2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 extern enum protocol_types Protocol;
25 extern struct current_user current_user;
27 static const char *known_nt_pipes[] = {
48 static char *nttrans_realloc(char **ptr, size_t size)
51 smb_panic("nttrans_realloc() called with NULL ptr");
54 *ptr = (char *)SMB_REALLOC(*ptr, size);
58 memset(*ptr,'\0',size);
62 /****************************************************************************
63 Send the required number of replies back.
64 We assume all fields other than the data fields are
65 set correctly for the type of call.
66 HACK ! Always assumes smb_setup field is zero.
67 ****************************************************************************/
69 void send_nt_replies(struct smb_request *req, NTSTATUS nt_error,
70 char *params, int paramsize,
71 char *pdata, int datasize)
73 int data_to_send = datasize;
74 int params_to_send = paramsize;
78 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
79 int alignment_offset = 3;
80 int data_alignment_offset = 0;
83 * If there genuinely are no parameters or data to send just send
87 if(params_to_send == 0 && data_to_send == 0) {
88 reply_outbuf(req, 18, 0);
89 show_msg((char *)req->outbuf);
94 * When sending params and data ensure that both are nicely aligned.
95 * Only do this alignment when there is also data to send - else
96 * can cause NT redirector problems.
99 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
100 data_alignment_offset = 4 - (params_to_send % 4);
104 * Space is bufsize minus Netbios over TCP header minus SMB header.
105 * The alignment_offset is to align the param bytes on a four byte
106 * boundary (2 bytes for data len, one byte pad).
107 * NT needs this to work correctly.
110 useable_space = max_send - (smb_size
113 + data_alignment_offset);
116 * useable_space can never be more than max_send minus the
120 useable_space = MIN(useable_space,
121 max_send - (alignment_offset+data_alignment_offset));
124 while (params_to_send || data_to_send) {
127 * Calculate whether we will totally or partially fill this packet.
130 total_sent_thistime = params_to_send + data_to_send +
131 alignment_offset + data_alignment_offset;
134 * We can never send more than useable_space.
137 total_sent_thistime = MIN(total_sent_thistime, useable_space);
139 reply_outbuf(req, 18, total_sent_thistime);
142 * Set total params and data to be sent.
145 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
146 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
149 * Calculate how many parameters and data we can fit into
150 * this packet. Parameters get precedence.
153 params_sent_thistime = MIN(params_to_send,useable_space);
154 data_sent_thistime = useable_space - params_sent_thistime;
155 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
157 SIVAL(req->outbuf, smb_ntr_ParameterCount,
158 params_sent_thistime);
160 if(params_sent_thistime == 0) {
161 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
162 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
165 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
166 * parameter bytes, however the first 4 bytes of outbuf are
167 * the Netbios over TCP header. Thus use smb_base() to subtract
168 * them from the calculation.
171 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
172 ((smb_buf(req->outbuf)+alignment_offset)
173 - smb_base(req->outbuf)));
175 * Absolute displacement of param bytes sent in this packet.
178 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
183 * Deal with the data portion.
186 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
188 if(data_sent_thistime == 0) {
189 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
190 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
193 * The offset of the data bytes is the offset of the
194 * parameter bytes plus the number of parameters being sent this time.
197 SIVAL(req->outbuf, smb_ntr_DataOffset,
198 ((smb_buf(req->outbuf)+alignment_offset) -
199 smb_base(req->outbuf))
200 + params_sent_thistime + data_alignment_offset);
201 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
205 * Copy the param bytes into the packet.
208 if(params_sent_thistime) {
209 if (alignment_offset != 0) {
210 memset(smb_buf(req->outbuf), 0,
213 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
214 params_sent_thistime);
218 * Copy in the data bytes
221 if(data_sent_thistime) {
222 if (data_alignment_offset != 0) {
223 memset((smb_buf(req->outbuf)+alignment_offset+
224 params_sent_thistime), 0,
225 data_alignment_offset);
227 memcpy(smb_buf(req->outbuf)+alignment_offset
228 +params_sent_thistime+data_alignment_offset,
229 pd,data_sent_thistime);
232 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
233 params_sent_thistime, data_sent_thistime, useable_space));
234 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
235 params_to_send, data_to_send, paramsize, datasize));
237 if (NT_STATUS_V(nt_error)) {
238 error_packet_set((char *)req->outbuf,
243 /* Send the packet */
244 show_msg((char *)req->outbuf);
245 if (!send_smb(smbd_server_fd(),(char *)req->outbuf)) {
246 exit_server_cleanly("send_nt_replies: send_smb failed.");
249 TALLOC_FREE(req->outbuf);
251 pp += params_sent_thistime;
252 pd += data_sent_thistime;
254 params_to_send -= params_sent_thistime;
255 data_to_send -= data_sent_thistime;
261 if(params_to_send < 0 || data_to_send < 0) {
262 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
263 params_to_send, data_to_send));
269 /****************************************************************************
270 Is it an NTFS stream name ?
271 ****************************************************************************/
273 bool is_ntfs_stream_name(const char *fname)
275 if (lp_posix_pathnames()) {
278 return (strchr_m(fname, ':') != NULL) ? True : False;
281 struct case_semantics_state {
282 connection_struct *conn;
285 bool short_case_preserve;
288 /****************************************************************************
289 Restore case semantics.
290 ****************************************************************************/
291 static int restore_case_semantics(struct case_semantics_state *state)
293 state->conn->case_sensitive = state->case_sensitive;
294 state->conn->case_preserve = state->case_preserve;
295 state->conn->short_case_preserve = state->short_case_preserve;
299 /****************************************************************************
301 ****************************************************************************/
302 static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
303 connection_struct *conn)
305 struct case_semantics_state *result;
307 if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
308 DEBUG(0, ("talloc failed\n"));
313 result->case_sensitive = conn->case_sensitive;
314 result->case_preserve = conn->case_preserve;
315 result->short_case_preserve = conn->short_case_preserve;
318 conn->case_sensitive = True;
319 conn->case_preserve = True;
320 conn->short_case_preserve = True;
322 talloc_set_destructor(result, restore_case_semantics);
327 /****************************************************************************
328 Reply to an NT create and X call on a pipe
329 ****************************************************************************/
331 static void nt_open_pipe(char *fname, connection_struct *conn,
332 struct smb_request *req, int *ppnum)
334 smb_np_struct *p = NULL;
337 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
339 /* See if it is one we want to handle. */
341 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
342 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
347 for( i = 0; known_nt_pipes[i]; i++ ) {
348 if( strequal(fname,known_nt_pipes[i])) {
353 if ( known_nt_pipes[i] == NULL ) {
354 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
359 /* Strip \\ off the name. */
362 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
364 p = open_rpc_pipe_p(fname, conn, req->vuid);
366 reply_doserror(req, ERRSRV, ERRnofids);
370 /* TODO: Add pipe to db */
372 if ( !store_pipe_opendb( p ) ) {
373 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
380 /****************************************************************************
381 Reply to an NT create and X call for pipes.
382 ****************************************************************************/
384 static void do_ntcreate_pipe_open(connection_struct *conn,
385 struct smb_request *req)
390 uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
391 TALLOC_CTX *ctx = talloc_tos();
393 srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
394 smb_buf(req->inbuf), STR_TERMINATE);
397 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
401 nt_open_pipe(fname, conn, req, &pnum);
409 * Deal with pipe return.
412 if (flags & EXTENDED_RESPONSE_REQUIRED) {
413 /* This is very strange. We
414 * return 50 words, but only set
415 * the wcnt to 42 ? It's definately
416 * what happens on the wire....
418 reply_outbuf(req, 50, 0);
419 SCVAL(req->outbuf,smb_wct,42);
421 reply_outbuf(req, 34, 0);
424 p = (char *)req->outbuf + smb_vwv2;
428 SIVAL(p,0,FILE_WAS_OPENED);
431 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
434 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
436 SSVAL(p,2, 0x5FF); /* ? */
439 if (flags & EXTENDED_RESPONSE_REQUIRED) {
441 SIVAL(p,0,FILE_GENERIC_ALL);
443 * For pipes W2K3 seems to return
445 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
447 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
450 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
455 static NTSTATUS create_file(connection_struct *conn,
456 struct smb_request *req,
457 uint16_t root_dir_fid,
460 uint32_t access_mask,
461 uint32_t file_attributes,
462 uint32_t share_access,
463 uint32_t create_disposition,
464 uint32_t create_options,
466 SMB_BIG_UINT allocation_size,
467 struct security_descriptor *sd,
468 struct ea_list *ea_list,
470 files_struct **result,
472 uint8_t *poplock_granted,
473 SMB_STRUCT_STAT *psbuf,
474 SMB_OFF_T *pfile_len)
476 TALLOC_CTX *frame = talloc_stackframe();
477 struct case_semantics_state *case_state = NULL;
479 SMB_OFF_T file_len = 0;
480 SMB_STRUCT_STAT sbuf;
481 int info = FILE_WAS_OPENED;
482 files_struct *fsp = NULL;
483 uint8_t oplock_granted = NO_OPLOCK_RETURN;
486 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
487 "file_attributes = 0x%x, share_access = 0x%x, "
488 "create_disposition = 0x%x create_options = 0x%x "
489 "root_dir_fid = 0x%x, fname = %s\n",
491 (unsigned int)access_mask,
492 (unsigned int)file_attributes,
493 (unsigned int)share_access,
494 (unsigned int)create_disposition,
495 (unsigned int)create_options,
496 (unsigned int)root_dir_fid,
499 SET_STAT_INVALID(sbuf);
501 if (create_options & FILE_OPEN_BY_FILE_ID) {
502 status = NT_STATUS_NOT_SUPPORTED;
510 if (root_dir_fid != 0) {
512 * This filename is relative to a directory fid.
