Remove two pointless else branches
[tprouty/samba.git] / source / smbd / nttrans.c
1 /*
2    Unix SMB/CIFS implementation.
3    SMB NT transaction handling
4    Copyright (C) Jeremy Allison                 1994-2007
5    Copyright (C) Stefan (metze) Metzmacher      2003
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 extern int max_send;
24 extern enum protocol_types Protocol;
25 extern struct current_user current_user;
26
27 static const char *known_nt_pipes[] = {
28         "\\LANMAN",
29         "\\srvsvc",
30         "\\samr",
31         "\\wkssvc",
32         "\\NETLOGON",
33         "\\ntlsa",
34         "\\ntsvcs",
35         "\\lsass",
36         "\\lsarpc",
37         "\\winreg",
38         "\\initshutdown",
39         "\\spoolss",
40         "\\netdfs",
41         "\\rpcecho",
42         "\\svcctl",
43         "\\eventlog",
44         "\\unixinfo",
45         NULL
46 };
47
48 static char *nttrans_realloc(char **ptr, size_t size)
49 {
50         if (ptr==NULL) {
51                 smb_panic("nttrans_realloc() called with NULL ptr");
52         }
53
54         *ptr = (char *)SMB_REALLOC(*ptr, size);
55         if(*ptr == NULL) {
56                 return NULL;
57         }
58         memset(*ptr,'\0',size);
59         return *ptr;
60 }
61
62 /****************************************************************************
63  Send the required number of replies back.
64  We assume all fields other than the data fields are
65  set correctly for the type of call.
66  HACK ! Always assumes smb_setup field is zero.
67 ****************************************************************************/
68
69 void send_nt_replies(connection_struct *conn,
70                         struct smb_request *req, NTSTATUS nt_error,
71                      char *params, int paramsize,
72                      char *pdata, int datasize)
73 {
74         int data_to_send = datasize;
75         int params_to_send = paramsize;
76         int useable_space;
77         char *pp = params;
78         char *pd = pdata;
79         int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80         int alignment_offset = 3;
81         int data_alignment_offset = 0;
82
83         /*
84          * If there genuinely are no parameters or data to send just send
85          * the empty packet.
86          */
87
88         if(params_to_send == 0 && data_to_send == 0) {
89                 reply_outbuf(req, 18, 0);
90                 show_msg((char *)req->outbuf);
91                 return;
92         }
93
94         /*
95          * When sending params and data ensure that both are nicely aligned.
96          * Only do this alignment when there is also data to send - else
97          * can cause NT redirector problems.
98          */
99
100         if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
101                 data_alignment_offset = 4 - (params_to_send % 4);
102         }
103
104         /*
105          * Space is bufsize minus Netbios over TCP header minus SMB header.
106          * The alignment_offset is to align the param bytes on a four byte
107          * boundary (2 bytes for data len, one byte pad).
108          * NT needs this to work correctly.
109          */
110
111         useable_space = max_send - (smb_size
112                                     + 2 * 18 /* wct */
113                                     + alignment_offset
114                                     + data_alignment_offset);
115
116         /*
117          * useable_space can never be more than max_send minus the
118          * alignment offset.
119          */
120
121         useable_space = MIN(useable_space,
122                                 max_send - (alignment_offset+data_alignment_offset));
123
124
125         while (params_to_send || data_to_send) {
126
127                 /*
128                  * Calculate whether we will totally or partially fill this packet.
129                  */
130
131                 total_sent_thistime = params_to_send + data_to_send +
132                                         alignment_offset + data_alignment_offset;
133
134                 /*
135                  * We can never send more than useable_space.
136                  */
137
138                 total_sent_thistime = MIN(total_sent_thistime, useable_space);
139
140                 reply_outbuf(req, 18, total_sent_thistime);
141
142                 /*
143                  * Set total params and data to be sent.
144                  */
145
146                 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
147                 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
148
149                 /*
150                  * Calculate how many parameters and data we can fit into
151                  * this packet. Parameters get precedence.
152                  */
153
154                 params_sent_thistime = MIN(params_to_send,useable_space);
155                 data_sent_thistime = useable_space - params_sent_thistime;
156                 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
157
158                 SIVAL(req->outbuf, smb_ntr_ParameterCount,
159                       params_sent_thistime);
160
161                 if(params_sent_thistime == 0) {
162                         SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
163                         SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
164                 } else {
165                         /*
166                          * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
167                          * parameter bytes, however the first 4 bytes of outbuf are
168                          * the Netbios over TCP header. Thus use smb_base() to subtract
169                          * them from the calculation.
170                          */
171
172                         SIVAL(req->outbuf,smb_ntr_ParameterOffset,
173                               ((smb_buf(req->outbuf)+alignment_offset)
174                                - smb_base(req->outbuf)));
175                         /*
176                          * Absolute displacement of param bytes sent in this packet.
177                          */
178
179                         SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
180                               pp - params);
181                 }
182
183                 /*
184                  * Deal with the data portion.
185                  */
186
187                 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
188
189                 if(data_sent_thistime == 0) {
190                         SIVAL(req->outbuf,smb_ntr_DataOffset,0);
191                         SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
192                 } else {
193                         /*
194                          * The offset of the data bytes is the offset of the
195                          * parameter bytes plus the number of parameters being sent this time.
196                          */
197
198                         SIVAL(req->outbuf, smb_ntr_DataOffset,
199                               ((smb_buf(req->outbuf)+alignment_offset) -
200                                smb_base(req->outbuf))
201                               + params_sent_thistime + data_alignment_offset);
202                         SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
203                 }
204
205                 /*
206                  * Copy the param bytes into the packet.
207                  */
208
209                 if(params_sent_thistime) {
210                         if (alignment_offset != 0) {
211                                 memset(smb_buf(req->outbuf), 0,
212                                        alignment_offset);
213                         }
214                         memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
215                                params_sent_thistime);
216                 }
217
218                 /*
219                  * Copy in the data bytes
220                  */
221
222                 if(data_sent_thistime) {
223                         if (data_alignment_offset != 0) {
224                                 memset((smb_buf(req->outbuf)+alignment_offset+
225                                         params_sent_thistime), 0,
226                                        data_alignment_offset);
227                         }
228                         memcpy(smb_buf(req->outbuf)+alignment_offset
229                                +params_sent_thistime+data_alignment_offset,
230                                pd,data_sent_thistime);
231                 }
232
233                 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
234                         params_sent_thistime, data_sent_thistime, useable_space));
235                 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
236                         params_to_send, data_to_send, paramsize, datasize));
237
238                 if (NT_STATUS_V(nt_error)) {
239                         error_packet_set((char *)req->outbuf,
240                                          0, 0, nt_error,
241                                          __LINE__,__FILE__);
242                 }
243
244                 /* Send the packet */
245                 show_msg((char *)req->outbuf);
246                 if (!srv_send_smb(smbd_server_fd(),
247                                 (char *)req->outbuf,
248                                 IS_CONN_ENCRYPTED(conn))) {
249                         exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
250                 }
251
252                 TALLOC_FREE(req->outbuf);
253
254                 pp += params_sent_thistime;
255                 pd += data_sent_thistime;
256
257                 params_to_send -= params_sent_thistime;
258                 data_to_send -= data_sent_thistime;
259
260                 /*
261                  * Sanity check
262                  */
263
264                 if(params_to_send < 0 || data_to_send < 0) {
265                         DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
266                                 params_to_send, data_to_send));
267                         return;
268                 }
269         }
270 }
271
272 /****************************************************************************
273  Is it an NTFS stream name ?
274  An NTFS file name is <path>.<extention>:<stream name>:<stream type>
275  $DATA can be used as both a stream name and a stream type. A missing stream
276  name or type implies $DATA.
277 ****************************************************************************/
278
279 bool is_ntfs_stream_name(const char *fname)
280 {
281         if (lp_posix_pathnames()) {
282                 return False;
283         }
284         return (strchr_m(fname, ':') != NULL) ? True : False;
285 }
286
287 /****************************************************************************
288  Reply to an NT create and X call on a pipe
289 ****************************************************************************/
290
291 static void nt_open_pipe(char *fname, connection_struct *conn,
292                          struct smb_request *req, int *ppnum)
293 {
294         smb_np_struct *p = NULL;
295         int i;
296
297         DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
298
299         /* See if it is one we want to handle. */
300
301         if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
302                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
303                                 ERRDOS, ERRbadpipe);
304                 return;
305         }
306
307         for( i = 0; known_nt_pipes[i]; i++ ) {
308                 if( strequal(fname,known_nt_pipes[i])) {
309                         break;
310                 }
311         }
312
313         if ( known_nt_pipes[i] == NULL ) {
314                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
315                                 ERRDOS, ERRbadpipe);
316                 return;
317         }
318
319         /* Strip \\ off the name. */
320         fname++;
321
322         DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
323
324         p = open_rpc_pipe_p(fname, conn, req->vuid);
325         if (!p) {
326                 reply_doserror(req, ERRSRV, ERRnofids);
327                 return;
328         }
329
330         /* TODO: Add pipe to db */
331
332         if ( !store_pipe_opendb( p ) ) {
333                 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
334         }
335
336         *ppnum = p->pnum;
337         return;
338 }
339
340 /****************************************************************************
341  Reply to an NT create and X call for pipes.
342 ****************************************************************************/
343
344 static void do_ntcreate_pipe_open(connection_struct *conn,
345                                   struct smb_request *req)
346 {
347         char *fname = NULL;
348         int pnum = -1;
349         char *p = NULL;
350         uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
351         TALLOC_CTX *ctx = talloc_tos();
352
353         srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
354                         smb_buf(req->inbuf), STR_TERMINATE);
355
356         if (!fname) {
357                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
358                                 ERRDOS, ERRbadpipe);
359                 return;
360         }
361         nt_open_pipe(fname, conn, req, &pnum);
362
363         if (req->outbuf) {
364                 /* error reply */
365                 return;
366         }
367
368         /*
369          * Deal with pipe return.
370          */
371
372         if (flags & EXTENDED_RESPONSE_REQUIRED) {
373                 /* This is very strange. We
374                  * return 50 words, but only set
375                  * the wcnt to 42 ? It's definately
376                  * what happens on the wire....
377                  */
378                 reply_outbuf(req, 50, 0);
379                 SCVAL(req->outbuf,smb_wct,42);
380         } else {
381                 reply_outbuf(req, 34, 0);
382         }
383
384         p = (char *)req->outbuf + smb_vwv2;
385         p++;
386         SSVAL(p,0,pnum);
387         p += 2;
388         SIVAL(p,0,FILE_WAS_OPENED);
389         p += 4;
390         p += 32;
391         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
392         p += 20;
393         /* File type. */
394         SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
395         /* Device state. */
396         SSVAL(p,2, 0x5FF); /* ? */
397         p += 4;
398
399         if (flags & EXTENDED_RESPONSE_REQUIRED) {
400                 p += 25;
401                 SIVAL(p,0,FILE_GENERIC_ALL);
402                 /*
403                  * For pipes W2K3 seems to return
404                  * 0x12019B next.
