (state->total_param) { + + if (trans_oob(state->total_param, 0, pscnt) + || trans_oob(smb_len(req->inbuf), psoff, pscnt)) { + goto bad_param; + } + /* Can't use talloc here, the core routines do realloc on the * params and data. */ if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) { @@ -2692,12 +2710,6 @@ void reply_nttrans(struct smb_request *req) END_PROFILE(SMBnttrans); return; } - if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt)) - goto bad_param; - if ((smb_base(req->inbuf)+psoff+pscnt - > (char *)req->inbuf + size) || - (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf))) - goto bad_param; memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt); } @@ -2708,6 +2720,19 @@ void reply_nttrans(struct smb_request *req) if(state->setup_count > 0) { DEBUG(10,("reply_nttrans: state->setup_count = %d\n", state->setup_count)); + + /* + * No overflow possible here, state->setup_count is an + * unsigned int, being filled by a single byte from + * CVAL(req->vwv+13, 0) above. The cast in the comparison + * below is not necessary, it's here to clarify things. The + * validity of req->vwv and req->wct has been checked in + * init_smb_request already. + */ + if ((state->setup_count/2) + 19 > (unsigned int)req->wct) { + goto bad_param; + } + state->setup = (uint16 *)TALLOC(state, state->setup_count); if (state->setup == NULL) { DEBUG(0,("reply_nttrans : Out of memory\n")); @@ -2719,16 +2744,7 @@ void reply_nttrans(struct smb_request *req) return; } - if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) || - (smb_nt_SetupStart + state->setup_count < state->setup_count)) { - goto bad_param; - } - if (smb_nt_SetupStart + state->setup_count > size) { - goto bad_param; - } - - memcpy( state->setup, &req->inbuf[smb_nt_SetupStart], - state->setup_count); + memcpy(state->setup, req->vwv+19, state->setup_count); dump_data(10, (uint8 *)state->setup, state->setup_count); } @@ -2769,11 +2785,9 @@ void reply_nttrans(struct smb_request *req) void reply_nttranss(struct smb_request *req) { connection_struct *conn = req->conn; - unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp; + uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp; struct trans_state *state; - int size; - START_PROFILE(SMBnttranss); show_msg((char *)req->inbuf); @@ -2799,24 +2813,20 @@ void reply_nttranss(struct smb_request *req) /* Revise state->total_param and state->total_data in case they have changed downwards */ - if (IVAL(req->inbuf, smb_nts_TotalParameterCount) - < state->total_param) { - state->total_param = IVAL(req->inbuf, - smb_nts_TotalParameterCount); + if (IVAL(req->vwv+1, 1) < state->total_param) { + state->total_param = IVAL(req->vwv+1, 1); } - if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) { - state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount); + if (IVAL(req->vwv+3, 1) < state->total_data) { + state->total_data = IVAL(req->vwv+3, 1); } - size = smb_len(req->inbuf) + 4; - - pcnt = IVAL(req->inbuf,smb_nts_ParameterCount); - poff = IVAL(req->inbuf, smb_nts_ParameterOffset); - pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement); + pcnt = IVAL(req->vwv+5, 1); + poff = IVAL(req->vwv+7, 1); + pdisp = IVAL(req->vwv+9, 1); - dcnt = IVAL(req->inbuf, smb_nts_DataCount); - ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement); - doff = IVAL(req->inbuf, smb_nts_DataOffset); + dcnt = IVAL(req->vwv+11, 1); + doff = IVAL(req->vwv+13, 1); + ddisp = IVAL(req->vwv+15, 1); state->received_param += pcnt; state->received_data += dcnt; @@ -2826,41 +2836,19 @@ void reply_nttranss(struct smb_request *req) goto bad_param; if (pcnt) { - if (pdisp+pcnt > state->total_param) - goto bad_param; - if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt)) + if (trans_oob(state->total_param, pdisp, pcnt) + || trans_oob(smb_len(req->inbuf), poff, pcnt)) { goto bad_param; - if (pdisp > state->total_param) - goto bad_param; - if ((smb_base(req->inbuf) + poff + pcnt - > (char *)req->inbuf + size) || - (smb_base(req->inbuf) + poff + pcnt - < smb_base(req->inbuf))) - goto bad_param; - if (state->param + pdisp < state->param) - goto bad_param; - - memcpy(state->param+pdisp, smb_base(req->inbuf)+poff, - pcnt); + } + memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt); } if (dcnt) { - if (ddisp+dcnt > state->total_data) - goto bad_param; - if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt)) - goto bad_param; - if (ddisp > state->total_data) + if (trans_oob(state->total_data, ddisp, dcnt) + || trans_oob(smb_len(req->inbuf), doff, dcnt)) { goto bad_param; - if ((smb_base(req->inbuf) + doff + dcnt - > (char *)req->inbuf + size) || - (smb_base(req->inbuf) + doff + dcnt - < smb_base(req->inbuf))) - goto bad_param; - if (state->data + ddisp < state->data) - goto bad_param; - - memcpy(state->data+ddisp, smb_base(req->inbuf)+doff, - dcnt); + } + memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt); } if ((state->received_param < state->total_param) || @@ -2869,12 +2857,6 @@ void reply_nttranss(struct smb_request *req) return; } - /* - * construct_reply_common will copy smb_com from inbuf to - * outbuf. SMBnttranss is wrong here. - */ - SCVAL(req->inbuf,smb_com,SMBnttrans); - handle_nttrans(conn, state, req); DLIST_REMOVE(conn->pending_trans, state);