514 char *parent_fname = NULL;
515 files_struct *dir_fsp = file_fsp(root_dir_fid);
517 if (dir_fsp == NULL) {
518 status = NT_STATUS_INVALID_HANDLE;
522 if (!dir_fsp->is_directory) {
525 * Check to see if this is a mac fork of some kind.
528 if (is_ntfs_stream_name(fname)) {
529 status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
534 we need to handle the case when we get a
535 relative open relative to a file and the
536 pathname is blank - this is a reopen!
537 (hint from demyn plantenberg)
540 status = NT_STATUS_INVALID_HANDLE;
544 if (ISDOT(dir_fsp->fsp_name)) {
546 * We're at the toplevel dir, the final file name
547 * must not contain ./, as this is filtered out
548 * normally by srvstr_get_path and unix_convert
549 * explicitly rejects paths containing ./.
551 parent_fname = talloc_strdup(talloc_tos(), "");
552 if (parent_fname == NULL) {
553 status = NT_STATUS_NO_MEMORY;
557 size_t dir_name_len = strlen(dir_fsp->fsp_name);
560 * Copy in the base directory name.
563 parent_fname = TALLOC_ARRAY(talloc_tos(), char,
565 if (parent_fname == NULL) {
566 status = NT_STATUS_NO_MEMORY;
569 memcpy(parent_fname, dir_fsp->fsp_name,
573 * Ensure it ends in a '/'.
574 * We used TALLOC_SIZE +2 to add space for the '/'.
578 && (parent_fname[dir_name_len-1] != '\\')
579 && (parent_fname[dir_name_len-1] != '/')) {
580 parent_fname[dir_name_len] = '/';
581 parent_fname[dir_name_len+1] = '\0';
585 fname = talloc_asprintf(talloc_tos(), "%s%s", parent_fname,
588 status = NT_STATUS_NO_MEMORY;
593 * Check to see if this is a mac fork of some kind.
596 if (is_ntfs_stream_name(fname)) {
597 enum FAKE_FILE_TYPE fake_file_type;
599 fake_file_type = is_fake_file(fname);
601 if (fake_file_type == FAKE_FILE_TYPE_NONE) {
602 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
606 * Here we go! support for changing the disk quotas
609 * We need to fake up to open this MAGIC QUOTA file
610 * and return a valid FID.
612 * w2k close this file directly after openening xp
613 * also tries a QUERY_FILE_INFO on the file and then
616 status = open_fake_file(conn, fake_file_type, fname,
618 if (!NT_STATUS_IS_OK(status)) {
626 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
627 if (oplock_request) {
628 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
632 status = resolve_dfspath(
633 talloc_tos(), conn, req->flags2 & FLAGS2_DFS_PATHNAMES,
636 if (!NT_STATUS_IS_OK(status)) {
638 * For PATH_NOT_COVERED we had
639 * reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
640 * ERRSRV, ERRbadpath);
641 * Need to fix in callers
647 * Ordinary file or directory.
651 * Check if POSIX semantics are wanted.
654 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
655 case_state = set_posix_case_semantics(talloc_tos(), conn);
656 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
659 status = unix_convert(talloc_tos(), conn, fname, False, &fname, NULL,
661 if (!NT_STATUS_IS_OK(status)) {
665 /* All file access must go through check_name() */
667 status = check_name(conn, fname);
668 if (!NT_STATUS_IS_OK(status)) {
672 /* This is the correct thing to do (check every time) but can_delete
673 * is expensive (it may have to read the parent directory
674 * permissions). So for now we're not doing it unless we have a strong
675 * hint the client is really going to delete this file. If the client
676 * is forcing FILE_CREATE let the filesystem take care of the
679 /* Setting FILE_SHARE_DELETE is the hint. */
681 if (lp_acl_check_permissions(SNUM(conn))
682 && (create_disposition != FILE_CREATE)
683 && (share_access & FILE_SHARE_DELETE)
684 && (access_mask & DELETE_ACCESS)
685 && (((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY)
686 && !lp_delete_readonly(SNUM(conn)))
687 || !can_delete_file_in_directory(conn, fname))) {
688 status = NT_STATUS_ACCESS_DENIED;
693 /* We need to support SeSecurityPrivilege for this. */
694 if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
695 !user_has_privileges(current_user.nt_user_token,
697 status = NT_STATUS_PRIVILEGE_NOT_HELD;
703 * If it's a request for a directory open, deal with it separately.
706 if (create_options & FILE_DIRECTORY_FILE) {
708 /* Can't open a temp directory. IFS kit test. */
709 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
710 status = NT_STATUS_INVALID_PARAMETER;
715 * We will get a create directory here if the Win32
716 * app specified a security descriptor in the
717 * CreateDirectory() call.
721 status = open_directory(
722 conn, req, fname, &sbuf, access_mask, share_access,
723 create_disposition, create_options, file_attributes,
728 * Ordinary file case.
731 status = open_file_ntcreate(
732 conn, req, fname, &sbuf, access_mask, share_access,
733 create_disposition, create_options, file_attributes,
734 oplock_request, &info, &fsp);
736 if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_IS_A_DIRECTORY)) {
739 * Fail the open if it was explicitly a non-directory
743 if (create_options & FILE_NON_DIRECTORY_FILE) {
744 status = NT_STATUS_FILE_IS_A_DIRECTORY;
749 status = open_directory(
750 conn, req, fname, &sbuf, access_mask,
751 share_access, create_disposition,
752 create_options, file_attributes,
757 TALLOC_FREE(case_state);
759 if (!NT_STATUS_IS_OK(status)) {
764 * According to the MS documentation, the only time the security
765 * descriptor is applied to the opened file is iff we *created* the
766 * file; an existing file stays the same.
768 * Also, it seems (from observation) that you can open the file with
769 * any access mask but you can still write the sd. We need to override
770 * the granted access before we call set_sd
771 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
774 if ((sd != NULL) && (info == FILE_WAS_CREATED)
775 && lp_nt_acl_support(SNUM(conn))) {
777 uint32_t sec_info_sent = ALL_SECURITY_INFORMATION;
778 uint32_t saved_access_mask = fsp->access_mask;
780 if (sd->owner_sid==0) {
781 sec_info_sent &= ~OWNER_SECURITY_INFORMATION;
783 if (sd->group_sid==0) {
784 sec_info_sent &= ~GROUP_SECURITY_INFORMATION;
787 sec_info_sent &= ~SACL_SECURITY_INFORMATION;
790 sec_info_sent &= ~DACL_SECURITY_INFORMATION;
793 fsp->access_mask = FILE_GENERIC_ALL;
795 status = SMB_VFS_FSET_NT_ACL(
796 fsp, fsp->fh->fd, sec_info_sent, sd);
798 fsp->access_mask = saved_access_mask;
800 if (!NT_STATUS_IS_OK(status)) {
805 if ((ea_list != NULL) && (info == FILE_WAS_CREATED)) {
806 status = set_ea(conn, fsp, fname, ea_list);
807 if (!NT_STATUS_IS_OK(status)) {
812 file_len = sbuf.st_size;
813 fattr = dos_mode(conn,fname,&sbuf);
815 fattr = FILE_ATTRIBUTE_NORMAL;
817 if (!fsp->is_directory && (fattr & aDIR)) {
818 status = NT_STATUS_ACCESS_DENIED;
822 /* Save the requested allocation size. */
823 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
825 && (allocation_size > (SMB_BIG_UINT)file_len)) {
826 fsp->initial_allocation_size = smb_roundup(
827 fsp->conn, allocation_size);
828 if (fsp->is_directory) {
829 /* Can't set allocation size on a directory. */
830 status = NT_STATUS_ACCESS_DENIED;
833 if (vfs_allocate_file_space(
834 fsp, fsp->initial_allocation_size) == -1) {
835 status = NT_STATUS_DISK_FULL;
839 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
844 * If the caller set the extended oplock request bit
845 * and we granted one (by whatever means) - set the
846 * correct bit for extended oplock reply.
