30841686fb4139470bfe174b2aa70ce697c7246c
[nivanova/samba-autobuild/.git] / source3 / smbd / nttrans.c
1 /*
2    Unix SMB/CIFS implementation.
3    SMB NT transaction handling
4    Copyright (C) Jeremy Allison                 1994-2007
5    Copyright (C) Stefan (metze) Metzmacher      2003
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 extern int max_send;
24 extern enum protocol_types Protocol;
25 extern const struct generic_mapping file_generic_mapping;
26
27 static char *nttrans_realloc(char **ptr, size_t size)
28 {
29         if (ptr==NULL) {
30                 smb_panic("nttrans_realloc() called with NULL ptr");
31         }
32
33         *ptr = (char *)SMB_REALLOC(*ptr, size);
34         if(*ptr == NULL) {
35                 return NULL;
36         }
37         memset(*ptr,'\0',size);
38         return *ptr;
39 }
40
41 /****************************************************************************
42  Send the required number of replies back.
43  We assume all fields other than the data fields are
44  set correctly for the type of call.
45  HACK ! Always assumes smb_setup field is zero.
46 ****************************************************************************/
47
48 void send_nt_replies(connection_struct *conn,
49                         struct smb_request *req, NTSTATUS nt_error,
50                      char *params, int paramsize,
51                      char *pdata, int datasize)
52 {
53         int data_to_send = datasize;
54         int params_to_send = paramsize;
55         int useable_space;
56         char *pp = params;
57         char *pd = pdata;
58         int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59         int alignment_offset = 3;
60         int data_alignment_offset = 0;
61
62         /*
63          * If there genuinely are no parameters or data to send just send
64          * the empty packet.
65          */
66
67         if(params_to_send == 0 && data_to_send == 0) {
68                 reply_outbuf(req, 18, 0);
69                 show_msg((char *)req->outbuf);
70                 return;
71         }
72
73         /*
74          * When sending params and data ensure that both are nicely aligned.
75          * Only do this alignment when there is also data to send - else
76          * can cause NT redirector problems.
77          */
78
79         if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
80                 data_alignment_offset = 4 - (params_to_send % 4);
81         }
82
83         /*
84          * Space is bufsize minus Netbios over TCP header minus SMB header.
85          * The alignment_offset is to align the param bytes on a four byte
86          * boundary (2 bytes for data len, one byte pad).
87          * NT needs this to work correctly.
88          */
89
90         useable_space = max_send - (smb_size
91                                     + 2 * 18 /* wct */
92                                     + alignment_offset
93                                     + data_alignment_offset);
94
95         if (useable_space < 0) {
96                 char *msg = talloc_asprintf(
97                         talloc_tos(),
98                         "send_nt_replies failed sanity useable_space = %d!!!",
99                         useable_space);
100                 DEBUG(0, ("%s\n", msg));
101                 exit_server_cleanly(msg);
102         }
103
104         while (params_to_send || data_to_send) {
105
106                 /*
107                  * Calculate whether we will totally or partially fill this packet.
108                  */
109
110                 total_sent_thistime = params_to_send + data_to_send;
111
112                 /*
113                  * We can never send more than useable_space.
114                  */
115
116                 total_sent_thistime = MIN(total_sent_thistime, useable_space);
117
118                 reply_outbuf(req, 18,
119                              total_sent_thistime + alignment_offset
120                              + data_alignment_offset);
121
122                 /*
123                  * Set total params and data to be sent.
124                  */
125
126                 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
127                 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
128
129                 /*
130                  * Calculate how many parameters and data we can fit into
131                  * this packet. Parameters get precedence.
132                  */
133
134                 params_sent_thistime = MIN(params_to_send,useable_space);
135                 data_sent_thistime = useable_space - params_sent_thistime;
136                 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
137
138                 SIVAL(req->outbuf, smb_ntr_ParameterCount,
139                       params_sent_thistime);
140
141                 if(params_sent_thistime == 0) {
142                         SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
143                         SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
144                 } else {
145                         /*
146                          * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
147                          * parameter bytes, however the first 4 bytes of outbuf are
148                          * the Netbios over TCP header. Thus use smb_base() to subtract
149                          * them from the calculation.
150                          */
151
152                         SIVAL(req->outbuf,smb_ntr_ParameterOffset,
153                               ((smb_buf(req->outbuf)+alignment_offset)
154                                - smb_base(req->outbuf)));
155                         /*
156                          * Absolute displacement of param bytes sent in this packet.
157                          */
158
159                         SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
160                               pp - params);
161                 }
162
163                 /*
164                  * Deal with the data portion.
165                  */
166
167                 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
168
169                 if(data_sent_thistime == 0) {
170                         SIVAL(req->outbuf,smb_ntr_DataOffset,0);
171                         SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
172                 } else {
173                         /*
174                          * The offset of the data bytes is the offset of the
175                          * parameter bytes plus the number of parameters being sent this time.
176                          */
177
178                         SIVAL(req->outbuf, smb_ntr_DataOffset,
179                               ((smb_buf(req->outbuf)+alignment_offset) -
180                                smb_base(req->outbuf))
181                               + params_sent_thistime + data_alignment_offset);
182                         SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
183                 }
184
185                 /*
186                  * Copy the param bytes into the packet.
187                  */
188
189                 if(params_sent_thistime) {
190                         if (alignment_offset != 0) {
191                                 memset(smb_buf(req->outbuf), 0,
192                                        alignment_offset);
193                         }
194                         memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
195                                params_sent_thistime);
196                 }
197
198                 /*
199                  * Copy in the data bytes
200                  */
201
202                 if(data_sent_thistime) {
203                         if (data_alignment_offset != 0) {
204                                 memset((smb_buf(req->outbuf)+alignment_offset+
205                                         params_sent_thistime), 0,
206                                        data_alignment_offset);
207                         }
208                         memcpy(smb_buf(req->outbuf)+alignment_offset
209                                +params_sent_thistime+data_alignment_offset,
210                                pd,data_sent_thistime);
211                 }
212
213                 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
214                         params_sent_thistime, data_sent_thistime, useable_space));
215                 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
216                         params_to_send, data_to_send, paramsize, datasize));
217
218                 if (NT_STATUS_V(nt_error)) {
219                         error_packet_set((char *)req->outbuf,
220                                          0, 0, nt_error,
221                                          __LINE__,__FILE__);
222                 }
223
224                 /* Send the packet */
225                 show_msg((char *)req->outbuf);
226                 if (!srv_send_smb(smbd_server_fd(),
227                                 (char *)req->outbuf,
228                                 IS_CONN_ENCRYPTED(conn))) {
229                         exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
230                 }
231
232                 TALLOC_FREE(req->outbuf);
233
234                 pp += params_sent_thistime;
235                 pd += data_sent_thistime;
236
237                 params_to_send -= params_sent_thistime;
238                 data_to_send -= data_sent_thistime;
239
240                 /*
241                  * Sanity check
242                  */
243
244                 if(params_to_send < 0 || data_to_send < 0) {
245                         DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
246                                 params_to_send, data_to_send));
247                         exit_server_cleanly("send_nt_replies: internal error");
248                 }
249         }
250 }
251
252 /****************************************************************************
253  Is it an NTFS stream name ?
254  An NTFS file name is <path>.<extention>:<stream name>:<stream type>
255  $DATA can be used as both a stream name and a stream type. A missing stream
256  name or type implies $DATA.
257 ****************************************************************************/
258
259 bool is_ntfs_stream_name(const char *fname)
260 {
261         if (lp_posix_pathnames()) {
262                 return False;
263         }
264         return (strchr_m(fname, ':') != NULL) ? True : False;
265 }
266
267 /****************************************************************************
268  Reply to an NT create and X call on a pipe
269 ****************************************************************************/
270
271 static void nt_open_pipe(char *fname, connection_struct *conn,
272                          struct smb_request *req, int *ppnum)
273 {
274         files_struct *fsp;
275         NTSTATUS status;
276
277         DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
278
279         /* Strip \\ off the name. */
280         fname++;
281
282         status = np_open(req, conn, fname, &fsp);
283         if (!NT_STATUS_IS_OK(status)) {
284                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
285                         reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
286                                         ERRDOS, ERRbadpipe);
287                         return;
288                 }
289                 reply_nterror(req, status);
290                 return;
291         }
292
293         *ppnum = fsp->fnum;
294         return;
295 }
296
297 /****************************************************************************
298  Reply to an NT create and X call for pipes.
299 ****************************************************************************/
300
301 static void do_ntcreate_pipe_open(connection_struct *conn,
302                                   struct smb_request *req)
303 {
304         char *fname = NULL;
305         int pnum = -1;
306         char *p = NULL;
307         uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
308         TALLOC_CTX *ctx = talloc_tos();
309
310         srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
311                         smb_buf(req->inbuf), STR_TERMINATE);
312
313         if (!fname) {
314                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
315                                 ERRDOS, ERRbadpipe);
316                 return;
317         }
318         nt_open_pipe(fname, conn, req, &pnum);
319
320         if (req->outbuf) {
321                 /* error reply */
322                 return;
323         }
324
325         /*
326          * Deal with pipe return.
327          */
328
329         if (flags & EXTENDED_RESPONSE_REQUIRED) {
330                 /* This is very strange. We
331                  * return 50 words, but only set
332                  * the wcnt to 42 ? It's definately
333                  * what happens on the wire....
334                  */
335                 reply_outbuf(req, 50, 0);
336                 SCVAL(req->outbuf,smb_wct,42);
337         } else {
338                 reply_outbuf(req, 34, 0);
339         }
340
341         p = (char *)req->outbuf + smb_vwv2;
342         p++;
343         SSVAL(p,0,pnum);
344         p += 2;
345         SIVAL(p,0,FILE_WAS_OPENED);
346         p += 4;
347         p += 32;
348         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
349         p += 20;
350         /* File type. */
351         SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
352         /* Device state. */
353         SSVAL(p,2, 0x5FF); /* ? */
354         p += 4;
355
356         if (flags & EXTENDED_RESPONSE_REQUIRED) {
357                 p += 25;
358                 SIVAL(p,0,FILE_GENERIC_ALL);
359                 /*
360                  * For pipes W2K3 seems to return
361                  * 0x12019B next.