405                  * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
406                  */
407                 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
408         }
409
410         DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
411
412         chain_reply(req);
413 }
414
415 /****************************************************************************
416  Reply to an NT create and X call.
417 ****************************************************************************/
418
419 void reply_ntcreate_and_X(struct smb_request *req)
420 {
421         connection_struct *conn = req->conn;
422         char *fname = NULL;
423         uint32 flags;
424         uint32 access_mask;
425         uint32 file_attributes;
426         uint32 share_access;
427         uint32 create_disposition;
428         uint32 create_options;
429         uint16 root_dir_fid;
430         SMB_BIG_UINT allocation_size;
431         /* Breakout the oplock request bits so we can set the
432            reply bits separately. */
433         uint32 fattr=0;
434         SMB_OFF_T file_len = 0;
435         SMB_STRUCT_STAT sbuf;
436         int info = 0;
437         files_struct *fsp = NULL;
438         char *p = NULL;
439         struct timespec c_timespec;
440         struct timespec a_timespec;
441         struct timespec m_timespec;
442         NTSTATUS status;
443         int oplock_request;
444         uint8_t oplock_granted = NO_OPLOCK_RETURN;
445         TALLOC_CTX *ctx = talloc_tos();
446
447         START_PROFILE(SMBntcreateX);
448
449         if (req->wct < 24) {
450                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
451                 return;
452         }
453
454         flags = IVAL(req->inbuf,smb_ntcreate_Flags);
455         access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
456         file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
457         share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
458         create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
459         create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
460         root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
461
462         allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
463                                              smb_ntcreate_AllocationSize);
464 #ifdef LARGE_SMB_OFF_T
465         allocation_size |= (((SMB_BIG_UINT)IVAL(
466                                      req->inbuf,
467                                      smb_ntcreate_AllocationSize + 4)) << 32);
468 #endif
469
470         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
471                         smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
472
473         if (!NT_STATUS_IS_OK(status)) {
474                 reply_nterror(req, status);
475                 END_PROFILE(SMBntcreateX);
476                 return;
477         }
478
479         DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
480                   "file_attributes = 0x%x, share_access = 0x%x, "
481                   "create_disposition = 0x%x create_options = 0x%x "
482                   "root_dir_fid = 0x%x, fname = %s\n",
483                         (unsigned int)flags,
484                         (unsigned int)access_mask,
485                         (unsigned int)file_attributes,
486                         (unsigned int)share_access,
487                         (unsigned int)create_disposition,
488                         (unsigned int)create_options,
489                         (unsigned int)root_dir_fid,
490                         fname));
491
492         /*
493          * If it's an IPC, use the pipe handler.
494          */
495
496         if (IS_IPC(conn)) {
497                 if (lp_nt_pipe_support()) {
498                         do_ntcreate_pipe_open(conn, req);
499                         END_PROFILE(SMBntcreateX);
500                         return;
501                 }
502                 reply_doserror(req, ERRDOS, ERRnoaccess);
503                 END_PROFILE(SMBntcreateX);
504                 return;
505         }
506
507         oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
508         if (oplock_request) {
509                 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
510                         ? BATCH_OPLOCK : 0;
511         }
512
513         status = create_file(conn, req, root_dir_fid, fname,
514                              access_mask, share_access, create_disposition,
515                              create_options, file_attributes, oplock_request,
516                              allocation_size, NULL, NULL, &fsp, &info, &sbuf);
517
518         if (!NT_STATUS_IS_OK(status)) {
519                 if (open_was_deferred(req->mid)) {
520                         /* We have re-scheduled this call, no error. */
521                         END_PROFILE(SMBntcreateX);
522                         return;
523                 }
524                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
525                         reply_botherror(req, status, ERRDOS, ERRfilexists);
526                 }
527                 else {
528                         reply_nterror(req, status);
529                 }
530                 END_PROFILE(SMBntcreateX);
531                 return;
532         }
533
534         /*
535          * If the caller set the extended oplock request bit
536          * and we granted one (by whatever means) - set the
537          * correct bit for extended oplock reply.
538          */
539
540         if (oplock_request &&
541             (lp_fake_oplocks(SNUM(conn))
542              || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
543
544                 /*
545                  * Exclusive oplock granted
546                  */
547
548                 if (flags & REQUEST_BATCH_OPLOCK) {
549                         oplock_granted = BATCH_OPLOCK_RETURN;
550                 } else {
551                         oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
552                 }
553         } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
554                 oplock_granted = LEVEL_II_OPLOCK_RETURN;
555         } else {
556                 oplock_granted = NO_OPLOCK_RETURN;
557         }
558
559         file_len = sbuf.st_size;
560         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
561         if (fattr == 0) {
562                 fattr = FILE_ATTRIBUTE_NORMAL;
563         }
564
565         if (flags & EXTENDED_RESPONSE_REQUIRED) {
566                 /* This is very strange. We
567                  * return 50 words, but only set
568                  * the wcnt to 42 ? It's definately
569                  * what happens on the wire....
570                  */
571                 reply_outbuf(req, 50, 0);
572                 SCVAL(req->outbuf,smb_wct,42);
573         } else {
574                 reply_outbuf(req, 34, 0);
575         }
576
577         p = (char *)req->outbuf + smb_vwv2;
578
579         SCVAL(p, 0, oplock_granted);
580
581         p++;
582         SSVAL(p,0,fsp->fnum);
583         p += 2;
584         if ((create_disposition == FILE_SUPERSEDE)
585             && (info == FILE_WAS_OVERWRITTEN)) {
586                 SIVAL(p,0,FILE_WAS_SUPERSEDED);
587         } else {
588                 SIVAL(p,0,info);
589         }
590         p += 4;
591
592         /* Create time. */
593         c_timespec = get_create_timespec(
594                 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
595         a_timespec = get_atimespec(&sbuf);
596         m_timespec = get_mtimespec(&sbuf);
597
598         if (lp_dos_filetime_resolution(SNUM(conn))) {
599                 dos_filetime_timespec(&c_timespec);
600                 dos_filetime_timespec(&a_timespec);
601                 dos_filetime_timespec(&m_timespec);
602         }
603
604         put_long_date_timespec(p, c_timespec); /* create time. */
605         p += 8;
606         put_long_date_timespec(p, a_timespec); /* access time */
607         p += 8;
608         put_long_date_timespec(p, m_timespec); /* write time */
609         p += 8;
610         put_long_date_timespec(p, m_timespec); /* change time */
611         p += 8;
612         SIVAL(p,0,fattr); /* File Attributes. */
613         p += 4;
614         SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
615         p += 8;
616         SOFF_T(p,0,file_len);
617         p += 8;
618         if (flags & EXTENDED_RESPONSE_REQUIRED) {
619                 SSVAL(p,2,0x7);
620         }
621         p += 4;
622         SCVAL(p,0,fsp->is_directory ? 1 : 0);
623
624         if (flags & EXTENDED_RESPONSE_REQUIRED) {
625                 uint32 perms = 0;
626                 p += 25;
627                 if (fsp->is_directory
628                     || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
629                         perms = FILE_GENERIC_ALL;
630                 } else {
631                         perms = FILE_GENERIC_READ|FILE_EXECUTE;
632                 }
633                 SIVAL(p,0,perms);
634         }
635
636         DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
637                  fsp->fnum, fsp->fsp_name));
638
639         chain_reply(req);
640         END_PROFILE(SMBntcreateX);
641         return;
642 }
643
644 /****************************************************************************
645  Reply to a NT_TRANSACT_CREATE call to open a pipe.
646 ****************************************************************************/
647
648 static void do_nt_transact_create_pipe(connection_struct *conn,
649                                        struct smb_request *req,
650                                        uint16 **ppsetup, uint32 setup_count,
651                                        char **ppparams, uint32 parameter_count,
652                                        char **ppdata, uint32 data_count)
653 {
654         char *fname = NULL;
655         char *params = *ppparams;
656         int pnum = -1;
657         char *p = NULL;
658         NTSTATUS status;
659         size_t param_len;
660         uint32 flags;
661         TALLOC_CTX *ctx = talloc_tos();
662
663         /*
664          * Ensure minimum number of parameters sent.
665          */
666
667         if(parameter_count < 54) {
668                 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
669                 reply_doserror(req, ERRDOS, ERRnoaccess);
670                 return;
671         }
672
673         flags = IVAL(params,0);
674
675         srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
676                         parameter_count-53, STR_TERMINATE,
677                         &status);
678         if (!NT_STATUS_IS_OK(status)) {
679                 reply_nterror(req, status);
680                 return;
681         }
682
683         nt_open_pipe(fname, conn, req, &pnum);
684
685         if (req->outbuf) {
686                 /* Error return */
687                 return;
688         }
689
690         /* Realloc the size of parameters and data we will return */
691         if (flags & EXTENDED_RESPONSE_REQUIRED) {
692                 /* Extended response is 32 more byyes. */
693                 param_len = 101;
694         } else {
695                 param_len = 69;
696         }
697         params = nttrans_realloc(ppparams, param_len);
698         if(params == NULL) {
699                 reply_doserror(req, ERRDOS, ERRnomem);
700                 return;
701         }
702
703         p = params;
704         SCVAL(p,0,NO_OPLOCK_RETURN);
705
706         p += 2;
707         SSVAL(p,0,pnum);
708         p += 2;
709         SIVAL(p,0,FILE_WAS_OPENED);
710         p += 8;
711
712         p += 32;
713         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
714         p += 20;
715         /* File type. */
716         SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
717         /* Device state. */
718         SSVAL(p,2, 0x5FF); /* ? */
719         p += 4;
720
721         if (flags & EXTENDED_RESPONSE_REQUIRED) {
722                 p += 25;
723                 SIVAL(p,0,FILE_GENERIC_ALL);
724                 /*
725                  * For pipes W2K3 seems to return
726                  * 0x12019B next.