849 if (oplock_request &&
850 (lp_fake_oplocks(SNUM(conn))
851 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
854 * Exclusive oplock granted
857 if (flags & REQUEST_BATCH_OPLOCK) {
858 oplock_granted = BATCH_OPLOCK_RETURN;
860 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
862 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
863 oplock_granted = LEVEL_II_OPLOCK_RETURN;
865 oplock_granted = NO_OPLOCK_RETURN;
869 DEBUG(10, ("create_file: info=%d, oplock_granted=%d, file_len=%lu\n",
870 info, (int)oplock_granted, (unsigned long)file_len));
874 *poplock_granted = oplock_granted;
876 *pfile_len = file_len;
881 DEBUG(10, ("create_file: %s\n", nt_errstr(status)));
884 close_file(fsp, ERROR_CLOSE);
891 /****************************************************************************
892 Reply to an NT create and X call.
893 ****************************************************************************/
895 void reply_ntcreate_and_X(connection_struct *conn, struct smb_request *req)
900 uint32 file_attributes;
902 uint32 create_disposition;
903 uint32 create_options;
905 SMB_BIG_UINT allocation_size;
906 /* Breakout the oplock request bits so we can set the
907 reply bits separately. */
908 int oplock_request = 0;
910 SMB_OFF_T file_len = 0;
911 SMB_STRUCT_STAT sbuf;
913 files_struct *fsp = NULL;
915 struct timespec c_timespec;
916 struct timespec a_timespec;
917 struct timespec m_timespec;
919 uint8_t oplock_granted = NO_OPLOCK_RETURN;
920 TALLOC_CTX *ctx = talloc_tos();
922 START_PROFILE(SMBntcreateX);
925 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
929 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
930 access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
931 file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
932 share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
933 create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
934 create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
935 root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
937 allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
938 smb_ntcreate_AllocationSize);
939 #ifdef LARGE_SMB_OFF_T
940 allocation_size |= (((SMB_BIG_UINT)IVAL(
942 smb_ntcreate_AllocationSize + 4)) << 32);
945 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
946 smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
948 if (!NT_STATUS_IS_OK(status)) {
949 reply_nterror(req, status);
950 END_PROFILE(SMBntcreateX);
954 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
955 "file_attributes = 0x%x, share_access = 0x%x, "
956 "create_disposition = 0x%x create_options = 0x%x "
957 "root_dir_fid = 0x%x, fname = %s\n",
959 (unsigned int)access_mask,
960 (unsigned int)file_attributes,
961 (unsigned int)share_access,
962 (unsigned int)create_disposition,
963 (unsigned int)create_options,
964 (unsigned int)root_dir_fid,
968 * If it's an IPC, use the pipe handler.
972 if (lp_nt_pipe_support()) {
973 do_ntcreate_pipe_open(conn, req);
974 END_PROFILE(SMBntcreateX);
977 reply_doserror(req, ERRDOS, ERRnoaccess);
978 END_PROFILE(SMBntcreateX);
983 status = create_file(conn, req, root_dir_fid, fname, flags,
984 access_mask, file_attributes, share_access,
985 create_disposition, create_options,
986 oplock_request, allocation_size, NULL, NULL,
987 &fsp, &info, &oplock_granted, &sbuf, &file_len);
989 if (!NT_STATUS_IS_OK(status)) {
990 if (open_was_deferred(req->mid)) {
991 /* We have re-scheduled this call, no error. */
992 END_PROFILE(SMBntcreateX);
995 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
996 reply_botherror(req, status, ERRDOS, ERRfilexists);
999 reply_nterror(req, status);
1001 END_PROFILE(SMBntcreateX);
1005 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1006 /* This is very strange. We
1007 * return 50 words, but only set
1008 * the wcnt to 42 ? It's definately
1009 * what happens on the wire....
1011 reply_outbuf(req, 50, 0);
1012 SCVAL(req->outbuf,smb_wct,42);
1014 reply_outbuf(req, 34, 0);
1017 p = (char *)req->outbuf + smb_vwv2;
1019 SCVAL(p, 0, oplock_granted);
1022 SSVAL(p,0,fsp->fnum);
1024 if ((create_disposition == FILE_SUPERSEDE)
1025 && (info == FILE_WAS_OVERWRITTEN)) {
1026 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1033 c_timespec = get_create_timespec(
1034 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1035 a_timespec = get_atimespec(&sbuf);
1036 m_timespec = get_mtimespec(&sbuf);
1038 if (lp_dos_filetime_resolution(SNUM(conn))) {
1039 dos_filetime_timespec(&c_timespec);
1040 dos_filetime_timespec(&a_timespec);
1041 dos_filetime_timespec(&m_timespec);
1044 put_long_date_timespec(p, c_timespec); /* create time. */
1046 put_long_date_timespec(p, a_timespec); /* access time */
1048 put_long_date_timespec(p, m_timespec); /* write time */
1050 put_long_date_timespec(p, m_timespec); /* change time */
1052 SIVAL(p,0,fattr); /* File Attributes. */
1054 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1056 SOFF_T(p,0,file_len);
1058 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1062 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1064 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1067 if (fsp->is_directory
1068 || can_write_to_file(conn, fname, &sbuf)) {
1069 perms = FILE_GENERIC_ALL;
1071 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1076 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
1077 fsp->fnum, fsp->fsp_name));
1080 END_PROFILE(SMBntcreateX);
1084 /****************************************************************************
1085 Reply to a NT_TRANSACT_CREATE call to open a pipe.
1086 ****************************************************************************/
1088 static void do_nt_transact_create_pipe(connection_struct *conn,
1089 struct smb_request *req,
1090 uint16 **ppsetup, uint32 setup_count,
1091 char **ppparams, uint32 parameter_count,
1092 char **ppdata, uint32 data_count)
1095 char *params = *ppparams;
1101 TALLOC_CTX *ctx = talloc_tos();
1104 * Ensure minimum number of parameters sent.
1107 if(parameter_count < 54) {
1108 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1109 reply_doserror(req, ERRDOS, ERRnoaccess);
1113 flags = IVAL(params,0);
1115 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
1116 parameter_count-53, STR_TERMINATE,
1118 if (!NT_STATUS_IS_OK(status)) {
1119 reply_nterror(req, status);
1123 nt_open_pipe(fname, conn, req, &pnum);
1130 /* Realloc the size of parameters and data we will return */
1131 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1132 /* Extended response is 32 more byyes. */
1137 params = nttrans_realloc(ppparams, param_len);
1138 if(params == NULL) {
1139 reply_doserror(req, ERRDOS, ERRnomem);
1144 SCVAL(p,0,NO_OPLOCK_RETURN);
1149 SIVAL(p,0,FILE_WAS_OPENED);
1153 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1156 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1158 SSVAL(p,2, 0x5FF); /* ? */
1161 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1163 SIVAL(p,0,FILE_GENERIC_ALL);
1165 * For pipes W2K3 seems to return
1167 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
1169 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
1172 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1174 /* Send the required number of replies */
1175 send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1180 /****************************************************************************
1181 Internal fn to set security descriptors.
1182 ****************************************************************************/
1184 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1187 SEC_DESC *psd = NULL;
1188 TALLOC_CTX *mem_ctx;
1191 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
1192 return NT_STATUS_OK;
1196 * Init the parse struct we will unmarshall from.
1199 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1200 DEBUG(0,("set_sd: talloc_init failed.\n"));
1201 return NT_STATUS_NO_MEMORY;
1204 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1207 * Setup the prs_struct to point at the memory we just
1211 prs_give_memory( &pd, data, sd_len, False);
1214 * Finally, unmarshall from the data buffer.
1217 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1218 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1220 * Return access denied for want of a better error message..
1222 talloc_destroy(mem_ctx);
1223 return NT_STATUS_NO_MEMORY;
1226 if (psd->owner_sid==0) {
1227 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1229 if (psd->group_sid==0) {
1230 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1233 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1236 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1239 status = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1241 talloc_destroy(mem_ctx);
1245 /****************************************************************************
1246 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1247 ****************************************************************************/
1249 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1251 struct ea_list *ea_list_head = NULL;
1254 if (data_size < 4) {
1258 while (offset + 4 <= data_size) {
1259 size_t next_offset = IVAL(pdata,offset);
1260 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1266 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1267 if (next_offset == 0) {
1270 offset += next_offset;
1273 return ea_list_head;
1276 /****************************************************************************
1277 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1278 ****************************************************************************/
1280 static void call_nt_transact_create(connection_struct *conn,
1281 struct smb_request *req,
1282 uint16 **ppsetup, uint32 setup_count,
1283 char **ppparams, uint32 parameter_count,
1284 char **ppdata, uint32 data_count,
1285 uint32 max_data_count)
1288 char *params = *ppparams;
1289 char *data = *ppdata;
1290 /* Breakout the oplock request bits so we can set the reply bits separately. */
1291 int oplock_request = 0;
1293 SMB_OFF_T file_len = 0;
1294 SMB_STRUCT_STAT sbuf;
1296 files_struct *fsp = NULL;
1300 uint32 file_attributes;
1301 uint32 share_access;
1302 uint32 create_disposition;
1303 uint32 create_options;
1305 struct security_descriptor *sd;
1307 uint16 root_dir_fid;
1308 struct timespec c_timespec;
1309 struct timespec a_timespec;
1310 struct timespec m_timespec;
1311 struct ea_list *ea_list = NULL;
1314 SMB_BIG_UINT allocation_size;
1315 uint8_t oplock_granted;
1316 TALLOC_CTX *ctx = talloc_tos();
1318 DEBUG(5,("call_nt_transact_create\n"));
1321 * If it's an IPC, use the pipe handler.