362                  * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
363                  */
364                 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
365         }
366
367         DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
368
369         chain_reply(req);
370 }
371
372 /****************************************************************************
373  Reply to an NT create and X call.
374 ****************************************************************************/
375
376 void reply_ntcreate_and_X(struct smb_request *req)
377 {
378         connection_struct *conn = req->conn;
379         char *fname = NULL;
380         uint32 flags;
381         uint32 access_mask;
382         uint32 file_attributes;
383         uint32 share_access;
384         uint32 create_disposition;
385         uint32 create_options;
386         uint16 root_dir_fid;
387         uint64_t allocation_size;
388         /* Breakout the oplock request bits so we can set the
389            reply bits separately. */
390         uint32 fattr=0;
391         SMB_OFF_T file_len = 0;
392         SMB_STRUCT_STAT sbuf;
393         int info = 0;
394         files_struct *fsp = NULL;
395         char *p = NULL;
396         struct timespec c_timespec;
397         struct timespec a_timespec;
398         struct timespec m_timespec;
399         NTSTATUS status;
400         int oplock_request;
401         uint8_t oplock_granted = NO_OPLOCK_RETURN;
402         TALLOC_CTX *ctx = talloc_tos();
403
404         START_PROFILE(SMBntcreateX);
405
406         if (req->wct < 24) {
407                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
408                 return;
409         }
410
411         flags = IVAL(req->inbuf,smb_ntcreate_Flags);
412         access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
413         file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
414         share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
415         create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
416         create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
417         root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
418
419         allocation_size = (uint64_t)IVAL(req->inbuf,
420                                              smb_ntcreate_AllocationSize);
421 #ifdef LARGE_SMB_OFF_T
422         allocation_size |= (((uint64_t)IVAL(
423                                      req->inbuf,
424                                      smb_ntcreate_AllocationSize + 4)) << 32);
425 #endif
426
427         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
428                         smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
429
430         if (!NT_STATUS_IS_OK(status)) {
431                 reply_nterror(req, status);
432                 END_PROFILE(SMBntcreateX);
433                 return;
434         }
435
436         DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
437                   "file_attributes = 0x%x, share_access = 0x%x, "
438                   "create_disposition = 0x%x create_options = 0x%x "
439                   "root_dir_fid = 0x%x, fname = %s\n",
440                         (unsigned int)flags,
441                         (unsigned int)access_mask,
442                         (unsigned int)file_attributes,
443                         (unsigned int)share_access,
444                         (unsigned int)create_disposition,
445                         (unsigned int)create_options,
446                         (unsigned int)root_dir_fid,
447                         fname));
448
449         /*
450          * we need to remove ignored bits when they come directly from the client
451          * because we reuse some of them for internal stuff
452          */
453         create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
454
455         /*
456          * If it's an IPC, use the pipe handler.
457          */
458
459         if (IS_IPC(conn)) {
460                 if (lp_nt_pipe_support()) {
461                         do_ntcreate_pipe_open(conn, req);
462                         END_PROFILE(SMBntcreateX);
463                         return;
464                 }
465                 reply_doserror(req, ERRDOS, ERRnoaccess);
466                 END_PROFILE(SMBntcreateX);
467                 return;
468         }
469
470         oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
471         if (oplock_request) {
472                 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
473                         ? BATCH_OPLOCK : 0;
474         }
475
476         status = create_file(conn, req, root_dir_fid, fname,
477                              access_mask, share_access, create_disposition,
478                              create_options, file_attributes, oplock_request,
479                              allocation_size, NULL, NULL, &fsp, &info, &sbuf);
480
481         if (!NT_STATUS_IS_OK(status)) {
482                 if (open_was_deferred(req->mid)) {
483                         /* We have re-scheduled this call, no error. */
484                         END_PROFILE(SMBntcreateX);
485                         return;
486                 }
487                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
488                         reply_botherror(req, status, ERRDOS, ERRfilexists);
489                 }
490                 else {
491                         reply_nterror(req, status);
492                 }
493                 END_PROFILE(SMBntcreateX);
494                 return;
495         }
496
497         /*
498          * If the caller set the extended oplock request bit
499          * and we granted one (by whatever means) - set the
500          * correct bit for extended oplock reply.
501          */
502
503         if (oplock_request &&
504             (lp_fake_oplocks(SNUM(conn))
505              || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
506
507                 /*
508                  * Exclusive oplock granted
509                  */
510
511                 if (flags & REQUEST_BATCH_OPLOCK) {
512                         oplock_granted = BATCH_OPLOCK_RETURN;
513                 } else {
514                         oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
515                 }
516         } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
517                 oplock_granted = LEVEL_II_OPLOCK_RETURN;
518         } else {
519                 oplock_granted = NO_OPLOCK_RETURN;
520         }
521
522         file_len = sbuf.st_size;
523         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
524         if (fattr == 0) {
525                 fattr = FILE_ATTRIBUTE_NORMAL;
526         }
527
528         if (flags & EXTENDED_RESPONSE_REQUIRED) {
529                 /* This is very strange. We
530                  * return 50 words, but only set
531                  * the wcnt to 42 ? It's definately
532                  * what happens on the wire....
533                  */
534                 reply_outbuf(req, 50, 0);
535                 SCVAL(req->outbuf,smb_wct,42);
536         } else {
537                 reply_outbuf(req, 34, 0);
538         }
539
540         p = (char *)req->outbuf + smb_vwv2;
541
542         SCVAL(p, 0, oplock_granted);
543
544         p++;
545         SSVAL(p,0,fsp->fnum);
546         p += 2;
547         if ((create_disposition == FILE_SUPERSEDE)
548             && (info == FILE_WAS_OVERWRITTEN)) {
549                 SIVAL(p,0,FILE_WAS_SUPERSEDED);
550         } else {
551                 SIVAL(p,0,info);
552         }
553         p += 4;
554
555         /* Create time. */
556         c_timespec = get_create_timespec(
557                 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
558         a_timespec = get_atimespec(&sbuf);
559         m_timespec = get_mtimespec(&sbuf);
560
561         if (lp_dos_filetime_resolution(SNUM(conn))) {
562                 dos_filetime_timespec(&c_timespec);
563                 dos_filetime_timespec(&a_timespec);
564                 dos_filetime_timespec(&m_timespec);
565         }
566
567         put_long_date_timespec(p, c_timespec); /* create time. */
568         p += 8;
569         put_long_date_timespec(p, a_timespec); /* access time */
570         p += 8;
571         put_long_date_timespec(p, m_timespec); /* write time */
572         p += 8;
573         put_long_date_timespec(p, m_timespec); /* change time */
574         p += 8;
575         SIVAL(p,0,fattr); /* File Attributes. */
576         p += 4;
577         SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
578         p += 8;
579         SOFF_T(p,0,file_len);
580         p += 8;
581         if (flags & EXTENDED_RESPONSE_REQUIRED) {
582                 SSVAL(p,2,0x7);
583         }
584         p += 4;
585         SCVAL(p,0,fsp->is_directory ? 1 : 0);
586
587         if (flags & EXTENDED_RESPONSE_REQUIRED) {
588                 uint32 perms = 0;
589                 p += 25;
590                 if (fsp->is_directory
591                     || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
592                         perms = FILE_GENERIC_ALL;
593                 } else {
594                         perms = FILE_GENERIC_READ|FILE_EXECUTE;
595                 }
596                 SIVAL(p,0,perms);
597         }
598
599         DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
600                  fsp->fnum, fsp->fsp_name));
601
602         chain_reply(req);
603         END_PROFILE(SMBntcreateX);
604         return;
605 }
606
607 /****************************************************************************
608  Reply to a NT_TRANSACT_CREATE call to open a pipe.
609 ****************************************************************************/
610
611 static void do_nt_transact_create_pipe(connection_struct *conn,
612                                        struct smb_request *req,
613                                        uint16 **ppsetup, uint32 setup_count,
614                                        char **ppparams, uint32 parameter_count,
615                                        char **ppdata, uint32 data_count)
616 {
617         char *fname = NULL;
618         char *params = *ppparams;
619         int pnum = -1;
620         char *p = NULL;
621         NTSTATUS status;
622         size_t param_len;
623         uint32 flags;
624         TALLOC_CTX *ctx = talloc_tos();
625
626         /*
627          * Ensure minimum number of parameters sent.
628          */
629
630         if(parameter_count < 54) {
631                 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
632                 reply_doserror(req, ERRDOS, ERRnoaccess);
633                 return;
634         }
635
636         flags = IVAL(params,0);
637
638         srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
639                         parameter_count-53, STR_TERMINATE,
640                         &status);
641         if (!NT_STATUS_IS_OK(status)) {
642                 reply_nterror(req, status);
643                 return;
644         }
645
646         nt_open_pipe(fname, conn, req, &pnum);
647
648         if (req->outbuf) {
649                 /* Error return */
650                 return;
651         }
652
653         /* Realloc the size of parameters and data we will return */
654         if (flags & EXTENDED_RESPONSE_REQUIRED) {
655                 /* Extended response is 32 more byyes. */
656                 param_len = 101;
657         } else {
658                 param_len = 69;
659         }
660         params = nttrans_realloc(ppparams, param_len);
661         if(params == NULL) {
662                 reply_doserror(req, ERRDOS, ERRnomem);
663                 return;
664         }
665
666         p = params;
667         SCVAL(p,0,NO_OPLOCK_RETURN);
668
669         p += 2;
670         SSVAL(p,0,pnum);
671         p += 2;
672         SIVAL(p,0,FILE_WAS_OPENED);
673         p += 8;
674
675         p += 32;
676         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
677         p += 20;
678         /* File type. */
679         SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
680         /* Device state. */
681         SSVAL(p,2, 0x5FF); /* ? */
682         p += 4;
683
684         if (flags & EXTENDED_RESPONSE_REQUIRED) {
685                 p += 25;
686                 SIVAL(p,0,FILE_GENERIC_ALL);
687                 /*
688                  * For pipes W2K3 seems to return
689                  * 0x12019B next.