727                  * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
728                  */
729                 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
730         }
731
732         DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
733
734         /* Send the required number of replies */
735         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
736
737         return;
738 }
739
740 /****************************************************************************
741  Internal fn to set security descriptors.
742 ****************************************************************************/
743
744 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
745                        uint32 security_info_sent)
746 {
747         SEC_DESC *psd = NULL;
748         NTSTATUS status;
749
750         if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
751                 return NT_STATUS_OK;
752         }
753
754         status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
755
756         if (!NT_STATUS_IS_OK(status)) {
757                 return status;
758         }
759
760         if (psd->owner_sid==0) {
761                 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
762         }
763         if (psd->group_sid==0) {
764                 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
765         }
766         if (psd->sacl==0) {
767                 security_info_sent &= ~SACL_SECURITY_INFORMATION;
768         }
769         if (psd->dacl==0) {
770                 security_info_sent &= ~DACL_SECURITY_INFORMATION;
771         }
772
773         if (fsp->fh->fd != -1) {
774                 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
775         }
776         else {
777                 status = SMB_VFS_SET_NT_ACL(fsp, fsp->fsp_name,
778                                             security_info_sent, psd);
779         }
780
781         TALLOC_FREE(psd);
782
783         return status;
784 }
785
786 /****************************************************************************
787  Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
788 ****************************************************************************/
789
790 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
791 {
792         struct ea_list *ea_list_head = NULL;
793         size_t offset = 0;
794
795         if (data_size < 4) {
796                 return NULL;
797         }
798
799         while (offset + 4 <= data_size) {
800                 size_t next_offset = IVAL(pdata,offset);
801                 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
802
803                 if (!eal) {
804                         return NULL;
805                 }
806
807                 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
808                 if (next_offset == 0) {
809                         break;
810                 }
811                 offset += next_offset;
812         }
813
814         return ea_list_head;
815 }
816
817 /****************************************************************************
818  Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
819 ****************************************************************************/
820
821 static void call_nt_transact_create(connection_struct *conn,
822                                     struct smb_request *req,
823                                     uint16 **ppsetup, uint32 setup_count,
824                                     char **ppparams, uint32 parameter_count,
825                                     char **ppdata, uint32 data_count,
826                                     uint32 max_data_count)
827 {
828         char *fname = NULL;
829         char *params = *ppparams;
830         char *data = *ppdata;
831         /* Breakout the oplock request bits so we can set the reply bits separately. */
832         uint32 fattr=0;
833         SMB_OFF_T file_len = 0;
834         SMB_STRUCT_STAT sbuf;
835         int info = 0;
836         files_struct *fsp = NULL;
837         char *p = NULL;
838         uint32 flags;
839         uint32 access_mask;
840         uint32 file_attributes;
841         uint32 share_access;
842         uint32 create_disposition;
843         uint32 create_options;
844         uint32 sd_len;
845         struct security_descriptor *sd = NULL;
846         uint32 ea_len;
847         uint16 root_dir_fid;
848         struct timespec c_timespec;
849         struct timespec a_timespec;
850         struct timespec m_timespec;
851         struct ea_list *ea_list = NULL;
852         NTSTATUS status;
853         size_t param_len;
854         SMB_BIG_UINT allocation_size;
855         int oplock_request;
856         uint8_t oplock_granted;
857         TALLOC_CTX *ctx = talloc_tos();
858
859         DEBUG(5,("call_nt_transact_create\n"));
860
861         /*
862          * If it's an IPC, use the pipe handler.
863          */
864
865         if (IS_IPC(conn)) {
866                 if (lp_nt_pipe_support()) {
867                         do_nt_transact_create_pipe(
868                                 conn, req,
869                                 ppsetup, setup_count,
870                                 ppparams, parameter_count,
871                                 ppdata, data_count);
872                         return;
873                 }
874                 reply_doserror(req, ERRDOS, ERRnoaccess);
875                 return;
876         }
877
878         /*
879          * Ensure minimum number of parameters sent.
880          */
881
882         if(parameter_count < 54) {
883                 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
884                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
885                 return;
886         }
887
888         flags = IVAL(params,0);
889         access_mask = IVAL(params,8);
890         file_attributes = IVAL(params,20);
891         share_access = IVAL(params,24);
892         create_disposition = IVAL(params,28);
893         create_options = IVAL(params,32);
894         sd_len = IVAL(params,36);
895         ea_len = IVAL(params,40);
896         root_dir_fid = (uint16)IVAL(params,4);
897         allocation_size = (SMB_BIG_UINT)IVAL(params,12);
898 #ifdef LARGE_SMB_OFF_T
899         allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
900 #endif
901
902         /* Ensure the data_len is correct for the sd and ea values given. */
903         if ((ea_len + sd_len > data_count)
904             || (ea_len > data_count) || (sd_len > data_count)
905             || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
906                 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
907                            "%u, data_count = %u\n", (unsigned int)ea_len,
908                            (unsigned int)sd_len, (unsigned int)data_count));
909                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
910                 return;
911         }
912
913         if (sd_len) {
914                 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
915                            sd_len));
916
917                 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
918                                              &sd);
919                 if (!NT_STATUS_IS_OK(status)) {
920                         DEBUG(10, ("call_nt_transact_create: "
921                                    "unmarshall_sec_desc failed: %s\n",
922                                    nt_errstr(status)));
923                         reply_nterror(req, status);
924                         return;
925                 }
926         }
927
928         if (ea_len) {
929                 if (!lp_ea_support(SNUM(conn))) {
930                         DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
931                                    "EA's not supported.\n",
932                                    (unsigned int)ea_len));
933                         reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
934                         return;
935                 }
936
937                 if (ea_len < 10) {
938                         DEBUG(10,("call_nt_transact_create - ea_len = %u - "
939                                   "too small (should be more than 10)\n",
940                                   (unsigned int)ea_len ));
941                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
942                         return;
943                 }
944
945                 /* We have already checked that ea_len <= data_count here. */
946                 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
947                                                ea_len);
948                 if (ea_list == NULL) {
949                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
950                         return;
951                 }
952         }
953
954         srvstr_get_path(ctx, params, req->flags2, &fname,
955                         params+53, parameter_count-53,
956                         STR_TERMINATE, &status);
957         if (!NT_STATUS_IS_OK(status)) {
958                 reply_nterror(req, status);
959                 return;
960         }
961
962         oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
963         if (oplock_request) {
964                 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
965                         ? BATCH_OPLOCK : 0;
966         }
967
968         status = create_file(conn, req, root_dir_fid, fname,
969                              access_mask, share_access, create_disposition,
970                              create_options, file_attributes, oplock_request,
971                              allocation_size, sd, ea_list, &fsp, &info, &sbuf);
972
973         if(!NT_STATUS_IS_OK(status)) {
974                 if (open_was_deferred(req->mid)) {
975                         /* We have re-scheduled this call, no error. */
976                         return;
977                 }
978                 reply_openerror(req, status);
979                 return;
980         }
981
982         /*
983          * If the caller set the extended oplock request bit
984          * and we granted one (by whatever means) - set the
985          * correct bit for extended oplock reply.
986          */
987
988         if (oplock_request &&
989             (lp_fake_oplocks(SNUM(conn))
990              || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
991
992                 /*
993                  * Exclusive oplock granted
994                  */
995
996                 if (flags & REQUEST_BATCH_OPLOCK) {
997                         oplock_granted = BATCH_OPLOCK_RETURN;
998                 } else {
999                         oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1000                 }
1001         } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1002                 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1003         } else {
1004                 oplock_granted = NO_OPLOCK_RETURN;
1005         }
1006
1007         file_len = sbuf.st_size;
1008         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1009         if (fattr == 0) {
1010                 fattr = FILE_ATTRIBUTE_NORMAL;
1011         }
1012
1013         /* Realloc the size of parameters and data we will return */
1014         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1015                 /* Extended response is 32 more byyes. */
1016                 param_len = 101;
1017         } else {
1018                 param_len = 69;
1019         }
1020         params = nttrans_realloc(ppparams, param_len);
1021         if(params == NULL) {
1022                 reply_doserror(req, ERRDOS, ERRnomem);
1023                 return;
1024         }
1025
1026         p = params;
1027         SCVAL(p, 0, oplock_granted);
1028
1029         p += 2;
1030         SSVAL(p,0,fsp->fnum);
1031         p += 2;
1032         if ((create_disposition == FILE_SUPERSEDE)
1033             && (info == FILE_WAS_OVERWRITTEN)) {
1034                 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1035         } else {
1036                 SIVAL(p,0,info);
1037         }
1038         p += 8;
1039
1040         /* Create time. */
1041         c_timespec = get_create_timespec(
1042                 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1043         a_timespec = get_atimespec(&sbuf);
1044         m_timespec = get_mtimespec(&sbuf);
1045
1046         if (lp_dos_filetime_resolution(SNUM(conn))) {
1047                 dos_filetime_timespec(&c_timespec);
1048                 dos_filetime_timespec(&a_timespec);
1049                 dos_filetime_timespec(&m_timespec);
1050         }
1051
1052         put_long_date_timespec(p, c_timespec); /* create time. */
1053         p += 8;
1054         put_long_date_timespec(p, a_timespec); /* access time */
1055         p += 8;
1056         put_long_date_timespec(p, m_timespec); /* write time */
1057         p += 8;
1058         put_long_date_timespec(p, m_timespec); /* change time */
1059         p += 8;
1060         SIVAL(p,0,fattr); /* File Attributes. */
1061         p += 4;
1062         SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1063         p += 8;
1064         SOFF_T(p,0,file_len);
1065         p += 8;
1066         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1067                 SSVAL(p,2,0x7);
1068         }
1069         p += 4;
1070         SCVAL(p,0,fsp->is_directory ? 1 : 0);
1071
1072         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1073                 uint32 perms = 0;
1074                 p += 25;
1075                 if (fsp->is_directory
1076                     || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1077                         perms = FILE_GENERIC_ALL;
1078                 } else {
1079                         perms = FILE_GENERIC_READ|FILE_EXECUTE;
1080                 }
1081                 SIVAL(p,0,perms);
1082         }
1083
1084         DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1085
1086         /* Send the required number of replies */
1087         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1088
1089         return;
1090 }
1091
1092 /****************************************************************************
1093  Reply to a NT CANCEL request.
1094  conn POINTER CAN BE NULL HERE !
1095 ****************************************************************************/
1096
1097 void reply_ntcancel(struct smb_request *req)
1098 {
1099         /*
1100          * Go through and cancel any pending change notifies.