1325 if (lp_nt_pipe_support()) {
1326 do_nt_transact_create_pipe(
1328 ppsetup, setup_count,
1329 ppparams, parameter_count,
1330 ppdata, data_count);
1333 reply_doserror(req, ERRDOS, ERRnoaccess);
1339 * Ensure minimum number of parameters sent.
1342 if(parameter_count < 54) {
1343 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1344 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1348 flags = IVAL(params,0);
1349 access_mask = IVAL(params,8);
1350 file_attributes = IVAL(params,20);
1351 share_access = IVAL(params,24);
1352 create_disposition = IVAL(params,28);
1353 create_options = IVAL(params,32);
1354 sd_len = IVAL(params,36);
1355 ea_len = IVAL(params,40);
1356 root_dir_fid = (uint16)IVAL(params,4);
1357 allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1358 #ifdef LARGE_SMB_OFF_T
1359 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1362 /* Ensure the data_len is correct for the sd and ea values given. */
1363 if ((ea_len + sd_len > data_count)
1364 || (ea_len > data_count) || (sd_len > data_count)
1365 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1366 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
1367 "%u, data_count = %u\n", (unsigned int)ea_len,
1368 (unsigned int)sd_len, (unsigned int)data_count));
1369 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1374 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
1376 if (!NT_STATUS_IS_OK(status)) {
1377 DEBUG(10, ("call_nt_transact_create: "
1378 "unmarshall_sec_desc failed: %s\n",
1379 nt_errstr(status)));
1380 reply_nterror(req, status);
1386 if (!lp_ea_support(SNUM(conn))) {
1387 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
1388 "EA's not supported.\n",
1389 (unsigned int)ea_len));
1390 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1395 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
1396 "too small (should be more than 10)\n",
1397 (unsigned int)ea_len ));
1398 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1402 /* We have already checked that ea_len <= data_count here. */
1403 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
1405 if (ea_list == NULL) {
1406 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1411 srvstr_get_path(ctx, params, req->flags2, &fname,
1412 params+53, parameter_count-53,
1413 STR_TERMINATE, &status);
1414 if (!NT_STATUS_IS_OK(status)) {
1415 reply_nterror(req, status);
1419 status = create_file(conn, req, root_dir_fid, fname, flags,
1420 access_mask, file_attributes, share_access,
1421 create_disposition, create_options,
1422 oplock_request, allocation_size, sd, ea_list,
1423 &fsp, &info, &oplock_granted, &sbuf, &file_len);
1425 if(!NT_STATUS_IS_OK(status)) {
1426 if (open_was_deferred(req->mid)) {
1427 /* We have re-scheduled this call, no error. */
1430 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1431 reply_botherror(req, status, ERRDOS, ERRfilexists);
1434 reply_nterror(req, status);
1439 /* Realloc the size of parameters and data we will return */
1440 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1441 /* Extended response is 32 more byyes. */
1446 params = nttrans_realloc(ppparams, param_len);
1447 if(params == NULL) {
1448 reply_doserror(req, ERRDOS, ERRnomem);
1453 SCVAL(p, 0, oplock_granted);
1456 SSVAL(p,0,fsp->fnum);
1458 if ((create_disposition == FILE_SUPERSEDE)
1459 && (info == FILE_WAS_OVERWRITTEN)) {
1460 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1467 c_timespec = get_create_timespec(
1468 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1469 a_timespec = get_atimespec(&sbuf);
1470 m_timespec = get_mtimespec(&sbuf);
1472 if (lp_dos_filetime_resolution(SNUM(conn))) {
1473 dos_filetime_timespec(&c_timespec);
1474 dos_filetime_timespec(&a_timespec);
1475 dos_filetime_timespec(&m_timespec);
1478 put_long_date_timespec(p, c_timespec); /* create time. */
1480 put_long_date_timespec(p, a_timespec); /* access time */
1482 put_long_date_timespec(p, m_timespec); /* write time */
1484 put_long_date_timespec(p, m_timespec); /* change time */
1486 SIVAL(p,0,fattr); /* File Attributes. */
1488 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1490 SOFF_T(p,0,file_len);
1492 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1496 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1498 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1501 if (fsp->is_directory
1502 || can_write_to_file(conn, fname, &sbuf)) {
1503 perms = FILE_GENERIC_ALL;
1505 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1510 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1512 /* Send the required number of replies */
1513 send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1518 /****************************************************************************
1519 Reply to a NT CANCEL request.
1520 conn POINTER CAN BE NULL HERE !
1521 ****************************************************************************/
1523 void reply_ntcancel(connection_struct *conn, struct smb_request *req)
1526 * Go through and cancel any pending change notifies.
1529 START_PROFILE(SMBntcancel);
1530 remove_pending_change_notify_requests_by_mid(req->mid);
1531 remove_pending_lock_requests_by_mid(req->mid);
1532 srv_cancel_sign_response(req->mid);
1534 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1536 END_PROFILE(SMBntcancel);
1540 /****************************************************************************
1542 ****************************************************************************/
1544 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1545 connection_struct *conn,
1546 struct smb_request *req,
1547 const char *oldname_in,
1548 const char *newname_in,
1551 SMB_STRUCT_STAT sbuf1, sbuf2;
1552 char *oldname = NULL;
1553 char *newname = NULL;
1554 char *last_component_oldname = NULL;
1555 char *last_component_newname = NULL;
1556 files_struct *fsp1,*fsp2;
1560 NTSTATUS status = NT_STATUS_OK;
1565 if (!CAN_WRITE(conn)) {
1566 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1569 status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1570 &last_component_oldname, &sbuf1);
1571 if (!NT_STATUS_IS_OK(status)) {
1575 status = check_name(conn, oldname);
1576 if (!NT_STATUS_IS_OK(status)) {
1580 /* Source must already exist. */
1581 if (!VALID_STAT(sbuf1)) {
1582 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1584 /* Ensure attributes match. */
1585 fattr = dos_mode(conn,oldname,&sbuf1);
1586 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1587 return NT_STATUS_NO_SUCH_FILE;
1590 status = unix_convert(ctx, conn, newname_in, False, &newname,
1591 &last_component_newname, &sbuf2);
1592 if (!NT_STATUS_IS_OK(status)) {
1596 status = check_name(conn, newname);
1597 if (!NT_STATUS_IS_OK(status)) {
1601 /* Disallow if newname already exists. */
1602 if (VALID_STAT(sbuf2)) {
1603 return NT_STATUS_OBJECT_NAME_COLLISION;
1606 /* No links from a directory. */
1607 if (S_ISDIR(sbuf1.st_mode)) {
1608 return NT_STATUS_FILE_IS_A_DIRECTORY;
1611 /* Ensure this is within the share. */
1612 status = check_reduced_name(conn, oldname);
1613 if (!NT_STATUS_IS_OK(status)) {
1617 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1620 status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1621 FILE_READ_DATA, /* Read-only. */
1622 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1624 0, /* No create options. */
1625 FILE_ATTRIBUTE_NORMAL,
1629 if (!NT_STATUS_IS_OK(status)) {
1633 status = open_file_ntcreate(conn, req, newname, &sbuf2,
1634 FILE_WRITE_DATA, /* Read-only. */
1635 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1637 0, /* No create options. */
1642 if (!NT_STATUS_IS_OK(status)) {
1643 close_file(fsp1,ERROR_CLOSE);
1647 if (sbuf1.st_size) {
1648 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1652 * As we are opening fsp1 read-only we only expect
1653 * an error on close on fsp2 if we are out of space.
1654 * Thus we don't look at the error return from the
1657 close_file(fsp1,NORMAL_CLOSE);
1659 /* Ensure the modtime is set correctly on the destination file. */
1660 fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1));
1662 status = close_file(fsp2,NORMAL_CLOSE);
1664 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1665 creates the file. This isn't the correct thing to do in the copy
1667 file_set_dosmode(conn, newname, fattr, &sbuf2,
1668 parent_dirname(newname),false);
1670 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1671 return NT_STATUS_DISK_FULL;
1674 if (!NT_STATUS_IS_OK(status)) {
1675 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1676 nt_errstr(status), oldname, newname));
1681 /****************************************************************************