690                  * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
691                  */
692                 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
693         }
694
695         DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
696
697         /* Send the required number of replies */
698         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
699
700         return;
701 }
702
703 /****************************************************************************
704  Internal fn to set security descriptors.
705 ****************************************************************************/
706
707 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
708                        uint32 security_info_sent)
709 {
710         SEC_DESC *psd = NULL;
711         NTSTATUS status;
712
713         if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
714                 return NT_STATUS_OK;
715         }
716
717         status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
718
719         if (!NT_STATUS_IS_OK(status)) {
720                 return status;
721         }
722
723         if (psd->owner_sid==0) {
724                 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
725         }
726         if (psd->group_sid==0) {
727                 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
728         }
729         if (psd->sacl==0) {
730                 security_info_sent &= ~SACL_SECURITY_INFORMATION;
731         }
732         if (psd->dacl==0) {
733                 security_info_sent &= ~DACL_SECURITY_INFORMATION;
734         }
735
736         /* Convert all the generic bits. */
737         security_acl_map_generic(psd->dacl, &file_generic_mapping);
738         security_acl_map_generic(psd->sacl, &file_generic_mapping);
739
740         status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
741
742         TALLOC_FREE(psd);
743
744         return status;
745 }
746
747 /****************************************************************************
748  Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
749 ****************************************************************************/
750
751 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
752 {
753         struct ea_list *ea_list_head = NULL;
754         size_t offset = 0;
755
756         if (data_size < 4) {
757                 return NULL;
758         }
759
760         while (offset + 4 <= data_size) {
761                 size_t next_offset = IVAL(pdata,offset);
762                 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
763
764                 if (!eal) {
765                         return NULL;
766                 }
767
768                 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
769                 if (next_offset == 0) {
770                         break;
771                 }
772                 offset += next_offset;
773         }
774
775         return ea_list_head;
776 }
777
778 /****************************************************************************
779  Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
780 ****************************************************************************/
781
782 static void call_nt_transact_create(connection_struct *conn,
783                                     struct smb_request *req,
784                                     uint16 **ppsetup, uint32 setup_count,
785                                     char **ppparams, uint32 parameter_count,
786                                     char **ppdata, uint32 data_count,
787                                     uint32 max_data_count)
788 {
789         char *fname = NULL;
790         char *params = *ppparams;
791         char *data = *ppdata;
792         /* Breakout the oplock request bits so we can set the reply bits separately. */
793         uint32 fattr=0;
794         SMB_OFF_T file_len = 0;
795         SMB_STRUCT_STAT sbuf;
796         int info = 0;
797         files_struct *fsp = NULL;
798         char *p = NULL;
799         uint32 flags;
800         uint32 access_mask;
801         uint32 file_attributes;
802         uint32 share_access;
803         uint32 create_disposition;
804         uint32 create_options;
805         uint32 sd_len;
806         struct security_descriptor *sd = NULL;
807         uint32 ea_len;
808         uint16 root_dir_fid;
809         struct timespec c_timespec;
810         struct timespec a_timespec;
811         struct timespec m_timespec;
812         struct ea_list *ea_list = NULL;
813         NTSTATUS status;
814         size_t param_len;
815         uint64_t allocation_size;
816         int oplock_request;
817         uint8_t oplock_granted;
818         TALLOC_CTX *ctx = talloc_tos();
819
820         DEBUG(5,("call_nt_transact_create\n"));
821
822         /*
823          * If it's an IPC, use the pipe handler.
824          */
825
826         if (IS_IPC(conn)) {
827                 if (lp_nt_pipe_support()) {
828                         do_nt_transact_create_pipe(
829                                 conn, req,
830                                 ppsetup, setup_count,
831                                 ppparams, parameter_count,
832                                 ppdata, data_count);
833                         return;
834                 }
835                 reply_doserror(req, ERRDOS, ERRnoaccess);
836                 return;
837         }
838
839         /*
840          * Ensure minimum number of parameters sent.
841          */
842
843         if(parameter_count < 54) {
844                 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
845                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
846                 return;
847         }
848
849         flags = IVAL(params,0);
850         access_mask = IVAL(params,8);
851         file_attributes = IVAL(params,20);
852         share_access = IVAL(params,24);
853         create_disposition = IVAL(params,28);
854         create_options = IVAL(params,32);
855         sd_len = IVAL(params,36);
856         ea_len = IVAL(params,40);
857         root_dir_fid = (uint16)IVAL(params,4);
858         allocation_size = (uint64_t)IVAL(params,12);
859 #ifdef LARGE_SMB_OFF_T
860         allocation_size |= (((uint64_t)IVAL(params,16)) << 32);
861 #endif
862
863         /*
864          * we need to remove ignored bits when they come directly from the client
865          * because we reuse some of them for internal stuff
866          */
867         create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
868
869         /* Ensure the data_len is correct for the sd and ea values given. */
870         if ((ea_len + sd_len > data_count)
871             || (ea_len > data_count) || (sd_len > data_count)
872             || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
873                 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
874                            "%u, data_count = %u\n", (unsigned int)ea_len,
875                            (unsigned int)sd_len, (unsigned int)data_count));
876                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
877                 return;
878         }
879
880         if (sd_len) {
881                 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
882                            sd_len));
883
884                 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
885                                              &sd);
886                 if (!NT_STATUS_IS_OK(status)) {
887                         DEBUG(10, ("call_nt_transact_create: "
888                                    "unmarshall_sec_desc failed: %s\n",
889                                    nt_errstr(status)));
890                         reply_nterror(req, status);
891                         return;
892                 }
893         }
894
895         if (ea_len) {
896                 if (!lp_ea_support(SNUM(conn))) {
897                         DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
898                                    "EA's not supported.\n",
899                                    (unsigned int)ea_len));
900                         reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
901                         return;
902                 }
903
904                 if (ea_len < 10) {
905                         DEBUG(10,("call_nt_transact_create - ea_len = %u - "
906                                   "too small (should be more than 10)\n",
907                                   (unsigned int)ea_len ));
908                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
909                         return;
910                 }
911
912                 /* We have already checked that ea_len <= data_count here. */
913                 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
914                                                ea_len);
915                 if (ea_list == NULL) {
916                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
917                         return;
918                 }
919         }
920
921         srvstr_get_path(ctx, params, req->flags2, &fname,
922                         params+53, parameter_count-53,
923                         STR_TERMINATE, &status);
924         if (!NT_STATUS_IS_OK(status)) {
925                 reply_nterror(req, status);
926                 return;
927         }
928
929         oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
930         if (oplock_request) {
931                 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
932                         ? BATCH_OPLOCK : 0;
933         }
934
935         status = create_file(conn, req, root_dir_fid, fname,
936                              access_mask, share_access, create_disposition,
937                              create_options, file_attributes, oplock_request,
938                              allocation_size, sd, ea_list, &fsp, &info, &sbuf);
939
940         if(!NT_STATUS_IS_OK(status)) {
941                 if (open_was_deferred(req->mid)) {
942                         /* We have re-scheduled this call, no error. */
943                         return;
944                 }
945                 reply_openerror(req, status);
946                 return;
947         }
948
949         /*
950          * If the caller set the extended oplock request bit
951          * and we granted one (by whatever means) - set the
952          * correct bit for extended oplock reply.
953          */
954
955         if (oplock_request &&
956             (lp_fake_oplocks(SNUM(conn))
957              || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
958
959                 /*
960                  * Exclusive oplock granted
961                  */
962
963                 if (flags & REQUEST_BATCH_OPLOCK) {
964                         oplock_granted = BATCH_OPLOCK_RETURN;
965                 } else {
966                         oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
967                 }
968         } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
969                 oplock_granted = LEVEL_II_OPLOCK_RETURN;
970         } else {
971                 oplock_granted = NO_OPLOCK_RETURN;
972         }
973
974         file_len = sbuf.st_size;
975         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
976         if (fattr == 0) {
977                 fattr = FILE_ATTRIBUTE_NORMAL;
978         }
979
980         /* Realloc the size of parameters and data we will return */
981         if (flags & EXTENDED_RESPONSE_REQUIRED) {
982                 /* Extended response is 32 more byyes. */
983                 param_len = 101;
984         } else {
985                 param_len = 69;
986         }
987         params = nttrans_realloc(ppparams, param_len);
988         if(params == NULL) {
989                 reply_doserror(req, ERRDOS, ERRnomem);
990                 return;
991         }
992
993         p = params;
994         SCVAL(p, 0, oplock_granted);
995
996         p += 2;
997         SSVAL(p,0,fsp->fnum);
998         p += 2;
999         if ((create_disposition == FILE_SUPERSEDE)
1000             && (info == FILE_WAS_OVERWRITTEN)) {
1001                 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1002         } else {
1003                 SIVAL(p,0,info);
1004         }
1005         p += 8;
1006
1007         /* Create time. */
1008         c_timespec = get_create_timespec(
1009                 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1010         a_timespec = get_atimespec(&sbuf);
1011         m_timespec = get_mtimespec(&sbuf);
1012
1013         if (lp_dos_filetime_resolution(SNUM(conn))) {
1014                 dos_filetime_timespec(&c_timespec);
1015                 dos_filetime_timespec(&a_timespec);
1016                 dos_filetime_timespec(&m_timespec);
1017         }
1018
1019         put_long_date_timespec(p, c_timespec); /* create time. */
1020         p += 8;
1021         put_long_date_timespec(p, a_timespec); /* access time */
1022         p += 8;
1023         put_long_date_timespec(p, m_timespec); /* write time */
1024         p += 8;
1025         put_long_date_timespec(p, m_timespec); /* change time */
1026         p += 8;
1027         SIVAL(p,0,fattr); /* File Attributes. */
1028         p += 4;
1029         SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1030         p += 8;
1031         SOFF_T(p,0,file_len);
1032         p += 8;
1033         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1034                 SSVAL(p,2,0x7);
1035         }
1036         p += 4;
1037         SCVAL(p,0,fsp->is_directory ? 1 : 0);
1038
1039         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1040                 uint32 perms = 0;
1041                 p += 25;
1042                 if (fsp->is_directory
1043                     || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1044                         perms = FILE_GENERIC_ALL;
1045                 } else {
1046                         perms = FILE_GENERIC_READ|FILE_EXECUTE;
1047                 }
1048                 SIVAL(p,0,perms);
1049         }
1050
1051         DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1052
1053         /* Send the required number of replies */
1054         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1055
1056         return;
1057 }
1058
1059 /****************************************************************************
1060  Reply to a NT CANCEL request.
1061  conn POINTER CAN BE NULL HERE !
1062 ****************************************************************************/
1063
1064 void reply_ntcancel(struct smb_request *req)
1065 {
1066         /*
1067          * Go through and cancel any pending change notifies.
