#include "smb_server/smb_server.h"
#include "ntvfs/ntvfs.h"
#include "libcli/raw/libcliraw.h"
+#include "libcli/raw/raw_proto.h"
#include "librpc/gen_ndr/ndr_security.h"
+#include "param/param.h"
/*
hold the state of a nttrans op while in progress. Needed to allow for async backend
uint32_t sd_length, ea_length;
NTSTATUS status;
uint8_t *params;
+ enum ndr_err_code ndr_err;
if (trans->in.params.length < 54) {
return NT_STATUS_INVALID_PARAMETER;
io->ntcreatex.in.security_flags = CVAL(params, 52);
io->ntcreatex.in.sec_desc = NULL;
io->ntcreatex.in.ea_list = NULL;
+ io->ntcreatex.in.query_maximal_access = false;
- req_pull_string(req, &io->ntcreatex.in.fname,
+ req_pull_string(&req->in.bufinfo, &io->ntcreatex.in.fname,
params + 53,
MIN(fname_len+1, trans->in.params.length - 53),
STR_NO_RANGE_CHECK | STR_TERMINATE);
if (io->ntcreatex.in.sec_desc == NULL) {
return NT_STATUS_NO_MEMORY;
}
- status = ndr_pull_struct_blob(&blob, io,
- io->ntcreatex.in.sec_desc,
- (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
+ ndr_err = ndr_pull_struct_blob(&blob, io, NULL,
+ io->ntcreatex.in.sec_desc,
+ (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return ndr_map_error2ntstatus(ndr_err);
}
}
union smb_fileinfo *io = talloc_get_type(op->op_info, union smb_fileinfo);
uint8_t *params;
NTSTATUS status;
+ enum ndr_err_code ndr_err;
status = nttrans_setup_reply(op, op->trans, 4, 0, 0);
NT_STATUS_NOT_OK_RETURN(status);
params = op->trans->out.params.data;
- status = ndr_push_struct_blob(&op->trans->out.data, op,
- io->query_secdesc.out.sd,
- (ndr_push_flags_fn_t)ndr_push_security_descriptor);
- NT_STATUS_NOT_OK_RETURN(status);
+ ndr_err = ndr_push_struct_blob(&op->trans->out.data, op, NULL,
+ io->query_secdesc.out.sd,
+ (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return ndr_map_error2ntstatus(ndr_err);
+ }
SIVAL(params, 0, op->trans->out.data.length);
{
struct smb_nttrans *trans = op->trans;
union smb_setfileinfo *io;
- NTSTATUS status;
+ enum ndr_err_code ndr_err;
if (trans->in.params.length < 8) {
return NT_STATUS_INVALID_PARAMETER;
io->set_secdesc.in.sd = talloc(io, struct security_descriptor);
NT_STATUS_HAVE_NO_MEMORY(io->set_secdesc.in.sd);
- status = ndr_pull_struct_blob(&trans->in.data, req,
- io->set_secdesc.in.sd,
- (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
- NT_STATUS_NOT_OK_RETURN(status);
+ ndr_err = ndr_pull_struct_blob(&trans->in.data, req, NULL,
+ io->set_secdesc.in.sd,
+ (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return ndr_map_error2ntstatus(ndr_err);
+ }
SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(io->set_secdesc.in.file.ntvfs);
return ntvfs_setfileinfo(req->ntvfs, io);
static NTSTATUS nttrans_rename(struct smbsrv_request *req,
struct nttrans_op *op)
{
- return NT_STATUS_NOT_IMPLEMENTED;
+ struct smb_nttrans *trans = op->trans;
+ union smb_rename *io;
+
+ if (trans->in.params.length < 5) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* parse the request */
+ io = talloc(req, union smb_rename);
+ NT_STATUS_HAVE_NO_MEMORY(io);
+
+ io->nttrans.level = RAW_RENAME_NTTRANS;
+ io->nttrans.in.file.ntvfs = smbsrv_pull_fnum(req, trans->in.params.data, 0);
+ io->nttrans.in.flags = SVAL(trans->in.params.data, 2);
+
+ smbsrv_blob_pull_string(&req->in.bufinfo, &trans->in.params, 4,
+ &io->nttrans.in.new_name,
+ STR_TERMINATE);
+ if (!io->nttrans.in.new_name) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(io->nttrans.in.file.ntvfs);
+ return ntvfs_rename(req->ntvfs, io);
}
/*
ssize_t len;
SIVAL(p, 4, info->nttrans.out.changes[i].action);
- len = push_string(p + 12, info->nttrans.out.changes[i].name.s,