1682 Reply to a NT rename request.
1683 ****************************************************************************/
1685 void reply_ntrename(connection_struct *conn, struct smb_request *req)
1687 char *oldname = NULL;
1688 char *newname = NULL;
1691 bool src_has_wcard = False;
1692 bool dest_has_wcard = False;
1695 TALLOC_CTX *ctx = talloc_tos();
1697 START_PROFILE(SMBntrename);
1700 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1701 END_PROFILE(SMBntrename);
1705 attrs = SVAL(req->inbuf,smb_vwv0);
1706 rename_type = SVAL(req->inbuf,smb_vwv1);
1708 p = smb_buf(req->inbuf) + 1;
1709 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1710 0, STR_TERMINATE, &status,
1712 if (!NT_STATUS_IS_OK(status)) {
1713 reply_nterror(req, status);
1714 END_PROFILE(SMBntrename);
1718 if( is_ntfs_stream_name(oldname)) {
1719 /* Can't rename a stream. */
1720 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1721 END_PROFILE(SMBntrename);
1725 if (ms_has_wild(oldname)) {
1726 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1727 END_PROFILE(SMBntrename);
1732 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1733 0, STR_TERMINATE, &status,
1735 if (!NT_STATUS_IS_OK(status)) {
1736 reply_nterror(req, status);
1737 END_PROFILE(SMBntrename);
1741 status = resolve_dfspath(ctx, conn,
1742 req->flags2 & FLAGS2_DFS_PATHNAMES,
1745 if (!NT_STATUS_IS_OK(status)) {
1746 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1747 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1748 ERRSRV, ERRbadpath);
1749 END_PROFILE(SMBntrename);
1752 reply_nterror(req, status);
1753 END_PROFILE(SMBntrename);
1757 status = resolve_dfspath(ctx, conn,
1758 req->flags2 & FLAGS2_DFS_PATHNAMES,
1761 if (!NT_STATUS_IS_OK(status)) {
1762 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1763 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1764 ERRSRV, ERRbadpath);
1765 END_PROFILE(SMBntrename);
1768 reply_nterror(req, status);
1769 END_PROFILE(SMBntrename);
1773 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1775 switch(rename_type) {
1776 case RENAME_FLAG_RENAME:
1777 status = rename_internals(ctx, conn, req, oldname,
1778 newname, attrs, False, src_has_wcard,
1781 case RENAME_FLAG_HARD_LINK:
1782 if (src_has_wcard || dest_has_wcard) {
1784 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1786 status = hardlink_internals(ctx,
1792 case RENAME_FLAG_COPY:
1793 if (src_has_wcard || dest_has_wcard) {
1795 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1797 status = copy_internals(ctx, conn, req, oldname,
1801 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1802 status = NT_STATUS_INVALID_PARAMETER;
1805 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1809 if (!NT_STATUS_IS_OK(status)) {
1810 if (open_was_deferred(req->mid)) {
1811 /* We have re-scheduled this call. */
1812 END_PROFILE(SMBntrename);
1816 reply_nterror(req, status);
1817 END_PROFILE(SMBntrename);
1821 reply_outbuf(req, 0, 0);
1823 END_PROFILE(SMBntrename);
1827 /****************************************************************************
1828 Reply to a notify change - queue the request and
1829 don't allow a directory to be opened.
1830 ****************************************************************************/
1832 static void call_nt_transact_notify_change(connection_struct *conn,
1833 struct smb_request *req,
1837 uint32 parameter_count,
1838 char **ppdata, uint32 data_count,
1839 uint32 max_data_count,
1840 uint32 max_param_count)
1842 uint16 *setup = *ppsetup;
1848 if(setup_count < 6) {
1849 reply_doserror(req, ERRDOS, ERRbadfunc);
1853 fsp = file_fsp(SVAL(setup,4));
1854 filter = IVAL(setup, 0);
1855 recursive = (SVAL(setup, 6) != 0) ? True : False;
1857 DEBUG(3,("call_nt_transact_notify_change\n"));
1860 reply_doserror(req, ERRDOS, ERRbadfid);
1865 char *filter_string;
1867 if (!(filter_string = notify_filter_string(NULL, filter))) {
1868 reply_nterror(req,NT_STATUS_NO_MEMORY);
1872 DEBUG(3,("call_nt_transact_notify_change: notify change "
1873 "called on %s, filter = %s, recursive = %d\n",
1874 fsp->fsp_name, filter_string, recursive));
1876 TALLOC_FREE(filter_string);
1879 if((!fsp->is_directory) || (conn != fsp->conn)) {
1880 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1884 if (fsp->notify == NULL) {
1886 status = change_notify_create(fsp, filter, recursive);
1888 if (!NT_STATUS_IS_OK(status)) {
1889 DEBUG(10, ("change_notify_create returned %s\n",
1890 nt_errstr(status)));
1891 reply_nterror(req, status);
1896 if (fsp->notify->num_changes != 0) {
1899 * We've got changes pending, respond immediately
1903 * TODO: write a torture test to check the filtering behaviour
1907 change_notify_reply(req->inbuf, max_param_count, fsp->notify);
1910 * change_notify_reply() above has independently sent its
1917 * No changes pending, queue the request
1920 status = change_notify_add_request(req->inbuf, max_param_count, filter,
1922 if (!NT_STATUS_IS_OK(status)) {
1923 reply_nterror(req, status);
1928 /****************************************************************************
1929 Reply to an NT transact rename command.
1930 ****************************************************************************/
1932 static void call_nt_transact_rename(connection_struct *conn,
1933 struct smb_request *req,
1934 uint16 **ppsetup, uint32 setup_count,
1935 char **ppparams, uint32 parameter_count,
1936 char **ppdata, uint32 data_count,
1937 uint32 max_data_count)
1939 char *params = *ppparams;
1940 char *new_name = NULL;
1941 files_struct *fsp = NULL;
1942 bool replace_if_exists = False;
1943 bool dest_has_wcard = False;
1945 TALLOC_CTX *ctx = talloc_tos();
1947 if(parameter_count < 5) {
1948 reply_doserror(req, ERRDOS, ERRbadfunc);
1952 fsp = file_fsp(SVAL(params, 0));
1953 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1954 if (!check_fsp(conn, req, fsp, ¤t_user)) {
1957 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1958 parameter_count - 4,
1959 STR_TERMINATE, &status, &dest_has_wcard);
1960 if (!NT_STATUS_IS_OK(status)) {
1961 reply_nterror(req, status);
1965 status = rename_internals(ctx,
1975 if (!NT_STATUS_IS_OK(status)) {
1976 if (open_was_deferred(req->mid)) {
1977 /* We have re-scheduled this call. */
1980 reply_nterror(req, status);
1985 * Rename was successful.
1987 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
1989 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1990 fsp->fsp_name, new_name));
1995 /******************************************************************************
1996 Fake up a completely empty SD.
1997 *******************************************************************************/
1999 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
2003 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2005 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2006 return NT_STATUS_NO_MEMORY;
2009 return NT_STATUS_OK;
2012 /****************************************************************************
2013 Reply to query a security descriptor.
2014 ****************************************************************************/
2016 static void call_nt_transact_query_security_desc(connection_struct *conn,
2017 struct smb_request *req,
2021 uint32 parameter_count,
2024 uint32 max_data_count)
2026 char *params = *ppparams;
2027 char *data = *ppdata;
2029 SEC_DESC *psd = NULL;
2031 uint32 security_info_wanted;
2032 TALLOC_CTX *mem_ctx;
2033 files_struct *fsp = NULL;
2036 if(parameter_count < 8) {
2037 reply_doserror(req, ERRDOS, ERRbadfunc);
2041 fsp = file_fsp(SVAL(params,0));
2043 reply_doserror(req, ERRDOS, ERRbadfid);
2047 security_info_wanted = IVAL(params,4);
2049 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2050 (unsigned int)security_info_wanted ));
2052 params = nttrans_realloc(ppparams, 4);
2053 if(params == NULL) {
2054 reply_doserror(req, ERRDOS, ERRnomem);
2058 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2059 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2060 reply_doserror(req, ERRDOS, ERRnomem);
2065 * Get the permissions to return.
2068 if (!lp_nt_acl_support(SNUM(conn))) {
2069 status = get_null_nt_acl(mem_ctx, &psd);
2071 status = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd,
2072 security_info_wanted, &psd);
2075 if (!NT_STATUS_IS_OK(status)) {
2076 talloc_destroy(mem_ctx);
2077 reply_nterror(req, status);
2081 sd_size = sec_desc_size(psd);
2083 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2085 SIVAL(params,0,(uint32)sd_size);
2087 if(max_data_count < sd_size) {
2089 send_nt_replies(req, NT_STATUS_BUFFER_TOO_SMALL,
2090 params, 4, *ppdata, 0);
2091 talloc_destroy(mem_ctx);
2096 * Allocate the data we will point this at.
2099 data = nttrans_realloc(ppdata, sd_size);
2101 talloc_destroy(mem_ctx);
2102 reply_doserror(req, ERRDOS, ERRnomem);
2107 * Init the parse struct we will marshall into.
2110 prs_init(&pd, 0, mem_ctx, MARSHALL);
2113 * Setup the prs_struct to point at the memory we just
2117 prs_give_memory( &pd, data, (uint32)sd_size, False);
2120 * Finally, linearize into the outgoing buffer.
2123 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2124 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2125 security descriptor.\n"));
2127 * Return access denied for want of a better error message..
2129 talloc_destroy(mem_ctx);
2130 reply_unixerror(req, ERRDOS, ERRnoaccess);
2135 * Now we can delete the security descriptor.