1101          */
1102
1103         START_PROFILE(SMBntcancel);
1104         remove_pending_change_notify_requests_by_mid(req->mid);
1105         remove_pending_lock_requests_by_mid(req->mid);
1106         srv_cancel_sign_response(req->mid);
1107
1108         DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1109
1110         END_PROFILE(SMBntcancel);
1111         return;
1112 }
1113
1114 /****************************************************************************
1115  Copy a file.
1116 ****************************************************************************/
1117
1118 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1119                                 connection_struct *conn,
1120                                 struct smb_request *req,
1121                                 const char *oldname_in,
1122                                 const char *newname_in,
1123                                 uint32 attrs)
1124 {
1125         SMB_STRUCT_STAT sbuf1, sbuf2;
1126         char *oldname = NULL;
1127         char *newname = NULL;
1128         char *last_component_oldname = NULL;
1129         char *last_component_newname = NULL;
1130         files_struct *fsp1,*fsp2;
1131         uint32 fattr;
1132         int info;
1133         SMB_OFF_T ret=-1;
1134         NTSTATUS status = NT_STATUS_OK;
1135
1136         ZERO_STRUCT(sbuf1);
1137         ZERO_STRUCT(sbuf2);
1138
1139         if (!CAN_WRITE(conn)) {
1140                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1141         }
1142
1143         status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1144                         &last_component_oldname, &sbuf1);
1145         if (!NT_STATUS_IS_OK(status)) {
1146                 return status;
1147         }
1148
1149         status = check_name(conn, oldname);
1150         if (!NT_STATUS_IS_OK(status)) {
1151                 return status;
1152         }
1153
1154         /* Source must already exist. */
1155         if (!VALID_STAT(sbuf1)) {
1156                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1157         }
1158         /* Ensure attributes match. */
1159         fattr = dos_mode(conn,oldname,&sbuf1);
1160         if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1161                 return NT_STATUS_NO_SUCH_FILE;
1162         }
1163
1164         status = unix_convert(ctx, conn, newname_in, False, &newname,
1165                         &last_component_newname, &sbuf2);
1166         if (!NT_STATUS_IS_OK(status)) {
1167                 return status;
1168         }
1169
1170         status = check_name(conn, newname);
1171         if (!NT_STATUS_IS_OK(status)) {
1172                 return status;
1173         }
1174
1175         /* Disallow if newname already exists. */
1176         if (VALID_STAT(sbuf2)) {
1177                 return NT_STATUS_OBJECT_NAME_COLLISION;
1178         }
1179
1180         /* No links from a directory. */
1181         if (S_ISDIR(sbuf1.st_mode)) {
1182                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1183         }
1184
1185         /* Ensure this is within the share. */
1186         status = check_reduced_name(conn, oldname);
1187         if (!NT_STATUS_IS_OK(status)) {
1188                 return status;
1189         }
1190
1191         DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1192                                 oldname, newname));
1193
1194         status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1195                         FILE_READ_DATA, /* Read-only. */
1196                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1197                         FILE_OPEN,
1198                         0, /* No create options. */
1199                         FILE_ATTRIBUTE_NORMAL,
1200                         NO_OPLOCK,
1201                         &info, &fsp1);
1202
1203         if (!NT_STATUS_IS_OK(status)) {
1204                 return status;
1205         }
1206
1207         status = open_file_ntcreate(conn, req, newname, &sbuf2,
1208                         FILE_WRITE_DATA, /* Read-only. */
1209                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1210                         FILE_CREATE,
1211                         0, /* No create options. */
1212                         fattr,
1213                         NO_OPLOCK,
1214                         &info, &fsp2);
1215
1216         if (!NT_STATUS_IS_OK(status)) {
1217                 close_file(fsp1,ERROR_CLOSE);
1218                 return status;
1219         }
1220
1221         if (sbuf1.st_size) {
1222                 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1223         }
1224
1225         /*
1226          * As we are opening fsp1 read-only we only expect
1227          * an error on close on fsp2 if we are out of space.
1228          * Thus we don't look at the error return from the
1229          * close of fsp1.
1230          */
1231         close_file(fsp1,NORMAL_CLOSE);
1232
1233         /* Ensure the modtime is set correctly on the destination file. */
1234         set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1235
1236         status = close_file(fsp2,NORMAL_CLOSE);
1237
1238         /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1239            creates the file. This isn't the correct thing to do in the copy
1240            case. JRA */
1241         file_set_dosmode(conn, newname, fattr, &sbuf2,
1242                          parent_dirname(newname),false);
1243
1244         if (ret < (SMB_OFF_T)sbuf1.st_size) {
1245                 return NT_STATUS_DISK_FULL;
1246         }
1247
1248         if (!NT_STATUS_IS_OK(status)) {
1249                 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1250                         nt_errstr(status), oldname, newname));
1251         }
1252         return status;
1253 }
1254
1255 /****************************************************************************
1256  Reply to a NT rename request.
1257 ****************************************************************************/
1258
1259 void reply_ntrename(struct smb_request *req)
1260 {
1261         connection_struct *conn = req->conn;
1262         char *oldname = NULL;
1263         char *newname = NULL;
1264         char *p;
1265         NTSTATUS status;
1266         bool src_has_wcard = False;
1267         bool dest_has_wcard = False;
1268         uint32 attrs;
1269         uint16 rename_type;
1270         TALLOC_CTX *ctx = talloc_tos();
1271
1272         START_PROFILE(SMBntrename);
1273
1274         if (req->wct < 4) {
1275                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1276                 END_PROFILE(SMBntrename);
1277                 return;
1278         }
1279
1280         attrs = SVAL(req->inbuf,smb_vwv0);
1281         rename_type = SVAL(req->inbuf,smb_vwv1);
1282
1283         p = smb_buf(req->inbuf) + 1;
1284         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1285                                    0, STR_TERMINATE, &status,
1286                                    &src_has_wcard);
1287         if (!NT_STATUS_IS_OK(status)) {
1288                 reply_nterror(req, status);
1289                 END_PROFILE(SMBntrename);
1290                 return;
1291         }
1292
1293         if( is_ntfs_stream_name(oldname)) {
1294                 /* Can't rename a stream. */
1295                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1296                 END_PROFILE(SMBntrename);
1297                 return;
1298         }
1299
1300         if (ms_has_wild(oldname)) {
1301                 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1302                 END_PROFILE(SMBntrename);
1303                 return;
1304         }
1305
1306         p++;
1307         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1308                                    0, STR_TERMINATE, &status,
1309                                    &dest_has_wcard);
1310         if (!NT_STATUS_IS_OK(status)) {
1311                 reply_nterror(req, status);
1312                 END_PROFILE(SMBntrename);
1313                 return;
1314         }
1315
1316         status = resolve_dfspath(ctx, conn,
1317                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1318                                 oldname,
1319                                 &oldname);
1320         if (!NT_STATUS_IS_OK(status)) {
1321                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1322                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1323                                         ERRSRV, ERRbadpath);
1324                         END_PROFILE(SMBntrename);
1325                         return;
1326                 }
1327                 reply_nterror(req, status);
1328                 END_PROFILE(SMBntrename);
1329                 return;
1330         }
1331
1332         status = resolve_dfspath(ctx, conn,
1333                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1334                                 newname,
1335                                 &newname);
1336         if (!NT_STATUS_IS_OK(status)) {
1337                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1338                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1339                                         ERRSRV, ERRbadpath);
1340                         END_PROFILE(SMBntrename);
1341                         return;
1342                 }
1343                 reply_nterror(req, status);
1344                 END_PROFILE(SMBntrename);
1345                 return;
1346         }
1347
1348         DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1349
1350         switch(rename_type) {
1351                 case RENAME_FLAG_RENAME:
1352                         status = rename_internals(ctx, conn, req, oldname,
1353                                         newname, attrs, False, src_has_wcard,
1354                                         dest_has_wcard, DELETE_ACCESS);
1355                         break;
1356                 case RENAME_FLAG_HARD_LINK:
1357                         if (src_has_wcard || dest_has_wcard) {
1358                                 /* No wildcards. */
1359                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1360                         } else {
1361                                 status = hardlink_internals(ctx,
1362                                                 conn,
1363                                                 oldname,
1364                                                 newname);
1365                         }
1366                         break;
1367                 case RENAME_FLAG_COPY:
1368                         if (src_has_wcard || dest_has_wcard) {
1369                                 /* No wildcards. */
1370                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1371                         } else {
1372                                 status = copy_internals(ctx, conn, req, oldname,
1373                                                         newname, attrs);
1374                         }
1375                         break;
1376                 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1377                         status = NT_STATUS_INVALID_PARAMETER;
1378                         break;
1379                 default:
1380                         status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1381                         break;
1382         }
1383
1384         if (!NT_STATUS_IS_OK(status)) {
1385                 if (open_was_deferred(req->mid)) {
1386                         /* We have re-scheduled this call. */
1387                         END_PROFILE(SMBntrename);
1388                         return;
1389                 }
1390
1391                 reply_nterror(req, status);
1392                 END_PROFILE(SMBntrename);
1393                 return;
1394         }
1395
1396         reply_outbuf(req, 0, 0);
1397
1398         END_PROFILE(SMBntrename);
1399         return;
1400 }
1401
1402 /****************************************************************************
1403  Reply to a notify change - queue the request and
1404  don't allow a directory to be opened.
1405 ****************************************************************************/
1406
1407 static void call_nt_transact_notify_change(connection_struct *conn,
1408                                            struct smb_request *req,
1409                                            uint16 **ppsetup,
1410                                            uint32 setup_count,
1411                                            char **ppparams,
1412                                            uint32 parameter_count,
1413                                            char **ppdata, uint32 data_count,
1414                                            uint32 max_data_count,
1415                                            uint32 max_param_count)
1416 {
1417         uint16 *setup = *ppsetup;
1418         files_struct *fsp;
1419         uint32 filter;
1420         NTSTATUS status;
1421         bool recursive;
1422
1423         if(setup_count < 6) {
1424                 reply_doserror(req, ERRDOS, ERRbadfunc);
1425                 return;
1426         }
1427
1428         fsp = file_fsp(SVAL(setup,4));
1429         filter = IVAL(setup, 0);
1430         recursive = (SVAL(setup, 6) != 0) ? True : False;
1431
1432         DEBUG(3,("call_nt_transact_notify_change\n"));
1433
1434         if(!fsp) {
1435                 reply_doserror(req, ERRDOS, ERRbadfid);
1436                 return;
1437         }
1438
1439         {
1440                 char *filter_string;
1441
1442                 if (!(filter_string = notify_filter_string(NULL, filter))) {
1443                         reply_nterror(req,NT_STATUS_NO_MEMORY);
1444                         return;
1445                 }
1446
1447                 DEBUG(3,("call_nt_transact_notify_change: notify change "
1448                          "called on %s, filter = %s, recursive = %d\n",
1449                          fsp->fsp_name, filter_string, recursive));
1450
1451                 TALLOC_FREE(filter_string);
1452         }
1453
1454         if((!fsp->is_directory) || (conn != fsp->conn)) {
1455                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1456                 return;
1457         }
1458
1459         if (fsp->notify == NULL) {
1460
1461                 status = change_notify_create(fsp, filter, recursive);
1462
1463                 if (!NT_STATUS_IS_OK(status)) {
1464                         DEBUG(10, ("change_notify_create returned %s\n",
1465                                    nt_errstr(status)));
1466                         reply_nterror(req, status);
1467                         return;
1468                 }
1469         }
1470
1471         if (fsp->notify->num_changes != 0) {
1472
1473                 /*
1474                  * We've got changes pending, respond immediately
1475                  */
1476
1477                 /*
1478                  * TODO: write a torture test to check the filtering behaviour
1479                  * here.