+ len = push_string(lp_iconv_convenience(global_loadparm), p + 12, info->nttrans.out.changes[i].name.s,
op->trans->out.params.length -
(p+12 - op->trans->out.params.data), STR_UNICODE);
SIVAL(p, 8, len);
static void reply_nttrans_send(struct ntvfs_request *ntvfs)
{
struct smbsrv_request *req;
- uint16_t params_left, data_left;
+ uint32_t params_left, data_left;
uint8_t *params, *data;
struct smb_nttrans *trans;
struct nttrans_op *op;
/* we need to divide up the reply into chunks that fit into
the negotiated buffer size */
do {
- uint16_t this_data, this_param, max_bytes;
+ uint32_t this_data, this_param, max_bytes;
uint_t align1 = 1, align2 = (params_left ? 2 : 0);
struct smbsrv_request *this_req;
this_req = req;
}
- req_grow_data(req, this_param + this_data + (align1 + align2));
+ req_grow_data(this_req, this_param + this_data + (align1 + align2));
SSVAL(this_req->out.vwv, 0, 0); /* reserved */
SCVAL(this_req->out.vwv, 2, 0); /* reserved */
} while (params_left != 0 || data_left != 0);
}
+/*
+ send a continue request
+*/
+static void reply_nttrans_continue(struct smbsrv_request *req, struct smb_nttrans *trans)
+{
+ struct smbsrv_request *req2;
+ struct smbsrv_trans_partial *tp;
+ int count;
+
+ /* make sure they don't flood us */
+ for (count=0,tp=req->smb_conn->trans_partial;tp;tp=tp->next) count++;
+ if (count > 100) {
+ smbsrv_send_error(req, NT_STATUS_INSUFFICIENT_RESOURCES);
+ return;
+ }
+
+ tp = talloc(req, struct smbsrv_trans_partial);
+
+ tp->req = req;
+ tp->u.nttrans = trans;
+ tp->command = SMBnttrans;
+
+ DLIST_ADD(req->smb_conn->trans_partial, tp);
+ talloc_set_destructor(tp, smbsrv_trans_partial_destructor);
+
+ req2 = smbsrv_setup_secondary_request(req);
+
+ /* send a 'please continue' reply */
+ smbsrv_setup_reply(req2, 0, 0);
+ smbsrv_send_reply(req2);
+}
+
+
+/*
+ answer a reconstructed trans request
+*/
+static void reply_nttrans_complete(struct smbsrv_request *req, struct smb_nttrans *trans)
+{
+ struct nttrans_op *op;
+
+ SMBSRV_TALLOC_IO_PTR(op, struct nttrans_op);
+ SMBSRV_SETUP_NTVFS_REQUEST(reply_nttrans_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
+
+ op->trans = trans;
+ op->op_info = NULL;
+ op->send_fn = NULL;
+
+ /* its a full request, give it to the backend */
+ ZERO_STRUCT(trans->out);
+ SMBSRV_CALL_NTVFS_BACKEND(nttrans_backend(req, op));
+}
+
/****************************************************************************
Reply to an SMBnttrans request
****************************************************************************/
void smbsrv_reply_nttrans(struct smbsrv_request *req)
{
- struct nttrans_op *op;
struct smb_nttrans *trans;
- uint16_t param_ofs, data_ofs;
- uint16_t param_count, data_count;
- uint16_t param_total, data_total;
+ uint32_t param_ofs, data_ofs;
+ uint32_t param_count, data_count;
+ uint32_t param_total, data_total;
/* parse request */
if (req->in.wct < 19) {
return;
}
- SMBSRV_TALLOC_IO_PTR(op, struct nttrans_op);
- SMBSRV_SETUP_NTVFS_REQUEST(reply_nttrans_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
-
- trans = talloc(op, struct smb_nttrans);
+ trans = talloc(req, struct smb_nttrans);
if (trans == NULL) {
smbsrv_send_error(req, NT_STATUS_NO_MEMORY);
return;
}
- op->trans = trans;
- op->op_info = NULL;
- op->send_fn = NULL;
-
trans->in.max_setup = CVAL(req->in.vwv, 0);
param_total = IVAL(req->in.vwv, 3);
data_total = IVAL(req->in.vwv, 7);
memcpy(trans->in.setup, (char *)(req->in.vwv) + VWV(19),
sizeof(uint16_t) * trans->in.setup_count);
- if (!req_pull_blob(req, req->in.hdr + param_ofs, param_count, &trans->in.params) ||