2138 talloc_destroy(mem_ctx);
2140 send_nt_replies(req, NT_STATUS_OK, params, 4, data, (int)sd_size);
2144 /****************************************************************************
2145 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2146 ****************************************************************************/
2148 static void call_nt_transact_set_security_desc(connection_struct *conn,
2149 struct smb_request *req,
2153 uint32 parameter_count,
2156 uint32 max_data_count)
2158 char *params= *ppparams;
2159 char *data = *ppdata;
2160 files_struct *fsp = NULL;
2161 uint32 security_info_sent = 0;
2164 if(parameter_count < 8) {
2165 reply_doserror(req, ERRDOS, ERRbadfunc);
2169 if((fsp = file_fsp(SVAL(params,0))) == NULL) {
2170 reply_doserror(req, ERRDOS, ERRbadfid);
2174 if(!lp_nt_acl_support(SNUM(conn))) {
2178 security_info_sent = IVAL(params,4);
2180 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2181 (unsigned int)security_info_sent ));
2183 if (data_count == 0) {
2184 reply_doserror(req, ERRDOS, ERRnoaccess);
2188 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2189 reply_nterror(req, nt_status);
2195 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2199 /****************************************************************************
2201 ****************************************************************************/
2203 static void call_nt_transact_ioctl(connection_struct *conn,
2204 struct smb_request *req,
2205 uint16 **ppsetup, uint32 setup_count,
2206 char **ppparams, uint32 parameter_count,
2207 char **ppdata, uint32 data_count,
2208 uint32 max_data_count)
2215 static bool logged_message;
2216 char *pdata = *ppdata;
2218 if (setup_count != 8) {
2219 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2220 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2224 function = IVAL(*ppsetup, 0);
2225 fidnum = SVAL(*ppsetup, 4);
2226 isFSctl = CVAL(*ppsetup, 6);
2227 compfilter = CVAL(*ppsetup, 7);
2229 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2230 function, fidnum, isFSctl, compfilter));
2232 fsp=file_fsp(fidnum);
2233 /* this check is done in each implemented function case for now
2234 because I don't want to break anything... --metze
2235 FSP_BELONGS_CONN(fsp,conn);*/
2238 case FSCTL_SET_SPARSE:
2239 /* pretend this succeeded - tho strictly we should
2240 mark the file sparse (if the local fs supports it)
2241 so we can know if we need to pre-allocate or not */
2243 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2244 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2247 case FSCTL_CREATE_OR_GET_OBJECT_ID:
2249 unsigned char objid[16];
2251 /* This should return the object-id on this file.
2252 * I think I'll make this be the inode+dev. JRA.
2255 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
2257 if (!fsp_belongs_conn(conn, req, fsp, ¤t_user)) {
2262 pdata = nttrans_realloc(ppdata, data_count);
2263 if (pdata == NULL) {
2264 reply_nterror(req, NT_STATUS_NO_MEMORY);
2267 push_file_id_16(pdata, &fsp->file_id);
2268 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
2269 push_file_id_16(pdata+32, &fsp->file_id);
2270 send_nt_replies(req, NT_STATUS_OK, NULL, 0,
2275 case FSCTL_GET_REPARSE_POINT:
2276 /* pretend this fail - my winXP does it like this
2280 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2281 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2284 case FSCTL_SET_REPARSE_POINT:
2285 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2289 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2290 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2293 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2296 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2297 * and return their volume names. If max_data_count is 16, then it is just
2298 * asking for the number of volumes and length of the combined names.
2300 * pdata is the data allocated by our caller, but that uses
2301 * total_data_count (which is 0 in our case) rather than max_data_count.
2302 * Allocate the correct amount and return the pointer to let
2303 * it be deallocated when we return.
2305 SHADOW_COPY_DATA *shadow_data = NULL;
2306 TALLOC_CTX *shadow_mem_ctx = NULL;
2307 bool labels = False;
2308 uint32 labels_data_count = 0;
2312 if (!fsp_belongs_conn(conn, req, fsp, ¤t_user)) {
2316 if (max_data_count < 16) {
2317 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2319 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2323 if (max_data_count > 16) {
2327 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2328 if (shadow_mem_ctx == NULL) {
2329 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2330 reply_nterror(req, NT_STATUS_NO_MEMORY);
2334 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2335 if (shadow_data == NULL) {
2336 DEBUG(0,("TALLOC_ZERO() failed!\n"));
2337 talloc_destroy(shadow_mem_ctx);
2338 reply_nterror(req, NT_STATUS_NO_MEMORY);
2342 shadow_data->mem_ctx = shadow_mem_ctx;
2345 * Call the VFS routine to actually do the work.
2347 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2348 talloc_destroy(shadow_data->mem_ctx);
2349 if (errno == ENOSYS) {
2350 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2351 conn->connectpath));
2352 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2355 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2356 conn->connectpath));
2357 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
2362 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2367 data_count = 12+labels_data_count+4;
2370 if (max_data_count<data_count) {
2371 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2372 max_data_count,data_count));
2373 talloc_destroy(shadow_data->mem_ctx);
2374 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2378 pdata = nttrans_realloc(ppdata, data_count);
2379 if (pdata == NULL) {
2380 talloc_destroy(shadow_data->mem_ctx);
2381 reply_nterror(req, NT_STATUS_NO_MEMORY);
2387 /* num_volumes 4 bytes */
2388 SIVAL(pdata,0,shadow_data->num_volumes);
2391 /* num_labels 4 bytes */
2392 SIVAL(pdata,4,shadow_data->num_volumes);
2395 /* needed_data_count 4 bytes */
2396 SIVAL(pdata,8,labels_data_count);
2400 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2401 shadow_data->num_volumes,fsp->fsp_name));
2402 if (labels && shadow_data->labels) {
2403 for (i=0;i<shadow_data->num_volumes;i++) {
2404 srvstr_push(pdata, req->flags2,
2405 cur_pdata, shadow_data->labels[i],
2406 2*sizeof(SHADOW_COPY_LABEL),
2407 STR_UNICODE|STR_TERMINATE);
2408 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2409 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2413 talloc_destroy(shadow_data->mem_ctx);
2415 send_nt_replies(req, NT_STATUS_OK, NULL, 0,
2421 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2423 /* pretend this succeeded -
2425 * we have to send back a list with all files owned by this SID
2427 * but I have to check that --metze
2431 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2433 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2435 if (!fsp_belongs_conn(conn, req, fsp, ¤t_user)) {
2439 /* unknown 4 bytes: this is not the length of the sid :-( */
2440 /*unknown = IVAL(pdata,0);*/
2442 sid_parse(pdata+4,sid_len,&sid);
2443 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2445 if (!sid_to_uid(&sid, &uid)) {
2446 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2447 sid_string_static(&sid),(unsigned long)sid_len));
2451 /* we can take a look at the find source :-)
2453 * find ./ -uid $uid -name '*' is what we need here
2456 * and send 4bytes len and then NULL terminated unicode strings
2459 * but I don't know how to deal with the paged results
2460 * (maybe we can hang the result anywhere in the fsp struct)
2462 * we don't send all files at once
2463 * and at the next we should *not* start from the beginning,
2464 * so we have to cache the result
2469 /* this works for now... */
2470 send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
2474 if (!logged_message) {
2475 logged_message = True; /* Only print this once... */
2476 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2481 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2485 #ifdef HAVE_SYS_QUOTAS
2486 /****************************************************************************
2487 Reply to get user quota
2488 ****************************************************************************/
2490 static void call_nt_transact_get_user_quota(connection_struct *conn,
2491 struct smb_request *req,
2495 uint32 parameter_count,
2498 uint32 max_data_count)
2500 NTSTATUS nt_status = NT_STATUS_OK;
2501 char *params = *ppparams;
2502 char *pdata = *ppdata;
2504 int data_len=0,param_len=0;
2507 files_struct *fsp = NULL;
2511 bool start_enum = True;
2512 SMB_NTQUOTA_STRUCT qt;
2513 SMB_NTQUOTA_LIST *tmp_list;
2514 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2519 if (current_user.ut.uid != 0) {
2520 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2521 lp_servicename(SNUM(conn)),conn->user));
2522 reply_doserror(req, ERRDOS, ERRnoaccess);
2527 * Ensure minimum number of parameters sent.