1480                  */
1481
1482                 change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1483
1484                 /*
1485                  * change_notify_reply() above has independently sent its
1486                  * results
1487                  */
1488                 return;
1489         }
1490
1491         /*
1492          * No changes pending, queue the request
1493          */
1494
1495         status = change_notify_add_request(req,
1496                         max_param_count,
1497                         filter,
1498                         recursive, fsp);
1499         if (!NT_STATUS_IS_OK(status)) {
1500                 reply_nterror(req, status);
1501         }
1502         return;
1503 }
1504
1505 /****************************************************************************
1506  Reply to an NT transact rename command.
1507 ****************************************************************************/
1508
1509 static void call_nt_transact_rename(connection_struct *conn,
1510                                     struct smb_request *req,
1511                                     uint16 **ppsetup, uint32 setup_count,
1512                                     char **ppparams, uint32 parameter_count,
1513                                     char **ppdata, uint32 data_count,
1514                                     uint32 max_data_count)
1515 {
1516         char *params = *ppparams;
1517         char *new_name = NULL;
1518         files_struct *fsp = NULL;
1519         bool dest_has_wcard = False;
1520         NTSTATUS status;
1521         TALLOC_CTX *ctx = talloc_tos();
1522
1523         if(parameter_count < 5) {
1524                 reply_doserror(req, ERRDOS, ERRbadfunc);
1525                 return;
1526         }
1527
1528         fsp = file_fsp(SVAL(params, 0));
1529         if (!check_fsp(conn, req, fsp, &current_user)) {
1530                 return;
1531         }
1532         srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1533                               parameter_count - 4,
1534                               STR_TERMINATE, &status, &dest_has_wcard);
1535         if (!NT_STATUS_IS_OK(status)) {
1536                 reply_nterror(req, status);
1537                 return;
1538         }
1539
1540         /*
1541          * W2K3 ignores this request as the RAW-RENAME test
1542          * demonstrates, so we do.
1543          */
1544         send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1545
1546         DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1547                  fsp->fsp_name, new_name));
1548
1549         return;
1550 }
1551
1552 /******************************************************************************
1553  Fake up a completely empty SD.
1554 *******************************************************************************/
1555
1556 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1557 {
1558         size_t sd_size;
1559
1560         *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1561         if(!*ppsd) {
1562                 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1563                 return NT_STATUS_NO_MEMORY;
1564         }
1565
1566         return NT_STATUS_OK;
1567 }
1568
1569 /****************************************************************************
1570  Reply to query a security descriptor.
1571 ****************************************************************************/
1572
1573 static void call_nt_transact_query_security_desc(connection_struct *conn,
1574                                                  struct smb_request *req,
1575                                                  uint16 **ppsetup,
1576                                                  uint32 setup_count,
1577                                                  char **ppparams,
1578                                                  uint32 parameter_count,
1579                                                  char **ppdata,
1580                                                  uint32 data_count,
1581                                                  uint32 max_data_count)
1582 {
1583         char *params = *ppparams;
1584         char *data = *ppdata;
1585         SEC_DESC *psd = NULL;
1586         size_t sd_size;
1587         uint32 security_info_wanted;
1588         files_struct *fsp = NULL;
1589         NTSTATUS status;
1590         DATA_BLOB blob;
1591
1592         if(parameter_count < 8) {
1593                 reply_doserror(req, ERRDOS, ERRbadfunc);
1594                 return;
1595         }
1596
1597         fsp = file_fsp(SVAL(params,0));
1598         if(!fsp) {
1599                 reply_doserror(req, ERRDOS, ERRbadfid);
1600                 return;
1601         }
1602
1603         security_info_wanted = IVAL(params,4);
1604
1605         DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1606                         (unsigned int)security_info_wanted ));
1607
1608         params = nttrans_realloc(ppparams, 4);
1609         if(params == NULL) {
1610                 reply_doserror(req, ERRDOS, ERRnomem);
1611                 return;
1612         }
1613
1614         /*
1615          * Get the permissions to return.
1616          */
1617
1618         if (!lp_nt_acl_support(SNUM(conn))) {
1619                 status = get_null_nt_acl(talloc_tos(), &psd);
1620         } else {
1621                 if (fsp->fh->fd != -1) {
1622                         status = SMB_VFS_FGET_NT_ACL(
1623                                 fsp, security_info_wanted, &psd);
1624                 }
1625                 else {
1626                         status = SMB_VFS_GET_NT_ACL(
1627                                 conn, fsp->fsp_name, security_info_wanted, &psd);
1628                 }
1629         }
1630
1631         if (!NT_STATUS_IS_OK(status)) {
1632                 reply_nterror(req, status);
1633                 return;
1634         }
1635
1636         sd_size = ndr_size_security_descriptor(psd, 0);
1637
1638         DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1639
1640         SIVAL(params,0,(uint32)sd_size);
1641
1642         if (max_data_count < sd_size) {
1643                 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1644                                 params, 4, *ppdata, 0);
1645                 return;
1646         }
1647
1648         /*
1649          * Allocate the data we will point this at.
1650          */
1651
1652         data = nttrans_realloc(ppdata, sd_size);
1653         if(data == NULL) {
1654                 reply_doserror(req, ERRDOS, ERRnomem);
1655                 return;
1656         }
1657
1658         status = marshall_sec_desc(talloc_tos(), psd,
1659                                    &blob.data, &blob.length);
1660
1661         if (!NT_STATUS_IS_OK(status)) {
1662                 reply_nterror(req, status);
1663                 return;
1664         }
1665
1666         SMB_ASSERT(sd_size == blob.length);
1667         memcpy(data, blob.data, sd_size);
1668
1669         send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1670
1671         return;
1672 }
1673
1674 /****************************************************************************
1675  Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1676 ****************************************************************************/
1677
1678 static void call_nt_transact_set_security_desc(connection_struct *conn,
1679                                                struct smb_request *req,
1680                                                uint16 **ppsetup,
1681                                                uint32 setup_count,
1682                                                char **ppparams,
1683                                                uint32 parameter_count,
1684                                                char **ppdata,
1685                                                uint32 data_count,
1686                                                uint32 max_data_count)
1687 {
1688         char *params= *ppparams;
1689         char *data = *ppdata;
1690         files_struct *fsp = NULL;
1691         uint32 security_info_sent = 0;
1692         NTSTATUS status;
1693
1694         if(parameter_count < 8) {
1695                 reply_doserror(req, ERRDOS, ERRbadfunc);
1696                 return;
1697         }
1698
1699         if((fsp = file_fsp(SVAL(params,0))) == NULL) {
1700                 reply_doserror(req, ERRDOS, ERRbadfid);
1701                 return;
1702         }
1703
1704         if(!lp_nt_acl_support(SNUM(conn))) {
1705                 goto done;
1706         }
1707
1708         security_info_sent = IVAL(params,4);
1709
1710         DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1711                 (unsigned int)security_info_sent ));
1712
1713         if (data_count == 0) {
1714                 reply_doserror(req, ERRDOS, ERRnoaccess);
1715                 return;
1716         }
1717
1718         status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1719
1720         if (!NT_STATUS_IS_OK(status)) {
1721                 reply_nterror(req, status);
1722                 return;
1723         }
1724
1725   done:
1726         send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1727         return;
1728 }
1729
1730 /****************************************************************************
1731  Reply to NT IOCTL
1732 ****************************************************************************/
1733
1734 static void call_nt_transact_ioctl(connection_struct *conn,
1735                                    struct smb_request *req,
1736                                    uint16 **ppsetup, uint32 setup_count,
1737                                    char **ppparams, uint32 parameter_count,
1738                                    char **ppdata, uint32 data_count,
1739                                    uint32 max_data_count)
1740 {
1741         uint32 function;
1742         uint16 fidnum;
1743         files_struct *fsp;
1744         uint8 isFSctl;
1745         uint8 compfilter;
1746         static bool logged_message;
1747         char *pdata = *ppdata;
1748
1749         if (setup_count != 8) {
1750                 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1751                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1752                 return;
1753         }
1754
1755         function = IVAL(*ppsetup, 0);
1756         fidnum = SVAL(*ppsetup, 4);
1757         isFSctl = CVAL(*ppsetup, 6);
1758         compfilter = CVAL(*ppsetup, 7);
1759
1760         DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", 
1761                  function, fidnum, isFSctl, compfilter));
1762
1763         fsp=file_fsp(fidnum);
1764         /* this check is done in each implemented function case for now
1765            because I don't want to break anything... --metze
1766         FSP_BELONGS_CONN(fsp,conn);*/
1767
1768         switch (function) {
1769         case FSCTL_SET_SPARSE:
1770                 /* pretend this succeeded - tho strictly we should
1771                    mark the file sparse (if the local fs supports it)
1772                    so we can know if we need to pre-allocate or not */
1773
1774                 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1775                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1776                 return;
1777
1778         case FSCTL_CREATE_OR_GET_OBJECT_ID:
1779         {
1780                 unsigned char objid[16];
1781
1782                 /* This should return the object-id on this file.
1783                  * I think I'll make this be the inode+dev. JRA.
1784                  */
1785
1786                 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1787
1788                 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
1789                         return;
1790                 }
1791
1792                 data_count = 64;
1793                 pdata = nttrans_realloc(ppdata, data_count);
1794                 if (pdata == NULL) {
1795                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1796                         return;
1797                 }
1798                 push_file_id_16(pdata, &fsp->file_id);
1799                 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1800                 push_file_id_16(pdata+32, &fsp->file_id);
1801                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1802                                 pdata, data_count);
1803                 return;
1804         }
1805
1806         case FSCTL_GET_REPARSE_POINT:
1807                 /* pretend this fail - my winXP does it like this
1808                  * --metze
1809                  */
1810
1811                 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1812                 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1813                 return;
1814
1815         case FSCTL_SET_REPARSE_POINT:
1816                 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1817                  * --metze
1818                  */
1819
1820                 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1821                 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1822                 return;
1823
1824         case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1825         {
1826                 /*
1827                  * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1828                  * and return their volume names.  If max_data_count is 16, then it is just
1829                  * asking for the number of volumes and length of the combined names.
1830                  *
1831                  * pdata is the data allocated by our caller, but that uses
1832                  * total_data_count (which is 0 in our case) rather than max_data_count.
1833                  * Allocate the correct amount and return the pointer to let
1834                  * it be deallocated when we return.