- !req_pull_blob(req, req->in.hdr + data_ofs, data_count, &trans->in.data)) {
+ if (!req_pull_blob(&req->in.bufinfo, req->in.hdr + param_ofs, param_count, &trans->in.params) ||
+ !req_pull_blob(&req->in.bufinfo, req->in.hdr + data_ofs, data_count, &trans->in.data)) {
smbsrv_send_error(req, NT_STATUS_FOOBAR);
return;
}
/* is it a partial request? if so, then send a 'send more' message */
- if (param_total > param_count ||
- data_total > data_count) {
- DEBUG(0,("REWRITE: not handling partial nttrans requests!\n"));
- smbsrv_send_error(req, NT_STATUS_FOOBAR);
+ if (param_total > param_count || data_total > data_count) {
+ reply_nttrans_continue(req, trans);
return;
}
- ZERO_STRUCT(trans->out);
- SMBSRV_CALL_NTVFS_BACKEND(nttrans_backend(req, op));
+ reply_nttrans_complete(req, trans);
}
****************************************************************************/
void smbsrv_reply_nttranss(struct smbsrv_request *req)
{
- smbsrv_send_error(req, NT_STATUS_FOOBAR);
+ struct smbsrv_trans_partial *tp;
+ struct smb_nttrans *trans = NULL;
+ uint32_t param_ofs, data_ofs;
+ uint32_t param_count, data_count;
+ uint32_t param_disp, data_disp;
+ uint32_t param_total, data_total;
+ DATA_BLOB params, data;
+
+ /* parse request */
+ if (req->in.wct != 18) {
+ smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRerror));
+ return;
+ }
+
+ for (tp=req->smb_conn->trans_partial;tp;tp=tp->next) {
+ if (tp->command == SMBnttrans &&
+ SVAL(tp->req->in.hdr, HDR_MID) == SVAL(req->in.hdr, HDR_MID)) {
+/* TODO: check the VUID, PID and TID too? */
+ break;
+ }
+ }
+
+ if (tp == NULL) {
+ smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
+ return;
+ }
+
+ trans = tp->u.nttrans;
+
+ param_total = IVAL(req->in.vwv, 3);
+ data_total = IVAL(req->in.vwv, 7);
+ param_count = IVAL(req->in.vwv, 11);
+ param_ofs = IVAL(req->in.vwv, 15);
+ param_disp = IVAL(req->in.vwv, 19);
+ data_count = IVAL(req->in.vwv, 23);
+ data_ofs = IVAL(req->in.vwv, 27);
+ data_disp = IVAL(req->in.vwv, 31);
+
+ if (!req_pull_blob(&req->in.bufinfo, req->in.hdr + param_ofs, param_count, ¶ms) ||
+ !req_pull_blob(&req->in.bufinfo, req->in.hdr + data_ofs, data_count, &data)) {
+ smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
+ return;
+ }
+
+ /* only allow contiguous requests */
+ if ((param_count != 0 &&
+ param_disp != trans->in.params.length) ||
+ (data_count != 0 &&
+ data_disp != trans->in.data.length)) {
+ smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
+ return;
+ }
+
+ /* add to the existing request */
+ if (param_count != 0) {
+ trans->in.params.data = talloc_realloc(trans,
+ trans->in.params.data,
+ uint8_t,
+ param_disp + param_count);
+ if (trans->in.params.data == NULL) {
+ smbsrv_send_error(tp->req, NT_STATUS_NO_MEMORY);
+ return;
+ }
+ trans->in.params.length = param_disp + param_count;
+ }
+
+ if (data_count != 0) {
+ trans->in.data.data = talloc_realloc(trans,
+ trans->in.data.data,
+ uint8_t,
+ data_disp + data_count);
+ if (trans->in.data.data == NULL) {
+ smbsrv_send_error(tp->req, NT_STATUS_NO_MEMORY);
+ return;
+ }
+ trans->in.data.length = data_disp + data_count;
+ }
+
+ memcpy(trans->in.params.data + param_disp, params.data, params.length);
+ memcpy(trans->in.data.data + data_disp, data.data, data.length);
+
+ /* the sequence number of the reply is taken from the last secondary
+ response */
+ tp->req->seq_num = req->seq_num;
+
+ /* we don't reply to Transs2 requests */
+ talloc_free(req);
+
+ if (trans->in.params.length == param_total &&
+ trans->in.data.length == data_total) {
+ /* its now complete */
+ req = tp->req;
+ talloc_free(tp);
+ reply_nttrans_complete(req, trans);
+ }
+ return;
}