s3: smbd: Change canonicalize_ea_name() to take a const smb_filename * parameter...

[sfrench/samba-autobuild/.git] / source3 / smbd / nttrans.c

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index cd7454a1b566420ec841ce88da8389585e1ecffb..b1917fe62c11c857e9a8e04038c32decf340677c 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -461,6 +461,8 @@ void reply_ntcreate_and_X(struct smb_request *req)
        int oplock_request;
        uint8_t oplock_granted = NO_OPLOCK_RETURN;
        struct case_semantics_state *case_state = NULL;
+       uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                       (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBntcreateX);
@@ -538,7 +540,7 @@ void reply_ntcreate_and_X(struct smb_request *req)
                                conn,
                                req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
-                               UCF_PREP_CREATEFILE,
+                               ucf_flags,
                                NULL,
                                &smb_fname);
 
@@ -696,7 +698,7 @@ void reply_ntcreate_and_X(struct smb_request *req)
                if (NT_STATUS_IS_OK(status) && num_names) {
                        file_status &= ~NO_EAS;
                }
-               status = vfs_streaminfo(conn, NULL, smb_fname->base_name, ctx,
+               status = vfs_streaminfo(conn, NULL, smb_fname, ctx,
                        &num_streams, &streams);
                /* There is always one stream, ::$DATA. */
                if (NT_STATUS_IS_OK(status) && num_streams > 1) {
@@ -760,9 +762,25 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
 
        flags = IVAL(params,0);
 
-       srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
-                       parameter_count-53, STR_TERMINATE,
+       if (req->posix_pathnames) {
+               srvstr_get_path_posix(ctx,
+                       params,
+                       req->flags2,
+                       &fname,
+                       params+53,
+                       parameter_count-53,
+                       STR_TERMINATE,
                        &status);
+       } else {
+               srvstr_get_path(ctx,
+                       params,
+                       req->flags2,
+                       &fname,
+                       params+53,
+                       parameter_count-53,
+                       STR_TERMINATE,
+                       &status);
+       }
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
                return;
@@ -875,6 +893,12 @@ NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd,
                return NT_STATUS_OK;
        }
 
+       if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) {
+               DEBUG(10, ("ACL set on symlink %s denied.\n",
+                       fsp_str_dbg(fsp)));
+               return NT_STATUS_ACCESS_DENIED;
+       }
+
        if (psd->owner_sid == NULL) {
                security_info_sent &= ~SECINFO_OWNER;
        }
@@ -1000,6 +1024,8 @@ static void call_nt_transact_create(connection_struct *conn,
        int oplock_request;
        uint8_t oplock_granted;
        struct case_semantics_state *case_state = NULL;
+       uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                       (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
        TALLOC_CTX *ctx = talloc_tos();
 
        DEBUG(5,("call_nt_transact_create\n"));
@@ -1048,9 +1074,25 @@ static void call_nt_transact_create(connection_struct *conn,
         */
        create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
 
-       srvstr_get_path(ctx, params, req->flags2, &fname,
-                       params+53, parameter_count-53,
-                       STR_TERMINATE, &status);
+       if (req->posix_pathnames) {
+               srvstr_get_path_posix(ctx,
+                       params,
+                       req->flags2,
+                       &fname,
+                       params+53,
+                       parameter_count-53,
+                       STR_TERMINATE,
+                       &status);
+       } else {
+               srvstr_get_path(ctx,
+                       params,
+                       req->flags2,
+                       &fname,
+                       params+53,
+                       parameter_count-53,
+                       STR_TERMINATE,
+                       &status);
+       }
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
                goto out;
@@ -1068,7 +1110,7 @@ static void call_nt_transact_create(connection_struct *conn,
                                conn,
                                req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
-                               UCF_PREP_CREATEFILE,
+                               ucf_flags,
                                NULL,
                                &smb_fname);
 