1068          */
1069
1070         START_PROFILE(SMBntcancel);
1071         remove_pending_change_notify_requests_by_mid(req->mid);
1072         remove_pending_lock_requests_by_mid(req->mid);
1073         srv_cancel_sign_response(req->mid);
1074
1075         DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1076
1077         END_PROFILE(SMBntcancel);
1078         return;
1079 }
1080
1081 /****************************************************************************
1082  Copy a file.
1083 ****************************************************************************/
1084
1085 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1086                                 connection_struct *conn,
1087                                 struct smb_request *req,
1088                                 const char *oldname_in,
1089                                 const char *newname_in,
1090                                 uint32 attrs)
1091 {
1092         SMB_STRUCT_STAT sbuf1, sbuf2;
1093         char *oldname = NULL;
1094         char *newname = NULL;
1095         char *last_component_oldname = NULL;
1096         char *last_component_newname = NULL;
1097         files_struct *fsp1,*fsp2;
1098         uint32 fattr;
1099         int info;
1100         SMB_OFF_T ret=-1;
1101         NTSTATUS status = NT_STATUS_OK;
1102
1103         ZERO_STRUCT(sbuf1);
1104         ZERO_STRUCT(sbuf2);
1105
1106         if (!CAN_WRITE(conn)) {
1107                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1108         }
1109
1110         status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1111                         &last_component_oldname, &sbuf1);
1112         if (!NT_STATUS_IS_OK(status)) {
1113                 return status;
1114         }
1115
1116         status = check_name(conn, oldname);
1117         if (!NT_STATUS_IS_OK(status)) {
1118                 return status;
1119         }
1120
1121         /* Source must already exist. */
1122         if (!VALID_STAT(sbuf1)) {
1123                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1124         }
1125         /* Ensure attributes match. */
1126         fattr = dos_mode(conn,oldname,&sbuf1);
1127         if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1128                 return NT_STATUS_NO_SUCH_FILE;
1129         }
1130
1131         status = unix_convert(ctx, conn, newname_in, False, &newname,
1132                         &last_component_newname, &sbuf2);
1133         if (!NT_STATUS_IS_OK(status)) {
1134                 return status;
1135         }
1136
1137         status = check_name(conn, newname);
1138         if (!NT_STATUS_IS_OK(status)) {
1139                 return status;
1140         }
1141
1142         /* Disallow if newname already exists. */
1143         if (VALID_STAT(sbuf2)) {
1144                 return NT_STATUS_OBJECT_NAME_COLLISION;
1145         }
1146
1147         /* No links from a directory. */
1148         if (S_ISDIR(sbuf1.st_mode)) {
1149                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1150         }
1151
1152         /* Ensure this is within the share. */
1153         status = check_reduced_name(conn, oldname);
1154         if (!NT_STATUS_IS_OK(status)) {
1155                 return status;
1156         }
1157
1158         DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1159                                 oldname, newname));
1160
1161         status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1162                         FILE_READ_DATA, /* Read-only. */
1163                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1164                         FILE_OPEN,
1165                         0, /* No create options. */
1166                         FILE_ATTRIBUTE_NORMAL,
1167                         NO_OPLOCK,
1168                         &info, &fsp1);
1169
1170         if (!NT_STATUS_IS_OK(status)) {
1171                 return status;
1172         }
1173
1174         status = open_file_ntcreate(conn, req, newname, &sbuf2,
1175                         FILE_WRITE_DATA, /* Read-only. */
1176                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1177                         FILE_CREATE,
1178                         0, /* No create options. */
1179                         fattr,
1180                         NO_OPLOCK,
1181                         &info, &fsp2);
1182
1183         if (!NT_STATUS_IS_OK(status)) {
1184                 close_file(NULL, fsp1, ERROR_CLOSE);
1185                 return status;
1186         }
1187
1188         if (sbuf1.st_size) {
1189                 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1190         }
1191
1192         /*
1193          * As we are opening fsp1 read-only we only expect
1194          * an error on close on fsp2 if we are out of space.
1195          * Thus we don't look at the error return from the
1196          * close of fsp1.
1197          */
1198         close_file(NULL, fsp1, NORMAL_CLOSE);
1199
1200         /* Ensure the modtime is set correctly on the destination file. */
1201         set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1202
1203         status = close_file(NULL, fsp2, NORMAL_CLOSE);
1204
1205         /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1206            creates the file. This isn't the correct thing to do in the copy
1207            case. JRA */
1208         file_set_dosmode(conn, newname, fattr, &sbuf2,
1209                          parent_dirname(newname),false);
1210
1211         if (ret < (SMB_OFF_T)sbuf1.st_size) {
1212                 return NT_STATUS_DISK_FULL;
1213         }
1214
1215         if (!NT_STATUS_IS_OK(status)) {
1216                 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1217                         nt_errstr(status), oldname, newname));
1218         }
1219         return status;
1220 }
1221
1222 /****************************************************************************
1223  Reply to a NT rename request.
1224 ****************************************************************************/
1225
1226 void reply_ntrename(struct smb_request *req)
1227 {
1228         connection_struct *conn = req->conn;
1229         char *oldname = NULL;
1230         char *newname = NULL;
1231         char *p;
1232         NTSTATUS status;
1233         bool src_has_wcard = False;
1234         bool dest_has_wcard = False;
1235         uint32 attrs;
1236         uint16 rename_type;
1237         TALLOC_CTX *ctx = talloc_tos();
1238
1239         START_PROFILE(SMBntrename);
1240
1241         if (req->wct < 4) {
1242                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1243                 END_PROFILE(SMBntrename);
1244                 return;
1245         }
1246
1247         attrs = SVAL(req->inbuf,smb_vwv0);
1248         rename_type = SVAL(req->inbuf,smb_vwv1);
1249
1250         p = smb_buf(req->inbuf) + 1;
1251         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1252                                    0, STR_TERMINATE, &status,
1253                                    &src_has_wcard);
1254         if (!NT_STATUS_IS_OK(status)) {
1255                 reply_nterror(req, status);
1256                 END_PROFILE(SMBntrename);
1257                 return;
1258         }
1259
1260         if( is_ntfs_stream_name(oldname)) {
1261                 /* Can't rename a stream. */
1262                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1263                 END_PROFILE(SMBntrename);
1264                 return;
1265         }
1266
1267         if (ms_has_wild(oldname)) {
1268                 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1269                 END_PROFILE(SMBntrename);
1270                 return;
1271         }
1272
1273         p++;
1274         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1275                                    0, STR_TERMINATE, &status,
1276                                    &dest_has_wcard);
1277         if (!NT_STATUS_IS_OK(status)) {
1278                 reply_nterror(req, status);
1279                 END_PROFILE(SMBntrename);
1280                 return;
1281         }
1282
1283         status = resolve_dfspath(ctx, conn,
1284                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1285                                 oldname,
1286                                 &oldname);
1287         if (!NT_STATUS_IS_OK(status)) {
1288                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1289                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1290                                         ERRSRV, ERRbadpath);
1291                         END_PROFILE(SMBntrename);
1292                         return;
1293                 }
1294                 reply_nterror(req, status);
1295                 END_PROFILE(SMBntrename);
1296                 return;
1297         }
1298
1299         status = resolve_dfspath(ctx, conn,
1300                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1301                                 newname,
1302                                 &newname);
1303         if (!NT_STATUS_IS_OK(status)) {
1304                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1305                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1306                                         ERRSRV, ERRbadpath);
1307                         END_PROFILE(SMBntrename);
1308                         return;
1309                 }
1310                 reply_nterror(req, status);
1311                 END_PROFILE(SMBntrename);
1312                 return;
1313         }
1314
1315         DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1316
1317         switch(rename_type) {
1318                 case RENAME_FLAG_RENAME:
1319                         status = rename_internals(ctx, conn, req, oldname,
1320                                         newname, attrs, False, src_has_wcard,
1321                                         dest_has_wcard, DELETE_ACCESS);
1322                         break;
1323                 case RENAME_FLAG_HARD_LINK:
1324                         if (src_has_wcard || dest_has_wcard) {
1325                                 /* No wildcards. */
1326                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1327                         } else {
1328                                 status = hardlink_internals(ctx,
1329                                                 conn,
1330                                                 oldname,
1331                                                 newname);
1332                         }
1333                         break;
1334                 case RENAME_FLAG_COPY:
1335                         if (src_has_wcard || dest_has_wcard) {
1336                                 /* No wildcards. */
1337                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1338                         } else {
1339                                 status = copy_internals(ctx, conn, req, oldname,
1340                                                         newname, attrs);
1341                         }
1342                         break;
1343                 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1344                         status = NT_STATUS_INVALID_PARAMETER;
1345                         break;
1346                 default:
1347                         status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1348                         break;
1349         }
1350
1351         if (!NT_STATUS_IS_OK(status)) {
1352                 if (open_was_deferred(req->mid)) {
1353                         /* We have re-scheduled this call. */
1354                         END_PROFILE(SMBntrename);
1355                         return;
1356                 }
1357
1358                 reply_nterror(req, status);
1359                 END_PROFILE(SMBntrename);
1360                 return;
1361         }
1362
1363         reply_outbuf(req, 0, 0);
1364
1365         END_PROFILE(SMBntrename);
1366         return;
1367 }
1368
1369 /****************************************************************************
1370  Reply to a notify change - queue the request and
1371  don't allow a directory to be opened.
1372 ****************************************************************************/
1373
1374 static void call_nt_transact_notify_change(connection_struct *conn,
1375                                            struct smb_request *req,
1376                                            uint16 **ppsetup,
1377                                            uint32 setup_count,
1378                                            char **ppparams,
1379                                            uint32 parameter_count,
1380                                            char **ppdata, uint32 data_count,
1381                                            uint32 max_data_count,
1382                                            uint32 max_param_count)
1383 {
1384         uint16 *setup = *ppsetup;
1385         files_struct *fsp;
1386         uint32 filter;
1387         NTSTATUS status;
1388         bool recursive;
1389
1390         if(setup_count < 6) {
1391                 reply_doserror(req, ERRDOS, ERRbadfunc);
1392                 return;
1393         }
1394
1395         fsp = file_fsp(req, SVAL(setup,4));
1396         filter = IVAL(setup, 0);
1397         recursive = (SVAL(setup, 6) != 0) ? True : False;
1398
1399         DEBUG(3,("call_nt_transact_notify_change\n"));
1400
1401         if(!fsp) {
1402                 reply_doserror(req, ERRDOS, ERRbadfid);
1403                 return;
1404         }
1405
1406         {
1407                 char *filter_string;
1408
1409                 if (!(filter_string = notify_filter_string(NULL, filter))) {
1410                         reply_nterror(req,NT_STATUS_NO_MEMORY);
1411                         return;
1412                 }
1413
1414                 DEBUG(3,("call_nt_transact_notify_change: notify change "
1415                          "called on %s, filter = %s, recursive = %d\n",
1416                          fsp->fsp_name, filter_string, recursive));
1417
1418                 TALLOC_FREE(filter_string);
1419         }
1420
1421         if((!fsp->is_directory) || (conn != fsp->conn)) {
1422                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1423                 return;
1424         }
1425
1426         if (fsp->notify == NULL) {
1427
1428                 status = change_notify_create(fsp, filter, recursive);
1429
1430                 if (!NT_STATUS_IS_OK(status)) {
1431                         DEBUG(10, ("change_notify_create returned %s\n",
1432                                    nt_errstr(status)));
1433                         reply_nterror(req, status);
1434                         return;
1435                 }
1436         }
1437
1438         if (fsp->notify->num_changes != 0) {
1439
1440                 /*
1441                  * We've got changes pending, respond immediately
1442                  */
1443
1444                 /*
1445                  * TODO: write a torture test to check the filtering behaviour
1446                  * here.