2530 if (parameter_count < 4) {
2531 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2532 reply_doserror(req, ERRDOS, ERRinvalidparam);
2536 /* maybe we can check the quota_fnum */
2537 fsp = file_fsp(SVAL(params,0));
2538 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2539 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2540 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2544 /* the NULL pointer checking for fsp->fake_file_handle->pd
2545 * is done by CHECK_NTQUOTA_HANDLE_OK()
2547 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2549 level = SVAL(params,2);
2551 /* unknown 12 bytes leading in params */
2554 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2555 /* seems that we should continue with the enum here --metze */
2557 if (qt_handle->quota_list!=NULL &&
2558 qt_handle->tmp_list==NULL) {
2561 free_ntquota_list(&(qt_handle->quota_list));
2563 /* Realloc the size of parameters and data we will return */
2565 params = nttrans_realloc(ppparams, param_len);
2566 if(params == NULL) {
2567 reply_doserror(req, ERRDOS, ERRnomem);
2572 SIVAL(params,0,data_len);
2579 case TRANSACT_GET_USER_QUOTA_LIST_START:
2581 if (qt_handle->quota_list==NULL &&
2582 qt_handle->tmp_list==NULL) {
2586 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2587 reply_doserror(req, ERRSRV, ERRerror);
2591 /* Realloc the size of parameters and data we will return */
2593 params = nttrans_realloc(ppparams, param_len);
2594 if(params == NULL) {
2595 reply_doserror(req, ERRDOS, ERRnomem);
2599 /* we should not trust the value in max_data_count*/
2600 max_data_count = MIN(max_data_count,2048);
2602 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2604 reply_doserror(req, ERRDOS, ERRnomem);
2610 /* set params Size of returned Quota Data 4 bytes*/
2611 /* but set it later when we know it */
2613 /* for each entry push the data */
2616 qt_handle->tmp_list = qt_handle->quota_list;
2619 tmp_list = qt_handle->tmp_list;
2621 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2622 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2624 sid_len = sid_size(&tmp_list->quotas->sid);
2625 entry_len = 40 + sid_len;
2627 /* nextoffset entry 4 bytes */
2628 SIVAL(entry,0,entry_len);
2630 /* then the len of the SID 4 bytes */
2631 SIVAL(entry,4,sid_len);
2633 /* unknown data 8 bytes SMB_BIG_UINT */
2634 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2636 /* the used disk space 8 bytes SMB_BIG_UINT */
2637 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2639 /* the soft quotas 8 bytes SMB_BIG_UINT */
2640 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2642 /* the hard quotas 8 bytes SMB_BIG_UINT */
2643 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2645 /* and now the SID */
2646 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2649 qt_handle->tmp_list = tmp_list;
2651 /* overwrite the offset of the last entry */
2652 SIVAL(entry-entry_len,0,0);
2654 data_len = 4+qt_len;
2655 /* overwrite the params quota_data_len */
2656 SIVAL(params,0,data_len);
2660 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2662 /* unknown 4 bytes IVAL(pdata,0) */
2664 if (data_count < 8) {
2665 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2666 reply_doserror(req, ERRDOS, ERRunknownlevel);
2670 sid_len = IVAL(pdata,4);
2671 /* Ensure this is less than 1mb. */
2672 if (sid_len > (1024*1024)) {
2673 reply_doserror(req, ERRDOS, ERRnomem);
2677 if (data_count < 8+sid_len) {
2678 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2679 reply_doserror(req, ERRDOS, ERRunknownlevel);
2683 data_len = 4+40+sid_len;
2685 if (max_data_count < data_len) {
2686 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2687 max_data_count, data_len));
2689 SIVAL(params,0,data_len);
2691 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2695 sid_parse(pdata+8,sid_len,&sid);
2697 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2700 * we have to return zero's in all fields
2701 * instead of returning an error here
2706 /* Realloc the size of parameters and data we will return */
2708 params = nttrans_realloc(ppparams, param_len);
2709 if(params == NULL) {
2710 reply_doserror(req, ERRDOS, ERRnomem);
2714 pdata = nttrans_realloc(ppdata, data_len);
2716 reply_doserror(req, ERRDOS, ERRnomem);
2722 /* set params Size of returned Quota Data 4 bytes*/
2723 SIVAL(params,0,data_len);
2725 /* nextoffset entry 4 bytes */
2728 /* then the len of the SID 4 bytes */
2729 SIVAL(entry,4,sid_len);
2731 /* unknown data 8 bytes SMB_BIG_UINT */
2732 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2734 /* the used disk space 8 bytes SMB_BIG_UINT */
2735 SBIG_UINT(entry,16,qt.usedspace);
2737 /* the soft quotas 8 bytes SMB_BIG_UINT */
2738 SBIG_UINT(entry,24,qt.softlim);
2740 /* the hard quotas 8 bytes SMB_BIG_UINT */
2741 SBIG_UINT(entry,32,qt.hardlim);
2743 /* and now the SID */
2744 sid_linearize(entry+40, sid_len, &sid);
2749 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2750 reply_doserror(req, ERRSRV, ERRerror);
2755 send_nt_replies(req, nt_status, params, param_len,
2759 /****************************************************************************
2760 Reply to set user quota
2761 ****************************************************************************/
2763 static void call_nt_transact_set_user_quota(connection_struct *conn,
2764 struct smb_request *req,
2768 uint32 parameter_count,
2771 uint32 max_data_count)
2773 char *params = *ppparams;
2774 char *pdata = *ppdata;
2775 int data_len=0,param_len=0;
2776 SMB_NTQUOTA_STRUCT qt;
2779 files_struct *fsp = NULL;
2784 if (current_user.ut.uid != 0) {
2785 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2786 lp_servicename(SNUM(conn)),conn->user));
2787 reply_doserror(req, ERRDOS, ERRnoaccess);
2792 * Ensure minimum number of parameters sent.
2795 if (parameter_count < 2) {
2796 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2797 reply_doserror(req, ERRDOS, ERRinvalidparam);
2801 /* maybe we can check the quota_fnum */
2802 fsp = file_fsp(SVAL(params,0));
2803 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2804 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2805 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2809 if (data_count < 40) {
2810 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2811 reply_doserror(req, ERRDOS, ERRunknownlevel);
2815 /* offset to next quota record.
2816 * 4 bytes IVAL(pdata,0)
2821 sid_len = IVAL(pdata,4);
2823 if (data_count < 40+sid_len) {
2824 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2825 reply_doserror(req, ERRDOS, ERRunknownlevel);
2829 /* unknown 8 bytes in pdata
2830 * maybe its the change time in NTTIME
2833 /* the used space 8 bytes (SMB_BIG_UINT)*/
2834 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2835 #ifdef LARGE_SMB_OFF_T
2836 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2837 #else /* LARGE_SMB_OFF_T */
2838 if ((IVAL(pdata,20) != 0)&&
2839 ((qt.usedspace != 0xFFFFFFFF)||
2840 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2841 /* more than 32 bits? */
2842 reply_doserror(req, ERRDOS, ERRunknownlevel);
2845 #endif /* LARGE_SMB_OFF_T */
2847 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2848 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2849 #ifdef LARGE_SMB_OFF_T
2850 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2851 #else /* LARGE_SMB_OFF_T */
2852 if ((IVAL(pdata,28) != 0)&&
2853 ((qt.softlim != 0xFFFFFFFF)||
2854 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2855 /* more than 32 bits? */
2856 reply_doserror(req, ERRDOS, ERRunknownlevel);
2859 #endif /* LARGE_SMB_OFF_T */
2861 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2862 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2863 #ifdef LARGE_SMB_OFF_T
2864 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2865 #else /* LARGE_SMB_OFF_T */
2866 if ((IVAL(pdata,36) != 0)&&
2867 ((qt.hardlim != 0xFFFFFFFF)||
2868 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2869 /* more than 32 bits? */
2870 reply_doserror(req, ERRDOS, ERRunknownlevel);
2873 #endif /* LARGE_SMB_OFF_T */
2875 sid_parse(pdata+40,sid_len,&sid);
2876 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2878 /* 44 unknown bytes left... */
2880 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2881 reply_doserror(req, ERRSRV, ERRerror);
2885 send_nt_replies(req, NT_STATUS_OK, params, param_len,
2888 #endif /* HAVE_SYS_QUOTAS */
2890 static void handle_nttrans(connection_struct *conn,
2891 struct trans_state *state,
2892 struct smb_request *req)
2894 if (Protocol >= PROTOCOL_NT1) {
2895 req->flags2 |= 0x40; /* IS_LONG_NAME */
2896 SSVAL(req->inbuf,smb_flg2,req->flags2);
2899 /* Now we must call the relevant NT_TRANS function */
2900 switch(state->call) {
2901 case NT_TRANSACT_CREATE:
2903 START_PROFILE(NT_transact_create);
2904 call_nt_transact_create(
2906 &state->setup, state->setup_count,
2907 &state->param, state->total_param,
2908 &state->data, state->total_data,
2909 state->max_data_return);
2910 END_PROFILE(NT_transact_create);
2914 case NT_TRANSACT_IOCTL:
2916 START_PROFILE(NT_transact_ioctl);
2917 call_nt_transact_ioctl(
2919 &state->setup, state->setup_count,
2920 &state->param, state->total_param,
2921 &state->data, state->total_data,
2922 state->max_data_return);
2923 END_PROFILE(NT_transact_ioctl);
2927 case NT_TRANSACT_SET_SECURITY_DESC:
2929 START_PROFILE(NT_transact_set_security_desc);
2930 call_nt_transact_set_security_desc(
2932 &state->setup, state->setup_count,
2933 &state->param, state->total_param,
2934 &state->data, state->total_data,
2935 state->max_data_return);
2936 END_PROFILE(NT_transact_set_security_desc);
2940 case NT_TRANSACT_NOTIFY_CHANGE:
2942 START_PROFILE(NT_transact_notify_change);
2943 call_nt_transact_notify_change(
2945 &state->setup, state->setup_count,
2946 &state->param, state->total_param,
2947 &state->data, state->total_data,
2948 state->max_data_return,
2949 state->max_param_return);
2950 END_PROFILE(NT_transact_notify_change);
2954 case NT_TRANSACT_RENAME:
2956 START_PROFILE(NT_transact_rename);
2957 call_nt_transact_rename(
2959 &state->setup, state->setup_count,
2960 &state->param, state->total_param,
2961 &state->data, state->total_data,
2962 state->max_data_return);
2963 END_PROFILE(NT_transact_rename);
2967 case NT_TRANSACT_QUERY_SECURITY_DESC:
2969 START_PROFILE(NT_transact_query_security_desc);
2970 call_nt_transact_query_security_desc(
2972 &state->setup, state->setup_count,
2973 &state->param, state->total_param,
2974 &state->data, state->total_data,
2975 state->max_data_return);
2976 END_PROFILE(NT_transact_query_security_desc);
2980 #ifdef HAVE_SYS_QUOTAS
2981 case NT_TRANSACT_GET_USER_QUOTA:
2983 START_PROFILE(NT_transact_get_user_quota);
2984 call_nt_transact_get_user_quota(
2986 &state->setup, state->setup_count,
2987 &state->param, state->total_param,
2988 &state->data, state->total_data,
2989 state->max_data_return);
2990 END_PROFILE(NT_transact_get_user_quota);
2994 case NT_TRANSACT_SET_USER_QUOTA:
2996 START_PROFILE(NT_transact_set_user_quota);
2997 call_nt_transact_set_user_quota(
2999 &state->setup, state->setup_count,
3000 &state->param, state->total_param,
3001 &state->data, state->total_data,
3002 state->max_data_return);
3003 END_PROFILE(NT_transact_set_user_quota);
3006 #endif /* HAVE_SYS_QUOTAS */
3009 /* Error in request */
3010 DEBUG(0,("handle_nttrans: Unknown request %d in "
3011 "nttrans call\n", state->call));
3012 reply_doserror(req, ERRSRV, ERRerror);
3018 /****************************************************************************