1835                  */
1836                 SHADOW_COPY_DATA *shadow_data = NULL;
1837                 TALLOC_CTX *shadow_mem_ctx = NULL;
1838                 bool labels = False;
1839                 uint32 labels_data_count = 0;
1840                 uint32 i;
1841                 char *cur_pdata;
1842
1843                 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
1844                         return;
1845                 }
1846
1847                 if (max_data_count < 16) {
1848                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1849                                 max_data_count));
1850                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1851                         return;
1852                 }
1853
1854                 if (max_data_count > 16) {
1855                         labels = True;
1856                 }
1857
1858                 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1859                 if (shadow_mem_ctx == NULL) {
1860                         DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1861                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1862                         return;
1863                 }
1864
1865                 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1866                 if (shadow_data == NULL) {
1867                         DEBUG(0,("TALLOC_ZERO() failed!\n"));
1868                         talloc_destroy(shadow_mem_ctx);
1869                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1870                         return;
1871                 }
1872
1873                 shadow_data->mem_ctx = shadow_mem_ctx;
1874
1875                 /*
1876                  * Call the VFS routine to actually do the work.
1877                  */
1878                 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1879                         talloc_destroy(shadow_data->mem_ctx);
1880                         if (errno == ENOSYS) {
1881                                 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", 
1882                                         conn->connectpath));
1883                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1884                                 return;
1885                         } else {
1886                                 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", 
1887                                         conn->connectpath));
1888                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1889                                 return;
1890                         }
1891                 }
1892
1893                 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
1894
1895                 if (!labels) {
1896                         data_count = 16;
1897                 } else {
1898                         data_count = 12+labels_data_count+4;
1899                 }
1900
1901                 if (max_data_count<data_count) {
1902                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1903                                 max_data_count,data_count));
1904                         talloc_destroy(shadow_data->mem_ctx);
1905                         reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1906                         return;
1907                 }
1908
1909                 pdata = nttrans_realloc(ppdata, data_count);
1910                 if (pdata == NULL) {
1911                         talloc_destroy(shadow_data->mem_ctx);
1912                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1913                         return;
1914                 }
1915
1916                 cur_pdata = pdata;
1917
1918                 /* num_volumes 4 bytes */
1919                 SIVAL(pdata,0,shadow_data->num_volumes);
1920
1921                 if (labels) {
1922                         /* num_labels 4 bytes */
1923                         SIVAL(pdata,4,shadow_data->num_volumes);
1924                 }
1925
1926                 /* needed_data_count 4 bytes */
1927                 SIVAL(pdata,8,labels_data_count);
1928
1929                 cur_pdata+=12;
1930
1931                 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1932                         shadow_data->num_volumes,fsp->fsp_name));
1933                 if (labels && shadow_data->labels) {
1934                         for (i=0;i<shadow_data->num_volumes;i++) {
1935                                 srvstr_push(pdata, req->flags2,
1936                                             cur_pdata, shadow_data->labels[i],
1937                                             2*sizeof(SHADOW_COPY_LABEL),
1938                                             STR_UNICODE|STR_TERMINATE);
1939                                 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1940                                 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1941                         }
1942                 }
1943
1944                 talloc_destroy(shadow_data->mem_ctx);
1945
1946                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1947                                 pdata, data_count);
1948
1949                 return;
1950         }
1951
1952         case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1953         {
1954                 /* pretend this succeeded -
1955                  *
1956                  * we have to send back a list with all files owned by this SID
1957                  *
1958                  * but I have to check that --metze
1959                  */
1960                 DOM_SID sid;
1961                 uid_t uid;
1962                 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1963
1964                 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1965
1966                 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
1967                         return;
1968                 }
1969
1970                 /* unknown 4 bytes: this is not the length of the sid :-(  */
1971                 /*unknown = IVAL(pdata,0);*/
1972
1973                 sid_parse(pdata+4,sid_len,&sid);
1974                 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1975
1976                 if (!sid_to_uid(&sid, &uid)) {
1977                         DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1978                                  sid_string_dbg(&sid),
1979                                  (unsigned long)sid_len));
1980                         uid = (-1);
1981                 }
1982
1983                 /* we can take a look at the find source :-)
1984                  *
1985                  * find ./ -uid $uid  -name '*'   is what we need here
1986                  *
1987                  *
1988                  * and send 4bytes len and then NULL terminated unicode strings
1989                  * for each file
1990                  *
1991                  * but I don't know how to deal with the paged results
1992                  * (maybe we can hang the result anywhere in the fsp struct)
1993                  *
1994                  * we don't send all files at once
1995                  * and at the next we should *not* start from the beginning,
1996                  * so we have to cache the result
1997                  *
1998                  * --metze
1999                  */
2000
2001                 /* this works for now... */
2002                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2003                 return;
2004         }
2005         default:
2006                 if (!logged_message) {
2007                         logged_message = True; /* Only print this once... */
2008                         DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2009                                  function));
2010                 }
2011         }
2012
2013         reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2014 }
2015
2016
2017 #ifdef HAVE_SYS_QUOTAS
2018 /****************************************************************************
2019  Reply to get user quota
2020 ****************************************************************************/
2021
2022 static void call_nt_transact_get_user_quota(connection_struct *conn,
2023                                             struct smb_request *req,
2024                                             uint16 **ppsetup,
2025                                             uint32 setup_count,
2026                                             char **ppparams,
2027                                             uint32 parameter_count,
2028                                             char **ppdata,
2029                                             uint32 data_count,
2030                                             uint32 max_data_count)
2031 {
2032         NTSTATUS nt_status = NT_STATUS_OK;
2033         char *params = *ppparams;
2034         char *pdata = *ppdata;
2035         char *entry;
2036         int data_len=0,param_len=0;
2037         int qt_len=0;
2038         int entry_len = 0;
2039         files_struct *fsp = NULL;
2040         uint16 level = 0;
2041         size_t sid_len;
2042         DOM_SID sid;
2043         bool start_enum = True;
2044         SMB_NTQUOTA_STRUCT qt;
2045         SMB_NTQUOTA_LIST *tmp_list;
2046         SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2047
2048         ZERO_STRUCT(qt);
2049
2050         /* access check */
2051         if (current_user.ut.uid != 0) {
2052                 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2053                         lp_servicename(SNUM(conn)),conn->user));
2054                 reply_doserror(req, ERRDOS, ERRnoaccess);
2055                 return;
2056         }
2057
2058         /*
2059          * Ensure minimum number of parameters sent.
2060          */
2061
2062         if (parameter_count < 4) {
2063                 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2064                 reply_doserror(req, ERRDOS, ERRinvalidparam);
2065                 return;
2066         }
2067
2068         /* maybe we can check the quota_fnum */
2069         fsp = file_fsp(SVAL(params,0));
2070         if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2071                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2072                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2073                 return;
2074         }
2075
2076         /* the NULL pointer checking for fsp->fake_file_handle->pd
2077          * is done by CHECK_NTQUOTA_HANDLE_OK()
2078          */
2079         qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2080
2081         level = SVAL(params,2);
2082
2083         /* unknown 12 bytes leading in params */
2084
2085         switch (level) {
2086                 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2087                         /* seems that we should continue with the enum here --metze */
2088
2089                         if (qt_handle->quota_list!=NULL &&
2090                             qt_handle->tmp_list==NULL) {
2091
2092                                 /* free the list */
2093                                 free_ntquota_list(&(qt_handle->quota_list));
2094
2095                                 /* Realloc the size of parameters and data we will return */
2096                                 param_len = 4;
2097                                 params = nttrans_realloc(ppparams, param_len);
2098                                 if(params == NULL) {
2099                                         reply_doserror(req, ERRDOS, ERRnomem);
2100                                         return;
2101                                 }
2102
2103                                 data_len = 0;
2104                                 SIVAL(params,0,data_len);
2105
2106                                 break;
2107                         }
2108
2109                         start_enum = False;
2110
2111                 case TRANSACT_GET_USER_QUOTA_LIST_START:
2112
2113                         if (qt_handle->quota_list==NULL &&
2114                                 qt_handle->tmp_list==NULL) {
2115                                 start_enum = True;
2116                         }
2117
2118                         if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2119                                 reply_doserror(req, ERRSRV, ERRerror);
2120                                 return;
2121                         }
2122
2123                         /* Realloc the size of parameters and data we will return */
2124                         param_len = 4;
2125                         params = nttrans_realloc(ppparams, param_len);
2126                         if(params == NULL) {
2127                                 reply_doserror(req, ERRDOS, ERRnomem);
2128                                 return;
2129                         }
2130
2131                         /* we should not trust the value in max_data_count*/
2132                         max_data_count = MIN(max_data_count,2048);
2133
2134                         pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2135                         if(pdata == NULL) {
2136                                 reply_doserror(req, ERRDOS, ERRnomem);
2137                                 return;
2138                         }
2139
2140                         entry = pdata;
2141
2142                         /* set params Size of returned Quota Data 4 bytes*/
2143                         /* but set it later when we know it */
2144
2145                         /* for each entry push the data */
2146
2147                         if (start_enum) {
2148                                 qt_handle->tmp_list = qt_handle->quota_list;
2149                         }
2150
2151                         tmp_list = qt_handle->tmp_list;
2152
2153                         for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2154                                 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2155
2156                                 sid_len = ndr_size_dom_sid(
2157                                         &tmp_list->quotas->sid, 0);
2158                                 entry_len = 40 + sid_len;
2159
2160                                 /* nextoffset entry 4 bytes */
2161                                 SIVAL(entry,0,entry_len);
2162
2163                                 /* then the len of the SID 4 bytes */
2164                                 SIVAL(entry,4,sid_len);
2165
2166                                 /* unknown data 8 bytes SMB_BIG_UINT */
2167                                 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2168
2169                                 /* the used disk space 8 bytes SMB_BIG_UINT */
2170                                 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2171
2172                                 /* the soft quotas 8 bytes SMB_BIG_UINT */
2173                                 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2174
2175                                 /* the hard quotas 8 bytes SMB_BIG_UINT */
2176                                 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2177
2178                                 /* and now the SID */
2179                                 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2180                         }
2181
2182                         qt_handle->tmp_list = tmp_list;
2183
2184                         /* overwrite the offset of the last entry */
2185                         SIVAL(entry-entry_len,0,0);
2186
2187                         data_len = 4+qt_len;
2188                         /* overwrite the params quota_data_len */
2189                         SIVAL(params,0,data_len);
2190
2191                         break;
2192
2193                 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2194
2195                         /* unknown 4 bytes IVAL(pdata,0) */
2196