1447                  */
1448
1449                 change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1450
1451                 /*
1452                  * change_notify_reply() above has independently sent its
1453                  * results
1454                  */
1455                 return;
1456         }
1457
1458         /*
1459          * No changes pending, queue the request
1460          */
1461
1462         status = change_notify_add_request(req,
1463                         max_param_count,
1464                         filter,
1465                         recursive, fsp);
1466         if (!NT_STATUS_IS_OK(status)) {
1467                 reply_nterror(req, status);
1468         }
1469         return;
1470 }
1471
1472 /****************************************************************************
1473  Reply to an NT transact rename command.
1474 ****************************************************************************/
1475
1476 static void call_nt_transact_rename(connection_struct *conn,
1477                                     struct smb_request *req,
1478                                     uint16 **ppsetup, uint32 setup_count,
1479                                     char **ppparams, uint32 parameter_count,
1480                                     char **ppdata, uint32 data_count,
1481                                     uint32 max_data_count)
1482 {
1483         char *params = *ppparams;
1484         char *new_name = NULL;
1485         files_struct *fsp = NULL;
1486         bool dest_has_wcard = False;
1487         NTSTATUS status;
1488         TALLOC_CTX *ctx = talloc_tos();
1489
1490         if(parameter_count < 5) {
1491                 reply_doserror(req, ERRDOS, ERRbadfunc);
1492                 return;
1493         }
1494
1495         fsp = file_fsp(req, SVAL(params, 0));
1496         if (!check_fsp(conn, req, fsp)) {
1497                 return;
1498         }
1499         srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1500                               parameter_count - 4,
1501                               STR_TERMINATE, &status, &dest_has_wcard);
1502         if (!NT_STATUS_IS_OK(status)) {
1503                 reply_nterror(req, status);
1504                 return;
1505         }
1506
1507         /*
1508          * W2K3 ignores this request as the RAW-RENAME test
1509          * demonstrates, so we do.
1510          */
1511         send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1512
1513         DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1514                  fsp->fsp_name, new_name));
1515
1516         return;
1517 }
1518
1519 /******************************************************************************
1520  Fake up a completely empty SD.
1521 *******************************************************************************/
1522
1523 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1524 {
1525         size_t sd_size;
1526
1527         *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1528         if(!*ppsd) {
1529                 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1530                 return NT_STATUS_NO_MEMORY;
1531         }
1532
1533         return NT_STATUS_OK;
1534 }
1535
1536 /****************************************************************************
1537  Reply to query a security descriptor.
1538 ****************************************************************************/
1539
1540 static void call_nt_transact_query_security_desc(connection_struct *conn,
1541                                                  struct smb_request *req,
1542                                                  uint16 **ppsetup,
1543                                                  uint32 setup_count,
1544                                                  char **ppparams,
1545                                                  uint32 parameter_count,
1546                                                  char **ppdata,
1547                                                  uint32 data_count,
1548                                                  uint32 max_data_count)
1549 {
1550         char *params = *ppparams;
1551         char *data = *ppdata;
1552         SEC_DESC *psd = NULL;
1553         size_t sd_size;
1554         uint32 security_info_wanted;
1555         files_struct *fsp = NULL;
1556         NTSTATUS status;
1557         DATA_BLOB blob;
1558
1559         if(parameter_count < 8) {
1560                 reply_doserror(req, ERRDOS, ERRbadfunc);
1561                 return;
1562         }
1563
1564         fsp = file_fsp(req, SVAL(params,0));
1565         if(!fsp) {
1566                 reply_doserror(req, ERRDOS, ERRbadfid);
1567                 return;
1568         }
1569
1570         security_info_wanted = IVAL(params,4);
1571
1572         DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1573                         (unsigned int)security_info_wanted ));
1574
1575         params = nttrans_realloc(ppparams, 4);
1576         if(params == NULL) {
1577                 reply_doserror(req, ERRDOS, ERRnomem);
1578                 return;
1579         }
1580
1581         /*
1582          * Get the permissions to return.
1583          */
1584
1585         if (!lp_nt_acl_support(SNUM(conn))) {
1586                 status = get_null_nt_acl(talloc_tos(), &psd);
1587         } else {
1588                 status = SMB_VFS_FGET_NT_ACL(
1589                         fsp, security_info_wanted, &psd);
1590         }
1591
1592         if (!NT_STATUS_IS_OK(status)) {
1593                 reply_nterror(req, status);
1594                 return;
1595         }
1596
1597         sd_size = ndr_size_security_descriptor(psd, 0);
1598
1599         DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1600
1601         SIVAL(params,0,(uint32)sd_size);
1602
1603         if (max_data_count < sd_size) {
1604                 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1605                                 params, 4, *ppdata, 0);
1606                 return;
1607         }
1608
1609         /*
1610          * Allocate the data we will point this at.
1611          */
1612
1613         data = nttrans_realloc(ppdata, sd_size);
1614         if(data == NULL) {
1615                 reply_doserror(req, ERRDOS, ERRnomem);
1616                 return;
1617         }
1618
1619         status = marshall_sec_desc(talloc_tos(), psd,
1620                                    &blob.data, &blob.length);
1621
1622         if (!NT_STATUS_IS_OK(status)) {
1623                 reply_nterror(req, status);
1624                 return;
1625         }
1626
1627         SMB_ASSERT(sd_size == blob.length);
1628         memcpy(data, blob.data, sd_size);
1629
1630         send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1631
1632         return;
1633 }
1634
1635 /****************************************************************************
1636  Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1637 ****************************************************************************/
1638
1639 static void call_nt_transact_set_security_desc(connection_struct *conn,
1640                                                struct smb_request *req,
1641                                                uint16 **ppsetup,
1642                                                uint32 setup_count,
1643                                                char **ppparams,
1644                                                uint32 parameter_count,
1645                                                char **ppdata,
1646                                                uint32 data_count,
1647                                                uint32 max_data_count)
1648 {
1649         char *params= *ppparams;
1650         char *data = *ppdata;
1651         files_struct *fsp = NULL;
1652         uint32 security_info_sent = 0;
1653         NTSTATUS status;
1654
1655         if(parameter_count < 8) {
1656                 reply_doserror(req, ERRDOS, ERRbadfunc);
1657                 return;
1658         }
1659
1660         if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
1661                 reply_doserror(req, ERRDOS, ERRbadfid);
1662                 return;
1663         }
1664
1665         if(!lp_nt_acl_support(SNUM(conn))) {
1666                 goto done;
1667         }
1668
1669         security_info_sent = IVAL(params,4);
1670
1671         DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1672                 (unsigned int)security_info_sent ));
1673
1674         if (data_count == 0) {
1675                 reply_doserror(req, ERRDOS, ERRnoaccess);
1676                 return;
1677         }
1678
1679         status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1680
1681         if (!NT_STATUS_IS_OK(status)) {
1682                 reply_nterror(req, status);
1683                 return;
1684         }
1685
1686   done:
1687         send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1688         return;
1689 }
1690
1691 /****************************************************************************
1692  Reply to NT IOCTL
1693 ****************************************************************************/
1694
1695 static void call_nt_transact_ioctl(connection_struct *conn,
1696                                    struct smb_request *req,
1697                                    uint16 **ppsetup, uint32 setup_count,
1698                                    char **ppparams, uint32 parameter_count,
1699                                    char **ppdata, uint32 data_count,
1700                                    uint32 max_data_count)
1701 {
1702         uint32 function;
1703         uint16 fidnum;
1704         files_struct *fsp;
1705         uint8 isFSctl;
1706         uint8 compfilter;
1707         static bool logged_message;
1708         char *pdata = *ppdata;
1709
1710         if (setup_count != 8) {
1711                 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1712                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1713                 return;
1714         }
1715
1716         function = IVAL(*ppsetup, 0);
1717         fidnum = SVAL(*ppsetup, 4);
1718         isFSctl = CVAL(*ppsetup, 6);
1719         compfilter = CVAL(*ppsetup, 7);
1720
1721         DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", 
1722                  function, fidnum, isFSctl, compfilter));
1723
1724         fsp=file_fsp(req, fidnum);
1725         /* this check is done in each implemented function case for now
1726            because I don't want to break anything... --metze
1727         FSP_BELONGS_CONN(fsp,conn);*/
1728
1729         switch (function) {
1730         case FSCTL_SET_SPARSE:
1731                 /* pretend this succeeded - tho strictly we should
1732                    mark the file sparse (if the local fs supports it)
1733                    so we can know if we need to pre-allocate or not */
1734
1735                 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1736                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1737                 return;
1738
1739         case FSCTL_CREATE_OR_GET_OBJECT_ID:
1740         {
1741                 unsigned char objid[16];
1742
1743                 /* This should return the object-id on this file.
1744                  * I think I'll make this be the inode+dev. JRA.
1745                  */
1746
1747                 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1748
1749                 if (!fsp_belongs_conn(conn, req, fsp)) {
1750                         return;
1751                 }
1752
1753                 data_count = 64;
1754                 pdata = nttrans_realloc(ppdata, data_count);
1755                 if (pdata == NULL) {
1756                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1757                         return;
1758                 }
1759                 push_file_id_16(pdata, &fsp->file_id);
1760                 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1761                 push_file_id_16(pdata+32, &fsp->file_id);
1762                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1763                                 pdata, data_count);
1764                 return;
1765         }
1766
1767         case FSCTL_GET_REPARSE_POINT:
1768                 /* pretend this fail - my winXP does it like this
1769                  * --metze
1770                  */
1771
1772                 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1773                 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1774                 return;
1775
1776         case FSCTL_SET_REPARSE_POINT:
1777                 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1778                  * --metze
1779                  */
1780
1781                 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1782                 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1783                 return;
1784
1785         case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1786         {
1787                 /*
1788                  * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1789                  * and return their volume names.  If max_data_count is 16, then it is just
1790                  * asking for the number of volumes and length of the combined names.
1791                  *
1792                  * pdata is the data allocated by our caller, but that uses
1793                  * total_data_count (which is 0 in our case) rather than max_data_count.
1794                  * Allocate the correct amount and return the pointer to let
1795                  * it be deallocated when we return.
1796                  */
1797                 SHADOW_COPY_DATA *shadow_data = NULL;
1798                 TALLOC_CTX *shadow_mem_ctx = NULL;
1799                 bool labels = False;
1800                 uint32 labels_data_count = 0;
1801                 uint32 i;
1802                 char *cur_pdata;
1803
1804                 if (!fsp_belongs_conn(conn, req, fsp)) {
1805                         return;
1806                 }
1807
1808                 if (max_data_count < 16) {
1809                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1810                                 max_data_count));
1811                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1812                         return;
1813                 }
1814
1815                 if (max_data_count > 16) {
1816                         labels = True;
1817                 }
1818
1819                 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1820                 if (shadow_mem_ctx == NULL) {
1821                         DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1822                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1823                         return;
1824                 }
1825
1826                 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1827                 if (shadow_data == NULL) {
1828                         DEBUG(0,("TALLOC_ZERO() failed!\n"));
1829                         talloc_destroy(shadow_mem_ctx);
1830                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1831                         return;
1832                 }
1833
1834                 shadow_data->mem_ctx = shadow_mem_ctx;
1835
1836                 /*
1837                  * Call the VFS routine to actually do the work.