@@ -1301,7 +1343,7 @@ static void call_nt_transact_create(connection_struct *conn,
                if (NT_STATUS_IS_OK(status) && num_names) {
                        file_status &= ~NO_EAS;
                }
-               status = vfs_streaminfo(conn, NULL, smb_fname->base_name, ctx,
+               status = vfs_streaminfo(conn, NULL, smb_fname, ctx,
                        &num_streams, &streams);
                /* There is always one stream, ::$DATA. */
                if (NT_STATUS_IS_OK(status) && num_streams > 1) {
@@ -1524,8 +1566,8 @@ void reply_ntrename(struct smb_request *req)
        bool src_has_wcard = False;
        bool dest_has_wcard = False;
        uint32_t attrs;
-       uint32_t ucf_flags_src = 0;
-       uint32_t ucf_flags_dst = 0;
+       uint32_t ucf_flags_src = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+       uint32_t ucf_flags_dst = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
        uint16_t rename_type;
        TALLOC_CTX *ctx = talloc_tos();
        bool stream_rename = false;
@@ -1548,7 +1590,7 @@ void reply_ntrename(struct smb_request *req)
                goto out;
        }
 
-       if (ms_has_wild(oldname)) {
+       if (!req->posix_pathnames && ms_has_wild(oldname)) {
                reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
                goto out;
        }
@@ -1561,7 +1603,7 @@ void reply_ntrename(struct smb_request *req)
                goto out;
        }
 
-       if (!lp_posix_pathnames()) {
+       if (!req->posix_pathnames) {
                /* The newname must begin with a ':' if the
                   oldname contains a ':'. */
                if (strchr_m(oldname, ':')) {
@@ -1831,9 +1873,28 @@ static void call_nt_transact_rename(connection_struct *conn,
        if (!check_fsp(conn, req, fsp)) {
                return;
        }
-       srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
-                             parameter_count - 4,
-                             STR_TERMINATE, &status, &dest_has_wcard);
+       if (req->posix_pathnames) {
+               srvstr_get_path_wcard_posix(ctx,
+                               params,
+                               req->flags2,
+                               &new_name,
+                               params+4,
+                               parameter_count - 4,
+                               STR_TERMINATE,
+                               &status,
+                               &dest_has_wcard);
+       } else {
+               srvstr_get_path_wcard(ctx,
+                               params,
+                               req->flags2,
+                               &new_name,
+                               params+4,
+                               parameter_count - 4,
+                               STR_TERMINATE,
+                               &status,
+                               &dest_has_wcard);
+       }
+
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
                return;
@@ -1905,6 +1966,13 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
                return NT_STATUS_ACCESS_DENIED;
        }
 
+       if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) {
+               DEBUG(10, ("ACL get on symlink %s denied.\n",
+                       fsp_str_dbg(fsp)));
+               TALLOC_FREE(frame);
+               return NT_STATUS_ACCESS_DENIED;
+       }
+
        if (security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|
                        SECINFO_GROUP|SECINFO_SACL)) {
                /* Don't return SECINFO_LABEL if anything else was
@@ -2255,7 +2323,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
        ZERO_STRUCT(qt);
 
        /* access check */
-       if (get_current_uid(conn) != 0) {
+       if (get_current_uid(conn) != sec_initial_uid()) {
                DEBUG(1,("get_user_quota: access_denied service [%s] user "
                         "[%s]\n", lp_servicename(talloc_tos(), SNUM(conn)),
                         conn->session_info->unix_info->unix_name));
@@ -2384,7 +2452,8 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                                SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
 
                                /* and now the SID */
-                               sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
+                               sid_linearize((uint8_t *)(entry+40), sid_len,
+                                             &tmp_list->quotas->sid);
                        }
 
                        qt_handle->tmp_list = tmp_list;
@@ -2486,7 +2555,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                        SBIG_UINT(entry,32,qt.hardlim);
 
                        /* and now the SID */
-                       sid_linearize(entry+40, sid_len, &sid);
+                       sid_linearize((uint8_t *)(entry+40), sid_len, &sid);
 
                        break;