2197                         if (data_count < 8) {
2198                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2199                                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2200                                 return;
2201                         }
2202
2203                         sid_len = IVAL(pdata,4);
2204                         /* Ensure this is less than 1mb. */
2205                         if (sid_len > (1024*1024)) {
2206                                 reply_doserror(req, ERRDOS, ERRnomem);
2207                                 return;
2208                         }
2209
2210                         if (data_count < 8+sid_len) {
2211                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2212                                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2213                                 return;
2214                         }
2215
2216                         data_len = 4+40+sid_len;
2217
2218                         if (max_data_count < data_len) {
2219                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2220                                         max_data_count, data_len));
2221                                 param_len = 4;
2222                                 SIVAL(params,0,data_len);
2223                                 data_len = 0;
2224                                 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2225                                 break;
2226                         }
2227
2228                         sid_parse(pdata+8,sid_len,&sid);
2229
2230                         if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2231                                 ZERO_STRUCT(qt);
2232                                 /*
2233                                  * we have to return zero's in all fields
2234                                  * instead of returning an error here
2235                                  * --metze
2236                                  */
2237                         }
2238
2239                         /* Realloc the size of parameters and data we will return */
2240                         param_len = 4;
2241                         params = nttrans_realloc(ppparams, param_len);
2242                         if(params == NULL) {
2243                                 reply_doserror(req, ERRDOS, ERRnomem);
2244                                 return;
2245                         }
2246
2247                         pdata = nttrans_realloc(ppdata, data_len);
2248                         if(pdata == NULL) {
2249                                 reply_doserror(req, ERRDOS, ERRnomem);
2250                                 return;
2251                         }
2252
2253                         entry = pdata;
2254
2255                         /* set params Size of returned Quota Data 4 bytes*/
2256                         SIVAL(params,0,data_len);
2257
2258                         /* nextoffset entry 4 bytes */
2259                         SIVAL(entry,0,0);
2260
2261                         /* then the len of the SID 4 bytes */
2262                         SIVAL(entry,4,sid_len);
2263
2264                         /* unknown data 8 bytes SMB_BIG_UINT */
2265                         SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2266
2267                         /* the used disk space 8 bytes SMB_BIG_UINT */
2268                         SBIG_UINT(entry,16,qt.usedspace);
2269
2270                         /* the soft quotas 8 bytes SMB_BIG_UINT */
2271                         SBIG_UINT(entry,24,qt.softlim);
2272
2273                         /* the hard quotas 8 bytes SMB_BIG_UINT */
2274                         SBIG_UINT(entry,32,qt.hardlim);
2275
2276                         /* and now the SID */
2277                         sid_linearize(entry+40, sid_len, &sid);
2278
2279                         break;
2280
2281                 default:
2282                         DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2283                         reply_doserror(req, ERRSRV, ERRerror);
2284                         return;
2285                         break;
2286         }
2287
2288         send_nt_replies(conn, req, nt_status, params, param_len,
2289                         pdata, data_len);
2290 }
2291
2292 /****************************************************************************
2293  Reply to set user quota
2294 ****************************************************************************/
2295
2296 static void call_nt_transact_set_user_quota(connection_struct *conn,
2297                                             struct smb_request *req,
2298                                             uint16 **ppsetup,
2299                                             uint32 setup_count,
2300                                             char **ppparams,
2301                                             uint32 parameter_count,
2302                                             char **ppdata,
2303                                             uint32 data_count,
2304                                             uint32 max_data_count)
2305 {
2306         char *params = *ppparams;
2307         char *pdata = *ppdata;
2308         int data_len=0,param_len=0;
2309         SMB_NTQUOTA_STRUCT qt;
2310         size_t sid_len;
2311         DOM_SID sid;
2312         files_struct *fsp = NULL;
2313
2314         ZERO_STRUCT(qt);
2315
2316         /* access check */
2317         if (current_user.ut.uid != 0) {
2318                 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2319                         lp_servicename(SNUM(conn)),conn->user));
2320                 reply_doserror(req, ERRDOS, ERRnoaccess);
2321                 return;
2322         }
2323
2324         /*
2325          * Ensure minimum number of parameters sent.
2326          */
2327
2328         if (parameter_count < 2) {
2329                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2330                 reply_doserror(req, ERRDOS, ERRinvalidparam);
2331                 return;
2332         }
2333
2334         /* maybe we can check the quota_fnum */
2335         fsp = file_fsp(SVAL(params,0));
2336         if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2337                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2338                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2339                 return;
2340         }
2341
2342         if (data_count < 40) {
2343                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2344                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2345                 return;
2346         }
2347
2348         /* offset to next quota record.
2349          * 4 bytes IVAL(pdata,0)
2350          * unused here...
2351          */
2352
2353         /* sid len */
2354         sid_len = IVAL(pdata,4);
2355
2356         if (data_count < 40+sid_len) {
2357                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2358                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2359                 return;
2360         }
2361
2362         /* unknown 8 bytes in pdata
2363          * maybe its the change time in NTTIME
2364          */
2365
2366         /* the used space 8 bytes (SMB_BIG_UINT)*/
2367         qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2368 #ifdef LARGE_SMB_OFF_T
2369         qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2370 #else /* LARGE_SMB_OFF_T */
2371         if ((IVAL(pdata,20) != 0)&&
2372                 ((qt.usedspace != 0xFFFFFFFF)||
2373                 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2374                 /* more than 32 bits? */
2375                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2376                 return;
2377         }
2378 #endif /* LARGE_SMB_OFF_T */
2379
2380         /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2381         qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2382 #ifdef LARGE_SMB_OFF_T
2383         qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2384 #else /* LARGE_SMB_OFF_T */
2385         if ((IVAL(pdata,28) != 0)&&
2386                 ((qt.softlim != 0xFFFFFFFF)||
2387                 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2388                 /* more than 32 bits? */
2389                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2390                 return;
2391         }
2392 #endif /* LARGE_SMB_OFF_T */
2393
2394         /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2395         qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2396 #ifdef LARGE_SMB_OFF_T
2397         qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2398 #else /* LARGE_SMB_OFF_T */
2399         if ((IVAL(pdata,36) != 0)&&
2400                 ((qt.hardlim != 0xFFFFFFFF)||
2401                 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2402                 /* more than 32 bits? */
2403                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2404                 return;
2405         }
2406 #endif /* LARGE_SMB_OFF_T */
2407
2408         sid_parse(pdata+40,sid_len,&sid);
2409         DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2410
2411         /* 44 unknown bytes left... */
2412
2413         if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2414                 reply_doserror(req, ERRSRV, ERRerror);
2415                 return;
2416         }
2417
2418         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2419                         pdata, data_len);
2420 }
2421 #endif /* HAVE_SYS_QUOTAS */
2422
2423 static void handle_nttrans(connection_struct *conn,
2424                            struct trans_state *state,
2425                            struct smb_request *req)
2426 {
2427         if (Protocol >= PROTOCOL_NT1) {
2428                 req->flags2 |= 0x40; /* IS_LONG_NAME */
2429                 SSVAL(req->inbuf,smb_flg2,req->flags2);
2430         }
2431
2432         /* Now we must call the relevant NT_TRANS function */
2433         switch(state->call) {
2434                 case NT_TRANSACT_CREATE:
2435                 {
2436                         START_PROFILE(NT_transact_create);
2437                         call_nt_transact_create(
2438                                 conn, req,
2439                                 &state->setup, state->setup_count,
2440                                 &state->param, state->total_param,
2441                                 &state->data, state->total_data,
2442                                 state->max_data_return);
2443                         END_PROFILE(NT_transact_create);
2444                         break;
2445                 }
2446
2447                 case NT_TRANSACT_IOCTL:
2448                 {
2449                         START_PROFILE(NT_transact_ioctl);
2450                         call_nt_transact_ioctl(
2451                                 conn, req,
2452                                 &state->setup, state->setup_count,
2453                                 &state->param, state->total_param,
2454                                 &state->data, state->total_data,
2455                                 state->max_data_return);
2456                         END_PROFILE(NT_transact_ioctl);
2457                         break;
2458                 }
2459
2460                 case NT_TRANSACT_SET_SECURITY_DESC:
2461                 {
2462                         START_PROFILE(NT_transact_set_security_desc);
2463                         call_nt_transact_set_security_desc(
2464                                 conn, req,
2465                                 &state->setup, state->setup_count,
2466                                 &state->param, state->total_param,
2467                                 &state->data, state->total_data,
2468                                 state->max_data_return);
2469                         END_PROFILE(NT_transact_set_security_desc);
2470                         break;
2471                 }
2472
2473                 case NT_TRANSACT_NOTIFY_CHANGE:
2474                 {
2475                         START_PROFILE(NT_transact_notify_change);
2476                         call_nt_transact_notify_change(
2477                                 conn, req,
2478                                 &state->setup, state->setup_count,
2479                                 &state->param, state->total_param,
2480                                 &state->data, state->total_data,
2481                                 state->max_data_return,
2482                                 state->max_param_return);
2483                         END_PROFILE(NT_transact_notify_change);
2484                         break;
2485                 }
2486
2487                 case NT_TRANSACT_RENAME:
2488                 {
2489                         START_PROFILE(NT_transact_rename);
2490                         call_nt_transact_rename(
2491                                 conn, req,
2492                                 &state->setup, state->setup_count,
2493                                 &state->param, state->total_param,
2494                                 &state->data, state->total_data,
2495                                 state->max_data_return);
2496                         END_PROFILE(NT_transact_rename);
2497                         break;
2498                 }
2499
2500                 case NT_TRANSACT_QUERY_SECURITY_DESC:
2501                 {
2502                         START_PROFILE(NT_transact_query_security_desc);
2503                         call_nt_transact_query_security_desc(
2504                                 conn, req,
2505                                 &state->setup, state->setup_count,
2506                                 &state->param, state->total_param,
2507                                 &state->data, state->total_data,
2508                                 state->max_data_return);
2509                         END_PROFILE(NT_transact_query_security_desc);
2510                         break;
2511                 }
2512
2513 #ifdef HAVE_SYS_QUOTAS
2514                 case NT_TRANSACT_GET_USER_QUOTA:
2515                 {
2516                         START_PROFILE(NT_transact_get_user_quota);
2517                         call_nt_transact_get_user_quota(
2518                                 conn, req,
2519                                 &state->setup, state->setup_count,
2520                                 &state->param, state->total_param,
2521                                 &state->data, state->total_data,
2522                                 state->max_data_return);
2523                         END_PROFILE(NT_transact_get_user_quota);
2524                         break;
2525                 }
2526
2527                 case NT_TRANSACT_SET_USER_QUOTA:
2528                 {
2529                         START_PROFILE(NT_transact_set_user_quota);
2530                         call_nt_transact_set_user_quota(
2531                                 conn, req,
2532                                 &state->setup, state->setup_count,
2533                                 &state->param, state->total_param,
2534                                 &state->data, state->total_data,
2535                                 state->max_data_return);
2536                         END_PROFILE(NT_transact_set_user_quota);
2537                         break;
2538                 }
2539 #endif /* HAVE_SYS_QUOTAS */
2540
2541                 default:
2542                         /* Error in request */
2543                         DEBUG(0,("handle_nttrans: Unknown request %d in "
2544                                  "nttrans call\n", state->call));
2545                         reply_doserror(req, ERRSRV, ERRerror);
2546                         return;
2547         }
2548         return;
2549 }
2550
2551 /****************************************************************************