1838                  */
1839                 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1840                         talloc_destroy(shadow_data->mem_ctx);
1841                         if (errno == ENOSYS) {
1842                                 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", 
1843                                         conn->connectpath));
1844                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1845                                 return;
1846                         } else {
1847                                 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", 
1848                                         conn->connectpath));
1849                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1850                                 return;
1851                         }
1852                 }
1853
1854                 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
1855
1856                 if (!labels) {
1857                         data_count = 16;
1858                 } else {
1859                         data_count = 12+labels_data_count+4;
1860                 }
1861
1862                 if (max_data_count<data_count) {
1863                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1864                                 max_data_count,data_count));
1865                         talloc_destroy(shadow_data->mem_ctx);
1866                         reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1867                         return;
1868                 }
1869
1870                 pdata = nttrans_realloc(ppdata, data_count);
1871                 if (pdata == NULL) {
1872                         talloc_destroy(shadow_data->mem_ctx);
1873                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1874                         return;
1875                 }
1876
1877                 cur_pdata = pdata;
1878
1879                 /* num_volumes 4 bytes */
1880                 SIVAL(pdata,0,shadow_data->num_volumes);
1881
1882                 if (labels) {
1883                         /* num_labels 4 bytes */
1884                         SIVAL(pdata,4,shadow_data->num_volumes);
1885                 }
1886
1887                 /* needed_data_count 4 bytes */
1888                 SIVAL(pdata,8,labels_data_count);
1889
1890                 cur_pdata+=12;
1891
1892                 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1893                         shadow_data->num_volumes,fsp->fsp_name));
1894                 if (labels && shadow_data->labels) {
1895                         for (i=0;i<shadow_data->num_volumes;i++) {
1896                                 srvstr_push(pdata, req->flags2,
1897                                             cur_pdata, shadow_data->labels[i],
1898                                             2*sizeof(SHADOW_COPY_LABEL),
1899                                             STR_UNICODE|STR_TERMINATE);
1900                                 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1901                                 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1902                         }
1903                 }
1904
1905                 talloc_destroy(shadow_data->mem_ctx);
1906
1907                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1908                                 pdata, data_count);
1909
1910                 return;
1911         }
1912
1913         case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1914         {
1915                 /* pretend this succeeded -
1916                  *
1917                  * we have to send back a list with all files owned by this SID
1918                  *
1919                  * but I have to check that --metze
1920                  */
1921                 DOM_SID sid;
1922                 uid_t uid;
1923                 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1924
1925                 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1926
1927                 if (!fsp_belongs_conn(conn, req, fsp)) {
1928                         return;
1929                 }
1930
1931                 /* unknown 4 bytes: this is not the length of the sid :-(  */
1932                 /*unknown = IVAL(pdata,0);*/
1933
1934                 sid_parse(pdata+4,sid_len,&sid);
1935                 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1936
1937                 if (!sid_to_uid(&sid, &uid)) {
1938                         DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1939                                  sid_string_dbg(&sid),
1940                                  (unsigned long)sid_len));
1941                         uid = (-1);
1942                 }
1943
1944                 /* we can take a look at the find source :-)
1945                  *
1946                  * find ./ -uid $uid  -name '*'   is what we need here
1947                  *
1948                  *
1949                  * and send 4bytes len and then NULL terminated unicode strings
1950                  * for each file
1951                  *
1952                  * but I don't know how to deal with the paged results
1953                  * (maybe we can hang the result anywhere in the fsp struct)
1954                  *
1955                  * we don't send all files at once
1956                  * and at the next we should *not* start from the beginning,
1957                  * so we have to cache the result
1958                  *
1959                  * --metze
1960                  */
1961
1962                 /* this works for now... */
1963                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1964                 return;
1965         }
1966         default:
1967                 if (!logged_message) {
1968                         logged_message = True; /* Only print this once... */
1969                         DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
1970                                  function));
1971                 }
1972         }
1973
1974         reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1975 }
1976
1977
1978 #ifdef HAVE_SYS_QUOTAS
1979 /****************************************************************************
1980  Reply to get user quota
1981 ****************************************************************************/
1982
1983 static void call_nt_transact_get_user_quota(connection_struct *conn,
1984                                             struct smb_request *req,
1985                                             uint16 **ppsetup,
1986                                             uint32 setup_count,
1987                                             char **ppparams,
1988                                             uint32 parameter_count,
1989                                             char **ppdata,
1990                                             uint32 data_count,
1991                                             uint32 max_data_count)
1992 {
1993         NTSTATUS nt_status = NT_STATUS_OK;
1994         char *params = *ppparams;
1995         char *pdata = *ppdata;
1996         char *entry;
1997         int data_len=0,param_len=0;
1998         int qt_len=0;
1999         int entry_len = 0;
2000         files_struct *fsp = NULL;
2001         uint16 level = 0;
2002         size_t sid_len;
2003         DOM_SID sid;
2004         bool start_enum = True;
2005         SMB_NTQUOTA_STRUCT qt;
2006         SMB_NTQUOTA_LIST *tmp_list;
2007         SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2008
2009         ZERO_STRUCT(qt);
2010
2011         /* access check */
2012         if (conn->server_info->utok.uid != 0) {
2013                 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2014                          "[%s]\n", lp_servicename(SNUM(conn)),
2015                          conn->server_info->unix_name));
2016                 reply_doserror(req, ERRDOS, ERRnoaccess);
2017                 return;
2018         }
2019
2020         /*
2021          * Ensure minimum number of parameters sent.
2022          */
2023
2024         if (parameter_count < 4) {
2025                 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2026                 reply_doserror(req, ERRDOS, ERRinvalidparam);
2027                 return;
2028         }
2029
2030         /* maybe we can check the quota_fnum */
2031         fsp = file_fsp(req, SVAL(params,0));
2032         if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2033                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2034                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2035                 return;
2036         }
2037
2038         /* the NULL pointer checking for fsp->fake_file_handle->pd
2039          * is done by CHECK_NTQUOTA_HANDLE_OK()
2040          */
2041         qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2042
2043         level = SVAL(params,2);
2044
2045         /* unknown 12 bytes leading in params */
2046
2047         switch (level) {
2048                 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2049                         /* seems that we should continue with the enum here --metze */
2050
2051                         if (qt_handle->quota_list!=NULL &&
2052                             qt_handle->tmp_list==NULL) {
2053
2054                                 /* free the list */
2055                                 free_ntquota_list(&(qt_handle->quota_list));
2056
2057                                 /* Realloc the size of parameters and data we will return */
2058                                 param_len = 4;
2059                                 params = nttrans_realloc(ppparams, param_len);
2060                                 if(params == NULL) {
2061                                         reply_doserror(req, ERRDOS, ERRnomem);
2062                                         return;
2063                                 }
2064
2065                                 data_len = 0;
2066                                 SIVAL(params,0,data_len);
2067
2068                                 break;
2069                         }
2070
2071                         start_enum = False;
2072
2073                 case TRANSACT_GET_USER_QUOTA_LIST_START:
2074
2075                         if (qt_handle->quota_list==NULL &&
2076                                 qt_handle->tmp_list==NULL) {
2077                                 start_enum = True;
2078                         }
2079
2080                         if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2081                                 reply_doserror(req, ERRSRV, ERRerror);
2082                                 return;
2083                         }
2084
2085                         /* Realloc the size of parameters and data we will return */
2086                         param_len = 4;
2087                         params = nttrans_realloc(ppparams, param_len);
2088                         if(params == NULL) {
2089                                 reply_doserror(req, ERRDOS, ERRnomem);
2090                                 return;
2091                         }
2092
2093                         /* we should not trust the value in max_data_count*/
2094                         max_data_count = MIN(max_data_count,2048);
2095
2096                         pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2097                         if(pdata == NULL) {
2098                                 reply_doserror(req, ERRDOS, ERRnomem);
2099                                 return;
2100                         }
2101
2102                         entry = pdata;
2103
2104                         /* set params Size of returned Quota Data 4 bytes*/
2105                         /* but set it later when we know it */
2106
2107                         /* for each entry push the data */
2108
2109                         if (start_enum) {
2110                                 qt_handle->tmp_list = qt_handle->quota_list;
2111                         }
2112
2113                         tmp_list = qt_handle->tmp_list;
2114
2115                         for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2116                                 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2117
2118                                 sid_len = ndr_size_dom_sid(
2119                                         &tmp_list->quotas->sid, 0);
2120                                 entry_len = 40 + sid_len;
2121
2122                                 /* nextoffset entry 4 bytes */
2123                                 SIVAL(entry,0,entry_len);
2124
2125                                 /* then the len of the SID 4 bytes */
2126                                 SIVAL(entry,4,sid_len);
2127
2128                                 /* unknown data 8 bytes uint64_t */
2129                                 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/
2130
2131                                 /* the used disk space 8 bytes uint64_t */
2132                                 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2133
2134                                 /* the soft quotas 8 bytes uint64_t */
2135                                 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2136
2137                                 /* the hard quotas 8 bytes uint64_t */
2138                                 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2139
2140                                 /* and now the SID */
2141                                 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2142                         }
2143
2144                         qt_handle->tmp_list = tmp_list;
2145
2146                         /* overwrite the offset of the last entry */
2147                         SIVAL(entry-entry_len,0,0);
2148
2149                         data_len = 4+qt_len;
2150                         /* overwrite the params quota_data_len */
2151                         SIVAL(params,0,data_len);
2152
2153                         break;
2154
2155                 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2156
2157                         /* unknown 4 bytes IVAL(pdata,0) */
2158
2159                         if (data_count < 8) {
2160                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2161                                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2162                                 return;
2163                         }
2164
2165                         sid_len = IVAL(pdata,4);
2166                         /* Ensure this is less than 1mb. */
2167                         if (sid_len > (1024*1024)) {
2168                                 reply_doserror(req, ERRDOS, ERRnomem);
2169                                 return;
2170                         }
2171
2172                         if (data_count < 8+sid_len) {
2173                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2174                                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2175                                 return;
2176                         }
2177
2178                         data_len = 4+40+sid_len;
2179
2180                         if (max_data_count < data_len) {
2181                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2182                                         max_data_count, data_len));
2183                                 param_len = 4;
2184                                 SIVAL(params,0,data_len);
2185                                 data_len = 0;
2186                                 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2187                                 break;
2188                         }
2189
2190                         sid_parse(pdata+8,sid_len,&sid);
2191
2192                         if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2193                                 ZERO_STRUCT(qt);
2194                                 /*
2195                                  * we have to return zero's in all fields
2196                                  * instead of returning an error here
2197                                  * --metze
2198                                  */
2199                         }
2200
2201                         /* Realloc the size of parameters and data we will return */
2202                         param_len = 4;
2203                         params = nttrans_realloc(ppparams, param_len);
2204                         if(params == NULL) {
2205                                 reply_doserror(req, ERRDOS, ERRnomem);
2206                                 return;
2207                         }
2208
2209                         pdata = nttrans_realloc(ppdata, data_len);
2210                         if(pdata == NULL) {
2211                                 reply_doserror(req, ERRDOS, ERRnomem);
2212                                 return;
2213                         }
2214
2215                         entry = pdata;
2216
2217                         /* set params Size of returned Quota Data 4 bytes*/
2218                         SIVAL(params,0,data_len);
2219
2220                         /* nextoffset entry 4 bytes */
2221                         SIVAL(entry,0,0);
2222
2223                         /* then the len of the SID 4 bytes */
2224                         SIVAL(entry,4,sid_len);
2225
2226                         /* unknown data 8 bytes uint64_t */
2227                         SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/
2228
2229                         /* the used disk space 8 bytes uint64_t */
2230                         SBIG_UINT(entry,16,qt.usedspace);
2231
2232                         /* the soft quotas 8 bytes uint64_t */
2233                         SBIG_UINT(entry,24,qt.softlim);
2234
2235                         /* the hard quotas 8 bytes uint64_t */
2236                         SBIG_UINT(entry,32,qt.hardlim);
2237
2238                         /* and now the SID */
2239                         sid_linearize(entry+40, sid_len, &sid);
2240
2241                         break;
2242
2243                 default:
2244                         DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2245                         reply_doserror(req, ERRSRV, ERRerror);
2246                         return;
2247                         break;
2248         }
2249
2250         send_nt_replies(conn, req, nt_status, params, param_len,
2251                         pdata, data_len);
2252 }
2253
2254 /****************************************************************************
2255  Reply to set user quota
2256 ****************************************************************************/
2257
2258 static void call_nt_transact_set_user_quota(connection_struct *conn,
2259                                             struct smb_request *req,
2260                                             uint16 **ppsetup,
2261                                             uint32 setup_count,
2262                                             char **ppparams,
2263                                             uint32 parameter_count,
2264                                             char **ppdata,
2265                                             uint32 data_count,
2266                                             uint32 max_data_count)
2267 {
2268         char *params = *ppparams;
2269         char *pdata = *ppdata;
2270         int data_len=0,param_len=0;
2271         SMB_NTQUOTA_STRUCT qt;
2272         size_t sid_len;
2273         DOM_SID sid;
2274         files_struct *fsp = NULL;
2275
2276         ZERO_STRUCT(qt);
2277
2278         /* access check */
2279         if (conn->server_info->utok.uid != 0) {
2280                 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2281                          "[%s]\n", lp_servicename(SNUM(conn)),
2282                          conn->server_info->unix_name));
2283                 reply_doserror(req, ERRDOS, ERRnoaccess);
2284                 return;
2285         }
2286
2287         /*
2288          * Ensure minimum number of parameters sent.