3019 Reply to a SMBNTtrans.
3020 ****************************************************************************/
3022 void reply_nttrans(connection_struct *conn, struct smb_request *req)
3028 uint16 function_code;
3030 struct trans_state *state;
3033 START_PROFILE(SMBnttrans);
3035 if (req->wct < 19) {
3036 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3037 END_PROFILE(SMBnttrans);
3041 size = smb_len(req->inbuf) + 4;
3042 pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
3043 psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
3044 dscnt = IVAL(req->inbuf,smb_nt_DataCount);
3045 dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
3046 function_code = SVAL(req->inbuf, smb_nt_Function);
3048 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
3049 reply_doserror(req, ERRSRV, ERRaccess);
3050 END_PROFILE(SMBnttrans);
3054 result = allow_new_trans(conn->pending_trans, req->mid);
3055 if (!NT_STATUS_IS_OK(result)) {
3056 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
3057 reply_nterror(req, result);
3058 END_PROFILE(SMBnttrans);
3062 if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
3063 reply_doserror(req, ERRSRV, ERRaccess);
3064 END_PROFILE(SMBnttrans);
3068 state->cmd = SMBnttrans;
3070 state->mid = req->mid;
3071 state->vuid = req->vuid;
3072 state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
3074 state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
3075 state->param = NULL;
3076 state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
3077 state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
3079 /* setup count is in *words* */
3080 state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
3081 state->setup = NULL;
3082 state->call = function_code;
3085 * All nttrans messages we handle have smb_wct == 19 +
3086 * state->setup_count. Ensure this is so as a sanity check.
3089 if(req->wct != 19 + (state->setup_count/2)) {
3090 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3091 req->wct, 19 + (state->setup_count/2)));
3095 /* Don't allow more than 128mb for each value. */
3096 if ((state->total_data > (1024*1024*128)) ||
3097 (state->total_param > (1024*1024*128))) {
3098 reply_doserror(req, ERRDOS, ERRnomem);
3099 END_PROFILE(SMBnttrans);
3103 if ((dscnt > state->total_data) || (pscnt > state->total_param))
3106 if (state->total_data) {
3107 /* Can't use talloc here, the core routines do realloc on the
3108 * params and data. */
3109 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3110 DEBUG(0,("reply_nttrans: data malloc fail for %u "
3111 "bytes !\n", (unsigned int)state->total_data));
3113 reply_doserror(req, ERRDOS, ERRnomem);
3114 END_PROFILE(SMBnttrans);
3117 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
3119 if ((smb_base(req->inbuf)+dsoff+dscnt
3120 > (char *)req->inbuf + size) ||
3121 (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
3124 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
3127 if (state->total_param) {
3128 /* Can't use talloc here, the core routines do realloc on the
3129 * params and data. */
3130 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3131 DEBUG(0,("reply_nttrans: param malloc fail for %u "
3132 "bytes !\n", (unsigned int)state->total_param));
3133 SAFE_FREE(state->data);
3135 reply_doserror(req, ERRDOS, ERRnomem);
3136 END_PROFILE(SMBnttrans);
3139 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
3141 if ((smb_base(req->inbuf)+psoff+pscnt
3142 > (char *)req->inbuf + size) ||
3143 (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
3146 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
3149 state->received_data = dscnt;
3150 state->received_param = pscnt;
3152 if(state->setup_count > 0) {
3153 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3154 state->setup_count));
3155 state->setup = (uint16 *)TALLOC(state, state->setup_count);
3156 if (state->setup == NULL) {
3157 DEBUG(0,("reply_nttrans : Out of memory\n"));
3158 SAFE_FREE(state->data);
3159 SAFE_FREE(state->param);
3161 reply_doserror(req, ERRDOS, ERRnomem);
3162 END_PROFILE(SMBnttrans);
3166 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
3167 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3170 if (smb_nt_SetupStart + state->setup_count > size) {
3174 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
3175 state->setup_count);
3176 dump_data(10, (uint8 *)state->setup, state->setup_count);
3179 if ((state->received_data == state->total_data) &&
3180 (state->received_param == state->total_param)) {
3181 handle_nttrans(conn, state, req);
3182 SAFE_FREE(state->param);
3183 SAFE_FREE(state->data);
3185 END_PROFILE(SMBnttrans);
3189 DLIST_ADD(conn->pending_trans, state);
3191 /* We need to send an interim response then receive the rest
3192 of the parameter/data bytes */
3193 reply_outbuf(req, 0, 0);
3194 show_msg((char *)req->outbuf);
3195 END_PROFILE(SMBnttrans);
3200 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3201 SAFE_FREE(state->data);
3202 SAFE_FREE(state->param);
3204 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3205 END_PROFILE(SMBnttrans);
3209 /****************************************************************************
3210 Reply to a SMBnttranss
3211 ****************************************************************************/
3213 void reply_nttranss(connection_struct *conn, struct smb_request *req)
3215 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3216 struct trans_state *state;
3220 START_PROFILE(SMBnttranss);
3222 show_msg((char *)req->inbuf);
3224 if (req->wct < 18) {
3225 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3226 END_PROFILE(SMBnttranss);
3230 for (state = conn->pending_trans; state != NULL;
3231 state = state->next) {
3232 if (state->mid == req->mid) {
3237 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3238 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3239 END_PROFILE(SMBnttranss);
3243 /* Revise state->total_param and state->total_data in case they have
3244 changed downwards */
3245 if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
3246 < state->total_param) {
3247 state->total_param = IVAL(req->inbuf,
3248 smb_nts_TotalParameterCount);
3250 if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
3251 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
3254 size = smb_len(req->inbuf) + 4;
3256 pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
3257 poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
3258 pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
3260 dcnt = IVAL(req->inbuf, smb_nts_DataCount);
3261 ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
3262 doff = IVAL(req->inbuf, smb_nts_DataOffset);
3264 state->received_param += pcnt;
3265 state->received_data += dcnt;
3267 if ((state->received_data > state->total_data) ||
3268 (state->received_param > state->total_param))
3272 if (pdisp+pcnt > state->total_param)
3274 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3276 if (pdisp > state->total_param)
3278 if ((smb_base(req->inbuf) + poff + pcnt
3279 > (char *)req->inbuf + size) ||
3280 (smb_base(req->inbuf) + poff + pcnt
3281 < smb_base(req->inbuf)))
3283 if (state->param + pdisp < state->param)
3286 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
3291 if (ddisp+dcnt > state->total_data)
3293 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3295 if (ddisp > state->total_data)
3297 if ((smb_base(req->inbuf) + doff + dcnt
3298 > (char *)req->inbuf + size) ||
3299 (smb_base(req->inbuf) + doff + dcnt
3300 < smb_base(req->inbuf)))
3302 if (state->data + ddisp < state->data)
3305 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
3309 if ((state->received_param < state->total_param) ||
3310 (state->received_data < state->total_data)) {
3311 END_PROFILE(SMBnttranss);
3316 * construct_reply_common will copy smb_com from inbuf to
3317 * outbuf. SMBnttranss is wrong here.
3319 SCVAL(req->inbuf,smb_com,SMBnttrans);
3321 handle_nttrans(conn, state, req);
3323 DLIST_REMOVE(conn->pending_trans, state);
3324 SAFE_FREE(state->data);
3325 SAFE_FREE(state->param);
3327 END_PROFILE(SMBnttranss);
3332 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3333 DLIST_REMOVE(conn->pending_trans, state);
3334 SAFE_FREE(state->data);
3335 SAFE_FREE(state->param);
3337 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3338 END_PROFILE(SMBnttranss);