2552  Reply to a SMBNTtrans.
2553 ****************************************************************************/
2554
2555 void reply_nttrans(struct smb_request *req)
2556 {
2557         connection_struct *conn = req->conn;
2558         uint32_t pscnt;
2559         uint32_t psoff;
2560         uint32_t dscnt;
2561         uint32_t dsoff;
2562         uint16 function_code;
2563         NTSTATUS result;
2564         struct trans_state *state;
2565         uint32_t size;
2566         uint32_t av_size;
2567
2568         START_PROFILE(SMBnttrans);
2569
2570         if (req->wct < 19) {
2571                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2572                 END_PROFILE(SMBnttrans);
2573                 return;
2574         }
2575
2576         size = smb_len(req->inbuf) + 4;
2577         av_size = smb_len(req->inbuf);
2578         pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2579         psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2580         dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2581         dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2582         function_code = SVAL(req->inbuf, smb_nt_Function);
2583
2584         if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2585                 reply_doserror(req, ERRSRV, ERRaccess);
2586                 END_PROFILE(SMBnttrans);
2587                 return;
2588         }
2589
2590         result = allow_new_trans(conn->pending_trans, req->mid);
2591         if (!NT_STATUS_IS_OK(result)) {
2592                 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2593                 reply_nterror(req, result);
2594                 END_PROFILE(SMBnttrans);
2595                 return;
2596         }
2597
2598         if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
2599                 reply_doserror(req, ERRSRV, ERRaccess);
2600                 END_PROFILE(SMBnttrans);
2601                 return;
2602         }
2603
2604         state->cmd = SMBnttrans;
2605
2606         state->mid = req->mid;
2607         state->vuid = req->vuid;
2608         state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2609         state->data = NULL;
2610         state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2611         state->param = NULL;
2612         state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2613         state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2614
2615         /* setup count is in *words* */
2616         state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2617         state->setup = NULL;
2618         state->call = function_code;
2619
2620         /*
2621          * All nttrans messages we handle have smb_wct == 19 +
2622          * state->setup_count.  Ensure this is so as a sanity check.
2623          */
2624
2625         if(req->wct != 19 + (state->setup_count/2)) {
2626                 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2627                          req->wct, 19 + (state->setup_count/2)));
2628                 goto bad_param;
2629         }
2630
2631         /* Don't allow more than 128mb for each value. */
2632         if ((state->total_data > (1024*1024*128)) ||
2633             (state->total_param > (1024*1024*128))) {
2634                 reply_doserror(req, ERRDOS, ERRnomem);
2635                 END_PROFILE(SMBnttrans);
2636                 return;
2637         }
2638
2639         if ((dscnt > state->total_data) || (pscnt > state->total_param))
2640                 goto bad_param;
2641
2642         if (state->total_data)  {
2643                 /* Can't use talloc here, the core routines do realloc on the
2644                  * params and data. */
2645                 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2646                         DEBUG(0,("reply_nttrans: data malloc fail for %u "
2647                                  "bytes !\n", (unsigned int)state->total_data));
2648                         TALLOC_FREE(state);
2649                         reply_doserror(req, ERRDOS, ERRnomem);
2650                         END_PROFILE(SMBnttrans);
2651                         return;
2652                 }
2653
2654                 if (dscnt > state->total_data ||
2655                                 dsoff+dscnt < dsoff) {
2656                         goto bad_param;
2657                 }
2658
2659                 if (dsoff > av_size ||
2660                                 dscnt > av_size ||
2661                                 dsoff+dscnt > av_size) {
2662                         goto bad_param;
2663                 }
2664
2665                 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2666         }
2667
2668         if (state->total_param) {
2669                 /* Can't use talloc here, the core routines do realloc on the
2670                  * params and data. */
2671                 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2672                         DEBUG(0,("reply_nttrans: param malloc fail for %u "
2673                                  "bytes !\n", (unsigned int)state->total_param));
2674                         SAFE_FREE(state->data);
2675                         TALLOC_FREE(state);
2676                         reply_doserror(req, ERRDOS, ERRnomem);
2677                         END_PROFILE(SMBnttrans);
2678                         return;
2679                 }
2680
2681                 if (pscnt > state->total_param ||
2682                                 psoff+pscnt < psoff) {
2683                         goto bad_param;
2684                 }
2685
2686                 if (psoff > av_size ||
2687                                 pscnt > av_size ||
2688                                 psoff+pscnt > av_size) {
2689                         goto bad_param;
2690                 }
2691
2692                 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2693         }
2694
2695         state->received_data  = dscnt;
2696         state->received_param = pscnt;
2697
2698         if(state->setup_count > 0) {
2699                 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2700                           state->setup_count));
2701                 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2702                 if (state->setup == NULL) {
2703                         DEBUG(0,("reply_nttrans : Out of memory\n"));
2704                         SAFE_FREE(state->data);
2705                         SAFE_FREE(state->param);
2706                         TALLOC_FREE(state);
2707                         reply_doserror(req, ERRDOS, ERRnomem);
2708                         END_PROFILE(SMBnttrans);
2709                         return;
2710                 }
2711
2712                 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2713                     (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2714                         goto bad_param;
2715                 }
2716                 if (smb_nt_SetupStart + state->setup_count > size) {
2717                         goto bad_param;
2718                 }
2719
2720                 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2721                         state->setup_count);
2722                 dump_data(10, (uint8 *)state->setup, state->setup_count);
2723         }
2724
2725         if ((state->received_data == state->total_data) &&
2726             (state->received_param == state->total_param)) {
2727                 handle_nttrans(conn, state, req);
2728                 SAFE_FREE(state->param);
2729                 SAFE_FREE(state->data);
2730                 TALLOC_FREE(state);
2731                 END_PROFILE(SMBnttrans);
2732                 return;
2733         }
2734
2735         DLIST_ADD(conn->pending_trans, state);
2736
2737         /* We need to send an interim response then receive the rest
2738            of the parameter/data bytes */
2739         reply_outbuf(req, 0, 0);
2740         show_msg((char *)req->outbuf);
2741         END_PROFILE(SMBnttrans);
2742         return;
2743
2744   bad_param:
2745
2746         DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2747         SAFE_FREE(state->data);
2748         SAFE_FREE(state->param);
2749         TALLOC_FREE(state);
2750         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2751         END_PROFILE(SMBnttrans);
2752         return;
2753 }
2754
2755 /****************************************************************************
2756  Reply to a SMBnttranss
2757  ****************************************************************************/
2758
2759 void reply_nttranss(struct smb_request *req)
2760 {
2761         connection_struct *conn = req->conn;
2762         uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2763         struct trans_state *state;
2764         uint32_t av_size;
2765         uint32_t size;
2766
2767         START_PROFILE(SMBnttranss);
2768
2769         show_msg((char *)req->inbuf);
2770
2771         if (req->wct < 18) {
2772                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2773                 END_PROFILE(SMBnttranss);
2774                 return;
2775         }
2776
2777         for (state = conn->pending_trans; state != NULL;
2778              state = state->next) {
2779                 if (state->mid == req->mid) {
2780                         break;
2781                 }
2782         }
2783
2784         if ((state == NULL) || (state->cmd != SMBnttrans)) {
2785                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2786                 END_PROFILE(SMBnttranss);
2787                 return;
2788         }
2789
2790         /* Revise state->total_param and state->total_data in case they have
2791            changed downwards */
2792         if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2793             < state->total_param) {
2794                 state->total_param = IVAL(req->inbuf,
2795                                           smb_nts_TotalParameterCount);
2796         }
2797         if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2798                 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2799         }
2800
2801         size = smb_len(req->inbuf) + 4;
2802         av_size = smb_len(req->inbuf);
2803
2804         pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2805         poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2806         pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2807
2808         dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2809         ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2810         doff = IVAL(req->inbuf, smb_nts_DataOffset);
2811
2812         state->received_param += pcnt;
2813         state->received_data += dcnt;
2814
2815         if ((state->received_data > state->total_data) ||
2816             (state->received_param > state->total_param))
2817                 goto bad_param;
2818
2819         if (pcnt) {
2820                 if (pdisp > state->total_param ||
2821                                 pcnt > state->total_param ||
2822                                 pdisp+pcnt > state->total_param ||
2823                                 pdisp+pcnt < pdisp) {
2824                         goto bad_param;
2825                 }
2826
2827                 if (poff > av_size ||
2828                                 pcnt > av_size ||
2829                                 poff+pcnt > av_size ||
2830                                 poff+pcnt < poff) {
2831                         goto bad_param;
2832                 }
2833
2834                 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2835                        pcnt);
2836         }
2837
2838         if (dcnt) {
2839                 if (ddisp > state->total_data ||
2840                                 dcnt > state->total_data ||
2841                                 ddisp+dcnt > state->total_data ||
2842                                 ddisp+dcnt < ddisp) {
2843                         goto bad_param;
2844                 }
2845
2846                 if (ddisp > av_size ||
2847                                 dcnt > av_size ||
2848                                 ddisp+dcnt > av_size ||
2849                                 ddisp+dcnt < ddisp) {
2850                         goto bad_param;
2851                 }
2852
2853                 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2854                        dcnt);
2855         }
2856
2857         if ((state->received_param < state->total_param) ||
2858             (state->received_data < state->total_data)) {
2859                 END_PROFILE(SMBnttranss);
2860                 return;
2861         }
2862
2863         /*
2864          * construct_reply_common will copy smb_com from inbuf to
2865          * outbuf. SMBnttranss is wrong here.
2866          */
2867         SCVAL(req->inbuf,smb_com,SMBnttrans);
2868
2869         handle_nttrans(conn, state, req);
2870
2871         DLIST_REMOVE(conn->pending_trans, state);
2872         SAFE_FREE(state->data);
2873         SAFE_FREE(state->param);
2874         TALLOC_FREE(state);
2875         END_PROFILE(SMBnttranss);
2876         return;
2877
2878   bad_param:
2879
2880         DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2881         DLIST_REMOVE(conn->pending_trans, state);
2882         SAFE_FREE(state->data);
2883         SAFE_FREE(state->param);
2884         TALLOC_FREE(state);
2885         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2886         END_PROFILE(SMBnttranss);
2887         return;
2888 }