2289          */
2290
2291         if (parameter_count < 2) {
2292                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2293                 reply_doserror(req, ERRDOS, ERRinvalidparam);
2294                 return;
2295         }
2296
2297         /* maybe we can check the quota_fnum */
2298         fsp = file_fsp(req, SVAL(params,0));
2299         if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2300                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2301                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2302                 return;
2303         }
2304
2305         if (data_count < 40) {
2306                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2307                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2308                 return;
2309         }
2310
2311         /* offset to next quota record.
2312          * 4 bytes IVAL(pdata,0)
2313          * unused here...
2314          */
2315
2316         /* sid len */
2317         sid_len = IVAL(pdata,4);
2318
2319         if (data_count < 40+sid_len) {
2320                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2321                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2322                 return;
2323         }
2324
2325         /* unknown 8 bytes in pdata
2326          * maybe its the change time in NTTIME
2327          */
2328
2329         /* the used space 8 bytes (uint64_t)*/
2330         qt.usedspace = (uint64_t)IVAL(pdata,16);
2331 #ifdef LARGE_SMB_OFF_T
2332         qt.usedspace |= (((uint64_t)IVAL(pdata,20)) << 32);
2333 #else /* LARGE_SMB_OFF_T */
2334         if ((IVAL(pdata,20) != 0)&&
2335                 ((qt.usedspace != 0xFFFFFFFF)||
2336                 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2337                 /* more than 32 bits? */
2338                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2339                 return;
2340         }
2341 #endif /* LARGE_SMB_OFF_T */
2342
2343         /* the soft quotas 8 bytes (uint64_t)*/
2344         qt.softlim = (uint64_t)IVAL(pdata,24);
2345 #ifdef LARGE_SMB_OFF_T
2346         qt.softlim |= (((uint64_t)IVAL(pdata,28)) << 32);
2347 #else /* LARGE_SMB_OFF_T */
2348         if ((IVAL(pdata,28) != 0)&&
2349                 ((qt.softlim != 0xFFFFFFFF)||
2350                 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2351                 /* more than 32 bits? */
2352                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2353                 return;
2354         }
2355 #endif /* LARGE_SMB_OFF_T */
2356
2357         /* the hard quotas 8 bytes (uint64_t)*/
2358         qt.hardlim = (uint64_t)IVAL(pdata,32);
2359 #ifdef LARGE_SMB_OFF_T
2360         qt.hardlim |= (((uint64_t)IVAL(pdata,36)) << 32);
2361 #else /* LARGE_SMB_OFF_T */
2362         if ((IVAL(pdata,36) != 0)&&
2363                 ((qt.hardlim != 0xFFFFFFFF)||
2364                 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2365                 /* more than 32 bits? */
2366                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2367                 return;
2368         }
2369 #endif /* LARGE_SMB_OFF_T */
2370
2371         sid_parse(pdata+40,sid_len,&sid);
2372         DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2373
2374         /* 44 unknown bytes left... */
2375
2376         if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2377                 reply_doserror(req, ERRSRV, ERRerror);
2378                 return;
2379         }
2380
2381         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2382                         pdata, data_len);
2383 }
2384 #endif /* HAVE_SYS_QUOTAS */
2385
2386 static void handle_nttrans(connection_struct *conn,
2387                            struct trans_state *state,
2388                            struct smb_request *req)
2389 {
2390         if (Protocol >= PROTOCOL_NT1) {
2391                 req->flags2 |= 0x40; /* IS_LONG_NAME */
2392                 SSVAL(req->inbuf,smb_flg2,req->flags2);
2393         }
2394
2395         /* Now we must call the relevant NT_TRANS function */
2396         switch(state->call) {
2397                 case NT_TRANSACT_CREATE:
2398                 {
2399                         START_PROFILE(NT_transact_create);
2400                         call_nt_transact_create(
2401                                 conn, req,
2402                                 &state->setup, state->setup_count,
2403                                 &state->param, state->total_param,
2404                                 &state->data, state->total_data,
2405                                 state->max_data_return);
2406                         END_PROFILE(NT_transact_create);
2407                         break;
2408                 }
2409
2410                 case NT_TRANSACT_IOCTL:
2411                 {
2412                         START_PROFILE(NT_transact_ioctl);
2413                         call_nt_transact_ioctl(
2414                                 conn, req,
2415                                 &state->setup, state->setup_count,
2416                                 &state->param, state->total_param,
2417                                 &state->data, state->total_data,
2418                                 state->max_data_return);
2419                         END_PROFILE(NT_transact_ioctl);
2420                         break;
2421                 }
2422
2423                 case NT_TRANSACT_SET_SECURITY_DESC:
2424                 {
2425                         START_PROFILE(NT_transact_set_security_desc);
2426                         call_nt_transact_set_security_desc(
2427                                 conn, req,
2428                                 &state->setup, state->setup_count,
2429                                 &state->param, state->total_param,
2430                                 &state->data, state->total_data,
2431                                 state->max_data_return);
2432                         END_PROFILE(NT_transact_set_security_desc);
2433                         break;
2434                 }
2435
2436                 case NT_TRANSACT_NOTIFY_CHANGE:
2437                 {
2438                         START_PROFILE(NT_transact_notify_change);
2439                         call_nt_transact_notify_change(
2440                                 conn, req,
2441                                 &state->setup, state->setup_count,
2442                                 &state->param, state->total_param,
2443                                 &state->data, state->total_data,
2444                                 state->max_data_return,
2445                                 state->max_param_return);
2446                         END_PROFILE(NT_transact_notify_change);
2447                         break;
2448                 }
2449
2450                 case NT_TRANSACT_RENAME:
2451                 {
2452                         START_PROFILE(NT_transact_rename);
2453                         call_nt_transact_rename(
2454                                 conn, req,
2455                                 &state->setup, state->setup_count,
2456                                 &state->param, state->total_param,
2457                                 &state->data, state->total_data,
2458                                 state->max_data_return);
2459                         END_PROFILE(NT_transact_rename);
2460                         break;
2461                 }
2462
2463                 case NT_TRANSACT_QUERY_SECURITY_DESC:
2464                 {
2465                         START_PROFILE(NT_transact_query_security_desc);
2466                         call_nt_transact_query_security_desc(
2467                                 conn, req,
2468                                 &state->setup, state->setup_count,
2469                                 &state->param, state->total_param,
2470                                 &state->data, state->total_data,
2471                                 state->max_data_return);
2472                         END_PROFILE(NT_transact_query_security_desc);
2473                         break;
2474                 }
2475
2476 #ifdef HAVE_SYS_QUOTAS
2477                 case NT_TRANSACT_GET_USER_QUOTA:
2478                 {
2479                         START_PROFILE(NT_transact_get_user_quota);
2480                         call_nt_transact_get_user_quota(
2481                                 conn, req,
2482                                 &state->setup, state->setup_count,
2483                                 &state->param, state->total_param,
2484                                 &state->data, state->total_data,
2485                                 state->max_data_return);
2486                         END_PROFILE(NT_transact_get_user_quota);
2487                         break;
2488                 }
2489
2490                 case NT_TRANSACT_SET_USER_QUOTA:
2491                 {
2492                         START_PROFILE(NT_transact_set_user_quota);
2493                         call_nt_transact_set_user_quota(
2494                                 conn, req,
2495                                 &state->setup, state->setup_count,
2496                                 &state->param, state->total_param,
2497                                 &state->data, state->total_data,
2498                                 state->max_data_return);
2499                         END_PROFILE(NT_transact_set_user_quota);
2500                         break;
2501                 }
2502 #endif /* HAVE_SYS_QUOTAS */
2503
2504                 default:
2505                         /* Error in request */
2506                         DEBUG(0,("handle_nttrans: Unknown request %d in "
2507                                  "nttrans call\n", state->call));
2508                         reply_doserror(req, ERRSRV, ERRerror);
2509                         return;
2510         }
2511         return;
2512 }
2513
2514 /****************************************************************************
2515  Reply to a SMBNTtrans.
2516 ****************************************************************************/
2517
2518 void reply_nttrans(struct smb_request *req)
2519 {
2520         connection_struct *conn = req->conn;
2521         uint32_t pscnt;
2522         uint32_t psoff;
2523         uint32_t dscnt;
2524         uint32_t dsoff;
2525         uint16 function_code;
2526         NTSTATUS result;
2527         struct trans_state *state;
2528         uint32_t size;
2529         uint32_t av_size;
2530
2531         START_PROFILE(SMBnttrans);
2532
2533         if (req->wct < 19) {
2534                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2535                 END_PROFILE(SMBnttrans);
2536                 return;
2537         }
2538
2539         size = smb_len(req->inbuf) + 4;
2540         av_size = smb_len(req->inbuf);
2541         pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2542         psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2543         dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2544         dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2545         function_code = SVAL(req->inbuf, smb_nt_Function);
2546
2547         if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2548                 reply_doserror(req, ERRSRV, ERRaccess);
2549                 END_PROFILE(SMBnttrans);
2550                 return;
2551         }
2552
2553         result = allow_new_trans(conn->pending_trans, req->mid);
2554         if (!NT_STATUS_IS_OK(result)) {
2555                 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2556                 reply_nterror(req, result);
2557                 END_PROFILE(SMBnttrans);
2558                 return;
2559         }
2560
2561         if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2562                 reply_doserror(req, ERRSRV, ERRaccess);
2563                 END_PROFILE(SMBnttrans);
2564                 return;
2565         }
2566
2567         state->cmd = SMBnttrans;
2568
2569         state->mid = req->mid;
2570         state->vuid = req->vuid;
2571         state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2572         state->data = NULL;
2573         state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2574         state->param = NULL;
2575         state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2576         state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2577
2578         /* setup count is in *words* */
2579         state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2580         state->setup = NULL;
2581         state->call = function_code;
2582
2583         DEBUG(10, ("num_setup=%u, "
2584                    "param_total=%u, this_param=%u, max_param=%u, "
2585                    "data_total=%u, this_data=%u, max_data=%u, "
2586                    "param_offset=%u, data_offset=%u\n",
2587                    (unsigned)state->setup_count,
2588                    (unsigned)state->total_param, (unsigned)pscnt,
2589                    (unsigned)state->max_param_return,
2590                    (unsigned)state->total_data, (unsigned)dscnt,
2591                    (unsigned)state->max_data_return,
2592                    (unsigned)psoff, (unsigned)dsoff));
2593
2594         /*
2595          * All nttrans messages we handle have smb_wct == 19 +
2596          * state->setup_count.  Ensure this is so as a sanity check.
2597          */
2598
2599         if(req->wct != 19 + (state->setup_count/2)) {
2600                 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2601                          req->wct, 19 + (state->setup_count/2)));
2602                 goto bad_param;
2603         }
2604
2605         /* Don't allow more than 128mb for each value. */
2606         if ((state->total_data > (1024*1024*128)) ||
2607             (state->total_param > (1024*1024*128))) {
2608                 reply_doserror(req, ERRDOS, ERRnomem);
2609                 END_PROFILE(SMBnttrans);
2610                 return;
2611         }
2612
2613         if ((dscnt > state->total_data) || (pscnt > state->total_param))
2614                 goto bad_param;
2615
2616         if (state->total_data)  {
2617                 /* Can't use talloc here, the core routines do realloc on the
2618                  * params and data. */
2619                 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2620                         DEBUG(0,("reply_nttrans: data malloc fail for %u "
2621                                  "bytes !\n", (unsigned int)state->total_data));
2622                         TALLOC_FREE(state);
2623                         reply_doserror(req, ERRDOS, ERRnomem);
2624                         END_PROFILE(SMBnttrans);
2625                         return;
2626                 }
2627
2628                 if (dscnt > state->total_data ||
2629                                 dsoff+dscnt < dsoff) {
2630                         goto bad_param;
2631                 }
2632
2633                 if (dsoff > av_size ||
2634                                 dscnt > av_size ||
2635                                 dsoff+dscnt > av_size) {
2636                         goto bad_param;
2637                 }
2638
2639                 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2640         }
2641
2642         if (state->total_param) {
2643                 /* Can't use talloc here, the core routines do realloc on the
2644                  * params and data. */
2645                 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2646                         DEBUG(0,("reply_nttrans: param malloc fail for %u "
2647                                  "bytes !\n", (unsigned int)state->total_param));
2648                         SAFE_FREE(state->data);
2649                         TALLOC_FREE(state);
2650                         reply_doserror(req, ERRDOS, ERRnomem);
2651                         END_PROFILE(SMBnttrans);
2652                         return;
2653                 }
2654
2655                 if (pscnt > state->total_param ||
2656                                 psoff+pscnt < psoff) {
2657                         goto bad_param;
2658                 }
2659
2660                 if (psoff > av_size ||
2661                                 pscnt > av_size ||
2662                                 psoff+pscnt > av_size) {
2663                         goto bad_param;
2664                 }
2665
2666                 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2667         }
2668
2669         state->received_data  = dscnt;
2670         state->received_param = pscnt;
2671
2672         if(state->setup_count > 0) {
2673                 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2674                           state->setup_count));
2675                 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2676                 if (state->setup == NULL) {
2677                         DEBUG(0,("reply_nttrans : Out of memory\n"));
2678                         SAFE_FREE(state->data);
2679                         SAFE_FREE(state->param);
2680                         TALLOC_FREE(state);
2681                         reply_doserror(req, ERRDOS, ERRnomem);
2682                         END_PROFILE(SMBnttrans);
2683                         return;
2684                 }
2685
2686                 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2687                     (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2688                         goto bad_param;
2689                 }
2690                 if (smb_nt_SetupStart + state->setup_count > size) {
2691                         goto bad_param;
2692                 }
2693
2694                 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2695                         state->setup_count);
2696                 dump_data(10, (uint8 *)state->setup, state->setup_count);
2697         }
2698
2699         if ((state->received_data == state->total_data) &&
2700             (state->received_param == state->total_param)) {
2701                 handle_nttrans(conn, state, req);
2702                 SAFE_FREE(state->param);
2703                 SAFE_FREE(state->data);
2704                 TALLOC_FREE(state);
2705                 END_PROFILE(SMBnttrans);
2706                 return;
2707         }
2708
2709         DLIST_ADD(conn->pending_trans, state);
2710
2711         /* We need to send an interim response then receive the rest
2712            of the parameter/data bytes */
2713         reply_outbuf(req, 0, 0);
2714         show_msg((char *)req->outbuf);
2715         END_PROFILE(SMBnttrans);
2716         return;
2717
2718   bad_param:
2719
2720         DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2721         SAFE_FREE(state->data);
2722         SAFE_FREE(state->param);
2723         TALLOC_FREE(state);
2724         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2725         END_PROFILE(SMBnttrans);
2726         return;
2727 }
2728
2729 /****************************************************************************
2730  Reply to a SMBnttranss
2731  ****************************************************************************/
2732
2733 void reply_nttranss(struct smb_request *req)
2734 {
2735         connection_struct *conn = req->conn;
2736         uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2737         struct trans_state *state;
2738         uint32_t av_size;
2739         uint32_t size;
2740
2741         START_PROFILE(SMBnttranss);
2742
2743         show_msg((char *)req->inbuf);
2744
2745         if (req->wct < 18) {
2746                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2747                 END_PROFILE(SMBnttranss);
2748                 return;
2749         }
2750
2751         for (state = conn->pending_trans; state != NULL;
2752              state = state->next) {
2753                 if (state->mid == req->mid) {
2754                         break;
2755                 }
2756         }
2757
2758         if ((state == NULL) || (state->cmd != SMBnttrans)) {
2759                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2760                 END_PROFILE(SMBnttranss);
2761                 return;
2762         }
2763
2764         /* Revise state->total_param and state->total_data in case they have
2765            changed downwards */
2766         if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2767             < state->total_param) {
2768                 state->total_param = IVAL(req->inbuf,
2769                                           smb_nts_TotalParameterCount);
2770         }
2771         if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2772                 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2773         }
2774
2775         size = smb_len(req->inbuf) + 4;
2776         av_size = smb_len(req->inbuf);
2777
2778         pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2779         poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2780         pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2781
2782         dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2783         ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2784         doff = IVAL(req->inbuf, smb_nts_DataOffset);
2785
2786         state->received_param += pcnt;
2787         state->received_data += dcnt;
2788
2789         if ((state->received_data > state->total_data) ||
2790             (state->received_param > state->total_param))
2791                 goto bad_param;
2792
2793         if (pcnt) {
2794                 if (pdisp > state->total_param ||
2795                                 pcnt > state->total_param ||
2796                                 pdisp+pcnt > state->total_param ||
2797                                 pdisp+pcnt < pdisp) {
2798                         goto bad_param;
2799                 }
2800
2801                 if (poff > av_size ||
2802                                 pcnt > av_size ||
2803                                 poff+pcnt > av_size ||
2804                                 poff+pcnt < poff) {
2805                         goto bad_param;
2806                 }
2807
2808                 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2809                        pcnt);
2810         }
2811
2812         if (dcnt) {
2813                 if (ddisp > state->total_data ||
2814                                 dcnt > state->total_data ||
2815                                 ddisp+dcnt > state->total_data ||
2816                                 ddisp+dcnt < ddisp) {
2817                         goto bad_param;
2818                 }
2819
2820                 if (ddisp > av_size ||
2821                                 dcnt > av_size ||
2822                                 ddisp+dcnt > av_size ||
2823                                 ddisp+dcnt < ddisp) {
2824                         goto bad_param;
2825                 }
2826
2827                 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2828                        dcnt);
2829         }
2830
2831         if ((state->received_param < state->total_param) ||
2832             (state->received_data < state->total_data)) {
2833                 END_PROFILE(SMBnttranss);
2834                 return;
2835         }
2836
2837         /*
2838          * construct_reply_common will copy smb_com from inbuf to
2839          * outbuf. SMBnttranss is wrong here.
2840          */
2841         SCVAL(req->inbuf,smb_com,SMBnttrans);
2842
2843         handle_nttrans(conn, state, req);
2844
2845         DLIST_REMOVE(conn->pending_trans, state);
2846         SAFE_FREE(state->data);
2847         SAFE_FREE(state->param);
2848         TALLOC_FREE(state);
2849         END_PROFILE(SMBnttranss);
2850         return;
2851
2852   bad_param:
2853
2854         DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2855         DLIST_REMOVE(conn->pending_trans, state);
2856         SAFE_FREE(state->data);
2857         SAFE_FREE(state->param);
2858         TALLOC_FREE(state);
2859         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2860         END_PROFILE(SMBnttranss);
2861         return;
2862 }